Getting Access Denied for all routes with PermitAll() in Vaadin 24 and Azure SSO

Flow
21

The anyRequest().authenticated() part is already done by VaadinWebSecurity, when you call super.configure()
so you can remove it from ypur code

22

OK - I can get to my pages now but with no login request

23

Unless my login is still valid from yesterday

24

I’ll try another browser

25

OK - so I got a login request on Opera and logged in with Azure SSO and then an error page

26

image.png

27

Looks like wrong usage of spring scopes on Vaadin components

28

I’ll have to look at my pages

29

Maybe revert to a test project and make sure that all works also, although this was all working with the standard Vaadin login that’s supplied with the default LoginForm etc in teh Vaadin docs so I don’t see why it would not work when all I’m changing is the auth metod

30

Anyhow - I’ll see how I get on - thanks a million for all the help @versatile-zorse and @quirky-zebra

31

Actually - one more question guys - by wrong usage of spring scopes on Vaadin components do you mean I may have mixed up som of the annotations between Spring and Vaadin?

32

Yes. Using @Component makes Vaadin components a singleton, which in turn makes your site unusable for more than one person

33

Weird as I’m not using @Component anywhere (just searched all files)

34

It had been there initially with the vaadin example code and the example login but that’s commented out now

35

private static… can also be a problem… but yeah, start from scratch - test your auth thing in there before bringing it to your full fledged project

36

Thanks!

37

@quirky-zebra and @versatile-zorse
All I needed was

@Configuration
public class SecurityConfig extends VaadinWebSecurity {
    protected void configure(HttpSecurity http) throws Exception {
        http.oauth2Login(Customizer.withDefaults());
        super.configure(http);
    }
}```
38

I’m still getting the error with this though:
image.png

39

I created a dummy project and it all works fine so I just need to narrow down what it is.
I’m also using JPA but I doubt that would cause a problem
I do have a few private static variables also - I’ll remove them and
ALso - the JPA generated classes all have
private static final long serialVersionUID = 1L;
Would that be an issue?

40

Probably not