Spring Boot Security - allow without authentication

Spring boot security allow anonymous user

I am trying configure Spring Boot Security to allow anonymous user reach all URLs except one. By default user and generated security password by Spring.
I need just one page for maintanance application
I already tried a lot tips and tutorials.

<a href="https://stackoverflow.com/questions/24696717/spring-security-permitall-not-allowing-anonymous-access">1</a>
<a href="https://www.baeldung.com/security-none-filters-none-access-permitAll">2</a>
<a href="https://stackoverflow.com/questions/57275361/how-to-allow-guest-to-access-home-page-without-login-in-spring-security">3</a>
<a href="https://stackoverflow.com/questions/36809561/spring-security-thymleaf-static-resources-dont-load">4</a>

And others.

But Spring still required authetification for all pages.
<br>
My current security config

@EnableWebSecurity
@Configuration
public class SecurityConf extends WebSecurityConfigurerAdapter {
	@Override
	public void configure(HttpSecurity http) throws Exception {
		http
		.csrf()
		.disable()
		.authorizeRequests()
		.anyRequest()
		.anonymous()
		.antMatchers("/secure")
		.authenticated();
	}
}

Web configuration

@Configuration
@EnableWebMvc
@EnableAsync
public class WebConf implements WebMvcConfigurer {
	@Override
	public void addResourceHandlers(ResourceHandlerRegistry registry) {
		WebMvcConfigurer.super.addResourceHandlers(registry);
		registry.addResourceHandler("/webjars/**").addResourceLocations("/webjars/**");
	}	
	@Bean
	public Executor asyncExecutor() {
	    ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
	    executor.setCorePoolSize(5);
	    executor.setMaxPoolSize(5);
	    executor.setQueueCapacity(500);
	    executor.setThreadNamePrefix("Asynchronous Process-");
	    executor.initialize();
	    return executor;
	}	
}

And main method

@ComponentScan
@SpringBootApplication
@EnableScheduling
public class MainServiceApplication {
	public static void main(String[] args) {
		SpringApplication.run(MainServiceApplication.class, args);
	}
}

I tried

.permitAll()
.anonymous()

without success.

Edit 1

Project structure

Project structure

Edit 2

Project structure

@ComponentScan()
@SpringBootApplication
@EnableScheduling
public class MainServiceApplication {

	public static void main(String[] args) {
		SpringApplication.run(MainServiceApplication.class, args);
	}

}

Login page

Solved by move config package. Spring did not scan configuration package.

You may need to change the order. Possible issue is antMatchers("/secure").authenticated() has no effect due to /secure endpoint will be considerd in the anyRequest(). Also make sure SecurityConf is in correct package as required for scanning.

@EnableWebSecurity
@Configuration
public class SecurityConf extends WebSecurityConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
            .disable()
            .authorizeRequests()
            .antMatchers("/secure").authenticated()
            .anyRequest().anonymous();
    }
}

OR

@EnableWebSecurity
@Configuration
public class SecurityConf extends WebSecurityConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
            .disable()
            .authorizeRequests()
            .antMatchers("/secure").authenticated()
            .anyRequest().permitAll();
    }
}

UPDATE

You need to create a configs package inside cz.lh.main_service and SecurityConf and WebConf should be part of the cz.lh.main_service.configs

OR

You can use @ComponentScan and can specify the current package in which you have SecurityConf and WebConf

@ComponentScan(“your-config-package”)