InsufficientAuthenticationException being handled as HTTP 500 instead of 401

[icaromagnago]

I'm using Springboot 2..3.4.RELEASE and problem-spring-web 0.25.0.

When trying to make a request to the API with no token a InsufficientAuthenticationException is thrown, in this case the HTTP status code should be 401, but problem library is handling it as status code 500.

{
  "title": "Internal Server Error",
  "status": 500,
  "detail": "Full authentication is required to access this resource"
}

2021-01-08 12:11:32.898 ERROR 24769 --- [nio-8080-exec-1] o.z.problem.spring.common.AdviceTraits   : Internal Server Error

org.springframework.security.authentication.InsufficientAuthenticationException: Full authentication is required to access this resource
...

Configurations

Spring security

@KeycloakConfiguration
@Import(SecurityProblemSupport.class)
public class KeycloakSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Autowired
    private SecurityProblemSupport problemSupport;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http
            .exceptionHandling()
            .authenticationEntryPoint(problemSupport)
            .accessDeniedHandler(problemSupport)
        .and()
            .cors().and().csrf().disable()
            .authorizeRequests()
            .antMatchers(HttpMethod.OPTIONS,"/swagger-ui.html#/**").permitAll()
            .anyRequest()
            .authenticated();
    }
...

Controller Advice

@ControllerAdvice
public class SecurityExceptionHandler implements SecurityAdviceTrait {

}

In version 0.23.0 works as expected.

{
  "title": "Unauthorized",
  "status": 401,
  "detail": "Full authentication is required to access this resource"
}

2021-01-08 12:21:41.871  WARN 26529 --- [nio-8080-exec-1] o.z.p.spring.web.advice.AdviceTrait      : Unauthorized: Full authentication is required to access this resource

[whiskeysierra]

Previous similar issue: #498

I'm out of ideas here, tbh. Can you reproduce it in a test so we can improve our test suite?

[icaromagnago]

I will try reproduce it in test as soon as possible.

[icaromagnago]

I figured out the problem.

Its occurs when I have two @ControllerAdvice, one implementing ProblemHandling and the other one implementing SecurityAdviceTrait.

If I disable the one implementing ProblemHandling then code works as expected. If I use just one @ControllerAdvice implements the two interfaces also seems to work.

I'm not sure if this is a bug or just a missconfiguration.

Here's a sample: https://github.com/icaromagnago/sample-spring-problem-issue

[Kogs]

Just use the higher @Priority for the one @ControllerAdvice you want to use, fixed it for me.