Spring boot - how to configure multiple login pages? -

with team have written spring application + sapui5 portal using spring boot. web application divided 3 separate locations example:

webapp: - app1 - app2 - app3

to access applications implemented login page. based on user role, redirect users exact app.

my spring application security looks like:

    @override     protected void configure(httpsecurity http) throws exception {         http.authorizerequests()                 .antmatchers("/app1/**/*.*")                 .permitall()                 .antmatchers("/register.html")                 .permitall()                 //                 .antmatchers("/app2/*.*")                 .hasrole("user")                 //                 //                 .antmatchers("/login*")                 .permitall()                 .antmatchers("/soap/*")                 .permitall()                 .antmatchers("/postlogin")                 .authenticated()                 //                 .antmatchers("/app3/*")                 //.permitall()                 .hasrole("admin")                 //                 .anyrequest()                 .authenticated()                 // log in                 .and()                 .formlogin()                 .loginpage("/login")                 .failureurl("/login?error=loginerror")                 .defaultsuccessurl("/postlogin")                 // logout                 .and().logout().logouturl("/**/logout")                 .logoutsuccessurl("/login").deletecookies("jsessionid").and()                 .csrf()                 .disable() 

and of course have class redirections. must provide each app , different login page. tried configure spring security accept multiple login form on different pages don't work. possible? read documentation inconclusive.

you should able configuring multiple httpsecurity objects using different instances. similar this question , spring security documentation here. define multiple static classes in configuration class extend websecurityconfigureradapter. using myself configure different types of auth (form/basic) based on urls , did quick test confirm it. believe in example (if reading intent correctly):

@enablewebsecurity public class multihttpsecurityconfig {      @configuration     @order(1)     public static class app1configurationadapter extends websecurityconfigureradapter {         protected void configure(httpsecurity http) throws exception {             http                     .authorizerequests()                     .antmatchers("/app1/**/*.*")                     .permitall()                     .antmatchers("/register.html")                     .permitall()                     .anyrequest()                     .authenticated()                     // log in                     .and()                     .formlogin()                     .loginpage("/login")                     .failureurl("/login?error=loginerror")                     .defaultsuccessurl("/postlogin")                             // logout                     .and().logout().logouturl("/**/logout")                     .logoutsuccessurl("/login").deletecookies("jsessionid").and()                     .csrf()                     .disable();         }     }      @configuration     public static class app2configurationadapter extends websecurityconfigureradapter {          @override         protected void configure(httpsecurity http) throws exception {             http                     .authorizerequests()                     .antmatchers("/app2/*.*")                     .hasrole("user")                             // log in                     .and()                     .formlogin()                     .loginpage("/login2")                     .failureurl("/login2?error=loginerror")                     .defaultsuccessurl("/postlogin")                             // logout                     .and().logout().logouturl("/**/logout")                     .logoutsuccessurl("/login2").deletecookies("jsessionid").and()                     .csrf()                     .disable();         }     } } 

note these not different application instances won't redirected login if authenticate user , go area not authorized.