Spring Security WebSecurityConfigurerAdapter Configuration

Question

I have a simple Spring Boot application with the following 2 endpoints:

• int: requires Shibboleth SSO && Authorized Role
• ext: no SSO, no authorization required

I've implemented a PreAuthenticationFilter to work with SSO. Below is the configuration that is not working:

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                .antMatchers("/ext/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .authorizeRequests()
                .and()
            .addFilter(preAuthenticationFilter());
    }
}

Shouldn't PreAuthenticationFilter bypass the /ext endpoint? However, the above configuration forces both endpoints to go to the PreauthenticationFilter. Also tried

web.ignoring().antMatchers("/ext/**")

to no avail.

Here's the rest of my program:

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/ext/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .authorizeRequests()
                .and()
            .addFilter(preAuthenticationFilter());
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        //web.ignoring().antMatchers("/ext/**");
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        PreAuthenticatedAuthenticationProvider authenticationProvider = new PreAuthenticatedAuthenticationProvider();
        authenticationProvider.setPreAuthenticatedUserDetailsService(new ShibbolethUserDetailsService());
        auth.authenticationProvider(authenticationProvider);
    }

    @Bean
    RequestHeaderAuthenticationFilter preAuthenticationFilter() throws Exception {
        ShibbolethRequestHeaderAuthenticationFilter filter = new ShibbolethRequestHeaderAuthenticationFilter();
        filter.setAuthenticationManager(authenticationManager());       
        return filter;
    }