public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  @Override
protected void configure(HttpSecurity http) throws Exception {
    // @formatter:off
    http.httpBasic().and()
        .authorizeRequests()
        .antMatchers("/order/**").hasAuthority("read_order")//(1)
        .antMatchers("/order/**").hasIpAddress("192.168.1.45")//(2)
        .anyRequest().denyAll();
    // @formatter:on
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userService);
}