Try including /swagger.json in the permitAll, swagger-ui.html loads the open api definition from there. (look into the browser logs to see what url is answering Http 401, that's the one triggering the password prompt