diff --git a/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/web/spring-security.adoc b/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/web/spring-security.adoc index 0b2b323c5db..2c32bbf1398 100644 --- a/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/web/spring-security.adoc +++ b/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/web/spring-security.adoc @@ -35,8 +35,8 @@ You can provide a different javadoc:org.springframework.security.authentication. [[web.security.spring-mvc]] == MVC Security -The default security configuration is implemented in javadoc:org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration[] and javadoc:org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration[]. -javadoc:org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration[] imports `SpringBootWebSecurityConfiguration` for web security and javadoc:org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration[] for authentication. +The default security configuration is implemented in javadoc:org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration[] and javadoc:org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration[]. +javadoc:org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration[] imports `SpringBootWebSecurityConfiguration` for web security and javadoc:org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration[] for authentication. To completely switch off the default web application security configuration, including Actuator security, or to combine multiple Spring Security components such as OAuth2 Client and Resource Server, add a bean of type javadoc:org.springframework.security.web.SecurityFilterChain[] (doing so does not disable the javadoc:org.springframework.security.core.userdetails.UserDetailsService[] configuration). To also switch off the javadoc:org.springframework.security.core.userdetails.UserDetailsService[] configuration, add a bean of type javadoc:org.springframework.security.core.userdetails.UserDetailsService[], javadoc:org.springframework.security.authentication.AuthenticationProvider[], or javadoc:org.springframework.security.authentication.AuthenticationManager[]. @@ -52,7 +52,7 @@ To use javadoc:org.springframework.security.core.userdetails.UserDetailsService[ Access rules can be overridden by adding a custom javadoc:org.springframework.security.web.SecurityFilterChain[] bean. Spring Boot provides convenience methods that can be used to override access rules for actuator endpoints and static resources. javadoc:org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest[] can be used to create a javadoc:org.springframework.security.web.util.matcher.RequestMatcher[] that is based on the configprop:management.endpoints.web.base-path[] property. -javadoc:org.springframework.boot.security.autoconfigure.servlet.PathRequest[] can be used to create a javadoc:org.springframework.security.web.util.matcher.RequestMatcher[] for resources in commonly used locations. +javadoc:org.springframework.boot.security.autoconfigure.web.servlet.PathRequest[] can be used to create a javadoc:org.springframework.security.web.util.matcher.RequestMatcher[] for resources in commonly used locations. @@ -60,8 +60,8 @@ javadoc:org.springframework.boot.security.autoconfigure.servlet.PathRequest[] ca == WebFlux Security Similar to Spring MVC applications, you can secure your WebFlux applications by adding the `spring-boot-starter-security` dependency. -The default security configuration is implemented in javadoc:org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration[] and javadoc:org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration[]. -javadoc:org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration[] imports `WebFluxSecurityConfiguration` for web security and javadoc:org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration[] for authentication. +The default security configuration is implemented in javadoc:org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration[] and javadoc:org.springframework.boot.security.autoconfigure.ReactiveUserDetailsServiceAutoConfiguration[]. +javadoc:org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration[] imports `WebFluxSecurityConfiguration` for web security and javadoc:org.springframework.boot.security.autoconfigure.ReactiveUserDetailsServiceAutoConfiguration[] for authentication. In addition to reactive web applications, the latter is also auto-configured when RSocket is in use. To completely switch off the default web application security configuration, including Actuator security, add a bean of type javadoc:org.springframework.security.web.server.WebFilterChainProxy[] (doing so does not disable the javadoc:org.springframework.security.core.userdetails.ReactiveUserDetailsService[] configuration). diff --git a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.java b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.java index 06c77a80949..42409c860f4 100644 --- a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.java +++ b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.java @@ -16,7 +16,7 @@ package org.springframework.boot.docs.actuator.endpoints.security.exposeall; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; diff --git a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.java b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.java index 6cd96dbab23..c96b5103a9c 100644 --- a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.java +++ b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.java @@ -16,7 +16,7 @@ package org.springframework.boot.docs.actuator.endpoints.security.typical; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; diff --git a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/data/sql/h2webconsole/springsecurity/DevProfileSecurityConfiguration.java b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/data/sql/h2webconsole/springsecurity/DevProfileSecurityConfiguration.java index a81bf6b0b3c..847be49b50c 100644 --- a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/data/sql/h2webconsole/springsecurity/DevProfileSecurityConfiguration.java +++ b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/data/sql/h2webconsole/springsecurity/DevProfileSecurityConfiguration.java @@ -16,7 +16,7 @@ package org.springframework.boot.docs.data.sql.h2webconsole.springsecurity; -import org.springframework.boot.security.autoconfigure.servlet.PathRequest; +import org.springframework.boot.security.autoconfigure.web.servlet.PathRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Profile; diff --git a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.java b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.java index 98337dac551..48695ffa893 100644 --- a/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.java +++ b/documentation/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.java @@ -16,7 +16,7 @@ package org.springframework.boot.docs.web.security.springwebflux; -import org.springframework.boot.security.autoconfigure.reactive.PathRequest; +import org.springframework.boot.security.autoconfigure.web.reactive.PathRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.web.server.ServerHttpSecurity; diff --git a/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.kt b/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.kt index 00183a6d8a1..092aeff51bb 100644 --- a/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.kt +++ b/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.kt @@ -16,7 +16,7 @@ package org.springframework.boot.docs.actuator.endpoints.security.exposeall -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest import org.springframework.context.annotation.Bean import org.springframework.context.annotation.Configuration import org.springframework.security.config.annotation.web.builders.HttpSecurity diff --git a/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.kt b/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.kt index b6800f8daa0..098549f3030 100644 --- a/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.kt +++ b/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.kt @@ -16,7 +16,7 @@ package org.springframework.boot.docs.actuator.endpoints.security.typical -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest import org.springframework.context.annotation.Bean import org.springframework.context.annotation.Configuration import org.springframework.security.config.Customizer.withDefaults diff --git a/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.kt b/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.kt index eb97ed61949..c2390c63b1a 100644 --- a/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.kt +++ b/documentation/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/web/security/springwebflux/MyWebFluxSecurityConfiguration.kt @@ -16,7 +16,7 @@ package org.springframework.boot.docs.web.security.springwebflux -import org.springframework.boot.security.autoconfigure.reactive.PathRequest +import org.springframework.boot.security.autoconfigure.web.reactive.PathRequest import org.springframework.context.annotation.Bean import org.springframework.context.annotation.Configuration import org.springframework.security.config.Customizer.withDefaults diff --git a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveActuatorAutoConfigurationTests.java b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveActuatorAutoConfigurationTests.java index 5da9f109e55..2841e8a3c96 100644 --- a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveActuatorAutoConfigurationTests.java +++ b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveActuatorAutoConfigurationTests.java @@ -54,7 +54,7 @@ import org.springframework.boot.health.autoconfigure.contributor.HealthContribut import org.springframework.boot.health.autoconfigure.registry.HealthContributorRegistryAutoConfiguration; import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.ssl.SslBundle; import org.springframework.boot.ssl.jks.JksSslStoreBundle; import org.springframework.boot.ssl.jks.JksSslStoreDetails; @@ -97,7 +97,7 @@ class CloudFoundryReactiveActuatorAutoConfigurationTests { private static final String V3_JSON = ApiVersion.V3.getProducedMimeType().toString(); private final ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner() - .withConfiguration(AutoConfigurations.of(ReactiveSecurityAutoConfiguration.class, + .withConfiguration(AutoConfigurations.of(ReactiveWebSecurityAutoConfiguration.class, WebFluxAutoConfiguration.class, JacksonAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class, WebClientCustomizerConfig.class, WebClientAutoConfiguration.class, diff --git a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java index 0ad7a18581a..05a79ebce79 100644 --- a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java +++ b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java @@ -38,7 +38,7 @@ import org.springframework.boot.health.contributor.Health; import org.springframework.boot.health.contributor.HealthIndicator; import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner; import org.springframework.boot.webclient.autoconfigure.WebClientAutoConfiguration; import org.springframework.boot.webflux.autoconfigure.WebFluxAutoConfiguration; @@ -58,7 +58,7 @@ class CloudFoundryReactiveHealthEndpointWebExtensionTests { private final ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner() .withPropertyValues("VCAP_APPLICATION={}") - .withConfiguration(AutoConfigurations.of(ReactiveSecurityAutoConfiguration.class, + .withConfiguration(AutoConfigurations.of(ReactiveWebSecurityAutoConfiguration.class, WebFluxAutoConfiguration.class, JacksonAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class, CloudFoundryReactiveActuatorAutoConfigurationTests.WebClientCustomizerConfig.class, diff --git a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryActuatorAutoConfigurationTests.java b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryActuatorAutoConfigurationTests.java index 7ad64b31786..521fb969a68 100644 --- a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryActuatorAutoConfigurationTests.java +++ b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryActuatorAutoConfigurationTests.java @@ -43,7 +43,8 @@ import org.springframework.boot.health.autoconfigure.registry.HealthContributorR import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; import org.springframework.boot.restclient.autoconfigure.RestTemplateAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.servlet.autoconfigure.actuate.web.ServletManagementContextAutoConfiguration; import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; @@ -82,7 +83,8 @@ class CloudFoundryActuatorAutoConfigurationTests { private static final String BASE_PATH = "/cloudfoundryapplication"; private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() - .withConfiguration(AutoConfigurations.of(SecurityAutoConfiguration.class, WebMvcAutoConfiguration.class, + .withConfiguration(AutoConfigurations.of(SecurityAutoConfiguration.class, + ServletWebSecurityAutoConfiguration.class, WebMvcAutoConfiguration.class, JacksonAutoConfiguration.class, DispatcherServletAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class, RestTemplateAutoConfiguration.class, ManagementContextAutoConfiguration.class, diff --git a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryHealthEndpointWebExtensionTests.java b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryHealthEndpointWebExtensionTests.java index 7f092ac4ddf..4f5c1ce2368 100644 --- a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryHealthEndpointWebExtensionTests.java +++ b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryHealthEndpointWebExtensionTests.java @@ -37,7 +37,8 @@ import org.springframework.boot.health.contributor.HealthIndicator; import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; import org.springframework.boot.restclient.autoconfigure.RestTemplateAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.servlet.autoconfigure.actuate.web.ServletManagementContextAutoConfiguration; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; import org.springframework.boot.webmvc.autoconfigure.DispatcherServletAutoConfiguration; @@ -54,14 +55,15 @@ class CloudFoundryHealthEndpointWebExtensionTests { private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() .withPropertyValues("VCAP_APPLICATION={}") - .withConfiguration(AutoConfigurations.of(SecurityAutoConfiguration.class, WebMvcAutoConfiguration.class, - JacksonAutoConfiguration.class, DispatcherServletAutoConfiguration.class, - HttpMessageConvertersAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class, - RestTemplateAutoConfiguration.class, ManagementContextAutoConfiguration.class, - ServletManagementContextAutoConfiguration.class, EndpointAutoConfiguration.class, - WebEndpointAutoConfiguration.class, HealthContributorAutoConfiguration.class, - HealthContributorRegistryAutoConfiguration.class, HealthEndpointAutoConfiguration.class, - CloudFoundryActuatorAutoConfiguration.class)) + .withConfiguration( + AutoConfigurations.of(SecurityAutoConfiguration.class, ServletWebSecurityAutoConfiguration.class, + WebMvcAutoConfiguration.class, JacksonAutoConfiguration.class, + DispatcherServletAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class, + PropertyPlaceholderAutoConfiguration.class, RestTemplateAutoConfiguration.class, + ManagementContextAutoConfiguration.class, ServletManagementContextAutoConfiguration.class, + EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class, + HealthContributorAutoConfiguration.class, HealthContributorRegistryAutoConfiguration.class, + HealthEndpointAutoConfiguration.class, CloudFoundryActuatorAutoConfiguration.class)) .withUserConfiguration(TestHealthIndicator.class); @Test diff --git a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryInfoEndpointWebExtensionTests.java b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryInfoEndpointWebExtensionTests.java index 8aa7b962dbb..48c287a8cd7 100644 --- a/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryInfoEndpointWebExtensionTests.java +++ b/module/spring-boot-cloudfoundry/src/test/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/CloudFoundryInfoEndpointWebExtensionTests.java @@ -32,7 +32,8 @@ import org.springframework.boot.health.autoconfigure.actuate.endpoint.HealthEndp import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; import org.springframework.boot.restclient.autoconfigure.RestTemplateAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.servlet.autoconfigure.actuate.web.ServletManagementContextAutoConfiguration; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; import org.springframework.boot.testsupport.classpath.resources.WithResource; @@ -50,7 +51,8 @@ class CloudFoundryInfoEndpointWebExtensionTests { private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() .withPropertyValues("VCAP_APPLICATION={}") - .withConfiguration(AutoConfigurations.of(SecurityAutoConfiguration.class, WebMvcAutoConfiguration.class, + .withConfiguration(AutoConfigurations.of(SecurityAutoConfiguration.class, + ServletWebSecurityAutoConfiguration.class, WebMvcAutoConfiguration.class, JacksonAutoConfiguration.class, DispatcherServletAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class, RestTemplateAutoConfiguration.class, ManagementContextAutoConfiguration.class, diff --git a/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfiguration.java b/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfiguration.java index 16085cae930..77c564a53b9 100644 --- a/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfiguration.java +++ b/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfiguration.java @@ -59,7 +59,8 @@ import org.springframework.util.Assert; * @author Madhura Bhave * @since 1.3.0 */ -@AutoConfiguration(afterName = "org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration") +@AutoConfiguration( + afterName = "org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration") @ConditionalOnEnabledDevTools @ConditionalOnProperty("spring.devtools.remote.secret") @ConditionalOnClass({ Filter.class, ServerHttpRequest.class, ServerProperties.class }) diff --git a/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java b/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java index 9f72ec1a2dc..fc40680c9fa 100644 --- a/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java +++ b/module/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java @@ -17,7 +17,7 @@ package org.springframework.boot.devtools.autoconfigure; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; -import org.springframework.boot.security.autoconfigure.SecurityProperties; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterProperties; import org.springframework.boot.web.server.autoconfigure.ServerProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @@ -46,7 +46,7 @@ class RemoteDevtoolsSecurityConfiguration { } @Bean - @Order(SecurityProperties.BASIC_AUTH_ORDER - 1) + @Order(SecurityFilterProperties.BASIC_AUTH_ORDER - 1) SecurityFilterChain devtoolsSecurityFilterChain(HttpSecurity http) { http.securityMatcher(PathPatternRequestMatcher.withDefaults().matcher(this.url)); http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous()); diff --git a/module/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfigurationTests.java b/module/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfigurationTests.java index 01c1b492a07..bd9266757c6 100644 --- a/module/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfigurationTests.java +++ b/module/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfigurationTests.java @@ -32,7 +32,8 @@ import org.springframework.boot.devtools.remote.server.DispatcherFilter; import org.springframework.boot.devtools.restart.MockRestarter; import org.springframework.boot.devtools.restart.server.HttpRestartServer; import org.springframework.boot.devtools.restart.server.SourceDirectoryUrlFilter; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.test.util.TestPropertyValues; import org.springframework.boot.web.context.servlet.AnnotationConfigServletWebApplicationContext; import org.springframework.context.annotation.Bean; @@ -236,8 +237,8 @@ class RemoteDevToolsAutoConfigurationTests { private AnnotationConfigServletWebApplicationContext loadContext(String... properties) { AnnotationConfigServletWebApplicationContext context = new AnnotationConfigServletWebApplicationContext(); context.setServletContext(new MockServletContext()); - context.register(Config.class, SecurityAutoConfiguration.class, RemoteDevToolsAutoConfiguration.class, - PropertyPlaceholderAutoConfiguration.class); + context.register(Config.class, SecurityAutoConfiguration.class, ServletWebSecurityAutoConfiguration.class, + RemoteDevToolsAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class); TestPropertyValues.of(properties).applyTo(context); context.refresh(); return context; diff --git a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebFluxSecurityAutoConfigurationTests.java b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebFluxSecurityAutoConfigurationTests.java index 431d35f2659..e3a331a9ffe 100644 --- a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebFluxSecurityAutoConfigurationTests.java +++ b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebFluxSecurityAutoConfigurationTests.java @@ -30,7 +30,7 @@ import org.springframework.boot.graphql.autoconfigure.GraphQlTestDataFetchers; import org.springframework.boot.graphql.autoconfigure.reactive.GraphQlWebFluxAutoConfiguration; import org.springframework.boot.http.codec.autoconfigure.CodecsAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner; import org.springframework.boot.testsupport.classpath.resources.WithResource; import org.springframework.boot.webflux.autoconfigure.HttpHandlerAutoConfiguration; @@ -87,7 +87,7 @@ class GraphQlWebFluxSecurityAutoConfigurationTests { .withConfiguration(AutoConfigurations.of(HttpHandlerAutoConfiguration.class, WebFluxAutoConfiguration.class, CodecsAutoConfiguration.class, JacksonAutoConfiguration.class, GraphQlAutoConfiguration.class, GraphQlWebFluxAutoConfiguration.class, GraphQlWebFluxSecurityAutoConfiguration.class, - ReactiveSecurityAutoConfiguration.class)) + ReactiveWebSecurityAutoConfiguration.class)) .withUserConfiguration(DataFetchersConfiguration.class, SecurityConfig.class) .withPropertyValues("spring.main.web-application-type=reactive"); diff --git a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebMvcSecurityAutoConfigurationTests.java b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebMvcSecurityAutoConfigurationTests.java index 1ea419e85ef..2cf52edb556 100644 --- a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebMvcSecurityAutoConfigurationTests.java +++ b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/security/GraphQlWebMvcSecurityAutoConfigurationTests.java @@ -28,7 +28,7 @@ import org.springframework.boot.graphql.autoconfigure.GraphQlTestDataFetchers; import org.springframework.boot.graphql.autoconfigure.servlet.GraphQlWebMvcAutoConfiguration; import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; import org.springframework.boot.testsupport.classpath.resources.WithResource; import org.springframework.boot.webmvc.autoconfigure.DispatcherServletAutoConfiguration; diff --git a/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfiguration.java b/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfiguration.java index a06d07b093c..97980437cb5 100644 --- a/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfiguration.java +++ b/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfiguration.java @@ -21,9 +21,9 @@ import org.springframework.boot.autoconfigure.EnableAutoConfiguration; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; -import org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration; import org.springframework.context.annotation.Import; import org.springframework.security.oauth2.server.authorization.OAuth2Authorization; diff --git a/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerJwtAutoConfiguration.java b/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerJwtAutoConfiguration.java index f7f867ec075..c4f461cfa01 100644 --- a/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerJwtAutoConfiguration.java +++ b/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerJwtAutoConfiguration.java @@ -35,7 +35,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; -import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Role; diff --git a/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfiguration.java b/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfiguration.java index a53fd05d797..7f040654108 100644 --- a/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfiguration.java +++ b/module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfiguration.java @@ -19,8 +19,8 @@ package org.springframework.boot.security.oauth2.server.authorization.autoconfig import java.util.Set; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; -import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity; -import org.springframework.boot.security.autoconfigure.SecurityProperties; +import org.springframework.boot.security.autoconfigure.web.servlet.ConditionalOnDefaultWebSecurity; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.Ordered; @@ -62,7 +62,7 @@ class OAuth2AuthorizationServerWebSecurityConfiguration { } @Bean - @Order(SecurityProperties.BASIC_AUTH_ORDER) + @Order(SecurityFilterProperties.BASIC_AUTH_ORDER) SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) { http.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated()).formLogin(withDefaults()); return http.build(); diff --git a/module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfigurationTests.java b/module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfigurationTests.java index 3bc57384ae4..0fd7af8a3a3 100644 --- a/module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfigurationTests.java @@ -19,9 +19,10 @@ package org.springframework.boot.security.oauth2.server.authorization.autoconfig import org.junit.jupiter.api.Test; import org.springframework.boot.autoconfigure.AutoConfigurations; -import org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; import org.springframework.boot.testsupport.classpath.ClassPathExclusions; @@ -53,7 +54,7 @@ class OAuth2AuthorizationServerAutoConfigurationTests { private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() .withConfiguration(AutoConfigurations.of(OAuth2AuthorizationServerAutoConfiguration.class, OAuth2AuthorizationServerJwtAutoConfiguration.class, SecurityAutoConfiguration.class, - UserDetailsServiceAutoConfiguration.class)); + ServletWebSecurityAutoConfiguration.class, UserDetailsServiceAutoConfiguration.class)); @Test void autoConfigurationConditionalOnClassOauth2Authorization() { diff --git a/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfiguration.java b/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfiguration.java index 337c9cd2eb3..a2919d7c226 100644 --- a/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfiguration.java +++ b/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfiguration.java @@ -24,8 +24,8 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; -import org.springframework.boot.security.autoconfigure.actuate.reactive.ReactiveManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.reactive.ReactiveManagementWebSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.context.annotation.Bean; import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; import org.springframework.security.config.web.server.ServerHttpSecurity; @@ -45,7 +45,7 @@ import static org.springframework.security.config.Customizer.withDefaults; * @since 4.0.0 */ @AutoConfiguration( - before = { ReactiveManagementWebSecurityAutoConfiguration.class, ReactiveSecurityAutoConfiguration.class }, + before = { ReactiveManagementWebSecurityAutoConfiguration.class, ReactiveWebSecurityAutoConfiguration.class }, after = ReactiveOAuth2ClientAutoConfiguration.class) @ConditionalOnClass({ Flux.class, EnableWebFluxSecurity.class, ServerOAuth2AuthorizedClientRepository.class }) @ConditionalOnBean(ReactiveOAuth2AuthorizedClientService.class) diff --git a/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/servlet/OAuth2ClientWebSecurityAutoConfiguration.java b/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/servlet/OAuth2ClientWebSecurityAutoConfiguration.java index 9f0868dbc5a..f4cf8d1b25d 100644 --- a/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/servlet/OAuth2ClientWebSecurityAutoConfiguration.java +++ b/module/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/servlet/OAuth2ClientWebSecurityAutoConfiguration.java @@ -22,9 +22,9 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; -import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity; -import org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ConditionalOnDefaultWebSecurity; import org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; diff --git a/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientAutoConfigurationTests.java b/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientAutoConfigurationTests.java index 886f2007766..34405b7ea98 100644 --- a/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientAutoConfigurationTests.java @@ -22,7 +22,7 @@ import org.junit.jupiter.api.Test; import reactor.core.publisher.Flux; import org.springframework.boot.autoconfigure.AutoConfigurations; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.runner.ApplicationContextRunner; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; @@ -46,7 +46,7 @@ class ReactiveOAuth2ClientAutoConfigurationTests { private final ApplicationContextRunner contextRunner = new ApplicationContextRunner() .withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientAutoConfiguration.class, - ReactiveSecurityAutoConfiguration.class)); + ReactiveWebSecurityAutoConfiguration.class)); @Test void autoConfigurationShouldBackOffForServletEnvironments() { diff --git a/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfigurationTests.java b/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfigurationTests.java index 397af9d7d45..970b43b405e 100644 --- a/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfigurationTests.java @@ -22,7 +22,7 @@ import java.util.List; import org.junit.jupiter.api.Test; import org.springframework.boot.autoconfigure.AutoConfigurations; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext; import org.springframework.boot.test.context.runner.ApplicationContextRunner; import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner; @@ -60,7 +60,7 @@ class ReactiveOAuth2ClientWebSecurityAutoConfigurationTests { private final ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner() .withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientWebSecurityAutoConfiguration.class, - ReactiveSecurityAutoConfiguration.class)); + ReactiveWebSecurityAutoConfiguration.class)); @Test void autoConfigurationShouldBackOffForServletEnvironments() { @@ -107,7 +107,7 @@ class ReactiveOAuth2ClientWebSecurityAutoConfigurationTests { void securityWebFilterChainBeanConditionalOnWebApplication() { new ApplicationContextRunner() .withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientWebSecurityAutoConfiguration.class, - ReactiveSecurityAutoConfiguration.class)) + ReactiveWebSecurityAutoConfiguration.class)) .withUserConfiguration(ReactiveOAuth2AuthorizedClientRepositoryConfiguration.class) .run((context) -> assertThat(context).doesNotHaveBean(SecurityWebFilterChain.class)); } diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfiguration.java index 8a75a66a767..3d506782604 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfiguration.java @@ -22,9 +22,9 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.security.autoconfigure.actuate.reactive.ReactiveManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.ReactiveUserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.reactive.ReactiveManagementWebSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties; import org.springframework.context.annotation.Import; import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; @@ -37,7 +37,7 @@ import org.springframework.security.config.annotation.web.reactive.EnableWebFlux * @since 4.0.0 */ @AutoConfiguration(before = { ReactiveManagementWebSecurityAutoConfiguration.class, - ReactiveSecurityAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class }) + ReactiveWebSecurityAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class }) @EnableConfigurationProperties(OAuth2ResourceServerProperties.class) @ConditionalOnClass({ EnableWebFluxSecurity.class }) @ConditionalOnWebApplication(type = Type.REACTIVE) diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfiguration.java index 71561a2a72a..5a235ac2a20 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfiguration.java @@ -22,9 +22,9 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties; import org.springframework.context.annotation.Import; import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken; diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java index c4491ac6edb..735409d206a 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java @@ -33,7 +33,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.context.properties.PropertyMapper; -import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity; +import org.springframework.boot.security.autoconfigure.web.servlet.ConditionalOnDefaultWebSecurity; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnIssuerLocationJwtDecoder; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnPublicKeyJwtDecoder; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties; diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerOpaqueTokenConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerOpaqueTokenConfiguration.java index 401ad31fdac..c9852e8c9f6 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerOpaqueTokenConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerOpaqueTokenConfiguration.java @@ -19,7 +19,7 @@ package org.springframework.boot.security.oauth2.server.resource.autoconfigure.s import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; -import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity; +import org.springframework.boot.security.autoconfigure.web.servlet.ConditionalOnDefaultWebSecurity; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java index 8d708825a9a..6cec0083d32 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java @@ -49,8 +49,8 @@ import reactor.core.publisher.Mono; import tools.jackson.databind.ObjectMapper; import org.springframework.boot.autoconfigure.AutoConfigurations; -import org.springframework.boot.security.autoconfigure.actuate.reactive.ReactiveManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.reactive.ReactiveManagementWebSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.JwtConverterCustomizationsArgumentsProvider; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext; @@ -718,7 +718,7 @@ class ReactiveOAuth2ResourceServerAutoConfigurationTests { void causesReactiveManagementWebSecurityAutoConfigurationToBackOff() { ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner() .withConfiguration(AutoConfigurations.of(ReactiveManagementWebSecurityAutoConfiguration.class, - ReactiveOAuth2ResourceServerAutoConfiguration.class, ReactiveSecurityAutoConfiguration.class, + ReactiveOAuth2ResourceServerAutoConfiguration.class, ReactiveWebSecurityAutoConfiguration.class, WebFluxAutoConfiguration.class)); contextRunner .run((context) -> assertThat(context).hasSingleBean(ReactiveManagementWebSecurityAutoConfiguration.class)); diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java index 4ea1e978614..c361f44ac5b 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java @@ -47,8 +47,9 @@ import org.mockito.InOrder; import tools.jackson.databind.ObjectMapper; import org.springframework.boot.autoconfigure.AutoConfigurations; -import org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.security.oauth2.server.resource.autoconfigure.JwtConverterCustomizationsArgumentsProvider; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext; @@ -737,7 +738,7 @@ class OAuth2ResourceServerAutoConfigurationTests { WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() .withConfiguration(AutoConfigurations.of(ManagementWebSecurityAutoConfiguration.class, OAuth2ResourceServerAutoConfiguration.class, SecurityAutoConfiguration.class, - WebMvcAutoConfiguration.class)); + ServletWebSecurityAutoConfiguration.class, WebMvcAutoConfiguration.class)); contextRunner.run((context) -> assertThat(context).hasSingleBean(ManagementWebSecurityAutoConfiguration.class)); contextRunner.withPropertyValues("spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://authserver") .run((context) -> assertThat(context).doesNotHaveBean(ManagementWebSecurityAutoConfiguration.class) diff --git a/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2LoginConfiguration.java b/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2LoginConfiguration.java index 4b7e36f035c..160382865af 100644 --- a/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2LoginConfiguration.java +++ b/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2LoginConfiguration.java @@ -17,7 +17,7 @@ package org.springframework.boot.security.saml2.autoconfigure; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; -import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity; +import org.springframework.boot.security.autoconfigure.web.servlet.ConditionalOnDefaultWebSecurity; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; diff --git a/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfiguration.java b/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfiguration.java index 7418a86084a..c9e7bbc4c3b 100644 --- a/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfiguration.java +++ b/module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfiguration.java @@ -22,8 +22,8 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration; import org.springframework.context.annotation.Import; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; diff --git a/module/spring-boot-security-saml2/src/test/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfigurationTests.java b/module/spring-boot-security-saml2/src/test/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfigurationTests.java index 5b80db576d4..2194678c658 100644 --- a/module/spring-boot-security-saml2/src/test/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfigurationTests.java +++ b/module/spring-boot-security-saml2/src/test/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfigurationTests.java @@ -27,8 +27,9 @@ import org.jspecify.annotations.Nullable; import org.junit.jupiter.api.Test; import org.springframework.boot.autoconfigure.AutoConfigurations; -import org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext; import org.springframework.boot.test.context.runner.ApplicationContextRunner; @@ -69,8 +70,9 @@ class Saml2RelyingPartyAutoConfigurationTests { private static final String MANAGEMENT_SECURITY_FILTER_CHAIN_BEAN = "managementSecurityFilterChain"; - private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner().withConfiguration( - AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class, SecurityAutoConfiguration.class)); + private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() + .withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class, + SecurityAutoConfiguration.class, ServletWebSecurityAutoConfiguration.class)); @Test void autoConfigurationShouldBeConditionalOnRelyingPartyRegistrationRepositoryClass() { @@ -444,7 +446,7 @@ class Saml2RelyingPartyAutoConfigurationTests { } @EnableWebSecurity - static class WebSecurityEnablerConfiguration { + static class EnableWebSecurityConfiguration { } diff --git a/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc.imports b/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc.imports index 8492ef9f3b2..8c4fca9cc2a 100644 --- a/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc.imports +++ b/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc.imports @@ -1,4 +1,5 @@ -org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration -org.springframework.boot.security.autoconfigure.servlet.SecurityFilterAutoConfiguration -org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration -org.springframework.boot.security.test.autoconfigure.webmvc.SecurityMockMvcAutoConfiguration +org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration +org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration +org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterAutoConfiguration +org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration +org.springframework.boot.security.test.autoconfigure.webmvc.SecurityMockMvcAutoConfiguration \ No newline at end of file diff --git a/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webtestclient.AutoConfigureWebTestClient.imports b/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webtestclient.AutoConfigureWebTestClient.imports index c8a49b9a11a..06fbd6c8345 100644 --- a/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webtestclient.AutoConfigureWebTestClient.imports +++ b/module/spring-boot-security-test/src/main/resources/META-INF/spring/org.springframework.boot.webtestclient.AutoConfigureWebTestClient.imports @@ -1,3 +1,4 @@ -org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration -org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration +org.springframework.boot.security.autoconfigure.ReactiveUserDetailsServiceAutoConfiguration +org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration +org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration org.springframework.boot.security.test.autoconfigure.webflux.SecurityWebTestClientAutoConfiguration diff --git a/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/AfterSecurityFilter.java b/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/AfterSecurityFilter.java index 3289ec38da5..2c164f7c67a 100644 --- a/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/AfterSecurityFilter.java +++ b/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/AfterSecurityFilter.java @@ -26,7 +26,7 @@ import jakarta.servlet.ServletRequest; import jakarta.servlet.ServletResponse; import jakarta.servlet.http.HttpServletRequest; -import org.springframework.boot.security.autoconfigure.SecurityProperties; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterProperties; import org.springframework.core.Ordered; /** @@ -38,7 +38,7 @@ public class AfterSecurityFilter implements Filter, Ordered { @Override public int getOrder() { - return SecurityProperties.DEFAULT_FILTER_ORDER + 1; + return SecurityFilterProperties.DEFAULT_FILTER_ORDER + 1; } @Override diff --git a/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/ExampleFilter.java b/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/ExampleFilter.java index 0a77a041992..f7911b8ecad 100644 --- a/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/ExampleFilter.java +++ b/module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/ExampleFilter.java @@ -26,7 +26,7 @@ import jakarta.servlet.ServletRequest; import jakarta.servlet.ServletResponse; import jakarta.servlet.http.HttpServletResponse; -import org.springframework.boot.security.autoconfigure.SecurityProperties; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterProperties; import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest; import org.springframework.core.Ordered; import org.springframework.stereotype.Component; @@ -56,7 +56,7 @@ public class ExampleFilter implements Filter, Ordered { @Override public int getOrder() { - return SecurityProperties.DEFAULT_FILTER_ORDER - 1; + return SecurityFilterProperties.DEFAULT_FILTER_ORDER - 1; } } diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured.java new file mode 100644 index 00000000000..0645697f316 --- /dev/null +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured.java @@ -0,0 +1,53 @@ +/* + * Copyright 2012-present the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.boot.security.autoconfigure; + +import org.springframework.boot.autoconfigure.condition.AnyNestedCondition; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingClass; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; +import org.springframework.context.annotation.Condition; + +/** + * {@link Condition} used to check if security username or passowrd properties have been + * set or there are no alternatives to the user details manager available. + * + * @author Andy Wilkinson + */ +final class MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured extends AnyNestedCondition { + + MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured() { + super(ConfigurationPhase.PARSE_CONFIGURATION); + } + + @ConditionalOnMissingClass({ "org.springframework.security.oauth2.client.registration.ClientRegistrationRepository", + "org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector", + "org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository" }) + static final class MissingAlternative { + + } + + @ConditionalOnProperty("spring.security.user.name") + static final class NameConfigured { + + } + + @ConditionalOnProperty("spring.security.user.password") + static final class PasswordConfigured { + + } + +} diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveUserDetailsServiceAutoConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/ReactiveUserDetailsServiceAutoConfiguration.java similarity index 75% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveUserDetailsServiceAutoConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/ReactiveUserDetailsServiceAutoConfiguration.java index 1470edd006a..9284713696e 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveUserDetailsServiceAutoConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/ReactiveUserDetailsServiceAutoConfiguration.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure; import java.util.List; import java.util.regex.Pattern; @@ -25,19 +25,16 @@ import org.jspecify.annotations.Nullable; import org.springframework.beans.factory.ObjectProvider; import org.springframework.boot.autoconfigure.AutoConfiguration; +import org.springframework.boot.autoconfigure.EnableAutoConfiguration; import org.springframework.boot.autoconfigure.condition.AnyNestedCondition; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; -import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingClass; -import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.security.autoconfigure.SecurityProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Conditional; -import org.springframework.context.annotation.Configuration; import org.springframework.messaging.rsocket.annotation.support.RSocketMessageHandler; import org.springframework.security.authentication.ReactiveAuthenticationManager; import org.springframework.security.authentication.ReactiveAuthenticationManagerResolver; @@ -49,24 +46,29 @@ import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.util.StringUtils; /** - * Default user {@link Configuration @Configuration} for a reactive web application. - * Configures a {@link ReactiveUserDetailsService} with a default user and generated - * password. This backs-off completely if there is a bean of type + * {@link EnableAutoConfiguration Auto-configuration} for a Spring Security in-memory + * {@link ReactiveUserDetailsService}. Adds a {@link MapReactiveUserDetailsService} with a + * default user and generated password. + *

+ * This configuration backs-off completely if there is a bean of type * {@link ReactiveUserDetailsService}, {@link ReactiveAuthenticationManager}, or * {@link ReactiveAuthenticationManagerResolver}. + *

+ * Note that the reactive application detection mechanism is limited to web applications + * only. If you're writing a non-web application you will need to configure reactive + * security yourself. * * @author Madhura Bhave * @since 4.0.0 */ -@AutoConfiguration(before = ReactiveSecurityAutoConfiguration.class, - afterName = "org.springframework.boot.rsocket.autoconfigure.RSocketMessagingAutoConfiguration") +@AutoConfiguration(afterName = "org.springframework.boot.rsocket.autoconfigure.RSocketMessagingAutoConfiguration") @ConditionalOnClass({ ReactiveAuthenticationManager.class }) @ConditionalOnMissingBean( value = { ReactiveAuthenticationManager.class, ReactiveUserDetailsService.class, ReactiveAuthenticationManagerResolver.class }, type = { "org.springframework.security.oauth2.jwt.ReactiveJwtDecoder" }) @Conditional({ ReactiveUserDetailsServiceAutoConfiguration.RSocketEnabledOrReactiveWebApplication.class, - ReactiveUserDetailsServiceAutoConfiguration.MissingAlternativeOrUserPropertiesConfigured.class }) + MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured.class }) @EnableConfigurationProperties(SecurityProperties.class) public final class ReactiveUserDetailsServiceAutoConfiguration { @@ -118,29 +120,4 @@ public final class ReactiveUserDetailsServiceAutoConfiguration { } - static final class MissingAlternativeOrUserPropertiesConfigured extends AnyNestedCondition { - - MissingAlternativeOrUserPropertiesConfigured() { - super(ConfigurationPhase.PARSE_CONFIGURATION); - } - - @ConditionalOnMissingClass({ - "org.springframework.security.oauth2.client.registration.ClientRegistrationRepository", - "org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenIntrospector" }) - static final class MissingAlternative { - - } - - @ConditionalOnProperty("spring.security.user.name") - static final class NameConfigured { - - } - - @ConditionalOnProperty("spring.security.user.password") - static final class PasswordConfigured { - - } - - } - } diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SecurityAutoConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityAutoConfiguration.java similarity index 77% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SecurityAutoConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityAutoConfiguration.java index de7aaebdd2d..e903e2d0494 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SecurityAutoConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityAutoConfiguration.java @@ -14,20 +14,19 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure; import org.springframework.boot.autoconfigure.AutoConfiguration; import org.springframework.boot.autoconfigure.EnableAutoConfiguration; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.security.autoconfigure.SecurityDataConfiguration; -import org.springframework.boot.security.autoconfigure.SecurityProperties; import org.springframework.context.ApplicationEventPublisher; import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Import; +import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationEventPublisher; import org.springframework.security.authentication.DefaultAuthenticationEventPublisher; +import org.springframework.security.data.repository.query.SecurityEvaluationContextExtension; /** * {@link EnableAutoConfiguration Auto-configuration} for Spring Security. @@ -37,10 +36,9 @@ import org.springframework.security.authentication.DefaultAuthenticationEventPub * @author Madhura Bhave * @since 4.0.0 */ -@AutoConfiguration(before = UserDetailsServiceAutoConfiguration.class) +@AutoConfiguration @ConditionalOnClass(DefaultAuthenticationEventPublisher.class) @EnableConfigurationProperties(SecurityProperties.class) -@Import({ SpringBootWebSecurityConfiguration.class, SecurityDataConfiguration.class }) public final class SecurityAutoConfiguration { @Bean @@ -49,4 +47,16 @@ public final class SecurityAutoConfiguration { return new DefaultAuthenticationEventPublisher(publisher); } + @Configuration(proxyBeanMethods = false) + @ConditionalOnClass(SecurityEvaluationContextExtension.class) + static class SecurityDataConfiguration { + + @Bean + @ConditionalOnMissingBean + SecurityEvaluationContextExtension securityEvaluationContextExtension() { + return new SecurityEvaluationContextExtension(); + } + + } + } diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityDataConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityDataConfiguration.java deleted file mode 100644 index 2b949cedf29..00000000000 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityDataConfiguration.java +++ /dev/null @@ -1,41 +0,0 @@ -/* - * Copyright 2012-present the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.boot.security.autoconfigure; - -import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; -import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.security.data.repository.query.SecurityEvaluationContextExtension; - -/** - * Automatically adds Spring Security's integration with Spring Data. - * - * @author Rob Winch - * @since 4.0.0 - */ -@Configuration(proxyBeanMethods = false) -@ConditionalOnClass(SecurityEvaluationContextExtension.class) -public class SecurityDataConfiguration { - - @Bean - @ConditionalOnMissingBean - public SecurityEvaluationContextExtension securityEvaluationContextExtension() { - return new SecurityEvaluationContextExtension(); - } - -} diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityProperties.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityProperties.java index a1798878b35..4064ff5a10e 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityProperties.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/SecurityProperties.java @@ -17,15 +17,10 @@ package org.springframework.boot.security.autoconfigure; import java.util.ArrayList; -import java.util.EnumSet; import java.util.List; -import java.util.Set; import java.util.UUID; import org.springframework.boot.context.properties.ConfigurationProperties; -import org.springframework.boot.servlet.filter.OrderedFilter; -import org.springframework.boot.web.servlet.DispatcherType; -import org.springframework.core.Ordered; import org.springframework.util.StringUtils; /** @@ -39,63 +34,12 @@ import org.springframework.util.StringUtils; @ConfigurationProperties("spring.security") public class SecurityProperties { - /** - * Order applied to the {@code SecurityFilterChain} that is used to configure basic - * authentication for application endpoints. Create your own - * {@code SecurityFilterChain} if you want to add your own authentication for all or - * some of those endpoints. - */ - public static final int BASIC_AUTH_ORDER = Ordered.LOWEST_PRECEDENCE - 5; - - /** - * Default order of Spring Security's Filter in the servlet container (i.e. amongst - * other filters registered with the container). There is no connection between this - * and the {@code @Order} on a {@code SecurityFilterChain}. - */ - public static final int DEFAULT_FILTER_ORDER = OrderedFilter.REQUEST_WRAPPER_FILTER_MAX_ORDER - 100; - - private final Filter filter = new Filter(); - private final User user = new User(); public User getUser() { return this.user; } - public Filter getFilter() { - return this.filter; - } - - public static class Filter { - - /** - * Security filter chain order for Servlet-based web applications. - */ - private int order = DEFAULT_FILTER_ORDER; - - /** - * Security filter chain dispatcher types for Servlet-based web applications. - */ - private Set dispatcherTypes = EnumSet.allOf(DispatcherType.class); - - public int getOrder() { - return this.order; - } - - public void setOrder(int order) { - this.order = order; - } - - public Set getDispatcherTypes() { - return this.dispatcherTypes; - } - - public void setDispatcherTypes(Set dispatcherTypes) { - this.dispatcherTypes = dispatcherTypes; - } - - } - public static class User { /** diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/UserDetailsServiceAutoConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/UserDetailsServiceAutoConfiguration.java similarity index 72% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/UserDetailsServiceAutoConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/UserDetailsServiceAutoConfiguration.java index 09cc9469d43..d4e0eef6e73 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/UserDetailsServiceAutoConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/UserDetailsServiceAutoConfiguration.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure; import java.util.List; import java.util.regex.Pattern; @@ -26,22 +26,15 @@ import org.jspecify.annotations.Nullable; import org.springframework.beans.factory.ObjectProvider; import org.springframework.boot.autoconfigure.AutoConfiguration; import org.springframework.boot.autoconfigure.EnableAutoConfiguration; -import org.springframework.boot.autoconfigure.condition.AnyNestedCondition; -import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; -import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingClass; -import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; -import org.springframework.boot.security.autoconfigure.SecurityProperties; -import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration.MissingAlternativeOrUserPropertiesConfigured; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Conditional; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.AuthenticationManagerResolver; import org.springframework.security.authentication.AuthenticationProvider; -import org.springframework.security.config.ObjectPostProcessor; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.password.PasswordEncoder; @@ -61,8 +54,7 @@ import org.springframework.util.StringUtils; */ @AutoConfiguration @ConditionalOnClass(AuthenticationManager.class) -@Conditional(MissingAlternativeOrUserPropertiesConfigured.class) -@ConditionalOnBean(ObjectPostProcessor.class) +@Conditional(MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured.class) @ConditionalOnMissingBean(value = { AuthenticationManager.class, AuthenticationProvider.class, UserDetailsService.class, AuthenticationManagerResolver.class }, type = "org.springframework.security.oauth2.jwt.JwtDecoder") @ConditionalOnWebApplication(type = Type.SERVLET) @@ -100,30 +92,4 @@ public final class UserDetailsServiceAutoConfiguration { return NOOP_PASSWORD_PREFIX + password; } - static final class MissingAlternativeOrUserPropertiesConfigured extends AnyNestedCondition { - - MissingAlternativeOrUserPropertiesConfigured() { - super(ConfigurationPhase.PARSE_CONFIGURATION); - } - - @ConditionalOnMissingClass({ - "org.springframework.security.oauth2.client.registration.ClientRegistrationRepository", - "org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector", - "org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository" }) - static final class MissingAlternative { - - } - - @ConditionalOnProperty("spring.security.user.name") - static final class NameConfigured { - - } - - @ConditionalOnProperty("spring.security.user.password") - static final class PasswordConfigured { - - } - - } - } diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java similarity index 99% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequest.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java index 53dea0e3af7..bb5f3c9b5f6 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequest.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.reactive; +package org.springframework.boot.security.autoconfigure.actuate.web.reactive; import java.util.ArrayList; import java.util.Arrays; @@ -37,7 +37,7 @@ import org.springframework.boot.actuate.endpoint.EndpointId; import org.springframework.boot.actuate.endpoint.annotation.Endpoint; import org.springframework.boot.actuate.endpoint.web.PathMappedEndpoints; import org.springframework.boot.actuate.endpoint.web.WebServerNamespace; -import org.springframework.boot.security.reactive.ApplicationContextServerWebExchangeMatcher; +import org.springframework.boot.security.web.reactive.ApplicationContextServerWebExchangeMatcher; import org.springframework.boot.web.server.context.WebServerApplicationContext; import org.springframework.context.ApplicationContext; import org.springframework.core.annotation.MergedAnnotation; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/ReactiveManagementWebSecurityAutoConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/ReactiveManagementWebSecurityAutoConfiguration.java similarity index 92% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/ReactiveManagementWebSecurityAutoConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/ReactiveManagementWebSecurityAutoConfiguration.java index de918a09854..7dc9075528b 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/ReactiveManagementWebSecurityAutoConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/ReactiveManagementWebSecurityAutoConfiguration.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.reactive; +package org.springframework.boot.security.autoconfigure.actuate.web.reactive; import reactor.core.publisher.Mono; @@ -27,8 +27,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.health.actuate.endpoint.HealthEndpoint; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.context.annotation.Bean; import org.springframework.security.authentication.ReactiveAuthenticationManager; import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; @@ -52,8 +51,7 @@ import static org.springframework.security.config.Customizer.withDefaults; * @author Madhura Bhave * @since 4.0.0 */ -@AutoConfiguration(before = ReactiveSecurityAutoConfiguration.class, - after = ReactiveUserDetailsServiceAutoConfiguration.class, +@AutoConfiguration(before = ReactiveWebSecurityAutoConfiguration.class, afterName = { "org.springframework.boot.health.autoconfigure.actuate.endpoint.HealthEndpointAutoConfiguration", "org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration", "org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration" }) diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/package-info.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/package-info.java similarity index 98% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/package-info.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/package-info.java index 3b461153edf..bdcae5687a7 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/reactive/package-info.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/package-info.java @@ -18,6 +18,6 @@ * Auto-configuration for actuator security using WebFlux. */ @NullMarked -package org.springframework.boot.security.autoconfigure.actuate.reactive; +package org.springframework.boot.security.autoconfigure.actuate.web.reactive; import org.jspecify.annotations.NullMarked; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/EndpointRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java similarity index 99% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/EndpointRequest.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java index 4c7326fa0d8..7249f4903ac 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/EndpointRequest.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import java.util.ArrayList; import java.util.Arrays; @@ -37,7 +37,7 @@ import org.springframework.boot.actuate.endpoint.EndpointId; import org.springframework.boot.actuate.endpoint.annotation.Endpoint; import org.springframework.boot.actuate.endpoint.web.PathMappedEndpoints; import org.springframework.boot.actuate.endpoint.web.WebServerNamespace; -import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher; +import org.springframework.boot.security.web.servlet.ApplicationContextRequestMatcher; import org.springframework.boot.web.server.context.WebServerApplicationContext; import org.springframework.context.ApplicationContext; import org.springframework.core.annotation.MergedAnnotation; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/ManagementWebSecurityAutoConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/ManagementWebSecurityAutoConfiguration.java similarity index 89% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/ManagementWebSecurityAutoConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/ManagementWebSecurityAutoConfiguration.java index a328b143d51..1f019b6d864 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/ManagementWebSecurityAutoConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/ManagementWebSecurityAutoConfiguration.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration; import org.springframework.boot.actuate.endpoint.web.WebServerNamespace; @@ -24,9 +24,9 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.health.actuate.endpoint.HealthEndpoint; -import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity; -import org.springframework.boot.security.autoconfigure.SecurityProperties; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ConditionalOnDefaultWebSecurity; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterProperties; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.context.annotation.Bean; import org.springframework.core.annotation.Order; import org.springframework.core.env.Environment; @@ -48,7 +48,7 @@ import static org.springframework.security.config.Customizer.withDefaults; * @author Hatef Palizgar * @since 4.0.0 */ -@AutoConfiguration(before = SecurityAutoConfiguration.class, +@AutoConfiguration(before = ServletWebSecurityAutoConfiguration.class, afterName = { "org.springframework.boot.health.autoconfigure.actuate.endpoint.HealthEndpointAutoConfiguration", "org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration" }) @ConditionalOnWebApplication(type = Type.SERVLET) @@ -57,7 +57,7 @@ import static org.springframework.security.config.Customizer.withDefaults; public final class ManagementWebSecurityAutoConfiguration { @Bean - @Order(SecurityProperties.BASIC_AUTH_ORDER) + @Order(SecurityFilterProperties.BASIC_AUTH_ORDER) SecurityFilterChain managementSecurityFilterChain(Environment environment, HttpSecurity http) { if (ClassUtils.isPresent("org.springframework.boot.health.actuate.endpoint.HealthEndpoint", getClass().getClassLoader())) { diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/PathPatternRequestMatcherProvider.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/PathPatternRequestMatcherProvider.java similarity index 99% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/PathPatternRequestMatcherProvider.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/PathPatternRequestMatcherProvider.java index 14a0d23efdf..af43803f204 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/PathPatternRequestMatcherProvider.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/PathPatternRequestMatcherProvider.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import java.util.function.Function; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/RequestMatcherProvider.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/RequestMatcherProvider.java similarity index 99% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/RequestMatcherProvider.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/RequestMatcherProvider.java index 058ec15321e..3f9af58f1ba 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/RequestMatcherProvider.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/RequestMatcherProvider.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import org.jspecify.annotations.Nullable; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/SecurityRequestMatchersManagementContextConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/SecurityRequestMatchersManagementContextConfiguration.java similarity index 99% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/SecurityRequestMatchersManagementContextConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/SecurityRequestMatchersManagementContextConfiguration.java index ccbbcb672be..394216d9f72 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/SecurityRequestMatchersManagementContextConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/SecurityRequestMatchersManagementContextConfiguration.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import org.springframework.boot.actuate.autoconfigure.web.ManagementContextConfiguration; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/package-info.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/package-info.java similarity index 98% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/package-info.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/package-info.java index c62fa12def1..0f6f2e6a832 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/servlet/package-info.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/package-info.java @@ -18,6 +18,6 @@ * Auto-configuration for actuator security using Spring MVC. */ @NullMarked -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import org.jspecify.annotations.NullMarked; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/StaticResourceLocation.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/StaticResourceLocation.java similarity index 95% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/StaticResourceLocation.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/StaticResourceLocation.java index 9b6dba98da1..b8b32fb8cd3 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/StaticResourceLocation.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/StaticResourceLocation.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure; +package org.springframework.boot.security.autoconfigure.web; import java.util.Arrays; import java.util.stream.Stream; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/package-info.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/package-info.java new file mode 100644 index 00000000000..2642c34f76f --- /dev/null +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/package-info.java @@ -0,0 +1,23 @@ +/* + * Copyright 2012-present the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * Support classes for Spring Security web Auto-configuration. + */ +@NullMarked +package org.springframework.boot.security.autoconfigure.web; + +import org.jspecify.annotations.NullMarked; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/PathRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/PathRequest.java similarity index 88% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/PathRequest.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/PathRequest.java index b5d51b27d95..ff54bdc5994 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/PathRequest.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/PathRequest.java @@ -14,9 +14,9 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure.web.reactive; -import org.springframework.boot.security.autoconfigure.StaticResourceLocation; +import org.springframework.boot.security.autoconfigure.web.StaticResourceLocation; import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher; /** diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveSecurityAutoConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/ReactiveWebSecurityAutoConfiguration.java similarity index 89% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveSecurityAutoConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/ReactiveWebSecurityAutoConfiguration.java index a1456f8ae80..ca10e61c115 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveSecurityAutoConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/ReactiveWebSecurityAutoConfiguration.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure.web.reactive; import reactor.core.publisher.Flux; import reactor.core.publisher.Mono; @@ -26,6 +26,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.boot.security.autoconfigure.ReactiveUserDetailsServiceAutoConfiguration; import org.springframework.boot.security.autoconfigure.SecurityProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @@ -48,10 +49,11 @@ import org.springframework.web.reactive.config.WebFluxConfigurer; * @author Madhura Bhave * @since 4.0.0 */ -@AutoConfiguration +@AutoConfiguration(after = ReactiveUserDetailsServiceAutoConfiguration.class, + afterName = "org.springframework.boot.webflux.autoconfigure.WebFluxAutoConfiguration") @EnableConfigurationProperties(SecurityProperties.class) @ConditionalOnClass({ Flux.class, EnableWebFluxSecurity.class, WebFilterChainProxy.class, WebFluxConfigurer.class }) -public final class ReactiveSecurityAutoConfiguration { +public final class ReactiveWebSecurityAutoConfiguration { @ConditionalOnWebApplication(type = Type.REACTIVE) @Configuration(proxyBeanMethods = false) diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/StaticResourceRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/StaticResourceRequest.java similarity index 97% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/StaticResourceRequest.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/StaticResourceRequest.java index 4f7074e58f8..2bba52edc93 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/StaticResourceRequest.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/StaticResourceRequest.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure.web.reactive; import java.util.EnumSet; import java.util.LinkedHashSet; @@ -23,7 +23,7 @@ import java.util.stream.Stream; import reactor.core.publisher.Mono; -import org.springframework.boot.security.autoconfigure.StaticResourceLocation; +import org.springframework.boot.security.autoconfigure.web.StaticResourceLocation; import org.springframework.security.web.server.util.matcher.OrServerWebExchangeMatcher; import org.springframework.security.web.server.util.matcher.PathPatternParserServerWebExchangeMatcher; import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/package-info.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/package-info.java similarity index 91% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/package-info.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/package-info.java index 32c05196d12..1cf8776f29d 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/reactive/package-info.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/reactive/package-info.java @@ -18,6 +18,6 @@ * Auto-configuration for reactive Spring Security. */ @NullMarked -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure.web.reactive; import org.jspecify.annotations.NullMarked; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/ConditionalOnDefaultWebSecurity.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ConditionalOnDefaultWebSecurity.java similarity index 94% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/ConditionalOnDefaultWebSecurity.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ConditionalOnDefaultWebSecurity.java index eca9f26e148..f3ade7f67b6 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/ConditionalOnDefaultWebSecurity.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ConditionalOnDefaultWebSecurity.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure; +package org.springframework.boot.security.autoconfigure.web.servlet; import java.lang.annotation.Documented; import java.lang.annotation.ElementType; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/DefaultWebSecurityCondition.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/DefaultWebSecurityCondition.java similarity index 95% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/DefaultWebSecurityCondition.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/DefaultWebSecurityCondition.java index 1e37161bbc0..f7f76fbdba9 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/DefaultWebSecurityCondition.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/DefaultWebSecurityCondition.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure; +package org.springframework.boot.security.autoconfigure.web.servlet; import org.springframework.boot.autoconfigure.condition.AllNestedConditions; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/PathRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequest.java similarity index 92% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/PathRequest.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequest.java index 599d67bf4f9..cad1ee0b4f4 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/PathRequest.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequest.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import java.util.function.Supplier; @@ -22,8 +22,8 @@ import jakarta.servlet.http.HttpServletRequest; import org.jspecify.annotations.Nullable; import org.springframework.boot.h2console.autoconfigure.H2ConsoleProperties; -import org.springframework.boot.security.autoconfigure.StaticResourceLocation; -import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher; +import org.springframework.boot.security.autoconfigure.web.StaticResourceLocation; +import org.springframework.boot.security.web.servlet.ApplicationContextRequestMatcher; import org.springframework.boot.web.server.context.WebServerApplicationContext; import org.springframework.context.ApplicationContext; import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfiguration.java similarity index 79% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfiguration.java index b09acd9c83e..c3faca1088f 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfiguration.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import java.util.EnumSet; import java.util.stream.Collectors; @@ -29,7 +29,6 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.security.autoconfigure.SecurityProperties; import org.springframework.boot.web.servlet.DelegatingFilterProxyRegistrationBean; import org.springframework.context.annotation.Bean; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration; @@ -38,7 +37,7 @@ import org.springframework.security.web.context.AbstractSecurityWebApplicationIn /** * {@link EnableAutoConfiguration Auto-configuration} for Spring Security's Filter. - * Configured separately from {@link SpringBootWebSecurityConfiguration} to ensure that + * Configured separately from {@link ServletWebSecurityAutoConfiguration} to ensure that * the filter's order is still configured when a user-provided * {@link WebSecurityConfiguration} exists. * @@ -47,9 +46,9 @@ import org.springframework.security.web.context.AbstractSecurityWebApplicationIn * @author Andy Wilkinson * @since 4.0.0 */ -@AutoConfiguration(after = SecurityAutoConfiguration.class) +@AutoConfiguration(after = ServletWebSecurityAutoConfiguration.class) @ConditionalOnWebApplication(type = Type.SERVLET) -@EnableConfigurationProperties(SecurityProperties.class) +@EnableConfigurationProperties(SecurityFilterProperties.class) @ConditionalOnClass({ AbstractSecurityWebApplicationInitializer.class, SessionCreationPolicy.class }) public final class SecurityFilterAutoConfiguration { @@ -57,20 +56,20 @@ public final class SecurityFilterAutoConfiguration { @Bean @ConditionalOnBean(name = DEFAULT_FILTER_NAME) - DelegatingFilterProxyRegistrationBean securityFilterChainRegistration(SecurityProperties securityProperties) { + DelegatingFilterProxyRegistrationBean securityFilterChainRegistration( + SecurityFilterProperties securityFilterProperties) { DelegatingFilterProxyRegistrationBean registration = new DelegatingFilterProxyRegistrationBean( DEFAULT_FILTER_NAME); - registration.setOrder(securityProperties.getFilter().getOrder()); - registration.setDispatcherTypes(getDispatcherTypes(securityProperties)); + registration.setOrder(securityFilterProperties.getOrder()); + registration.setDispatcherTypes(getDispatcherTypes(securityFilterProperties)); return registration; } - private @Nullable EnumSet getDispatcherTypes(SecurityProperties securityProperties) { - if (securityProperties.getFilter().getDispatcherTypes() == null) { + private @Nullable EnumSet getDispatcherTypes(SecurityFilterProperties securityFilterProperties) { + if (securityFilterProperties.getDispatcherTypes() == null) { return null; } - return securityProperties.getFilter() - .getDispatcherTypes() + return securityFilterProperties.getDispatcherTypes() .stream() .map((type) -> DispatcherType.valueOf(type.name())) .collect(Collectors.toCollection(() -> EnumSet.noneOf(DispatcherType.class))); diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterProperties.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterProperties.java new file mode 100644 index 00000000000..b0c9d08d1b0 --- /dev/null +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterProperties.java @@ -0,0 +1,77 @@ +/* + * Copyright 2012-present the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.boot.security.autoconfigure.web.servlet; + +import java.util.EnumSet; +import java.util.Set; + +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.boot.servlet.filter.OrderedFilter; +import org.springframework.boot.web.servlet.DispatcherType; +import org.springframework.core.Ordered; + +/** + * Configuration properties for Spring Security Filter. + * + * @author Phillip Webb + * @since 4.0.0 + */ +@ConfigurationProperties("spring.security.filter") +public class SecurityFilterProperties { + + /** + * Order applied to the {@code SecurityFilterChain} that is used to configure basic + * authentication for application endpoints. Create your own + * {@code SecurityFilterChain} if you want to add your own authentication for all or + * some of those endpoints. + */ + public static final int BASIC_AUTH_ORDER = Ordered.LOWEST_PRECEDENCE - 5; + + /** + * Default order of Spring Security's Filter in the servlet container (i.e. amongst + * other filters registered with the container). There is no connection between this + * and the {@code @Order} on a {@code SecurityFilterChain}. + */ + public static final int DEFAULT_FILTER_ORDER = OrderedFilter.REQUEST_WRAPPER_FILTER_MAX_ORDER - 100; + + /** + * Security filter chain order for Servlet-based web applications. + */ + private int order = DEFAULT_FILTER_ORDER; + + /** + * Security filter chain dispatcher types for Servlet-based web applications. + */ + private Set dispatcherTypes = EnumSet.allOf(DispatcherType.class); + + public int getOrder() { + return this.order; + } + + public void setOrder(int order) { + this.order = order; + } + + public Set getDispatcherTypes() { + return this.dispatcherTypes; + } + + public void setDispatcherTypes(Set dispatcherTypes) { + this.dispatcherTypes = dispatcherTypes; + } + +} diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SpringBootWebSecurityConfiguration.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfiguration.java similarity index 82% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SpringBootWebSecurityConfiguration.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfiguration.java index f828db4d606..a8ab62ce00a 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/SpringBootWebSecurityConfiguration.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfiguration.java @@ -14,15 +14,16 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; +import org.springframework.boot.autoconfigure.AutoConfiguration; +import org.springframework.boot.autoconfigure.EnableAutoConfiguration; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type; -import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity; -import org.springframework.boot.security.autoconfigure.SecurityProperties; +import org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration; import org.springframework.boot.webmvc.autoconfigure.DispatcherServletPath; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @@ -36,13 +37,18 @@ import org.springframework.security.web.servlet.util.matcher.PathPatternRequestM import static org.springframework.security.config.Customizer.withDefaults; /** - * {@link Configuration @Configuration} class securing servlet applications. + * {@link EnableAutoConfiguration Auto-configuration} for Spring Security. * + * @author Dave Syer + * @author Andy Wilkinson * @author Madhura Bhave + * @since 4.0.0 */ -@Configuration(proxyBeanMethods = false) +@AutoConfiguration(after = UserDetailsServiceAutoConfiguration.class, + afterName = "org.springframework.boot.webmvc.autoconfigure.WebMvcAutoConfiguration") +@ConditionalOnClass(EnableWebSecurity.class) @ConditionalOnWebApplication(type = Type.SERVLET) -class SpringBootWebSecurityConfiguration { +public final class ServletWebSecurityAutoConfiguration { @Configuration(proxyBeanMethods = false) @ConditionalOnBean(DispatcherServletPath.class) @@ -72,7 +78,7 @@ class SpringBootWebSecurityConfiguration { static class SecurityFilterChainConfiguration { @Bean - @Order(SecurityProperties.BASIC_AUTH_ORDER) + @Order(SecurityFilterProperties.BASIC_AUTH_ORDER) SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) { http.authorizeHttpRequests((requests) -> requests.anyRequest().authenticated()); http.formLogin(withDefaults()); @@ -95,7 +101,7 @@ class SpringBootWebSecurityConfiguration { @ConditionalOnMissingBean(name = BeanIds.SPRING_SECURITY_FILTER_CHAIN) @ConditionalOnClass(EnableWebSecurity.class) @EnableWebSecurity - static class WebSecurityEnablerConfiguration { + static class EnableWebSecurityConfiguration { } diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/StaticResourceRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/StaticResourceRequest.java similarity index 96% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/StaticResourceRequest.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/StaticResourceRequest.java index 8998d253cb9..ef15fcaf90e 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/StaticResourceRequest.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/StaticResourceRequest.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import java.util.EnumSet; import java.util.LinkedHashSet; @@ -25,8 +25,8 @@ import java.util.stream.Stream; import jakarta.servlet.http.HttpServletRequest; import org.jspecify.annotations.Nullable; -import org.springframework.boot.security.autoconfigure.StaticResourceLocation; -import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher; +import org.springframework.boot.security.autoconfigure.web.StaticResourceLocation; +import org.springframework.boot.security.web.servlet.ApplicationContextRequestMatcher; import org.springframework.boot.web.server.context.WebServerApplicationContext; import org.springframework.boot.webmvc.autoconfigure.DispatcherServletPath; import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/package-info.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/package-info.java similarity index 91% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/package-info.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/package-info.java index bc78ccb2451..41fd265dd03 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/servlet/package-info.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/package-info.java @@ -18,6 +18,6 @@ * Auto-configuration for Servlet-based Spring Security. */ @NullMarked -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import org.jspecify.annotations.NullMarked; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/reactive/ApplicationContextServerWebExchangeMatcher.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/reactive/ApplicationContextServerWebExchangeMatcher.java similarity index 98% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/reactive/ApplicationContextServerWebExchangeMatcher.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/web/reactive/ApplicationContextServerWebExchangeMatcher.java index 393641e51c1..1bba2d505fc 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/reactive/ApplicationContextServerWebExchangeMatcher.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/reactive/ApplicationContextServerWebExchangeMatcher.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.reactive; +package org.springframework.boot.security.web.reactive; import java.util.function.Supplier; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/reactive/package-info.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/reactive/package-info.java similarity index 93% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/reactive/package-info.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/web/reactive/package-info.java index 6c67f765566..7b9913b4b87 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/reactive/package-info.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/reactive/package-info.java @@ -18,6 +18,6 @@ * Classes and utilities for reactive Spring Security. */ @NullMarked -package org.springframework.boot.security.reactive; +package org.springframework.boot.security.web.reactive; import org.jspecify.annotations.NullMarked; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/servlet/ApplicationContextRequestMatcher.java similarity index 98% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/web/servlet/ApplicationContextRequestMatcher.java index fd07393204e..4430251200a 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/servlet/ApplicationContextRequestMatcher.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.servlet; +package org.springframework.boot.security.web.servlet; import java.util.function.Supplier; diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/servlet/package-info.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/servlet/package-info.java similarity index 93% rename from module/spring-boot-security/src/main/java/org/springframework/boot/security/servlet/package-info.java rename to module/spring-boot-security/src/main/java/org/springframework/boot/security/web/servlet/package-info.java index f07ac95f6ae..16a82409e3e 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/servlet/package-info.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/web/servlet/package-info.java @@ -18,6 +18,6 @@ * Classes and utilities for Servlet-based Spring Security. */ @NullMarked -package org.springframework.boot.security.servlet; +package org.springframework.boot.security.web.servlet; import org.jspecify.annotations.NullMarked; diff --git a/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.actuate.autoconfigure.web.ManagementContextConfiguration.imports b/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.actuate.autoconfigure.web.ManagementContextConfiguration.imports index 91a140d1ded..9ff9200507f 100644 --- a/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.actuate.autoconfigure.web.ManagementContextConfiguration.imports +++ b/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.actuate.autoconfigure.web.ManagementContextConfiguration.imports @@ -1 +1 @@ -org.springframework.boot.security.autoconfigure.actuate.servlet.SecurityRequestMatchersManagementContextConfiguration +org.springframework.boot.security.autoconfigure.actuate.web.servlet.SecurityRequestMatchersManagementContextConfiguration diff --git a/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports index 0ebb4e22caa..8d3996304e1 100644 --- a/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports +++ b/module/spring-boot-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -1,8 +1,9 @@ -org.springframework.boot.security.autoconfigure.actuate.reactive.ReactiveManagementWebSecurityAutoConfiguration -org.springframework.boot.security.autoconfigure.actuate.servlet.ManagementWebSecurityAutoConfiguration -org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration -org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration +org.springframework.boot.security.autoconfigure.ReactiveUserDetailsServiceAutoConfiguration +org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration +org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration +org.springframework.boot.security.autoconfigure.actuate.web.reactive.ReactiveManagementWebSecurityAutoConfiguration +org.springframework.boot.security.autoconfigure.actuate.web.servlet.ManagementWebSecurityAutoConfiguration org.springframework.boot.security.autoconfigure.rsocket.RSocketSecurityAutoConfiguration -org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration -org.springframework.boot.security.autoconfigure.servlet.SecurityFilterAutoConfiguration -org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration \ No newline at end of file +org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration +org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterAutoConfiguration +org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveUserDetailsServiceAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/ReactiveUserDetailsServiceAutoConfigurationTests.java similarity index 90% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveUserDetailsServiceAutoConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/ReactiveUserDetailsServiceAutoConfigurationTests.java index c91dc7e24ab..c3fd85033f4 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveUserDetailsServiceAutoConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/ReactiveUserDetailsServiceAutoConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure; import java.time.Duration; @@ -25,7 +25,7 @@ import org.springframework.boot.autoconfigure.AutoConfigurations; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.boot.rsocket.autoconfigure.RSocketMessagingAutoConfiguration; import org.springframework.boot.rsocket.autoconfigure.RSocketStrategiesAutoConfiguration; -import org.springframework.boot.security.autoconfigure.SecurityProperties; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.runner.ApplicationContextRunner; import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner; @@ -42,7 +42,9 @@ import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository; +import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector; import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenIntrospector; +import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; import static org.assertj.core.api.Assertions.assertThat; import static org.mockito.Mockito.mock; @@ -60,9 +62,7 @@ class ReactiveUserDetailsServiceAutoConfigurationTests { @Test void configuresADefaultUser() { - this.contextRunner - .withClassLoader( - new FilteredClassLoader(ClientRegistrationRepository.class, ReactiveOpaqueTokenIntrospector.class)) + this.contextRunner.withClassLoader(filterAlternativeUserDetailsManager()) .withUserConfiguration(TestSecurityConfiguration.class) .run((context) -> { ReactiveUserDetailsService userDetailsService = context.getBean(ReactiveUserDetailsService.class); @@ -72,9 +72,7 @@ class ReactiveUserDetailsServiceAutoConfigurationTests { @Test void userDetailsServiceWhenRSocketConfigured() { - new ApplicationContextRunner() - .withClassLoader( - new FilteredClassLoader(ClientRegistrationRepository.class, ReactiveOpaqueTokenIntrospector.class)) + new ApplicationContextRunner().withClassLoader(filterAlternativeUserDetailsManager()) .withConfiguration(AutoConfigurations.of(ReactiveUserDetailsServiceAutoConfiguration.class, RSocketMessagingAutoConfiguration.class, RSocketStrategiesAutoConfiguration.class)) .withUserConfiguration(TestRSocketSecurityConfiguration.class) @@ -97,7 +95,7 @@ class ReactiveUserDetailsServiceAutoConfigurationTests { @Test void doesNotConfigureDefaultUserIfAuthenticationManagerAvailable() { this.contextRunner.withUserConfiguration(AuthenticationManagerConfig.class, TestSecurityConfiguration.class) - .withConfiguration(AutoConfigurations.of(ReactiveSecurityAutoConfiguration.class)) + .withConfiguration(AutoConfigurations.of(ReactiveWebSecurityAutoConfiguration.class)) .run((context) -> assertThat(context).getBean(ReactiveUserDetailsService.class).isNull()); } @@ -127,9 +125,7 @@ class ReactiveUserDetailsServiceAutoConfigurationTests { @Test void userDetailsServiceWhenPasswordEncoderAbsentAndDefaultPassword() { - this.contextRunner - .withClassLoader( - new FilteredClassLoader(ClientRegistrationRepository.class, ReactiveOpaqueTokenIntrospector.class)) + this.contextRunner.withClassLoader(filterAlternativeUserDetailsManager()) .withUserConfiguration(TestSecurityConfiguration.class) .run(((context) -> { MapReactiveUserDetailsService userDetailsService = context.getBean(MapReactiveUserDetailsService.class); @@ -171,6 +167,11 @@ class ReactiveUserDetailsServiceAutoConfigurationTests { })); } + private FilteredClassLoader filterAlternativeUserDetailsManager() { + return new FilteredClassLoader(ClientRegistrationRepository.class, ReactiveOpaqueTokenIntrospector.class, + OpaqueTokenIntrospector.class, RelyingPartyRegistrationRepository.class); + } + @Configuration(proxyBeanMethods = false) @EnableWebFluxSecurity @EnableConfigurationProperties(SecurityProperties.class) diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/SecurityAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/SecurityAutoConfigurationTests.java new file mode 100644 index 00000000000..3261b9972ad --- /dev/null +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/SecurityAutoConfigurationTests.java @@ -0,0 +1,112 @@ +/* + * Copyright 2012-present the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.boot.security.autoconfigure; + +import org.junit.jupiter.api.Test; + +import org.springframework.boot.autoconfigure.AutoConfigurations; +import org.springframework.boot.autoconfigure.TestAutoConfigurationPackage; +import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration; +import org.springframework.boot.hibernate.autoconfigure.HibernateJpaAutoConfiguration; +import org.springframework.boot.jdbc.autoconfigure.DataSourceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.jpa.City; +import org.springframework.boot.test.context.runner.WebApplicationContextRunner; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.orm.jpa.JpaTransactionManager; +import org.springframework.security.authentication.AuthenticationEventPublisher; +import org.springframework.security.authentication.DefaultAuthenticationEventPublisher; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.AuthenticationException; +import org.springframework.security.data.repository.query.SecurityEvaluationContextExtension; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * Tests for {@link SecurityAutoConfiguration}. + * + * @author Dave Syer + * @author Rob Winch + * @author Andy Wilkinson + * @author Madhura Bhave + */ +class SecurityAutoConfigurationTests { + + private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner().withConfiguration( + AutoConfigurations.of(SecurityAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class)); + + @Test + void defaultAuthenticationEventPublisherRegistered() { + this.contextRunner.run((context) -> assertThat(context.getBean(AuthenticationEventPublisher.class)) + .isInstanceOf(DefaultAuthenticationEventPublisher.class)); + } + + @Test + void defaultAuthenticationEventPublisherIsConditionalOnMissingBean() { + this.contextRunner.withUserConfiguration(AuthenticationEventPublisherConfiguration.class) + .run((context) -> assertThat(context.getBean(AuthenticationEventPublisher.class)) + .isInstanceOf(AuthenticationEventPublisherConfiguration.TestAuthenticationEventPublisher.class)); + } + + @Test + void testJpaCoexistsHappily() { + this.contextRunner.withPropertyValues("spring.datasource.url:jdbc:hsqldb:mem:testsecdb") + .withUserConfiguration(EntityConfiguration.class) + .withConfiguration( + AutoConfigurations.of(HibernateJpaAutoConfiguration.class, DataSourceAutoConfiguration.class)) + .run((context) -> assertThat(context.getBean(JpaTransactionManager.class)).isNotNull()); + // This can fail if security @Conditionals force early instantiation of the + // HibernateJpaAutoConfiguration (e.g. the EntityManagerFactory is not found) + } + + @Test + void testSecurityEvaluationContextExtensionSupport() { + this.contextRunner + .run((context) -> assertThat(context).getBean(SecurityEvaluationContextExtension.class).isNotNull()); + } + + @Configuration(proxyBeanMethods = false) + @TestAutoConfigurationPackage(City.class) + static class EntityConfiguration { + + } + + @Configuration(proxyBeanMethods = false) + static class AuthenticationEventPublisherConfiguration { + + @Bean + AuthenticationEventPublisher authenticationEventPublisher() { + return new TestAuthenticationEventPublisher(); + } + + class TestAuthenticationEventPublisher implements AuthenticationEventPublisher { + + @Override + public void publishAuthenticationSuccess(Authentication authentication) { + + } + + @Override + public void publishAuthenticationFailure(AuthenticationException exception, Authentication authentication) { + + } + + } + + } + +} diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/SecurityPropertiesTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/SecurityPropertiesTests.java index 1096184c5c8..3738ee5b463 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/SecurityPropertiesTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/SecurityPropertiesTests.java @@ -33,7 +33,7 @@ import static org.assertj.core.api.Assertions.assertThat; */ class SecurityPropertiesTests { - private final SecurityProperties security = new SecurityProperties(); + private final SecurityProperties properties = new SecurityProperties(); private Binder binder; @@ -44,21 +44,9 @@ class SecurityPropertiesTests { this.binder = new Binder(this.source); } - @Test - void validateDefaultFilterOrderMatchesMetadata() { - assertThat(this.security.getFilter().getOrder()).isEqualTo(-100); - } - - @Test - void filterOrderShouldBind() { - this.source.put("spring.security.filter.order", "55"); - this.binder.bind("spring.security", Bindable.ofInstance(this.security)); - assertThat(this.security.getFilter().getOrder()).isEqualTo(55); - } - @Test void userWhenNotConfiguredShouldUseDefaultNameAndGeneratedPassword() { - SecurityProperties.User user = this.security.getUser(); + SecurityProperties.User user = this.properties.getUser(); assertThat(user.getName()).isEqualTo("user"); assertThat(user.getPassword()).isNotNull(); assertThat(user.isPasswordGenerated()).isTrue(); @@ -70,8 +58,8 @@ class SecurityPropertiesTests { this.source.put("spring.security.user.name", "foo"); this.source.put("spring.security.user.password", "password"); this.source.put("spring.security.user.roles", "ADMIN,USER"); - this.binder.bind("spring.security", Bindable.ofInstance(this.security)); - SecurityProperties.User user = this.security.getUser(); + this.binder.bind("spring.security", Bindable.ofInstance(this.properties)); + SecurityProperties.User user = this.properties.getUser(); assertThat(user.getName()).isEqualTo("foo"); assertThat(user.getPassword()).isEqualTo("password"); assertThat(user.isPasswordGenerated()).isFalse(); @@ -81,8 +69,8 @@ class SecurityPropertiesTests { @Test void passwordAutogeneratedIfEmpty() { this.source.put("spring.security.user.password", ""); - this.binder.bind("spring.security", Bindable.ofInstance(this.security)); - assertThat(this.security.getUser().isPasswordGenerated()).isTrue(); + this.binder.bind("spring.security", Bindable.ofInstance(this.properties)); + assertThat(this.properties.getUser().isPasswordGenerated()).isTrue(); } } diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/UserDetailsServiceAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/UserDetailsServiceAutoConfigurationTests.java similarity index 97% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/UserDetailsServiceAutoConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/UserDetailsServiceAutoConfigurationTests.java index d4f1db4ac8c..c6ddf625890 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/UserDetailsServiceAutoConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/UserDetailsServiceAutoConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure; import java.util.Collections; import java.util.function.Function; @@ -33,8 +33,6 @@ import org.springframework.boot.autoconfigure.condition.ConditionEvaluationRepor import org.springframework.boot.autoconfigure.condition.ConditionEvaluationReport.ConditionAndOutcomes; import org.springframework.boot.autoconfigure.condition.ConditionOutcome; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.security.autoconfigure.SecurityProperties; -import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration.MissingAlternativeOrUserPropertiesConfigured; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.runner.AbstractApplicationContextRunner; import org.springframework.boot.test.context.runner.ApplicationContextRunner; @@ -243,11 +241,12 @@ class UserDetailsServiceAutoConfigurationTests { .get(UserDetailsServiceAutoConfiguration.class.getName()); assertThat(conditionAndOutcomes).isNotNull(); for (ConditionAndOutcome conditionAndOutcome : conditionAndOutcomes) { - if (conditionAndOutcome.getCondition() instanceof MissingAlternativeOrUserPropertiesConfigured) { + if (conditionAndOutcome + .getCondition() instanceof MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured) { return conditionAndOutcome.getOutcome(); } } - fail("No outcome for MissingAlternativeOrUserPropertiesConfigured found"); + fail("No outcome for MissingAlternativeUserDetailsManagerOrUserPropertiesConfigured found"); throw new AssertionError("Should not be reached"); } diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequestIntegrationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestIntegrationTests.java similarity index 96% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequestIntegrationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestIntegrationTests.java index 54b1dcc555d..4805c78f0c9 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequestIntegrationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestIntegrationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.reactive; +package org.springframework.boot.security.autoconfigure.actuate.web.reactive; import java.time.Duration; import java.util.Base64; @@ -33,8 +33,8 @@ import org.springframework.boot.autoconfigure.AutoConfigurations; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.ReactiveUserDetailsServiceAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext; import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner; import org.springframework.boot.tomcat.reactive.TomcatReactiveWebServerFactory; @@ -110,7 +110,7 @@ class EndpointRequestIntegrationTests { return createContextRunner().withPropertyValues("management.endpoints.web.exposure.include=*") .withUserConfiguration(BaseConfiguration.class, SecurityConfiguration.class) .withConfiguration( - AutoConfigurations.of(JacksonAutoConfiguration.class, ReactiveSecurityAutoConfiguration.class, + AutoConfigurations.of(JacksonAutoConfiguration.class, ReactiveWebSecurityAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class, EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class, ManagementContextAutoConfiguration.class)); diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java similarity index 99% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequestTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java index d761f8d04d5..630913a10ec 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/EndpointRequestTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.reactive; +package org.springframework.boot.security.autoconfigure.actuate.web.reactive; import java.time.Duration; import java.util.ArrayList; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java similarity index 98% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java index 9dfa518a1d9..d3966a91ff8 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.reactive; +package org.springframework.boot.security.autoconfigure.actuate.web.reactive; import java.net.URI; import java.time.Duration; @@ -33,7 +33,7 @@ import org.springframework.boot.autoconfigure.AutoConfigurations; import org.springframework.boot.health.autoconfigure.actuate.endpoint.HealthEndpointAutoConfiguration; import org.springframework.boot.health.autoconfigure.contributor.HealthContributorAutoConfiguration; import org.springframework.boot.health.autoconfigure.registry.HealthContributorRegistryAutoConfiguration; -import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.reactive.ReactiveWebSecurityAutoConfiguration; import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext; import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner; import org.springframework.boot.webflux.autoconfigure.WebFluxAutoConfiguration; @@ -72,7 +72,7 @@ class ReactiveManagementWebSecurityAutoConfigurationTests { HealthContributorRegistryAutoConfiguration.class, HealthEndpointAutoConfiguration.class, InfoEndpointAutoConfiguration.class, WebFluxAutoConfiguration.class, EnvironmentEndpointAutoConfiguration.class, EndpointAutoConfiguration.class, - WebEndpointAutoConfiguration.class, ReactiveSecurityAutoConfiguration.class, + WebEndpointAutoConfiguration.class, ReactiveWebSecurityAutoConfiguration.class, ReactiveManagementWebSecurityAutoConfiguration.class)); @Test diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/AbstractEndpointRequestIntegrationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/AbstractEndpointRequestIntegrationTests.java similarity index 95% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/AbstractEndpointRequestIntegrationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/AbstractEndpointRequestIntegrationTests.java index 682fd15804b..bf804722fb6 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/AbstractEndpointRequestIntegrationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/AbstractEndpointRequestIntegrationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import java.io.IOException; import java.time.Duration; @@ -36,7 +36,8 @@ import org.springframework.boot.actuate.endpoint.annotation.ReadOperation; import org.springframework.boot.actuate.endpoint.annotation.WriteOperation; import org.springframework.boot.autoconfigure.AutoConfigurations; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; import org.springframework.boot.web.server.WebServer; @@ -120,8 +121,8 @@ abstract class AbstractEndpointRequestIntegrationTests { return createContextRunner().withPropertyValues("management.endpoints.web.exposure.include=*") .withUserConfiguration(BaseConfiguration.class, SecurityConfiguration.class) .withConfiguration(AutoConfigurations.of(JacksonAutoConfiguration.class, SecurityAutoConfiguration.class, - EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class, - ManagementContextAutoConfiguration.class)); + ServletWebSecurityAutoConfiguration.class, EndpointAutoConfiguration.class, + WebEndpointAutoConfiguration.class, ManagementContextAutoConfiguration.class)); } diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/EndpointRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequestTests.java similarity index 98% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/EndpointRequestTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequestTests.java index 2be0093dea1..dade805d37f 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/EndpointRequestTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequestTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import java.util.ArrayList; import java.util.Arrays; @@ -33,8 +33,8 @@ import org.springframework.boot.actuate.endpoint.annotation.Endpoint; import org.springframework.boot.actuate.endpoint.web.PathMappedEndpoint; import org.springframework.boot.actuate.endpoint.web.PathMappedEndpoints; import org.springframework.boot.actuate.endpoint.web.WebServerNamespace; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest.AdditionalPathsEndpointRequestMatcher; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest.EndpointRequestMatcher; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest.AdditionalPathsEndpointRequestMatcher; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest.EndpointRequestMatcher; import org.springframework.boot.web.server.WebServer; import org.springframework.boot.web.server.context.WebServerApplicationContext; import org.springframework.http.HttpMethod; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/ManagementWebSecurityAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/ManagementWebSecurityAutoConfigurationTests.java similarity index 95% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/ManagementWebSecurityAutoConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/ManagementWebSecurityAutoConfigurationTests.java index cfda7c10ef4..719f5142c78 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/ManagementWebSecurityAutoConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/ManagementWebSecurityAutoConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import java.io.IOException; import java.util.List; @@ -31,8 +31,9 @@ import org.springframework.boot.autoconfigure.AutoConfigurations; import org.springframework.boot.health.autoconfigure.actuate.endpoint.HealthEndpointAutoConfiguration; import org.springframework.boot.health.autoconfigure.contributor.HealthContributorAutoConfiguration; import org.springframework.boot.health.autoconfigure.registry.HealthContributorRegistryAutoConfiguration; -import org.springframework.boot.security.autoconfigure.SecurityProperties; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterProperties; +import org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; @@ -74,7 +75,8 @@ class ManagementWebSecurityAutoConfigurationTests { HealthContributorRegistryAutoConfiguration.class, HealthEndpointAutoConfiguration.class, InfoEndpointAutoConfiguration.class, EnvironmentEndpointAutoConfiguration.class, EndpointAutoConfiguration.class, WebMvcAutoConfiguration.class, WebEndpointAutoConfiguration.class, - SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class)); + SecurityAutoConfiguration.class, ServletWebSecurityAutoConfiguration.class, + ManagementWebSecurityAutoConfiguration.class)); private static Supplier contextSupplier() { return WebApplicationContextRunner.withMockServletContext(MockWebServerApplicationContext::new); @@ -222,7 +224,7 @@ class ManagementWebSecurityAutoConfigurationTests { static class TestRemoteDevToolsSecurityFilterChainConfig extends TestSecurityFilterChainConfig { @Bean - @Order(SecurityProperties.BASIC_AUTH_ORDER - 1) + @Order(SecurityFilterProperties.BASIC_AUTH_ORDER - 1) SecurityFilterChain testRemoteDevToolsSecurityFilterChain(HttpSecurity http) { http.securityMatcher(PathPatternRequestMatcher.withDefaults().matcher("/**")); http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous()); diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/MvcEndpointRequestIntegrationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/MvcEndpointRequestIntegrationTests.java similarity index 99% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/MvcEndpointRequestIntegrationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/MvcEndpointRequestIntegrationTests.java index a5362469582..0f09f0b53ba 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/MvcEndpointRequestIntegrationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/MvcEndpointRequestIntegrationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import org.junit.jupiter.api.Test; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/SecurityRequestMatchersManagementContextConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/SecurityRequestMatchersManagementContextConfigurationTests.java similarity index 99% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/SecurityRequestMatchersManagementContextConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/SecurityRequestMatchersManagementContextConfigurationTests.java index 3e14183fa27..5b992ae37bf 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/servlet/SecurityRequestMatchersManagementContextConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/SecurityRequestMatchersManagementContextConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.actuate.servlet; +package org.springframework.boot.security.autoconfigure.actuate.web.servlet; import org.junit.jupiter.api.Test; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/jpa/JpaUserDetailsTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/jpa/JpaUserDetailsTests.java index 819ef2d32b4..6bbdee8d2cb 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/jpa/JpaUserDetailsTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/jpa/JpaUserDetailsTests.java @@ -22,7 +22,7 @@ import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoCon import org.springframework.boot.hibernate.autoconfigure.HibernateJpaAutoConfiguration; import org.springframework.boot.jdbc.autoconfigure.DataSourceAutoConfiguration; import org.springframework.boot.jdbc.autoconfigure.EmbeddedDataSourceConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; import org.springframework.boot.test.context.SpringBootContextLoader; import org.springframework.context.annotation.Import; import org.springframework.test.annotation.DirtiesContext; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/PathRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/PathRequestTests.java similarity index 93% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/PathRequestTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/PathRequestTests.java index 419dc5a59c1..9f3a069f096 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/PathRequestTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/PathRequestTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure.web.reactive; import org.junit.jupiter.api.Test; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveSecurityAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/ReactiveSecurityAutoConfigurationTests.java similarity index 91% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveSecurityAutoConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/ReactiveSecurityAutoConfigurationTests.java index d47ea67e3a1..bae8e532f8f 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/ReactiveSecurityAutoConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/ReactiveSecurityAutoConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure.web.reactive; import org.junit.jupiter.api.Test; import reactor.core.publisher.Flux; @@ -36,14 +36,14 @@ import static org.assertj.core.api.Assertions.assertThat; import static org.mockito.Mockito.mock; /** - * Tests for {@link ReactiveSecurityAutoConfiguration}. + * Tests for {@link ReactiveWebSecurityAutoConfiguration}. * * @author Madhura Bhave */ class ReactiveSecurityAutoConfigurationTests { private final ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner() - .withConfiguration(AutoConfigurations.of(ReactiveSecurityAutoConfiguration.class)); + .withConfiguration(AutoConfigurations.of(ReactiveWebSecurityAutoConfiguration.class)); @Test void backsOffWhenWebFilterChainProxyBeanPresent() { @@ -53,8 +53,9 @@ class ReactiveSecurityAutoConfigurationTests { @Test void autoConfiguresDenyAllReactiveAuthenticationManagerWhenNoAlternativeIsAvailable() { - this.contextRunner.run((context) -> assertThat(context).hasSingleBean(ReactiveSecurityAutoConfiguration.class) - .hasBean("denyAllAuthenticationManager")); + this.contextRunner + .run((context) -> assertThat(context).hasSingleBean(ReactiveWebSecurityAutoConfiguration.class) + .hasBean("denyAllAuthenticationManager")); } @Test diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/StaticResourceRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/StaticResourceRequestTests.java similarity index 97% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/StaticResourceRequestTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/StaticResourceRequestTests.java index 079f5e6d81f..012748e8de7 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/reactive/StaticResourceRequestTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/reactive/StaticResourceRequestTests.java @@ -14,14 +14,14 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.reactive; +package org.springframework.boot.security.autoconfigure.web.reactive; import java.time.Duration; import org.assertj.core.api.AssertDelegateTarget; import org.junit.jupiter.api.Test; -import org.springframework.boot.security.autoconfigure.StaticResourceLocation; +import org.springframework.boot.security.autoconfigure.web.StaticResourceLocation; import org.springframework.boot.web.server.autoconfigure.ServerProperties; import org.springframework.context.support.StaticApplicationContext; import org.springframework.http.server.reactive.ServerHttpRequest; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/PathRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequestTests.java similarity index 98% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/PathRequestTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequestTests.java index 8b23924d410..273eddbb0c8 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/PathRequestTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequestTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import jakarta.servlet.http.HttpServletRequest; import org.assertj.core.api.AssertDelegateTarget; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfigurationEarlyInitializationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfigurationEarlyInitializationTests.java similarity index 92% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfigurationEarlyInitializationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfigurationEarlyInitializationTests.java index 362d6800dea..f3e1d0e6970 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfigurationEarlyInitializationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfigurationEarlyInitializationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -33,6 +33,8 @@ import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoCon import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; import org.springframework.boot.resttestclient.TestRestTemplate; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration; import org.springframework.boot.test.system.CapturedOutput; import org.springframework.boot.test.system.OutputCaptureExtension; import org.springframework.boot.test.util.TestPropertyValues; @@ -89,8 +91,9 @@ class SecurityFilterAutoConfigurationEarlyInitializationTests { @Import({ DeserializerBean.class, JacksonModuleBean.class, ExampleController.class, ConverterBean.class }) @ImportAutoConfiguration({ WebMvcAutoConfiguration.class, JacksonAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class, DispatcherServletAutoConfiguration.class, - SecurityAutoConfiguration.class, UserDetailsServiceAutoConfiguration.class, - SecurityFilterAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class }) + SecurityAutoConfiguration.class, ServletWebSecurityAutoConfiguration.class, + UserDetailsServiceAutoConfiguration.class, SecurityFilterAutoConfiguration.class, + PropertyPlaceholderAutoConfiguration.class }) static class Config { @Bean diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfigurationTests.java similarity index 79% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfigurationTests.java index 8779cada15f..8b3473fdedc 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityFilterAutoConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterAutoConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import org.assertj.core.api.Assertions; import org.junit.jupiter.api.Test; @@ -23,10 +23,11 @@ import org.springframework.boot.autoconfigure.ImportAutoConfiguration; import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration; import org.springframework.boot.http.converter.autoconfigure.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; -import org.springframework.boot.security.autoconfigure.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.ConverterBean; -import org.springframework.boot.security.autoconfigure.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.DeserializerBean; -import org.springframework.boot.security.autoconfigure.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.ExampleController; -import org.springframework.boot.security.autoconfigure.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.JacksonModuleBean; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.ConverterBean; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.DeserializerBean; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.ExampleController; +import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterAutoConfigurationEarlyInitializationTests.JacksonModuleBean; import org.springframework.boot.servlet.filter.OrderedRequestContextFilter; import org.springframework.boot.web.context.servlet.AnnotationConfigServletWebApplicationContext; import org.springframework.boot.web.servlet.DelegatingFilterProxyRegistrationBean; @@ -58,7 +59,7 @@ class SecurityFilterAutoConfigurationTests { void filterIsOrderedShortlyAfterRequestContextFilter() { try (AnnotationConfigServletWebApplicationContext context = new AnnotationConfigServletWebApplicationContext()) { context.setServletContext(new MockServletContext()); - context.register(SecurityAutoConfiguration.class); + context.register(ServletWebSecurityAutoConfiguration.class, SecurityAutoConfiguration.class); context.register(Config.class); context.refresh(); int securityFilterOrder = context.getBean(DelegatingFilterProxyRegistrationBean.class).getOrder(); diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterPropertiesTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterPropertiesTests.java new file mode 100644 index 00000000000..e95da95b1a6 --- /dev/null +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/SecurityFilterPropertiesTests.java @@ -0,0 +1,59 @@ +/* + * Copyright 2012-present the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.boot.security.autoconfigure.web.servlet; + +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; + +import org.springframework.boot.context.properties.bind.Bindable; +import org.springframework.boot.context.properties.bind.Binder; +import org.springframework.boot.context.properties.source.MapConfigurationPropertySource; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * Tests for {@link SecurityFilterProperties}. + * + * @author Dave Syer + * @author Madhura Bhave + */ +class SecurityFilterPropertiesTests { + + private final SecurityFilterProperties properties = new SecurityFilterProperties(); + + private Binder binder; + + private final MapConfigurationPropertySource source = new MapConfigurationPropertySource(); + + @BeforeEach + void setUp() { + this.binder = new Binder(this.source); + } + + @Test + void validateDefaultFilterOrderMatchesMetadata() { + assertThat(this.properties.getOrder()).isEqualTo(-100); + } + + @Test + void filterOrderShouldBind() { + this.source.put("spring.security.filter.order", "55"); + this.binder.bind("spring.security.filter", Bindable.ofInstance(this.properties)); + assertThat(this.properties.getOrder()).isEqualTo(55); + } + +} diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityAutoConfigurationTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfigurationTests.java similarity index 77% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityAutoConfigurationTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfigurationTests.java index d206624114a..b4ea3d0d603 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/SecurityAutoConfigurationTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfigurationTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; @@ -29,15 +29,12 @@ import org.jspecify.annotations.Nullable; import org.junit.jupiter.api.Test; import org.springframework.boot.autoconfigure.AutoConfigurations; -import org.springframework.boot.autoconfigure.TestAutoConfigurationPackage; import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration; import org.springframework.boot.context.properties.ConfigurationProperties; import org.springframework.boot.context.properties.ConfigurationPropertiesBinding; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.boot.convert.ApplicationConversionService; -import org.springframework.boot.hibernate.autoconfigure.HibernateJpaAutoConfiguration; -import org.springframework.boot.jdbc.autoconfigure.DataSourceAutoConfiguration; -import org.springframework.boot.security.autoconfigure.jpa.City; +import org.springframework.boot.security.autoconfigure.SecurityAutoConfiguration; import org.springframework.boot.servlet.filter.OrderedFilter; import org.springframework.boot.test.context.FilteredClassLoader; import org.springframework.boot.test.context.runner.WebApplicationContextRunner; @@ -49,15 +46,9 @@ import org.springframework.context.annotation.AnnotationConfigApplicationContext import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.convert.converter.Converter; -import org.springframework.orm.jpa.JpaTransactionManager; -import org.springframework.security.authentication.AuthenticationEventPublisher; -import org.springframework.security.authentication.DefaultAuthenticationEventPublisher; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean; -import org.springframework.security.core.Authentication; -import org.springframework.security.core.AuthenticationException; -import org.springframework.security.data.repository.query.SecurityEvaluationContextExtension; import org.springframework.security.web.FilterChainProxy; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; @@ -65,17 +56,18 @@ import org.springframework.security.web.servlet.util.matcher.PathPatternRequestM import static org.assertj.core.api.Assertions.assertThat; /** - * Tests for {@link SecurityAutoConfiguration}. + * Tests for {@link ServletWebSecurityAutoConfiguration}. * * @author Dave Syer * @author Rob Winch * @author Andy Wilkinson * @author Madhura Bhave */ -class SecurityAutoConfigurationTests { +class ServletWebSecurityAutoConfigurationTests { - private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner().withConfiguration( - AutoConfigurations.of(SecurityAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class)); + private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() + .withConfiguration(AutoConfigurations.of(SecurityAutoConfiguration.class, + ServletWebSecurityAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class)); @Test void testWebConfiguration() { @@ -117,19 +109,6 @@ class SecurityAutoConfigurationTests { } } - @Test - void defaultAuthenticationEventPublisherRegistered() { - this.contextRunner.run((context) -> assertThat(context.getBean(AuthenticationEventPublisher.class)) - .isInstanceOf(DefaultAuthenticationEventPublisher.class)); - } - - @Test - void defaultAuthenticationEventPublisherIsConditionalOnMissingBean() { - this.contextRunner.withUserConfiguration(AuthenticationEventPublisherConfiguration.class) - .run((context) -> assertThat(context.getBean(AuthenticationEventPublisher.class)) - .isInstanceOf(AuthenticationEventPublisherConfiguration.TestAuthenticationEventPublisher.class)); - } - @Test void testDefaultFilterOrder() { this.contextRunner.withConfiguration(AutoConfigurations.of(SecurityFilterAutoConfiguration.class)) @@ -149,23 +128,6 @@ class SecurityAutoConfigurationTests { .isEqualTo(12345)); } - @Test - void testJpaCoexistsHappily() { - this.contextRunner.withPropertyValues("spring.datasource.url:jdbc:hsqldb:mem:testsecdb") - .withUserConfiguration(EntityConfiguration.class) - .withConfiguration( - AutoConfigurations.of(HibernateJpaAutoConfiguration.class, DataSourceAutoConfiguration.class)) - .run((context) -> assertThat(context.getBean(JpaTransactionManager.class)).isNotNull()); - // This can fail if security @Conditionals force early instantiation of the - // HibernateJpaAutoConfiguration (e.g. the EntityManagerFactory is not found) - } - - @Test - void testSecurityEvaluationContextExtensionSupport() { - this.contextRunner - .run((context) -> assertThat(context).getBean(SecurityEvaluationContextExtension.class).isNotNull()); - } - @Test void defaultFilterDispatcherTypes() { this.contextRunner.withConfiguration(AutoConfigurations.of(SecurityFilterAutoConfiguration.class)) @@ -238,36 +200,6 @@ class SecurityAutoConfigurationTests { }); } - @Configuration(proxyBeanMethods = false) - @TestAutoConfigurationPackage(City.class) - static class EntityConfiguration { - - } - - @Configuration(proxyBeanMethods = false) - static class AuthenticationEventPublisherConfiguration { - - @Bean - AuthenticationEventPublisher authenticationEventPublisher() { - return new TestAuthenticationEventPublisher(); - } - - class TestAuthenticationEventPublisher implements AuthenticationEventPublisher { - - @Override - public void publishAuthenticationSuccess(Authentication authentication) { - - } - - @Override - public void publishAuthenticationFailure(AuthenticationException exception, Authentication authentication) { - - } - - } - - } - @Configuration(proxyBeanMethods = false) static class TestSecurityFilterChainConfig { diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/StaticResourceRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/StaticResourceRequestTests.java similarity index 97% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/StaticResourceRequestTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/StaticResourceRequestTests.java index 597d0e5d2d7..384490b75c6 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/StaticResourceRequestTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/StaticResourceRequestTests.java @@ -14,14 +14,14 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import jakarta.servlet.http.HttpServletRequest; import org.assertj.core.api.AssertDelegateTarget; import org.jspecify.annotations.Nullable; import org.junit.jupiter.api.Test; -import org.springframework.boot.security.autoconfigure.StaticResourceLocation; +import org.springframework.boot.security.autoconfigure.web.StaticResourceLocation; import org.springframework.boot.webmvc.autoconfigure.DispatcherServletPath; import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockServletContext; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/TestWebApplicationContext.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/TestWebApplicationContext.java similarity index 95% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/TestWebApplicationContext.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/TestWebApplicationContext.java index 9baded74cf4..43d584905d8 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/servlet/TestWebApplicationContext.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/TestWebApplicationContext.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.autoconfigure.servlet; +package org.springframework.boot.security.autoconfigure.web.servlet; import org.jspecify.annotations.Nullable; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/reactive/ApplicationContextServerWebExchangeMatcherTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/web/reactive/ApplicationContextServerWebExchangeMatcherTests.java similarity index 99% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/reactive/ApplicationContextServerWebExchangeMatcherTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/web/reactive/ApplicationContextServerWebExchangeMatcherTests.java index 0bf556b9245..f860a883fa3 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/reactive/ApplicationContextServerWebExchangeMatcherTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/web/reactive/ApplicationContextServerWebExchangeMatcherTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.reactive; +package org.springframework.boot.security.web.reactive; import java.util.function.Supplier; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcherTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/web/servlet/ApplicationContextRequestMatcherTests.java similarity index 99% rename from module/spring-boot-security/src/test/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcherTests.java rename to module/spring-boot-security/src/test/java/org/springframework/boot/security/web/servlet/ApplicationContextRequestMatcherTests.java index 1d35f11fb32..78cf44d7170 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcherTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/web/servlet/ApplicationContextRequestMatcherTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.security.servlet; +package org.springframework.boot.security.web.servlet; import java.lang.Thread.UncaughtExceptionHandler; import java.util.ArrayList; diff --git a/smoke-test/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java b/smoke-test/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java index 9c80bcdfb34..39bb4cee622 100644 --- a/smoke-test/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java +++ b/smoke-test/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java @@ -20,8 +20,8 @@ import java.util.ArrayList; import java.util.List; import org.springframework.boot.actuate.web.mappings.MappingsEndpoint; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest; -import org.springframework.boot.security.autoconfigure.servlet.PathRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest; +import org.springframework.boot.security.autoconfigure.web.servlet.PathRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; diff --git a/smoke-test/spring-boot-smoke-test-secure-webflux/src/main/resources/application.properties b/smoke-test/spring-boot-smoke-test-secure-webflux/src/main/resources/application.properties index 488b0d55799..4d4c08e35c8 100644 --- a/smoke-test/spring-boot-smoke-test-secure-webflux/src/main/resources/application.properties +++ b/smoke-test/spring-boot-smoke-test-secure-webflux/src/main/resources/application.properties @@ -1,3 +1,5 @@ spring.security.user.name=user spring.security.user.password=password management.endpoints.web.exposure.include=* + +debug=true \ No newline at end of file diff --git a/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/ManagementPortSampleSecureWebFluxTests.java b/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/ManagementPortSampleSecureWebFluxTests.java index 509dfed46d0..33fc102bc1d 100644 --- a/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/ManagementPortSampleSecureWebFluxTests.java +++ b/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/ManagementPortSampleSecureWebFluxTests.java @@ -22,8 +22,8 @@ import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.actuate.web.mappings.MappingsEndpoint; -import org.springframework.boot.security.autoconfigure.actuate.reactive.EndpointRequest; -import org.springframework.boot.security.autoconfigure.reactive.PathRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.reactive.EndpointRequest; +import org.springframework.boot.security.autoconfigure.web.reactive.PathRequest; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.test.context.SpringBootTest.WebEnvironment; import org.springframework.boot.test.web.server.LocalManagementPort; diff --git a/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/SampleSecureWebFluxCustomSecurityTests.java b/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/SampleSecureWebFluxCustomSecurityTests.java index 3de1cbe9e51..981d254a680 100644 --- a/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/SampleSecureWebFluxCustomSecurityTests.java +++ b/smoke-test/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/SampleSecureWebFluxCustomSecurityTests.java @@ -22,8 +22,8 @@ import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.actuate.web.mappings.MappingsEndpoint; -import org.springframework.boot.security.autoconfigure.actuate.reactive.EndpointRequest; -import org.springframework.boot.security.autoconfigure.reactive.PathRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.reactive.EndpointRequest; +import org.springframework.boot.security.autoconfigure.web.reactive.PathRequest; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.webtestclient.AutoConfigureWebTestClient; import org.springframework.context.annotation.Bean; diff --git a/smoke-test/spring-boot-smoke-test-session-data-redis/src/main/java/smoketest/session/redis/SecurityConfiguration.java b/smoke-test/spring-boot-smoke-test-session-data-redis/src/main/java/smoketest/session/redis/SecurityConfiguration.java index 19f3c8dde24..86899cdecb0 100644 --- a/smoke-test/spring-boot-smoke-test-session-data-redis/src/main/java/smoketest/session/redis/SecurityConfiguration.java +++ b/smoke-test/spring-boot-smoke-test-session-data-redis/src/main/java/smoketest/session/redis/SecurityConfiguration.java @@ -17,7 +17,7 @@ package smoketest.session.redis; import org.springframework.boot.health.actuate.endpoint.HealthEndpoint; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; diff --git a/smoke-test/spring-boot-smoke-test-session-jdbc/src/main/java/smoketest/session/SecurityConfiguration.java b/smoke-test/spring-boot-smoke-test-session-jdbc/src/main/java/smoketest/session/SecurityConfiguration.java index 659bcf94382..a863e431553 100644 --- a/smoke-test/spring-boot-smoke-test-session-jdbc/src/main/java/smoketest/session/SecurityConfiguration.java +++ b/smoke-test/spring-boot-smoke-test-session-jdbc/src/main/java/smoketest/session/SecurityConfiguration.java @@ -17,7 +17,7 @@ package smoketest.session; import org.springframework.boot.health.actuate.endpoint.HealthEndpoint; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; diff --git a/smoke-test/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java b/smoke-test/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java index 170f565d0cd..e6208d424cb 100644 --- a/smoke-test/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java +++ b/smoke-test/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java @@ -20,7 +20,7 @@ import jakarta.servlet.DispatcherType; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.builder.SpringApplicationBuilder; -import org.springframework.boot.security.autoconfigure.actuate.servlet.EndpointRequest; +import org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.Ordered;