23 Commits
Author SHA1 Message Date
Andy Wilkinson f7bb983335 Merge branch '4.1.x'
Closes gh-51588
2026-09-04 16:20:05 +01:00
Andy Wilkinson 154a77cae9 Make reactive resource server back off with custom security
Previously, the auto-configuration of reactive OAuth 2 resource
server based web security did not back off when a custom
SecurityWebFilterChain was defined. This did not match the
equivalent servlet-based auto-configuration which backs off when
a custom SecurityFilterChain is defined.

This commit updates the reactive auto-configuration to behave in
the same way as the servlet auto-configuration. A new annotation,
@ConditionalOnDefaultReactiveWebSecurity, is introduced. The
existing servlet-specific annotation,
@ConditionalOnDefaultWebSecurity is deprecated and a replacement
named @ConditionalOnDefaultServletWebSecurity is introduced.

Fixes gh-50778
2026-09-04 16:08:58 +01:00
Venkata Naga Sai Srikanth Gollapudi 87c4755a86 Harmonize use of Collections and Maps in configuration properties
See gh-50367

Signed-off-by: Venkata Naga Sai Srikanth Gollapudi <42247688+gollapudisrikanth@users.noreply.github.com>
2026-07-15 11:37:31 +02:00
Andy Wilkinson 6a74bb85a3 Merge branch '4.0.x'
Closes gh-50440
2026-05-14 15:03:44 +01:00
Andy Wilkinson add52b6ccd Merge branch '3.5.x' into 4.0.x
Closes gh-50439
2026-05-14 15:02:24 +01:00
Stéphane Nicoll f71464b3c6 Merge branch '3.5.x' into 4.0.x
Closes gh-50227
2026-04-27 10:57:41 +02:00
Andy Wilkinson 8e5ae84796 Adapt to nullability changes in spring-security-oauth2-jose
See gh-49446
2026-03-13 17:20:11 +00:00
Andy Wilkinson fd58b76f51 Merge branch '4.0.x'
Closes gh-49379
2026-03-03 09:04:06 +00:00
Andy Wilkinson 42466e4776 Allow Customizer<HttpSecurity> beans to refine auth server config
Fixes gh-49367
2026-03-03 09:01:17 +00:00
Phillip Webb 86567aab1f Enable auto-configuration of OAuth2 machinery in a non-webapp
Refactor `spring-boot-security-oauth2-authorization-server` to separate
core authorization server auto-configuration from Spring Security web
auto-configuration.

This update should allow authorization server auto-configuration
outside or a reactive or servlet web application.

Closes gh-43978
2026-02-26 21:48:08 -08:00
Stéphane Nicoll d1e5fe3248 Merge branch '3.5.x'
Closes gh-48106
2025-11-13 10:31:25 +01:00
Phillip Webb c2e68c0911 Refactor security auto-configuration package structure
Refactor security auto-configuration package structure and classes to
create distinct web configurations.

Closes gh-14412
2025-10-16 14:10:08 -07:00
Phillip Webb 8f89bd304f Polish code to fix warnings 2025-10-14 21:51:25 -07:00
Phillip Webb 4587c82330 Start building against Spring Security 7.0.0-RC1 snapshots
See gh-47499
2025-10-13 15:13:00 -07:00
Moritz Halbritter 42744bdae9 Add nullability annotations to tests in module/spring-boot-security-oauth2-authorization-server
See gh-47263
2025-10-13 15:15:50 +02:00
Stéphane Nicoll 07c18ea9f1 Migrate dependency management for Spring Authorization Server
With Spring Authorization Server migrating to Spring Security proper as
of v7, this commit removes dependency management for it and adapt to
changes in recent snapshots

Closes gh-47174
2025-09-14 06:43:54 +02:00
Phillip WebbandMoritz Halbritter 239f384ac0 Update PropertyMapper to better support nullability
Refactor `PropertyMapper` so that it no longer calls adapter or
predicate methods by default when the source value is `null`. This
effectively makes all default calls the same as using
`alwaysWhenNotNull` in the previous generation of the code.

For the limited times when you do need to deal with `null` values, the
new `always()` method can be used.

For example,

	map.from(source::method).to(destination::method);

Will not call `destination.method(...)` if `source.method()` returns
`null`.

Where as:

	map.from(source::method).always().to(destination::method);

Will call  `destination.method(null)` if `source.method()` returns
`null`.

This update provides clearer semantics for the API and allows for better
JSpecify nullability annotations. It has also simplified much of our
existing property mapper code.

Closes gh-47024

Co-authored-by: Moritz Halbritter <moritz.halbritter@broadcom.com>
2025-09-05 14:43:33 -07:00
Andy Wilkinson 7666a02247 Make default management security back off with Authorization server
Fixes gh-46841
2025-08-19 12:07:11 +01:00
Moritz Halbritter e53f90bafe Add nullability annotations to module/spring-boot-security-oauth2-authorization-server
See gh-46587
2025-08-06 10:13:38 +02:00
Andy Wilkinson 7d1f974308 Merge branch '3.5.x'
Closes gh-46648
2025-08-01 09:59:38 +01:00
Moritz Halbritter c0f1f641ce Make auto-configurations final and remove public members
Closes gh-32883
2025-07-29 09:48:49 +02:00
Andy Wilkinson 4db83bd83e Revert "Disable tests broken by removal of ObjectPostProcessor"
This reverts commit 4b2861fa14.
2025-07-18 09:45:44 +01:00
Phillip Webb decc32dde3 Restructure project directories to better fit Gradle
Closes gh-46358
2025-07-10 17:54:08 -07:00