Skip to content

Commit b739110

Browse files
philwebbwilkinsona
philwebb
authored and
wilkinsona
committed
Move management web security concerns to spring-security module
1 parent d91c815 commit b739110

File tree

52 files changed

+131
-126
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+131
-126
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure-all/build.gradle

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
plugins {
22
id "java-library"
3-
id "org.springframework.boot.auto-configuration"
43
id "org.springframework.boot.deployed"
54
id "org.springframework.boot.optional-dependencies"
65
}
@@ -41,7 +40,7 @@ dependencies {
4140
testImplementation(project(":spring-boot-project:spring-boot-tools:spring-boot-test-support"))
4241
testImplementation(project(":spring-boot-project:spring-boot-webflux"))
4342
testImplementation("org.springframework.security:spring-security-test")
44-
43+
4544
testRuntimeOnly("ch.qos.logback:logback-classic")
4645
}
4746

‎spring-boot-project/spring-boot-actuator-autoconfigure-all/src/main/resources/META-INF/spring/org.springframework.boot.actuate.autoconfigure.web.ManagementContextConfiguration.imports

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎spring-boot-project/spring-boot-actuator-autoconfigure-all/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎spring-boot-project/spring-boot-actuator-autoconfigure-all/src/test/java/org/springframework/boot/actuate/autoconfigure/integrationtest/JerseyEndpointIntegrationTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,11 @@
2828
import org.springframework.boot.actuate.autoconfigure.beans.BeansEndpointAutoConfiguration;
2929
import org.springframework.boot.actuate.autoconfigure.endpoint.EndpointAutoConfiguration;
3030
import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration;
31-
import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
3231
import org.springframework.boot.actuate.autoconfigure.web.server.ManagementContextAutoConfiguration;
3332
import org.springframework.boot.autoconfigure.AutoConfigurations;
3433
import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration;
3534
import org.springframework.boot.jersey.autoconfigure.JerseyAutoConfiguration;
35+
import org.springframework.boot.security.actuate.autoconfigure.servlet.ManagementWebSecurityAutoConfiguration;
3636
import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration;
3737
import org.springframework.boot.test.context.FilteredClassLoader;
3838
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;

‎spring-boot-project/spring-boot-actuator-autoconfigure-all/src/test/resources/org/springframework/boot/actuate/autoconfigure/security/servlet/saml-certificate

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎spring-boot-project/spring-boot-docs/build.gradle

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ plugins.withType(EclipsePlugin) {
6161
dependencies {
6262
autoConfiguration(project(path: ":spring-boot-project:spring-boot-activemq", configuration: "autoConfigurationMetadata"))
6363
autoConfiguration(project(path: ":spring-boot-project:spring-boot-actuator-autoconfigure", configuration: "autoConfigurationMetadata"))
64-
autoConfiguration(project(path: ":spring-boot-project:spring-boot-actuator-autoconfigure-all", configuration: "autoConfigurationMetadata"))
6564
autoConfiguration(project(path: ":spring-boot-project:spring-boot-amqp", configuration: "autoConfigurationMetadata"))
6665
autoConfiguration(project(path: ":spring-boot-project:spring-boot-artemis", configuration: "autoConfigurationMetadata"))
6766
autoConfiguration(project(path: ":spring-boot-project:spring-boot-autoconfigure", configuration: "autoConfigurationMetadata"))
@@ -232,7 +231,6 @@ dependencies {
232231

233232
implementation(project(path: ":spring-boot-project:spring-boot-actuator"))
234233
implementation(project(path: ":spring-boot-project:spring-boot-actuator-autoconfigure"))
235-
implementation(project(path: ":spring-boot-project:spring-boot-actuator-autoconfigure-all"))
236234
implementation(project(path: ":spring-boot-project:spring-boot-amqp"))
237235
implementation(project(path: ":spring-boot-project:spring-boot-cache"))
238236
implementation(project(path: ":spring-boot-project:spring-boot-data-cassandra"))

‎spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
package org.springframework.boot.docs.actuator.endpoints.security.exposeall;
1818

19-
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
19+
import org.springframework.boot.security.actuate.autoconfigure.servlet.EndpointRequest;
2020
import org.springframework.context.annotation.Bean;
2121
import org.springframework.context.annotation.Configuration;
2222
import org.springframework.security.config.annotation.web.builders.HttpSecurity;

‎spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
package org.springframework.boot.docs.actuator.endpoints.security.typical;
1818

19-
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
19+
import org.springframework.boot.security.actuate.autoconfigure.servlet.EndpointRequest;
2020
import org.springframework.context.annotation.Bean;
2121
import org.springframework.context.annotation.Configuration;
2222
import org.springframework.security.config.annotation.web.builders.HttpSecurity;

‎spring-boot-project/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/exposeall/MySecurityConfiguration.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
package org.springframework.boot.docs.actuator.endpoints.security.exposeall
1818

19-
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest
19+
import org.springframework.boot.security.actuate.autoconfigure.servlet.EndpointRequest
2020
import org.springframework.context.annotation.Bean
2121
import org.springframework.context.annotation.Configuration
2222
import org.springframework.security.config.annotation.web.builders.HttpSecurity

‎spring-boot-project/spring-boot-docs/src/main/kotlin/org/springframework/boot/docs/actuator/endpoints/security/typical/MySecurityConfiguration.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
package org.springframework.boot.docs.actuator.endpoints.security.typical
1818

19-
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest
19+
import org.springframework.boot.security.actuate.autoconfigure.servlet.EndpointRequest
2020
import org.springframework.context.annotation.Bean
2121
import org.springframework.context.annotation.Configuration
2222
import org.springframework.security.config.Customizer.withDefaults

‎spring-boot-project/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfiguration.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
2424
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
2525
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
26+
import org.springframework.boot.security.actuate.autoconfigure.reactive.ReactiveManagementWebSecurityAutoConfiguration;
2627
import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration;
2728
import org.springframework.context.annotation.Bean;
2829
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
@@ -42,7 +43,8 @@
4243
* @author Andy Wilkinson
4344
* @since 4.0.0
4445
*/
45-
@AutoConfiguration(before = ReactiveSecurityAutoConfiguration.class,
46+
@AutoConfiguration(
47+
before = { ReactiveManagementWebSecurityAutoConfiguration.class, ReactiveSecurityAutoConfiguration.class },
4648
after = ReactiveOAuth2ClientAutoConfiguration.class)
4749
@ConditionalOnClass({ Flux.class, EnableWebFluxSecurity.class, ServerOAuth2AuthorizedClientRepository.class })
4850
@ConditionalOnBean(ReactiveOAuth2AuthorizedClientService.class)

‎spring-boot-project/spring-boot-security-oauth2-client/src/main/java/org/springframework/boot/security/oauth2/client/autoconfigure/servlet/OAuth2ClientWebSecurityAutoConfiguration.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
2222
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
2323
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
24+
import org.springframework.boot.security.actuate.autoconfigure.servlet.ManagementWebSecurityAutoConfiguration;
2425
import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity;
2526
import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration;
2627
import org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration;
@@ -43,7 +44,8 @@
4344
* @author Andy Wilkinson
4445
* @since 3.5.0
4546
*/
46-
@AutoConfiguration(before = SecurityAutoConfiguration.class, after = OAuth2ClientAutoConfiguration.class)
47+
@AutoConfiguration(before = { ManagementWebSecurityAutoConfiguration.class, SecurityAutoConfiguration.class },
48+
after = OAuth2ClientAutoConfiguration.class)
4749
@ConditionalOnClass({ EnableWebSecurity.class, OAuth2AuthorizedClientRepository.class })
4850
@ConditionalOnBean(OAuth2AuthorizedClientService.class)
4951
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)

‎spring-boot-project/spring-boot-security-oauth2-resource-server/build.gradle

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,11 @@ dependencies {
1919
optional(project(":spring-boot-project:spring-boot-reactor"))
2020
optional("jakarta.servlet:jakarta.servlet-api")
2121

22+
testImplementation(project(":spring-boot-project:spring-boot-actuator-autoconfigure"))
2223
testImplementation(project(":spring-boot-project:spring-boot-test"))
2324
testImplementation(project(":spring-boot-project:spring-boot-tools:spring-boot-test-support"))
2425
testImplementation(project(":spring-boot-project:spring-boot-webmvc"))
26+
testImplementation(project(":spring-boot-project:spring-boot-webflux"))
2527
testImplementation("com.fasterxml.jackson.core:jackson-databind")
2628
testImplementation("com.squareup.okhttp3:mockwebserver")
2729

‎spring-boot-project/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfiguration.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
2222
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
2323
import org.springframework.boot.context.properties.EnableConfigurationProperties;
24+
import org.springframework.boot.security.actuate.autoconfigure.reactive.ReactiveManagementWebSecurityAutoConfiguration;
2425
import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration;
2526
import org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration;
2627
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
@@ -34,8 +35,8 @@
3435
* @author Madhura Bhave
3536
* @since 4.0.0
3637
*/
37-
@AutoConfiguration(
38-
before = { ReactiveSecurityAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class })
38+
@AutoConfiguration(before = { ReactiveManagementWebSecurityAutoConfiguration.class,
39+
ReactiveSecurityAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class })
3940
@EnableConfigurationProperties(OAuth2ResourceServerProperties.class)
4041
@ConditionalOnClass({ EnableWebFluxSecurity.class })
4142
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.REACTIVE)

‎spring-boot-project/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfiguration.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
2222
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
2323
import org.springframework.boot.context.properties.EnableConfigurationProperties;
24+
import org.springframework.boot.security.actuate.autoconfigure.servlet.ManagementWebSecurityAutoConfiguration;
2425
import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration;
2526
import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration;
2627
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
@@ -33,7 +34,8 @@
3334
* @author Madhura Bhave
3435
* @since 4.0.0
3536
*/
36-
@AutoConfiguration(before = { SecurityAutoConfiguration.class, UserDetailsServiceAutoConfiguration.class })
37+
@AutoConfiguration(before = { ManagementWebSecurityAutoConfiguration.class, SecurityAutoConfiguration.class,
38+
UserDetailsServiceAutoConfiguration.class })
3739
@EnableConfigurationProperties(OAuth2ResourceServerProperties.class)
3840
@ConditionalOnClass(BearerTokenAuthenticationToken.class)
3941
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)

‎spring-boot-project/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,14 @@
4949
import reactor.core.publisher.Mono;
5050

5151
import org.springframework.boot.autoconfigure.AutoConfigurations;
52+
import org.springframework.boot.security.actuate.autoconfigure.reactive.ReactiveManagementWebSecurityAutoConfiguration;
53+
import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration;
5254
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.JwtConverterCustomizationsArgumentsProvider;
5355
import org.springframework.boot.test.context.FilteredClassLoader;
5456
import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
5557
import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
5658
import org.springframework.boot.testsupport.classpath.resources.WithResource;
59+
import org.springframework.boot.webflux.autoconfigure.WebFluxAutoConfiguration;
5760
import org.springframework.context.annotation.Bean;
5861
import org.springframework.context.annotation.Configuration;
5962
import org.springframework.core.annotation.Order;
@@ -705,6 +708,19 @@ void jwtAuthenticationConverterByJwtConfigIsConditionalOnMissingBean() {
705708
});
706709
}
707710

711+
@Test
712+
void causesReactiveManagementWebSecurityAutoConfigurationToBackOff() {
713+
ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner()
714+
.withConfiguration(AutoConfigurations.of(ReactiveManagementWebSecurityAutoConfiguration.class,
715+
ReactiveOAuth2ResourceServerAutoConfiguration.class, ReactiveSecurityAutoConfiguration.class,
716+
WebFluxAutoConfiguration.class));
717+
contextRunner
718+
.run((context) -> assertThat(context).hasSingleBean(ReactiveManagementWebSecurityAutoConfiguration.class));
719+
contextRunner.withPropertyValues("spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://authserver")
720+
.run((context) -> assertThat(context)
721+
.doesNotHaveBean(ReactiveManagementWebSecurityAutoConfiguration.class));
722+
}
723+
708724
private void assertFilterConfiguredWithJwtAuthenticationManager(AssertableReactiveWebApplicationContext context) {
709725
MatcherSecurityWebFilterChain filterChain = (MatcherSecurityWebFilterChain) context
710726
.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN);

‎spring-boot-project/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@
4747
import org.mockito.InOrder;
4848

4949
import org.springframework.boot.autoconfigure.AutoConfigurations;
50+
import org.springframework.boot.security.actuate.autoconfigure.servlet.ManagementWebSecurityAutoConfiguration;
51+
import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration;
5052
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.JwtConverterCustomizationsArgumentsProvider;
5153
import org.springframework.boot.test.context.FilteredClassLoader;
5254
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
@@ -98,6 +100,8 @@
98100
*/
99101
class OAuth2ResourceServerAutoConfigurationTests {
100102

103+
private static final String MANAGEMENT_SECURITY_FILTER_CHAIN_BEAN = "managementSecurityFilterChain";
104+
101105
private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner()
102106
.withConfiguration(AutoConfigurations.of(OAuth2ResourceServerAutoConfiguration.class))
103107
.withUserConfiguration(TestConfig.class);
@@ -718,6 +722,18 @@ void jwtAuthenticationConverterByJwtConfigIsConditionalOnMissingBean() {
718722
});
719723
}
720724

725+
@Test
726+
void causesManagementWebSecurityAutoConfigurationToBackOff() {
727+
WebApplicationContextRunner contextRunner = new WebApplicationContextRunner()
728+
.withConfiguration(AutoConfigurations.of(ManagementWebSecurityAutoConfiguration.class,
729+
OAuth2ResourceServerAutoConfiguration.class, SecurityAutoConfiguration.class,
730+
WebMvcAutoConfiguration.class));
731+
contextRunner.run((context) -> assertThat(context).hasSingleBean(ManagementWebSecurityAutoConfiguration.class));
732+
contextRunner.withPropertyValues("spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://authserver")
733+
.run((context) -> assertThat(context).doesNotHaveBean(ManagementWebSecurityAutoConfiguration.class)
734+
.doesNotHaveBean(MANAGEMENT_SECURITY_FILTER_CHAIN_BEAN));
735+
}
736+
721737
private Filter getBearerTokenFilter(AssertableWebApplicationContext context) {
722738
FilterChainProxy filterChain = (FilterChainProxy) context.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN);
723739
List<SecurityFilterChain> filterChains = filterChain.getFilterChains();

‎spring-boot-project/spring-boot-security-saml2/build.gradle

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ dependencies {
2424

2525
optional(project(":spring-boot-project:spring-boot-autoconfigure"))
2626

27+
testImplementation(project(":spring-boot-project:spring-boot-actuator-autoconfigure"))
2728
testImplementation(project(":spring-boot-project:spring-boot-test"))
2829
testImplementation(project(":spring-boot-project:spring-boot-tools:spring-boot-test-support"))
2930
testImplementation(project(":spring-boot-project:spring-boot-webmvc"))

‎spring-boot-project/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfiguration.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
2222
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
2323
import org.springframework.boot.context.properties.EnableConfigurationProperties;
24+
import org.springframework.boot.security.actuate.autoconfigure.servlet.ManagementWebSecurityAutoConfiguration;
2425
import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration;
2526
import org.springframework.context.annotation.Import;
2627
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
@@ -32,7 +33,7 @@
3233
* @author Madhura Bhave
3334
* @since 4.0.0
3435
*/
35-
@AutoConfiguration(before = SecurityAutoConfiguration.class)
36+
@AutoConfiguration(before = { SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class })
3637
@ConditionalOnClass(RelyingPartyRegistrationRepository.class)
3738
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)
3839
@Import({ Saml2RelyingPartyRegistrationConfiguration.class, Saml2LoginConfiguration.class })

0 commit comments

Comments
 (0)