Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Replace WebSecurityConfigurerAdapter with SecurityFilterChain in docs 

Closes gh-10003
This commit is contained in:
Eleftheria Stein 2022-02-08 16:12:10 +01:00
parent 84616543a3
commit 4142f06259
22 changed files with 622 additions and 444 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/modules/ROOT/pages/servlet/authentication/logout.adoc
View File

@ -6,7 +6,7 @@ This section covers how to customize the handling of logouts.
[[logout-java-configuration]]
== Logout Java/Kotlin Configuration
When using the `{security-api-url}org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.html[WebSecurityConfigurerAdapter]`, logout capabilities are automatically applied.
When using the `{security-api-url}org/springframework/security/config/annotation/web/builders/HttpSecurity.html[HttpSecurity]` bean, logout capabilities are automatically applied.
The default is that accessing the URL `/logout` logs the user out by:
- Invalidating the HTTP Session
@ -21,7 +21,7 @@ Similar to configuring login capabilities, however, you also have various option
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) throws Exception {
public SecurityFilterChain filterChain(HttpSecurity http) {
http
.logout(logout -> logout // <1>
.logoutUrl("/my/logout") // <2>
@ -38,7 +38,7 @@ protected void configure(HttpSecurity http) throws Exception {
.Kotlin
[source,kotlin,role="secondary"]
-----
override fun configure(http: HttpSecurity) {
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
logout {
logoutUrl = "/my/logout" // <1>
@ -49,12 +49,12 @@ override fun configure(http: HttpSecurity) {
deleteCookies(cookieNamesToClear) // <6>
}
}
// ...
}
-----
====
<1> Provides logout support.
This is automatically applied when using `WebSecurityConfigurerAdapter`.
<2> The URL that triggers log out to occur (the default is `/logout`).
If CSRF protection is enabled (the default), the request must also be a POST.
For more information, see {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutUrl-java.lang.String-[`logoutUrl(java.lang.String logoutUrl)`].

8
docs/modules/ROOT/pages/servlet/authentication/passwords/basic.adoc
View File

@ -64,10 +64,12 @@ The following example shows a minimal, explicit configuration:
[source,java,role="primary"]
.Java
----
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
http
// ...
.httpBasic(withDefaults());
return http.build();
}
----
@ -83,11 +85,13 @@ protected void configure(HttpSecurity http) {
[source,kotlin,role="secondary"]
.Kotlin
----
fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
httpBasic { }
}
return http.build()
}
----
====

6
docs/modules/ROOT/pages/servlet/authentication/passwords/digest.adoc
View File

@ -1,4 +1,4 @@
[[servlet-authentication-digest]]
**[[**servlet-authentication-digest]]
= Digest Authentication
This section provides details on how Spring Security provides support for https://tools.ietf.org/html/rfc2617[Digest Authentication], which is provided `DigestAuthenticationFilter`.
@ -58,11 +58,13 @@ DigestAuthenticationFilter digestAuthenticationFilter() {
result.setAuthenticationEntryPoint(entryPoint());
}
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.exceptionHandling(e -> e.authenticationEntryPoint(authenticationEntryPoint()))
.addFilterBefore(digestFilter());
return http.build();
}
----

16
docs/modules/ROOT/pages/servlet/authentication/passwords/form.adoc
View File

@ -71,10 +71,10 @@ The following example shows a minimal, explicit Java configuration:
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) {
public SecurityFilterChain filterChain(HttpSecurity http) {
http
// ...
.formLogin(withDefaults());
// ...
}
----
@ -90,11 +90,11 @@ protected void configure(HttpSecurity http) {
.Kotlin
[source,kotlin,role="secondary"]
----
fun configure(http: HttpSecurity) {
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
formLogin { }
}
// ...
}
----
====
@ -110,13 +110,13 @@ The following configuration demonstrates how to provide a custom login form.
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) throws Exception {
public SecurityFilterChain filterChain(HttpSecurity http) {
http
// ...
.formLogin(form -> form
.loginPage("/login")
.permitAll()
);
// ...
}
----
@ -133,14 +133,14 @@ protected void configure(HttpSecurity http) throws Exception {
.Kotlin
[source,kotlin,role="secondary"]
----
fun configure(http: HttpSecurity) {
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
formLogin {
loginPage = "/login"
permitAll()
}
}
// ...
}
----
====

20
docs/modules/ROOT/pages/servlet/authentication/session-management.adoc
View File

@ -11,12 +11,13 @@ To do so, configure the `session-management` element:
.Java
[source,java,role="primary"]
----
@Override
protected void configure(HttpSecurity http) throws Exception{
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
http
.sessionManagement(session -> session
.invalidSessionUrl("/invalidSession.htm")
);
return http.build();
}
----
@ -38,12 +39,13 @@ You may be able to explicitly delete the `JSESSIONID` cookie on logging out -- f
.Java
[source,java,role="primary"]
----
@Override
protected void configure(HttpSecurity http) throws Exception{
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
http
.logout(logout -> logout
.deleteCookies("JSESSIONID")
);
return http.build();
}
----
@ -107,12 +109,13 @@ Then add the following lines to your application context:
.Java
[source,java,role="primary"]
----
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
http
.sessionManagement(session -> session
.maximumSessions(1)
);
return http.build();
}
----
@ -135,13 +138,14 @@ Often, you would prefer to prevent a second login. In that case, you can use:
.Java
[source,java,role="primary"]
----
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
http
.sessionManagement(session -> session
.maximumSessions(1)
.maxSessionsPreventsLogin(true)
);
return http.build();
}
----

16
docs/modules/ROOT/pages/servlet/authorization/authorize-requests.adoc
View File

@ -37,12 +37,14 @@ The following listing shows the explicit configuration:
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.authorizeRequests(authorize -> authorize
.anyRequest().authenticated()
);
return http.build();
}
----
@ -58,13 +60,15 @@ protected void configure(HttpSecurity http) throws Exception {
.Kotlin
[source,kotlin,role="secondary"]
----
fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
authorizeRequests {
authorize(anyRequest, authenticated)
}
}
return http.build()
}
----
====
@ -76,7 +80,8 @@ We can configure Spring Security to have different rules by adding more rules in
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.authorizeRequests(authorize -> authorize // <1>
@ -85,6 +90,7 @@ protected void configure(HttpSecurity http) throws Exception {
.mvcMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')") // <4>
.anyRequest().denyAll() // <5>
);
return http.build();
}
----
@ -107,7 +113,8 @@ protected void configure(HttpSecurity http) throws Exception {
.Kotlin
[source,kotlin,role="secondary"]
----
fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests { // <1>
authorize("/resources/**", permitAll) // <2>
@ -119,6 +126,7 @@ fun configure(http: HttpSecurity) {
authorize(anyRequest, denyAll) // <5>
}
}
return http.build()
}
----
<1> There are multiple authorization rules specified.

75
docs/modules/ROOT/pages/servlet/configuration/java.adoc
View File

@ -144,19 +144,21 @@ public class MvcWebApplicationInitializer extends
Thus far, our <<jc-hello-wsca,`WebSecurityConfig`>> contains only information about how to authenticate our users.
How does Spring Security know that we want to require all users to be authenticated?
How does Spring Security know we want to support form-based authentication?
Actually, there is a configuration class (called `WebSecurityConfigurerAdapter`) that is being invoked behind the scenes.
It has a method called `configure` with the following default implementation:
Actually, there is a configuration class (called `SecurityFilterChain`) that is being invoked behind the scenes.
It is configured with the following default implementation:
====
[source,java]
----
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeRequests(authorize -> authorize
.anyRequest().authenticated()
)
.formLogin(withDefaults())
.httpBasic(withDefaults());
return http.build();
}
----
====
@ -183,7 +185,7 @@ Note that this configuration is parallels the XML Namespace configuration:
== Multiple HttpSecurity Instances
We can configure multiple `HttpSecurity` instances just as we can have multiple `<http>` blocks in XML.
The key is to extend the `WebSecurityConfigurerAdapter` multiple times.
The key is to register multiple `SecurityFilterChain` `@Bean`s.
The following example has a different configuration for URL's that start with `/api/`.
====
@ -201,39 +203,35 @@ public class MultiHttpSecurityConfig {
return manager;
}
@Configuration
@Bean
@Order(1) <2>
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**") <3>
.authorizeHttpRequests(authorize -> authorize
.anyRequest().hasRole("ADMIN")
)
.httpBasic(withDefaults());
}
public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**") <3>
.authorizeHttpRequests(authorize -> authorize
.anyRequest().hasRole("ADMIN")
)
.httpBasic(withDefaults());
return http.build();
}
@Configuration <4>
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.formLogin(withDefaults());
}
@Bean <4>
public SecurityFilterChain formLoginFilterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.formLogin(withDefaults());
return http.build();
}
}
----
<1> Configure Authentication as usual.
<2> Create an instance of `WebSecurityConfigurerAdapter` that contains `@Order` to specify which `WebSecurityConfigurerAdapter` should be considered first.
<2> Create an instance of `SecurityFilterChain` that contains `@Order` to specify which `SecurityFilterChain` should be considered first.
<3> The `http.antMatcher` states that this `HttpSecurity` is applicable only to URLs that start with `/api/`.
<4> Create another instance of `WebSecurityConfigurerAdapter`.
<4> Create another instance of `SecurityFilterChain`.
If the URL does not start with `/api/`, this configuration is used.
This configuration is considered after `ApiWebSecurityConfigurationAdapter`, since it has an `@Order` value after `1` (no `@Order` defaults to last).
This configuration is considered after `apiFilterChain`, since it has an `@Order` value after `1` (no `@Order` defaults to last).
====
[[jc-custom-dsls]]
@ -287,14 +285,15 @@ You can then use the custom DSL:
[source,java]
----
@EnableWebSecurity
public class Config extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
public class Config {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.apply(customDsl())
.flag(true)
.and()
...;
return http.build();
}
}
----
@ -306,7 +305,7 @@ The code is invoked in the following order:
* Code in the `MyCustomDsl.init` method is invoked
* Code in the `MyCustomDsl.configure` method is invoked
If you want, you can have `WebSecurityConfigurerAdapter` add `MyCustomDsl` by default by using `SpringFactories`.
If you want, you can have `HttpSecurity` add `MyCustomDsl` by default by using `SpringFactories`.
For example, you can create a resource on the classpath named `META-INF/spring.factories` with the following contents:
.META-INF/spring.factories
@ -323,12 +322,13 @@ You can also explicit disable the default:
[source,java]
----
@EnableWebSecurity
public class Config extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
public class Config {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.apply(customDsl()).disable()
...;
return http.build();
}
}
----
@ -348,8 +348,8 @@ For example, to configure the `filterSecurityPublishAuthorizationSuccess` proper
====
[source,java]
----
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeRequests(authorize -> authorize
.anyRequest().authenticated()
@ -361,6 +361,7 @@ protected void configure(HttpSecurity http) throws Exception {
}
})
);
return http.build();
}
----
====

48
docs/modules/ROOT/pages/servlet/configuration/kotlin.adoc
View File

@ -14,13 +14,14 @@ Spring Security provides https://github.com/spring-projects/spring-security-samp
How does Spring Security know that we want to require all users to be authenticated?
How does Spring Security know we want to support form-based authentication?
There is a configuration class (called `WebSecurityConfigurerAdapter`) that is being invoked behind the scenes.
It has a method called `configure` with the following default implementation:
There is a configuration class (called `SecurityFilterChain`) that is being invoked behind the scenes.
It is configured with the following default implementation:
====
[source,kotlin]
----
fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -28,6 +29,7 @@ fun configure(http: HttpSecurity) {
formLogin { }
httpBasic { }
}
return http.build()
}
----
====
@ -54,7 +56,7 @@ Note that this configuration is parallels the XML namespace configuration:
== Multiple HttpSecurity Instances
We can configure multiple HttpSecurity instances, just as we can have multiple `<http>` blocks.
The key is to extend the `WebSecurityConfigurerAdapter` multiple times.
The key is to register multiple `SecurityFilterChain` `@Bean`s.
The following example has a different configuration for URL's that start with `/api/`:
====
@ -71,38 +73,36 @@ class MultiHttpSecurityConfig {
return manager
}
@Configuration
@Order(1) <2>
class ApiWebSecurityConfigurationAdapter: WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
http {
securityMatcher("/api/**") <3>
authorizeRequests {
authorize(anyRequest, hasRole("ADMIN"))
}
httpBasic { }
@Bean
open fun apiFilterChain(http: HttpSecurity): SecurityFilterChain {
http {
securityMatcher("/api/**") <3>
authorizeRequests {
authorize(anyRequest, hasRole("ADMIN"))
}
httpBasic { }
}
return http.build()
}
@Configuration <4>
class FormLoginWebSecurityConfigurerAdapter: WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
formLogin { }
@Bean <4>
open fun formLoginFilterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
formLogin { }
}
return http.build()
}
}
----
<1> Configure Authentication as usual.
<2> Create an instance of `WebSecurityConfigurerAdapter` that contains `@Order` to specify which `WebSecurityConfigurerAdapter` should be considered first.
<2> Create an instance of `SecurityFilterChain` that contains `@Order` to specify which `SecurityFilterChain` should be considered first.
<3> The `http.antMatcher` states that this `HttpSecurity` is applicable only to URLs that start with `/api/`
<4> Create another instance of `WebSecurityConfigurerAdapter`.
<4> Create another instance of `SecurityFilterChain`.
If the URL does not start with `/api/`, this configuration is used.
This configuration is considered after `ApiWebSecurityConfigurationAdapter`, since it has an `@Order` value after `1` (no `@Order` defaults to last).
This configuration is considered after `apiFilterChain`, since it has an `@Order` value after `1` (no `@Order` defaults to last).
====

42
docs/modules/ROOT/pages/servlet/exploits/csrf.adoc
View File

@ -65,15 +65,15 @@ You can configure `CookieCsrfTokenRepository` in Java or Kotlin configuration by
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf(csrf -> csrf
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
);
return http.build();
}
}
----
@ -82,14 +82,16 @@ public class WebSecurityConfig extends
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
csrf {
csrfTokenRepository = CookieCsrfTokenRepository.withHttpOnlyFalse()
}
}
return http.build()
}
}
----
@ -129,13 +131,13 @@ The following Java or Kotlin configuration disables CSRF protection:
----
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf(csrf -> csrf.disable());
return http.build();
}
}
----
@ -145,14 +147,16 @@ public class WebSecurityConfig extends
----
@Configuration
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
csrf {
disable()
}
}
return http.build()
}
}
----
@ -329,15 +333,15 @@ For example, the following Java Configuration logs out when the `/logout` URL is
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.logout(logout -> logout
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
);
return http.build();
}
}
----
@ -346,14 +350,16 @@ public class WebSecurityConfig extends
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
logout {
logoutRequestMatcher = AntPathRequestMatcher("/logout")
}
}
return http.build()
}
}
----

252
docs/modules/ROOT/pages/servlet/exploits/headers.adoc
View File

@ -21,11 +21,10 @@ You can do so with the following configuration:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -33,6 +32,7 @@ public class WebSecurityConfig extends
.sameOrigin()
)
);
return http.build();
}
}
----
@ -53,8 +53,9 @@ public class WebSecurityConfig extends
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class SecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
@ -63,6 +64,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -79,11 +81,10 @@ If you use Spring Security's configuration, the following adds only xref:feature
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -91,6 +92,7 @@ WebSecurityConfigurerAdapter {
.defaultsDisabled()
.cacheControl(withDefaults())
);
return http.build();
}
}
----
@ -111,8 +113,9 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class SecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
@ -122,6 +125,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -135,14 +139,14 @@ If necessary, you can disable all of the HTTP Security response headers with the
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers.disable());
return http.build();
}
}
----
@ -161,14 +165,16 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class SecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
disable()
}
}
return http.build()
}
}
----
@ -194,16 +200,16 @@ If necessary, you can also disable Spring Security's cache control HTTP response
----
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
.cacheControl(cache -> cache.disable())
);
return http.build();
}
}
----
@ -224,9 +230,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
headers {
cacheControl {
@ -234,6 +241,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -252,16 +260,16 @@ However, you can disable it:
----
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
.contentTypeOptions(contentTypeOptions -> contentTypeOptions.disable())
);
return http.build();
}
}
----
@ -282,9 +290,10 @@ public class WebSecurityConfig extends
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
headers {
contentTypeOptions {
@ -292,6 +301,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -310,11 +320,10 @@ The following example explicitly provides HSTS:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -324,6 +333,7 @@ WebSecurityConfigurerAdapter {
.maxAgeInSeconds(31536000)
)
);
return http.build();
}
}
----
@ -347,9 +357,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
headers {
httpStrictTransportSecurity {
@ -359,6 +370,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -376,11 +388,10 @@ You can enable HPKP headers with the following configuration:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -390,6 +401,7 @@ WebSecurityConfigurerAdapter {
.addSha256Pins("d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=", "E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g=")
)
);
return http.build();
}
}
----
@ -416,9 +428,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
headers {
httpPublicKeyPinning {
@ -429,6 +442,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -447,11 +461,10 @@ For example, the following configuration specifies that Spring Security should n
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -459,6 +472,7 @@ WebSecurityConfigurerAdapter {
.sameOrigin()
)
);
return http.build();
}
}
----
@ -481,9 +495,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
headers {
frameOptions {
@ -491,6 +506,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -509,11 +525,10 @@ For example, the following configuration specifies that Spring Security should n
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -521,6 +536,7 @@ WebSecurityConfigurerAdapter {
.block(false)
)
);
return http.build();
}
}
----
@ -541,9 +557,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
// ...
http {
headers {
@ -552,6 +569,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -581,11 +599,10 @@ Given the preceding security policy, you can enable the CSP header:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -593,6 +610,7 @@ WebSecurityConfigurerAdapter {
.policyDirectives("script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/")
)
);
return http.build();
}
}
----
@ -614,9 +632,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
@ -625,6 +644,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -638,11 +658,10 @@ To enable the CSP `report-only` header, provide the following configuration:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -651,6 +670,7 @@ public class WebSecurityConfig extends
.reportOnly()
)
);
return http.build();
}
}
----
@ -673,9 +693,10 @@ public class WebSecurityConfig extends
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
@ -685,6 +706,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -702,11 +724,10 @@ You can enable the Referrer Policy header by using the configuration:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -714,6 +735,7 @@ WebSecurityConfigurerAdapter {
.policy(ReferrerPolicy.SAME_ORIGIN)
)
);
return http.build();
}
}
----
@ -734,9 +756,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
@ -745,6 +768,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -772,16 +796,16 @@ You can enable the preceding feature policy header by using the following config
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
.featurePolicy("geolocation 'self'")
);
return http.build();
}
}
----
@ -802,15 +826,17 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
featurePolicy("geolocation 'self'")
}
}
return http.build()
}
}
----
@ -838,11 +864,10 @@ You can enable the preceding permissions policy header using the following confi
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -850,6 +875,7 @@ WebSecurityConfigurerAdapter {
.policy("geolocation=(self)")
)
);
return http.build();
}
}
----
@ -870,9 +896,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
@ -881,6 +908,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -907,16 +935,16 @@ You can send the preceding header on log out with the following configuration:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.logout((logout) -> logout
.addLogoutHandler(new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(CACHE, COOKIES)))
);
return http.build();
}
}
----
@ -925,15 +953,17 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
logout {
addLogoutHandler(HeaderWriterLogoutHandler(ClearSiteDataHeaderWriter(CACHE, COOKIES)))
}
}
return http.build()
}
}
----
@ -962,16 +992,16 @@ Given the preceding header, you could add the headers to the response by using t
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
.addHeaderWriter(new StaticHeadersWriter("X-Custom-Security-Header","header-value"))
);
return http.build();
}
}
----
@ -992,15 +1022,17 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
addHeaderWriter(StaticHeadersWriter("X-Custom-Security-Header","header-value"))
}
}
return http.build()
}
}
----
@ -1019,16 +1051,16 @@ If you wanted to explicitly configure <<servlet-headers-frame-options>>, you cou
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
.addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN))
);
return http.build();
}
}
----
@ -1055,15 +1087,17 @@ See https://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsi
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
addHeaderWriter(XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN))
}
}
return http.build()
}
}
----
@ -1084,11 +1118,10 @@ The following configuration example uses `DelegatingRequestMatcherHeaderWriter`:
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
RequestMatcher matcher = new AntPathRequestMatcher("/login");
DelegatingRequestMatcherHeaderWriter headerWriter =
new DelegatingRequestMatcherHeaderWriter(matcher,new XFrameOptionsHeaderWriter());
@ -1098,6 +1131,7 @@ WebSecurityConfigurerAdapter {
.frameOptions(frameOptions -> frameOptions.disable())
.addHeaderWriter(headerWriter)
);
return http.build();
}
}
----
@ -1131,9 +1165,10 @@ WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
val matcher: RequestMatcher = AntPathRequestMatcher("/login")
val headerWriter = DelegatingRequestMatcherHeaderWriter(matcher, XFrameOptionsHeaderWriter())
http {
@ -1144,6 +1179,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
addHeaderWriter(headerWriter)
}
}
return http.build()
}
}
----

14
docs/modules/ROOT/pages/servlet/exploits/http.adoc
View File

@ -19,16 +19,16 @@ For example, the following Java or Kotlin configuration redirects any HTTP reque
----
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.requiresChannel(channel -> channel
.anyRequest().requiresSecure()
);
return http.build();
}
}
----
@ -38,15 +38,17 @@ public class WebSecurityConfig extends
----
@Configuration
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
requiresChannel {
secure(AnyRequestMatcher.INSTANCE, "REQUIRES_SECURE_CHANNEL")
}
}
return http.build()
}
}
----

26
docs/modules/ROOT/pages/servlet/integrations/cors.adoc
View File

@ -13,14 +13,15 @@ Users can integrate the `CorsFilter` with Spring Security by providing a `CorsCo
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// by default uses a Bean by the name of corsConfigurationSource
.cors(withDefaults())
...
return http.build();
}
@Bean
@ -39,13 +40,15 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
open class WebSecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
open class WebSecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// by default uses a Bean by the name of corsConfigurationSource
cors { }
// ...
}
return http.build()
}
@Bean
@ -83,15 +86,16 @@ If you use Spring MVC's CORS support, you can omit specifying the `CorsConfigura
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// if Spring MVC is on classpath and no CorsConfigurationSource is provided,
// Spring Security will use CORS configuration provided to Spring MVC
.cors(withDefaults())
...
return http.build();
}
}
----
@ -100,14 +104,16 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
open class WebSecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
open class WebSecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// if Spring MVC is on classpath and no CorsConfigurationSource is provided,
// Spring Security will use CORS configuration provided to Spring MVC
cors { }
// ...
}
return http.build()
}
}
----

16
docs/modules/ROOT/pages/servlet/integrations/mvc.adoc
View File

@ -148,23 +148,27 @@ To restrict access to this controller method to admin users, you can provide aut
.Java
[source,java,role="primary"]
----
protected configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.antMatchers("/admin").hasRole("ADMIN")
);
return http.build();
}
----
.Kotlin
[source,kotlin,role="secondary"]
----
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(AntPathRequestMatcher("/admin"), hasRole("ADMIN"))
}
}
return http.build()
}
----
====
@ -194,23 +198,27 @@ The following configuration protects the same URLs that Spring MVC matches on by
.Java
[source,java,role="primary"]
----
protected configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.mvcMatchers("/admin").hasRole("ADMIN")
);
// ...
}
----
.Kotlin
[source,kotlin,role="secondary"]
----
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize("/admin", hasRole("ADMIN"))
}
}
// ...
}
----
====

26
docs/modules/ROOT/pages/servlet/integrations/websocket.adoc
View File

@ -379,11 +379,10 @@ Similarly, you can customize frame options to use the same origin within Java Co
[source,java,role="primary"]
----
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// ...
.headers(headers -> headers
@ -391,6 +390,7 @@ public class WebSecurityConfig extends
.sameOrigin()
)
);
return http.build();
}
}
----
@ -399,8 +399,9 @@ public class WebSecurityConfig extends
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
open class WebSecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
open class WebSecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
headers {
@ -409,6 +410,7 @@ open class WebSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -437,11 +439,10 @@ For example, if our stomp endpoint is `/chat`, we can disable CSRF protection on
----
@Configuration
@EnableWebSecurity
public class WebSecurityConfig
extends WebSecurityConfigurerAdapter {
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf(csrf -> csrf
// ignore our stomp endpoints since they are protected using Stomp headers
@ -466,8 +467,9 @@ public class WebSecurityConfig
----
@Configuration
@EnableWebSecurity
open class WebSecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
open class WebSecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
csrf {
ignoringAntMatchers("/chat/**")

39
docs/modules/ROOT/pages/servlet/oauth2/client/authorization-grants.adoc
View File

@ -130,13 +130,13 @@ The following example shows how to configure the `DefaultOAuth2AuthorizationRequ
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Autowired
private ClientRegistrationRepository clientRegistrationRepository;
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
@ -148,6 +148,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
)
)
);
return http.build();
}
private OAuth2AuthorizationRequestResolver authorizationRequestResolver(
@ -173,12 +174,13 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class SecurityConfig : WebSecurityConfigurerAdapter() {
class SecurityConfig {
@Autowired
private lateinit var customClientRegistrationRepository: ClientRegistrationRepository
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -189,6 +191,7 @@ class SecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
private fun authorizationRequestResolver(
@ -283,10 +286,10 @@ If you have a custom implementation of `AuthorizationRequestRepository`, you can
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2ClientSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Client(oauth2 -> oauth2
.authorizationCodeGrant(codeGrant -> codeGrant
@ -294,6 +297,7 @@ public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
}
----
@ -302,9 +306,10 @@ public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2ClientSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2ClientSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Client {
authorizationCodeGrant {
@ -312,6 +317,7 @@ class OAuth2ClientSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -403,10 +409,10 @@ Whether you customize `DefaultAuthorizationCodeTokenResponseClient` or provide y
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2ClientSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Client(oauth2 -> oauth2
.authorizationCodeGrant(codeGrant -> codeGrant
@ -414,6 +420,7 @@ public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
}
----
@ -422,9 +429,10 @@ public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2ClientSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2ClientSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Client {
authorizationCodeGrant {
@ -432,6 +440,7 @@ class OAuth2ClientSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----

13
docs/modules/ROOT/pages/servlet/oauth2/client/index.adoc
View File

@ -30,10 +30,10 @@ The following code shows the complete configuration options provided by the `Htt
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2ClientSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Client(oauth2 -> oauth2
.clientRegistrationRepository(this.clientRegistrationRepository())
@ -45,6 +45,7 @@ public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
.accessTokenResponseClient(this.accessTokenResponseClient())
)
);
return http.build();
}
}
----
@ -53,9 +54,10 @@ public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2ClientSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2ClientSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Client {
clientRegistrationRepository = clientRegistrationRepository()
@ -68,6 +70,7 @@ class OAuth2ClientSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----

130
docs/modules/ROOT/pages/servlet/oauth2/login/advanced.adoc
View File

@ -14,10 +14,10 @@ The following code shows an example:
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.authorizationEndpoint(authorization -> authorization
@ -33,6 +33,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
}
----
@ -41,9 +42,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
authorizationEndpoint {
@ -60,6 +62,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -92,10 +95,10 @@ The following code shows the complete configuration options available for the `o
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.clientRegistrationRepository(this.clientRegistrationRepository())
@ -119,6 +122,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
.oidcUserService(this.oidcUserService())
)
);
return http.build();
}
}
----
@ -127,9 +131,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
clientRegistrationRepository = clientRegistrationRepository()
@ -154,6 +159,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -230,10 +236,10 @@ The following listing shows an example:
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.loginPage("/login/oauth2")
@ -243,6 +249,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
}
----
@ -251,9 +258,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
loginPage = "/login/oauth2"
@ -262,6 +270,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -318,10 +327,10 @@ If you would like to customize the Authorization Response `baseUri`, configure i
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.redirectionEndpoint(redirection -> redirection
@ -329,6 +338,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
}
----
@ -337,9 +347,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
redirectionEndpoint {
@ -347,6 +358,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -427,10 +439,10 @@ Provide an implementation of `GrantedAuthoritiesMapper` and configure it, as fol
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.userInfoEndpoint(userInfo -> userInfo
@ -438,6 +450,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
private GrantedAuthoritiesMapper userAuthoritiesMapper() {
@ -475,9 +488,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
userInfoEndpoint {
@ -485,6 +499,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
private fun userAuthoritiesMapper(): GrantedAuthoritiesMapper = GrantedAuthoritiesMapper { authorities: Collection<GrantedAuthority> ->
@ -527,12 +542,13 @@ Alternatively, you can register a `GrantedAuthoritiesMapper` `@Bean` to have it
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(withDefaults());
return http.build();
}
@Bean
@ -546,12 +562,14 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login { }
}
return http.build()
}
@Bean
@ -577,10 +595,10 @@ The following example shows how to implement and configure a delegation-based st
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.userInfoEndpoint(userInfo -> userInfo
@ -588,6 +606,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService() {
@ -617,9 +636,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
userInfoEndpoint {
@ -627,6 +647,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
@Bean
@ -700,10 +721,10 @@ Whether you customize `DefaultOAuth2UserService` or provide your own implementat
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.userInfoEndpoint(userInfo -> userInfo
@ -711,6 +732,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
@ -723,9 +745,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
userInfoEndpoint {
@ -734,6 +757,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
private fun oauth2UserService(): OAuth2UserService<OAuth2UserRequest, OAuth2User> {
@ -760,10 +784,10 @@ Whether you customize `OidcUserService` or provide your own implementation of `O
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.oauth2Login(oauth2 -> oauth2
.userInfoEndpoint(userInfo -> userInfo
@ -771,6 +795,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
...
)
);
return http.build();
}
private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService() {
@ -783,9 +808,10 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
oauth2Login {
userInfoEndpoint {
@ -794,6 +820,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
private fun oidcUserService(): OAuth2UserService<OidcUserRequest, OidcUser> {
@ -887,13 +914,13 @@ Also, you can configure `OidcClientInitiatedLogoutSuccessHandler`, which impleme
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Autowired
private ClientRegistrationRepository clientRegistrationRepository;
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
@ -902,6 +929,7 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
.logout(logout -> logout
.logoutSuccessHandler(oidcLogoutSuccessHandler())
);
return http.build();
}
private LogoutSuccessHandler oidcLogoutSuccessHandler() {
@ -921,11 +949,12 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
@Autowired
private lateinit var clientRegistrationRepository: ClientRegistrationRepository
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -935,6 +964,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
logoutSuccessHandler = oidcLogoutSuccessHandler()
}
}
return http.build()
}
private fun oidcLogoutSuccessHandler(): LogoutSuccessHandler {

98
docs/modules/ROOT/pages/servlet/oauth2/login/core.adoc
View File

@ -243,15 +243,14 @@ The Spring Boot 2.x auto-configuration class for OAuth Client support is `OAuth2
It performs the following tasks:
* Registers a `ClientRegistrationRepository` `@Bean` composed of `ClientRegistration`(s) from the configured OAuth Client properties.
* Provides a `WebSecurityConfigurerAdapter` `@Configuration` and enables OAuth 2.0 Login through `httpSecurity.oauth2Login()`.
* Registers a `SecurityFilterChain` `@Bean` and enables OAuth 2.0 Login through `httpSecurity.oauth2Login()`.
If you need to override the auto-configuration based on your specific requirements, you may do so in the following ways:
* <<oauth2login-register-clientregistrationrepository-bean>>
* <<oauth2login-provide-websecurityconfigureradapter>>
* <<oauth2login-provide-securityfilterchain-bean>>
* <<oauth2login-completely-override-autoconfiguration>>
[[oauth2login-register-clientregistrationrepository-bean]]
=== Register a ClientRegistrationRepository @Bean
@ -319,10 +318,10 @@ class OAuth2LoginConfig {
====
[[oauth2login-provide-websecurityconfigureradapter]]
=== Provide a WebSecurityConfigurerAdapter
[[oauth2login-provide-securityfilterchain-bean]]
=== Register a SecurityFilterChain @Bean
The following example shows how to provide a `WebSecurityConfigurerAdapter` with `@EnableWebSecurity` and enable OAuth 2.0 login through `httpSecurity.oauth2Login()`:
The following example shows how to register a `SecurityFilterChain` `@Bean` with `@EnableWebSecurity` and enable OAuth 2.0 login through `httpSecurity.oauth2Login()`:
.OAuth2 Login Configuration
====
@ -330,15 +329,16 @@ The following example shows how to provide a `WebSecurityConfigurerAdapter` with
[source,java,role="primary"]
----
@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
public class OAuth2LoginSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2Login(withDefaults());
return http.build();
}
}
----
@ -347,15 +347,16 @@ public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
class OAuth2LoginSecurityConfig {
override fun configure(http: HttpSecurity) {
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
oauth2Login { }
}
return http.build()
}
}
----
@ -365,7 +366,7 @@ class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
[[oauth2login-completely-override-autoconfiguration]]
=== Completely Override the Auto-configuration
The following example shows how to completely override the auto-configuration by registering a `ClientRegistrationRepository` `@Bean` and providing a `WebSecurityConfigurerAdapter`.
The following example shows how to completely override the auto-configuration by registering a `ClientRegistrationRepository` `@Bean` and a `SecurityFilterChain` `@Bean`.
.Overriding the auto-configuration
====
@ -375,17 +376,14 @@ The following example shows how to completely override the auto-configuration by
@Configuration
public class OAuth2LoginConfig {
@EnableWebSecurity
public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2Login(withDefaults());
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2Login(withDefaults());
return http.build();
}
@Bean
@ -418,17 +416,15 @@ public class OAuth2LoginConfig {
@Configuration
class OAuth2LoginConfig {
@EnableWebSecurity
class OAuth2LoginSecurityConfig: WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
oauth2Login { }
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
oauth2Login { }
}
return http.build()
}
@Bean
@ -467,20 +463,17 @@ If you are not able to use Spring Boot 2.x and would like to configure one of th
.Java
[source,java,role="primary"]
----
@Configuration
@EnableWebSecurity
public class OAuth2LoginConfig {
@EnableWebSecurity
public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2Login(withDefaults());
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2Login(withDefaults());
return http.build();
}
@Bean
@ -512,18 +505,17 @@ public class OAuth2LoginConfig {
.Kotlin
[source,kotlin,role="secondary"]
----
@Configuration
@EnableWebSecurity
open class OAuth2LoginConfig {
@EnableWebSecurity
open class OAuth2LoginSecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
oauth2Login { }
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
oauth2Login { }
}
return http.build()
}
@Bean

72
docs/modules/ROOT/pages/servlet/oauth2/resource-server/jwt.adoc
View File

@ -137,26 +137,29 @@ This property can also be supplied directly on the <<oauth2resourceserver-jwt-jw
There are two ``@Bean``s that Spring Boot generates on Resource Server's behalf.
The first is a `WebSecurityConfigurerAdapter` that configures the app as a resource server. When including `spring-security-oauth2-jose`, this `WebSecurityConfigurerAdapter` looks like:
The first is a `SecurityFilterChain` that configures the app as a resource server. When including `spring-security-oauth2-jose`, this `SecurityFilterChain` looks like:
.Default JWT Configuration
====
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
return http.build();
}
----
.Kotlin
[source,kotlin,role="secondary"]
----
fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -165,11 +168,12 @@ fun configure(http: HttpSecurity) {
jwt { }
}
}
return http.build()
}
----
====
If the application doesn't expose a `WebSecurityConfigurerAdapter` bean, then Spring Boot will expose the above default one.
If the application doesn't expose a `SecurityFilterChain` bean, then Spring Boot will expose the above default one.
Replacing this is as simple as exposing the bean within the application:
@ -179,8 +183,9 @@ Replacing this is as simple as exposing the bean within the application:
[source,java,role="primary"]
----
@EnableWebSecurity
public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class MyCustomSecurityConfiguration {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.mvcMatchers("/messages/**").hasAuthority("SCOPE_message:read")
@ -191,6 +196,7 @@ public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter
.jwtAuthenticationConverter(myConverter())
)
);
return http.build();
}
}
----
@ -199,8 +205,9 @@ public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class MyCustomSecurityConfiguration {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize("/messages/**", hasAuthority("SCOPE_message:read"))
@ -212,6 +219,7 @@ class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -296,8 +304,9 @@ An authorization server's JWK Set Uri can be configured <<oauth2resourceserver-j
[source,java,role="primary"]
----
@EnableWebSecurity
public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class DirectlyConfiguredJwkSetUri {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
@ -307,6 +316,7 @@ public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
.jwkSetUri("https://idp.example.com/.well-known/jwks.json")
)
);
return http.build();
}
}
----
@ -315,8 +325,9 @@ public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class DirectlyConfiguredJwkSetUri : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class DirectlyConfiguredJwkSetUri {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -327,6 +338,7 @@ class DirectlyConfiguredJwkSetUri : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -356,8 +368,9 @@ More powerful than `jwkSetUri()` is `decoder()`, which will completely replace a
[source,java,role="primary"]
----
@EnableWebSecurity
public class DirectlyConfiguredJwtDecoder extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class DirectlyConfiguredJwtDecoder {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
@ -367,6 +380,7 @@ public class DirectlyConfiguredJwtDecoder extends WebSecurityConfigurerAdapter {
.decoder(myCustomDecoder())
)
);
return http.build();
}
}
----
@ -375,8 +389,9 @@ public class DirectlyConfiguredJwtDecoder extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class DirectlyConfiguredJwtDecoder : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class DirectlyConfiguredJwtDecoder {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -387,6 +402,7 @@ class DirectlyConfiguredJwtDecoder : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -716,8 +732,9 @@ This means that to protect an endpoint or method with a scope derived from a JWT
[source,java,role="primary"]
----
@EnableWebSecurity
public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class DirectlyConfiguredJwkSetUri {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.mvcMatchers("/contacts/**").hasAuthority("SCOPE_contacts")
@ -725,6 +742,7 @@ public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
.anyRequest().authenticated()
)
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
return http.build();
}
}
----
@ -733,8 +751,9 @@ public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class DirectlyConfiguredJwkSetUri : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class DirectlyConfiguredJwkSetUri {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize("/contacts/**", hasAuthority("SCOPE_contacts"))
@ -745,6 +764,7 @@ class DirectlyConfiguredJwkSetUri : WebSecurityConfigurerAdapter() {
jwt { }
}
}
return http.build()
}
}
----
@ -923,8 +943,9 @@ static class CustomAuthenticationConverter implements Converter<Jwt, AbstractAut
// ...
@EnableWebSecurity
public class CustomAuthenticationConverterConfig extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class CustomAuthenticationConverterConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
@ -934,6 +955,7 @@ public class CustomAuthenticationConverterConfig extends WebSecurityConfigurerAd
.jwtAuthenticationConverter(new CustomAuthenticationConverter())
)
);
return http.build();
}
}
----
@ -950,8 +972,9 @@ internal class CustomAuthenticationConverter : Converter<Jwt, AbstractAuthentica
// ...
@EnableWebSecurity
class CustomAuthenticationConverterConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class CustomAuthenticationConverterConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -962,6 +985,7 @@ class CustomAuthenticationConverterConfig : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----

62
docs/modules/ROOT/pages/servlet/oauth2/resource-server/opaque-token.adoc
View File

@ -178,27 +178,30 @@ fun forFoosEyesOnly(): String {
There are two ``@Bean``s that Spring Boot generates on Resource Server's behalf.
The first is a `WebSecurityConfigurerAdapter` that configures the app as a resource server.
When use Opaque Token, this `WebSecurityConfigurerAdapter` looks like:
The first is a `SecurityFilterChain` that configures the app as a resource server.
When use Opaque Token, this `SecurityFilterChain` looks like:
.Default Opaque Token Configuration
====
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::opaqueToken);
return http.build();
}
----
.Kotlin
[source,kotlin,role="secondary"]
----
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -207,11 +210,12 @@ override fun configure(http: HttpSecurity) {
opaqueToken { }
}
}
return http.build()
}
----
====
If the application doesn't expose a `WebSecurityConfigurerAdapter` bean, then Spring Boot will expose the above default one.
If the application doesn't expose a `SecurityFilterChain` bean, then Spring Boot will expose the above default one.
Replacing this is as simple as exposing the bean within the application:
@ -221,8 +225,9 @@ Replacing this is as simple as exposing the bean within the application:
[source,java,role="primary"]
----
@EnableWebSecurity
public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class MyCustomSecurityConfiguration {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.mvcMatchers("/messages/**").hasAuthority("SCOPE_message:read")
@ -233,6 +238,7 @@ public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter
.introspector(myIntrospector())
)
);
return http.build();
}
}
----
@ -241,8 +247,9 @@ public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class MyCustomSecurityConfiguration {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize("/messages/**", hasAuthority("SCOPE_message:read"))
@ -254,6 +261,7 @@ class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -335,8 +343,9 @@ An authorization server's Introspection Uri can be configured <<oauth2resourcese
[source,java,role="primary"]
----
@EnableWebSecurity
public class DirectlyConfiguredIntrospectionUri extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class DirectlyConfiguredIntrospectionUri {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
@ -347,6 +356,7 @@ public class DirectlyConfiguredIntrospectionUri extends WebSecurityConfigurerAda
.introspectionClientCredentials("client", "secret")
)
);
return http.build();
}
}
----
@ -355,8 +365,9 @@ public class DirectlyConfiguredIntrospectionUri extends WebSecurityConfigurerAda
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class DirectlyConfiguredIntrospectionUri : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class DirectlyConfiguredIntrospectionUri {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -368,6 +379,7 @@ class DirectlyConfiguredIntrospectionUri : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -397,8 +409,9 @@ More powerful than `introspectionUri()` is `introspector()`, which will complete
[source,java,role="primary"]
----
@EnableWebSecurity
public class DirectlyConfiguredIntrospector extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class DirectlyConfiguredIntrospector {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
@ -408,6 +421,7 @@ public class DirectlyConfiguredIntrospector extends WebSecurityConfigurerAdapter
.introspector(myCustomIntrospector())
)
);
return http.build();
}
}
----
@ -416,8 +430,9 @@ public class DirectlyConfiguredIntrospector extends WebSecurityConfigurerAdapter
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class DirectlyConfiguredIntrospector : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class DirectlyConfiguredIntrospector {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
@ -428,6 +443,7 @@ class DirectlyConfiguredIntrospector : WebSecurityConfigurerAdapter() {
}
}
}
return http.build()
}
}
----
@ -476,8 +492,9 @@ This means that to protect an endpoint or method with a scope derived from an Op
[source,java,role="primary"]
----
@EnableWebSecurity
public class MappedAuthorities extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class MappedAuthorities {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorizeRequests -> authorizeRequests
.mvcMatchers("/contacts/**").hasAuthority("SCOPE_contacts")
@ -485,6 +502,7 @@ public class MappedAuthorities extends WebSecurityConfigurerAdapter {
.anyRequest().authenticated()
)
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::opaqueToken);
return http.build();
}
}
----
@ -493,8 +511,9 @@ public class MappedAuthorities extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class MappedAuthorities : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class MappedAuthorities {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize("/contacts/**", hasAuthority("SCOPE_contacts"))
@ -505,6 +524,7 @@ class MappedAuthorities : WebSecurityConfigurerAdapter() {
opaqueToken { }
}
}
return http.build()
}
}
----

39
docs/modules/ROOT/pages/servlet/saml2/login/authentication.adoc
View File

@ -23,10 +23,10 @@ For that reason, you can configure `OpenSaml4AuthenticationProvider` 's default
[source,java,role="primary"]
----
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
public class SecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
OpenSaml4AuthenticationProvider authenticationProvider = new OpenSaml4AuthenticationProvider();
authenticationProvider.setAssertionValidator(OpenSaml4AuthenticationProvider
.createDefaultAssertionValidator(assertionToken -> {
@ -44,6 +44,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
.saml2Login(saml2 -> saml2
.authenticationManager(new ProviderManager(authenticationProvider))
);
return http.build();
}
}
----
@ -52,8 +53,9 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
open class SecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
open class SecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
val authenticationProvider = OpenSaml4AuthenticationProvider()
authenticationProvider.setAssertionValidator(
OpenSaml4AuthenticationProvider
@ -72,6 +74,7 @@ open class SecurityConfig : WebSecurityConfigurerAdapter() {
authenticationManager = ProviderManager(authenticationProvider)
}
}
return http.build()
}
}
----
@ -88,12 +91,12 @@ In that case, the response authentication converter can come in handy, as can be
[source,java,role="primary"]
----
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
public class SecurityConfig {
@Autowired
UserDetailsService userDetailsService;
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
OpenSaml4AuthenticationProvider authenticationProvider = new OpenSaml4AuthenticationProvider();
authenticationProvider.setResponseAuthenticationConverter(responseToken -> {
Saml2Authentication authentication = OpenSaml4AuthenticationProvider
@ -112,6 +115,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
.saml2Login(saml2 -> saml2
.authenticationManager(new ProviderManager(authenticationProvider))
);
return http.build();
}
}
----
@ -120,11 +124,12 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
open class SecurityConfig : WebSecurityConfigurerAdapter() {
open class SecurityConfig {
@Autowired
var userDetailsService: UserDetailsService? = null
override fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
val authenticationProvider = OpenSaml4AuthenticationProvider()
authenticationProvider.setResponseAuthenticationConverter { responseToken: OpenSaml4AuthenticationProvider.ResponseToken ->
val authentication = OpenSaml4AuthenticationProvider
@ -143,6 +148,7 @@ open class SecurityConfig : WebSecurityConfigurerAdapter() {
authenticationManager = ProviderManager(authenticationProvider)
}
}
return http.build()
}
}
----
@ -304,10 +310,10 @@ This authentication manager should expect a `Saml2AuthenticationToken` object co
[source,java,role="primary"]
----
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
public class SecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
AuthenticationManager authenticationManager = new MySaml2AuthenticationManager(...);
http
.authorizeHttpRequests(authorize -> authorize
@ -317,6 +323,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
.authenticationManager(authenticationManager)
)
;
return http.build();
}
}
----
@ -325,8 +332,9 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
open class SecurityConfig : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
open class SecurityConfig {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
val customAuthenticationManager: AuthenticationManager = MySaml2AuthenticationManager(...)
http {
authorizeRequests {
@ -336,6 +344,7 @@ open class SecurityConfig : WebSecurityConfigurerAdapter() {
authenticationManager = customAuthenticationManager
}
}
return http.build()
}
}
----

40
docs/modules/ROOT/pages/servlet/saml2/login/overview.adoc
View File

@ -297,38 +297,42 @@ The `requireInitialize` method may be called only once per application instance.
Spring Boot generates two `@Bean` objects for a relying party.
The first is a `WebSecurityConfigurerAdapter` that configures the application as a relying party.
When including `spring-security-saml2-service-provider`, the `WebSecurityConfigurerAdapter` looks like:
The first is a `SecurityFilterChain` that configures the application as a relying party.
When including `spring-security-saml2-service-provider`, the `SecurityFilterChain` looks like:
.Default JWT Configuration
====
.Java
[source,java,role="primary"]
----
protected void configure(HttpSecurity http) {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.saml2Login(withDefaults());
return http.build();
}
----
.Kotlin
[source,kotlin,role="secondary"]
----
fun configure(http: HttpSecurity) {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize(anyRequest, authenticated)
}
saml2Login { }
}
return http.build()
}
----
====
If the application does not expose a `WebSecurityConfigurerAdapter` bean, Spring Boot exposes the preceding default one.
If the application does not expose a `SecurityFilterChain` bean, Spring Boot exposes the preceding default one.
You can replace this by exposing the bean within the application:
@ -338,14 +342,16 @@ You can replace this by exposing the bean within the application:
[source,java,role="primary"]
----
@EnableWebSecurity
public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class MyCustomSecurityConfiguration {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.mvcMatchers("/messages/**").hasAuthority("ROLE_USER")
.anyRequest().authenticated()
)
.saml2Login(withDefaults());
return http.build();
}
}
----
@ -354,8 +360,9 @@ public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class MyCustomSecurityConfiguration {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize("/messages/**", hasAuthority("ROLE_USER"))
@ -364,6 +371,7 @@ class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
saml2Login {
}
}
return http.build()
}
}
----
@ -480,7 +488,7 @@ open fun relyingPartyRegistrations(): RelyingPartyRegistrationRepository {
[[servlet-saml2login-relyingpartyregistrationrepository-dsl]]
Alternatively, you can directly wire up the repository by using the DSL, which also overrides the auto-configured `WebSecurityConfigurerAdapter`:
Alternatively, you can directly wire up the repository by using the DSL, which also overrides the auto-configured `SecurityFilterChain`:
.Custom Relying Party Registration DSL
====
@ -488,8 +496,9 @@ Alternatively, you can directly wire up the repository by using the DSL, which a
[source,java,role="primary"]
----
@EnableWebSecurity
public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) {
public class MyCustomSecurityConfiguration {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.mvcMatchers("/messages/**").hasAuthority("ROLE_USER")
@ -498,6 +507,7 @@ public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter
.saml2Login(saml2 -> saml2
.relyingPartyRegistrationRepository(relyingPartyRegistrations())
);
return http.build();
}
}
----
@ -506,8 +516,9 @@ public class MyCustomSecurityConfiguration extends WebSecurityConfigurerAdapter
[source,kotlin,role="secondary"]
----
@EnableWebSecurity
class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
class MyCustomSecurityConfiguration {
@Bean
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
http {
authorizeRequests {
authorize("/messages/**", hasAuthority("ROLE_USER"))
@ -517,6 +528,7 @@ class MyCustomSecurityConfiguration : WebSecurityConfigurerAdapter() {
relyingPartyRegistrationRepository = relyingPartyRegistrations()
}
}
return http.build()
}
}
----