From 6222c5fe3440aa70702dad72d2f6dc052f87789e Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Tue, 8 Sep 2020 19:42:19 -0600 Subject: [PATCH] Add What's New in 5.4 Closes gh-9001 --- .../asciidoc/_includes/about/whats-new.adoc | 114 ++++++++++-------- 1 file changed, 63 insertions(+), 51 deletions(-) diff --git a/docs/manual/src/docs/asciidoc/_includes/about/whats-new.adoc b/docs/manual/src/docs/asciidoc/_includes/about/whats-new.adoc index 5fcd874c72..57f741c17d 100644 --- a/docs/manual/src/docs/asciidoc/_includes/about/whats-new.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/about/whats-new.adoc @@ -1,7 +1,7 @@ [[new]] -== What's New in Spring Security 5.3 +== What's New in Spring Security 5.4 -Spring Security 5.3 provides a number of new features. +Spring Security 5.4 provides a number of new features. Below are the highlights of the release. [[whats-new-documentation]] @@ -11,70 +11,82 @@ We will continue our effort to rewrite the documentation. Here's what you'll see in this release: -* Added <> -* Updated <> -** Rewrote -** Added how things work, including <> -* Added {gh-samples-url}/boot/kotlin[Kotlin samples] -* Reskinned -** Added scrolling menu -** Added <> -** Updated styles +* Added <> for <> and <> +* Restructured <> and added diagrams + +[[whats-new-logging]] +=== Logging Updates + +We have begun an effort to restructure our logging. + +Here's what you'll see in this release: + +* Restructured https://github.com/spring-projects/spring-security/commit/fa7baf551dc55eab50b9ad94720e7521f0b1d26f[authorization logs] +* Restructured https://github.com/spring-projects/spring-security/commit/fa7baf551dc55eab50b9ad94720e7521f0b1d26f[Form Login] and https://github.com/spring-projects/spring-security/commit/02d1516c566a58574af0a1d0391fd2ec8c5ad774[HTTP Basic] authentication logs +* Added https://github.com/spring-projects/spring-security/commit/bf067d679fb5990d6b3d31cee292af171f8a5014[Resource Server] https://github.com/spring-projects/spring-security/commit/b2728059ae903d027d0da0f4a25bed6df213a0ce[logs] [[whats-new-servlet]] === Servlet - -* Added <> +* Configuration +** Added support for https://github.com/spring-projects/spring-security/issues/8804[publishing `SecurityFilterChain` as a `@Bean`] +* Kotlin DSL +** Added https://github.com/spring-projects/spring-security/issues/8981[`authenticationManagerResolver`] +** Added https://github.com/spring-projects/spring-security/issues/8892[`hasAnyRole` and `hasAnyAuthority`] +** Added https://github.com/spring-projects/spring-security/issues/8823[custom HeaderWriter support] +** Updated to https://github.com/spring-projects/spring-security/issues/8697[use reified types] +** Added https://github.com/spring-projects/spring-security/pull/8350[`authorize()` method that accepts `HttpMethod`] * OAuth 2.0 Client -** Added Test support for <>, <>, and <> -** Improved https://github.com/spring-projects/spring-security/pull/7748[customizing the OAuth 2.0 Authorization Request] -** Enhanced https://github.com/spring-projects/spring-security/issues/7842[OIDC logout success handler to support `\{baseUrl\}`] -** Added https://github.com/spring-projects/spring-security/issues/7840[OAuth2Authorization success and failure handlers] -** Added https://github.com/spring-projects/spring-security/issues/5184[XML support] -** Added <> -** Added https://github.com/spring-projects/spring-security/issues/4886[JSON serialization support for OAuth 2.0 tokens] +** Polished <> test support to not require an `HttpSessionOAuth2AuthorizedClientRepository` bean +** Added support for https://github.com/spring-projects/spring-security/issues/8453[client ID and secret placeholders in XML support] +** Refined `ClientRegistrations` to https://github.com/spring-projects/spring-security/issues/8514[not default scopes to the OIDC `scopes_supported` attribute] +** Allow for https://github.com/spring-projects/spring-security/issues/8903[custom Client Authentication Method] in `ClientRegistration` +** Enhanced `OAuth2AuthorizedClientArgumentResolver` to https://github.com/spring-projects/spring-security/issues/8700[pick up `OAuth2AuthorizedClientManager` from the application context] +** Added https://github.com/spring-projects/spring-security/issues/8669[`OAuth2AuthorizedClientArgumentResolver` support to XML config] +** Added `RequestCache` support to https://github.com/spring-projects/spring-security/issues/8120[`OAuth2AuthorizationCodeGrantFilter`] +** Added https://github.com/spring-projects/spring-security/issues/8326[`issuerUri` to `ClientRegistration`] * OAuth 2.0 Resource Server -** Added support for <> -** Added <> -** Added <> -** Added https://github.com/spring-projects/spring-security/issues/5185[XML support] -** Improved https://github.com/spring-projects/spring-security/pull/7826[bearer token error handling] for JWT and Opaque Token +** Added <> +** Made https://github.com/spring-projects/spring-security/issues/8186[principal claim configurable in `JwtAuthenticationConverter`] +** Enhanced configuration to <> +** Simplified https://github.com/spring-projects/spring-security/pull/8740[attribute retrieval for opaque token] * SAML 2.0 -** Added <> configuration -** Added support for https://github.com/spring-projects/spring-security/issues/7711[AuthNRequest signatures] -** Added support for https://github.com/spring-projects/spring-security/pull/7759[AuthNRequest POST binding] +** Made <> +** Enhanced <> +** Opened <> +** Enhanced <`>> +** Enhanced <> +** Enhanced <` validation>> +** Added support for <> +** Added <> +** Added a <> +** Simplified <> +** Restructured `RelyingPartyRegistration` to <> +** Added <> +** Restructured `RelyingPartyRegistration` to <> +* LDAP +** Added support for configuring https://github.com/spring-projects/spring-security/issues/8144[`ApacheDSContainer`] with a random port +** Added support for configuring https://github.com/spring-projects/spring-security/issues/8138[application] with a random port +* CSRF +** Made the https://github.com/spring-projects/spring-security/pull/8749[`secure` flag configurable] [[whats-new-webflux]] === WebFlux -* Added https://github.com/spring-projects/spring-security/issues/7636[DSL support for custom header writers] -* OAuth 2.0 Client -** Added Test support for https://github.com/spring-projects/spring-security/issues/7910[OAuth 2.0 Client], https://github.com/spring-projects/spring-security/issues/7828[OAuth 2.0 Login], and https://github.com/spring-projects/spring-security/issues/7680[OIDC Login] -** Enhanced https://github.com/spring-projects/spring-security/issues/7842[OIDC logout success handler to support `\{baseUrl\}`] -** Added https://github.com/spring-projects/spring-security/issues/7699[OAuth2Authorization success and failure handlers] -** Added https://github.com/spring-projects/spring-security/issues/4886[JSON serialization support for OAuth 2.0 tokens] -** Added https://github.com/spring-projects/spring-security/issues/7569[ReactiveOAuth2AuthorizedClientManager integration with AuthorizedClientService] -* OAuth 2.0 Resource Server -** Added support for <> -** Added https://github.com/spring-projects/spring-security/issues/7827[test support for Opaque Tokens] -** Improved https://github.com/spring-projects/spring-security/pull/7826[bearer token error handling] for JWT and Opaque Token - -[[whats-new-rsocket]] -=== RSocket - -* Added support for https://github.com/spring-projects/spring-security/issues/7935[RSocket Authentication extension] +* Added https://github.com/spring-projects/spring-security/issues/5558[Kotlin DSL for WebFlux] +* Added https://github.com/spring-projects/spring-security/issues/8324[`AuthoritiesMapper` configuration] to OAuth 2.0 Login +* Added https://github.com/spring-projects/spring-security/issues/8599[`SwitchUserWebFilter`] [[whats-new-additional]] === Additional Updates -* Enhanced Authentication Event Publisher support -** Updated https://github.com/spring-projects/spring-security/pull/7802[configuration support] -** Added https://github.com/spring-projects/spring-security/issues/7825[default event] and https://github.com/spring-projects/spring-security/issues/7824[`Map`-based] exception mapping -* Improved https://github.com/spring-projects/spring-security/issues/7891[integration with Spring Data] -* Added support to https://github.com/spring-projects/spring-security/issues/7661[BCrypt to hash byte arrays] +* Renamed https://github.com/spring-projects/spring-security/issues/8676[whitelist and blacklist to allowlist and blocklist] +* Added https://github.com/spring-projects/spring-security/pull/7052[`RequestRejectedHandler`] +* Strengthened https://github.com/spring-projects/spring-security/pull/8644[`StrictHttpFirewall`] +* Made https://github.com/spring-projects/spring-security/issues/5438[`SessionRegistry` aware of `SessionIdChangedEvent`] +* Allow https://github.com/spring-projects/spring-security/issues/8402[`AesBytesEncryptor` to be constructed with a real key] +* https://github.com/spring-projects/spring-security/pull/8450[Deprecated OpenID 2.0 support] [[whats-new-build]] === Build Changes -* Changed build to https://github.com/spring-projects/spring-security/issues/7788[use version ranges] -* Removed https://github.com/spring-projects/spring-security/issues/4939[dependency on Groovy] +* https://github.com/spring-projects/spring-security/issues/8113[Improved performance further]