diff --git a/config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDsl.kt b/config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDsl.kt index b27d519567..6c832f79fc 100644 --- a/config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDsl.kt +++ b/config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDsl.kt @@ -274,7 +274,7 @@ class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl { } constructor(context: ApplicationContext) { - this.authorizationManagerFactory = resolveAuthorizationManagerFactory(context) + this.authorizationManagerFactory = resolveAuthorizationManagerFactory(context) this.authenticated = this.authorizationManagerFactory.authenticated() this.denyAll = this.authorizationManagerFactory.denyAll() this.fullyAuthenticated = this.authorizationManagerFactory.fullyAuthenticated() @@ -282,14 +282,14 @@ class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl { } private fun resolveAuthorizationManagerFactory(context: ApplicationContext): AuthorizationManagerFactory { - val specific = context.getBeanProvider>().getIfUnique() - if (specific != null) { - return specific + val factoryOfRequestAuthorizationContext = context.getBeanProvider>().getIfUnique() + if (factoryOfRequestAuthorizationContext != null) { + return factoryOfRequestAuthorizationContext } - val type = ResolvableType.forClassWithGenerics(AuthorizationManagerFactory::class.java, Object::class.java) - val general: AuthorizationManagerFactory? = context.getBeanProvider>(type).getIfUnique() - if (general != null) { - return general + val factoryOfObjectType = ResolvableType.forClassWithGenerics(AuthorizationManagerFactory::class.java, Object::class.java) + val factoryOfAny = context.getBeanProvider>(factoryOfObjectType).getIfUnique() + if (factoryOfAny != null) { + return factoryOfAny } val defaultFactory: DefaultAuthorizationManagerFactory = DefaultAuthorizationManagerFactory() val rolePrefix = resolveRolePrefix(context) @@ -318,4 +318,5 @@ class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl { } return NullRoleHierarchy() } + } diff --git a/config/src/test/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDslTests.kt b/config/src/test/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDslTests.kt index 6fd4ecf88e..4a30d60297 100644 --- a/config/src/test/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDslTests.kt +++ b/config/src/test/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDslTests.kt @@ -16,10 +16,12 @@ package org.springframework.security.config.annotation.web +import io.mockk.Called import io.mockk.every import io.mockk.mockk import io.mockk.verify import jakarta.servlet.DispatcherType +import org.aopalliance.intercept.MethodInvocation import org.assertj.core.api.Assertions.assertThatThrownBy import org.junit.jupiter.api.Test import org.junit.jupiter.api.extension.ExtendWith @@ -1120,4 +1122,51 @@ class AuthorizeHttpRequestsDslTests { } } } + + @Test + fun `custom AuthorizationManagerFactory of MethodInvocation`() { + this.spring.register(AuthorizationManagerFactoryMethodInvocationConfig::class.java).autowire() + val authzManagerFactory = + this.spring.context.getBean>() + + verify(exactly = 0) { authzManagerFactory.authenticated() } + } + + @Configuration + @EnableWebSecurity + @EnableWebMvc + open class AuthorizationManagerFactoryMethodInvocationConfig { + val authorizationManager: AuthorizationManager = mockk() + + @Bean + open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain { + http { + authorizeHttpRequests { + authorize("/authenticated", authenticated) + } + httpBasic { } + rememberMe { } + } + return http.build() + } + + @Bean + open fun authorizationManagerFactory(): AuthorizationManagerFactory { + val factory: AuthorizationManagerFactory = mockk() + every { factory.authenticated() } returns this.authorizationManager + + return factory + } + + @Bean + open fun userDetailsService(): UserDetailsService = InMemoryUserDetailsManager(TestAuthentication.user()) + + @RestController + internal class OkController { + @GetMapping("/**") + fun ok(): String { + return "ok" + } + } + } }