3226 Commits

Author	SHA1	Message	Date
Rob Winch	bce8049815	Web uses AuthorizationManager<? super RequestAuthorizationContext> ... This allows AuthorizationManager<Object> to be used instead of just AuthorizationManager<RequestAuthorizationContext>. In addition, the code was updated to use `AuthorizationManagerFactory<? super RequestAuthorizationContext>` Closes gh-17931	2025-09-18 17:32:09 -05:00
Rob Winch	675835e525	Add AuthorizationManagerFactory.hasAll(Authorities|Roles) ... Closes gh-17932	2025-09-18 14:19:22 -05:00
Rob Winch	9a3ae4b867	DelegatingAuthenticationEntryPoint uses RequestMatcherEntry ... Closes gh-17915	2025-09-16 09:48:04 -05:00
Rob Winch	2774948b92	Fix X509 WebFlux Configuration Checks ... The changes for gh-17382 broke the checkstyle and tests. This fixes them both. Issue gh-17382	2025-09-12 16:45:51 -05:00
blake_bauman	b502697731	feat: Add option to specify a custom ServerAuthenticationConverter for x509() ... Signed-off-by: blake_bauman <blake_bauman@apple.com>	2025-09-12 16:45:51 -05:00
Joe Grandja	35f41f87d1	Temporarily fix integration tests ... Issue gh-17880	2025-09-12 16:20:44 -04:00
Joe Grandja	7ef25cc101	Add HttpSecurity.oauth2AuthorizationServer() ... Issue gh-17880	2025-09-12 16:20:44 -04:00
Joe Grandja	098574c50e	Remove redundant classes ... Issue gh-17880	2025-09-12 16:20:43 -04:00
Joe Grandja	8399bc161d	Fix Serializable tests ... Issue gh-17880	2025-09-12 16:20:42 -04:00
Joe Grandja	cc71be71e5	Move OAuth2AuthorizationServerConfigurer and OAuth2AuthorizationServerConfiguration ... Issue gh-17880	2025-09-12 16:20:42 -04:00
Josh Cummings	eedcec9d5c	Move Core Access API ... Issue gh-17847	2025-09-12 10:32:38 -06:00
Josh Cummings	3a1692f3c3	Remove Direct Runtime Dependency on Access API ... Issue gh-17847	2025-09-12 10:32:37 -06:00
DingHao	10935632ee	Remove PortResolver ... Closes gh-15971 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-09-11 22:58:32 -05:00
Josh Cummings	2b87e3c5e2	Use withRoles ... Issue gh-17843	2025-09-09 17:03:05 -06:00
Josh Cummings	3f774548d2	Move Authority Propagation Into Filters ... Given that the filters are the level at which the SecurityContextHolder is consulted, this commit moves the operation that ProviderManager was doing into each authentication filter. Issue gh-17862	2025-09-09 14:49:13 -06:00
Josh Cummings	a0fe6a5fee	Polish Builders ... - Added remaining properties - Removed apply method since Spring Security isn't using it right now - Made builders extensible since the authentications are extensible Issue gh-17861	2025-09-09 14:49:13 -06:00
Josh Cummings	44fef786aa	Pick Up SecurityContextHolderStrategy Bean ... This commit provides the SecurityContextHolderStrategy bean to ProviderManager instances that the HttpSecurity DSL constructs. Issue gh-17862	2025-09-09 14:49:13 -06:00
Steve Riesenberg	eeb4574bb3	Add AuthorizationManagerFactory ... Signed-off-by: Steve Riesenberg <5248162+sjohnr@users.noreply.github.com>	2025-09-09 15:36:49 -05:00
blake_bauman	a4f813ab29	Support Multiple ServerLogoutHandlers ... This commit adds support to ServerHttpSecurity for registering multiple ServerLogoutHandlers. This is handy so that an application does not need to re-supply any handlers already configured by the DSL. Signed-off-by: blake_bauman <blake_bauman@apple.com>	2025-09-05 11:47:54 -06:00
Josh Cummings	f30cc9c5a9	Update to PropertySourcesPlaceholderConfigurer ... This commit replaces deprecated usage of PropertyPlaceholderConfigurer in favor of PropertySourcesPlaceholderConfigurer	2025-09-04 11:32:04 -06:00
Josh Cummings	c64b086878	Add SecurityAssertions ... This commit introduces a simple, internal test API for verifying aspects of an Authentication, like its name and authorities. Closes gh-17844	2025-09-03 17:53:42 -06:00
Josh Cummings	de10e08348	Make withRoles Check Only Roles ... This commit clarifies the semantics of withRoles, which is to check the role-based authorities in an authentication. Closes gh-17843	2025-09-03 17:53:41 -06:00
Rob Winch	24ffda28d8	Fixes for webauthn tests after JSpecify ... Issue gh-17839	2025-09-03 14:44:58 -05:00
Josh Cummings	3dbcf266e9	Merge branch '6.5.x'	2025-09-02 16:45:30 -06:00
Josh Cummings	eeb67650ee	Deprecate RequiresChannelDsl ... Issue gh-16680	2025-09-02 16:41:39 -06:00
Josh Cummings	3534b74945	Replace InteractiveAuthenticationSuccessEvent 7.0.x Sample ... Given that 7e3bf9662c changes the InteractiveAuthenticationSuccessEvent serialization sample, this commit syncs up the 7.0.x version to match. Closes gh-16276	2025-09-02 14:18:25 -06:00
Josh Cummings	dc0ab4c805	Merge branch '6.5.x'	2025-09-02 14:15:20 -06:00
Josh Cummings	c982753d46	Replace InteractiveAuthenticationSuccessEvent 6.5.x Sample ... Given that 7e3bf9662c changes the InteractiveAuthenticationSuccessEvent serialization sample, this commit syncs up the 6.5.x version to match. Issue gh-16276	2025-09-02 14:14:13 -06:00
Josh Cummings	0ff9f10696	Merge branch '6.4.x' into 6.5.x	2025-08-30 10:00:45 -06:00
Josh Cummings	7e3bf9662c	Polish InteractiveAuthenticationSuccessEvent Sample ... The sample better matches a value that would be used in the constructor Issue gh-16276	2025-08-30 10:00:24 -06:00
Rob Winch	a58f3282d9	Fix config/src/test/kotlin nullability for web ... Issue gh-17535	2025-08-29 15:46:08 -05:00
Rob Winch	c2ba662b91	Enable Null checking in spring-security-web via JSpecify ... Closes gh-17535	2025-08-29 15:06:48 -05:00
Rob Winch	49f308adb0	Use Supplier<? extends @Nullable Authentication> ... Previously Supplier<@Nullable Authentication> was used. This prevented Supplier<Authentication> from being used. The code now uses Supplier<? extends @Nullable Authentication> which allows for both Supplier<@Nullable Authentication> and Supplier<Authentication>. Closes gh-17814	2025-08-29 09:46:58 -05:00
Josh Cummings	4cbe8de7ea	Polish RSocket Anonymous Support ... Changed the DSL method name to anonymous to align with jwt. Since basicAuthenication is deprecated, we don't need to align with its naming convention. Also added a since attribute to the method. Issue gh-17132	2025-08-26 17:33:40 -06:00
Andrey Litvitski	559b73b39f	Add Disabling Anonymous Authentication in RSocketSecurity ... Closes: gh-17132 Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com> 1 Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com> 1 Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>	2025-08-26 17:33:40 -06:00
Josh Cummings	36f1de945f	Add OneTimeTokenAuthentication ... Closes gh-17799	2025-08-22 15:46:54 -06:00
Josh Cummings	89b2f9cf54	Improve Test Runnability in IDE ... In some configurations, Configuration classes with static elements may cause a test to hang. This commit changes JeeConfigurerTests test configuration classes to use mock beans instead of referencing them as static fields.	2025-08-22 15:46:53 -06:00
Rob Winch	f496ded4e5	AuthorizationManager allows null Authentication ... It is possible to have a null Authentication and so the AuthorizationManager APIs should allow for passing it in. Closes gh-17795	2025-08-22 12:03:16 -05:00
Josh Cummings	583e668c6b	Remove opensaml5Test Task ... Issue gh-17707	2025-08-22 09:19:20 -06:00
Yanming Zhou	41162aa7e3	Polish WebFluxSecurityConfiguration ... Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>	2025-08-21 11:16:12 -06:00
Yanming Zhou	d86f2c957d	Change @Bean method signature to return RsaKeyConversionServicePostProcessor instead of BeanFactoryPostProcessor ... It's friendly for Spring Boot's `@ConditionalOnMissingBean`, and: >> When defining a Spring `@Bean` method, it is generally recommended to declare the most specific type possible as the method's return type. This means returning the concrete class of the bean, or the most specific interface that the bean implements and through which it will be referenced in the application. Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>	2025-08-21 11:16:12 -06:00
Rob Winch	a8f045eb50	Add Modular Spring Security Configuration ... Closes gh-16258	2025-08-20 12:16:08 -05:00
Rob Winch	5c5efc9092	SpringTestContext registers WebTestClient Bean ... Closes gh-17780	2025-08-20 12:15:58 -05:00
Josh Cummings	3396890d8b	Propagate AccessDeniedException Only to ExceptionTranslationFilter ... Closes gh-17761	2025-08-18 17:04:19 -06:00
Josh Cummings	714781df78	Isolate AOT Test to Security Components ... PR gh-17724	2025-08-18 09:05:03 -05:00
Josh Cummings	a04b026000	Disable Test ... Issue gh-17747 PR gh-17724	2025-08-18 09:05:03 -05:00
Josh Cummings	aeb2dbc2b6	Move PathPatternRequestMatcher.Builder to Shared Object ... This commit changes the DSL to look for a shared object instead of publishing a bean for PathPatternRequestMatcher.Builder. Closes gh-17746	2025-08-18 06:31:31 -06:00
Josh Cummings	890c11d428	Polish SecurityNamespaceHandler Version Checking ... PR gh-17689	2025-08-15 17:26:57 -06:00
seongm1n	01401f1c67	Replace "shameless coverage code" in SecurityNamespaceHandlerTests ... Signed-off-by: seongm1n <0411tjdals34@gmail.com>	2025-08-15 16:26:31 -06:00
Josh Cummings	5506c487de	Remove OpenSaml4 Components ... Issue gh-17707	2025-08-14 18:01:02 -06:00
Josh Cummings	057b7c68fb	Add Serializable Sample ... Closes gh-17728	2025-08-14 16:39:49 -06:00
Josh Cummings	7b1c917593	Merge branch '6.5.x'	2025-08-14 16:34:48 -06:00
Josh Cummings	9b7e0e10fc	Add Serializable Sample ... Closes gh-17727	2025-08-14 16:20:06 -06:00
Josh Cummings	4fab90b2b8	Merge branch '6.4.x' into 6.5.x	2025-08-14 15:54:16 -06:00
Josh Cummings	10948b5b7a	Make OpenSamlAssertingPartyDetails Serializable ... Closes gh-17622	2025-08-14 15:52:58 -06:00
Joe Grandja	df3080b0e2	Merge branch '6.5.x'	2025-08-12 14:45:23 -04:00
Joe Grandja	518ae27105	Fix JwtDecoderFactory ClassNotFoundException with DPoP authentication ... Closes gh-17249	2025-08-12 14:28:30 -04:00
Josh Cummings	6d1a886f92	Deprecate SERIAL_VERSION_UID ... Closes gh-17623	2025-08-07 11:09:35 -06:00
Tran Ngoc Nhan	d6e378e9bb	Apply Diamond Operator ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-07-31 10:59:55 -06:00
Deep Dhamala	ca557a9880	Simplify Error Message for Unsupported Security XSD Versions ... Closes gh-17153 Signed-off-by: Deep Dhamala <dhamaladeep2@gmail.com>	2025-07-31 10:40:54 -06:00
Tran Ngoc Nhan	1a56023f7f	Use Spring Framework Nullability Annotations ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-07-31 10:18:51 -06:00
Rob Winch	f6cb0bd610	Merge Use 2004-present Copyright Header ... The original merge into main did not apply the changes. This fixes it. Closes gh-17635	2025-07-29 10:52:42 -05:00
Rob Winch	2fdca16c1a	Merge branch '6.4.x' into 6.5.x ... Closes gh-17634	2025-07-29 09:47:52 -05:00
Rob Winch	392129b616	Use 2004-present Copyright Header ... The Spring portfolio is changing to use <inception-year>-present in the copyright headers to simplify keeping headers up to date. This commit updates the headers and the checkstyle accordingly. The commit updated etc/checkstyle/header.txt It also updated the copyright headers using the following find/replace: Find: (Copyright \d{4})\s*(\-\d{4})? the original author or authors. Replace: Copyright 2004-present the original author or authors. Closes gh-17633	2025-07-29 09:45:23 -05:00
Rob Winch	79cd982341	Extract spring-security-webauthn ... Closes gh-17586	2025-07-22 17:18:38 -05:00
Rob Winch	7c887d2da1	Add nullability to spring-security-core ... Closes gh-17534	2025-07-22 16:29:13 -05:00
Rob Winch	85dc06bbdf	Merge branch '6.5.x' ... Closes gh-17581	2025-07-21 09:30:11 -05:00
Rob Winch	80ccb9b3cf	Merge branch '6.4.x' into 6.5.x ... Closes gh-17580	2025-07-21 09:29:20 -05:00
Rob Winch	829af961f0	Use Meaningful Configurer Names in Test ... This just renames the Configurer names used in AbstractConfiguredSecurityBuilderTests to be more meaningful. Issue gh-17020 gh-17011 Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>	2025-07-21 09:27:36 -05:00
Rob Winch	fca704e61f	Fix getConfigurersInInitializing Semantics ... A getter should not mutate state. This removes getConfigurersInInitializing in favor of inline code since this is just used once. Issue gh-17020 gh-17011 Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>	2025-07-21 09:27:36 -05:00
Rob Winch	ea9dd2728e	Support add nested security configurers during builder initialization ... Closes gh-17011 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-07-21 09:27:27 -05:00
Josh Cummings	63e0a56bee	Add setBasePath ... Originally, it was thought that this feature would be rather uncommon; however, given some feedback from the Boot team, it makes sense to make this easier to configure. Of specific note is migrating from an earlier version were the servlet path did not need to be specified in authorizeHttpRequests. Since it does in 7, this will be a significant migration for those who have a servlet path configured. This setter simplifies that a great deal, including simplifying Boot's support of it. Closes gh-17579	2025-07-20 22:57:06 -06:00
Josh Cummings	15fc898804	Make DataTargetVisitor package-private ... Closes gh-17561	2025-07-18 11:03:21 -06:00
Joe Grandja	a1f5b343ab	Merge branch '6.5.x'	2025-07-18 09:01:01 -04:00
Joe Grandja	ecec7cb98f	Merge branch '6.4.x' into 6.5.x ... Closes gh-17557	2025-07-18 08:40:31 -04:00
Marcus Hert da Coregio	2a38de48b8	Fix securityContextRepository() initialization in oauth2Login() DSL ... Closes gh-17502 Signed-off-by: Marcus Hert da Coregio <marcusdacoregio@gmail.com>	2025-07-18 07:48:05 -04:00
Josh Cummings	25f69e92c7	Merge branch '6.5.x'	2025-07-17 18:04:52 -06:00
Josh Cummings	72eb3065de	Remove AuthorizationWebProxyConfiguration From Reactive ... Closes gh-17545	2025-07-17 17:42:45 -06:00
DingHao	dadf4c0b8a	Remove shouldFilterAllDispatcherTypes ... Closes gh-12139 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-07-14 12:34:16 -06:00
DingHao	5fefdd5bb3	Remove AbstractConfiguredSecurityBuilder apply ... Closes gh-13441 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-07-11 16:13:25 -06:00
Josh Cummings	4d3024cb49	Remove MessageSecurityMetadataSourceRegistry ... Issue gh-17295	2025-07-10 14:38:03 -06:00
Josh Cummings	684775b46a	Use PathPatternMessageMatcher By Default ... Issue gh-17501	2025-07-10 14:38:03 -06:00
Josh Cummings	ec16322000	Merge branch '6.5.x'	2025-07-10 13:19:14 -06:00
Josh Cummings	bc0d706275	Use PathPatternMessageMatcher.Builder in XML Config ... Closes gh-17508	2025-07-10 13:16:14 -06:00
Josh Cummings	7f8b9c895f	Use with Instead of Apply ... Issue gh-13204	2025-07-09 18:58:23 -06:00
Josh Cummings	728b5224cb	Add withDefaults Shortcut for Custom Configurers ... Issue gh-13204	2025-07-09 18:58:23 -06:00
Josh Cummings	f1725b25a0	Remove authorizeRequests ... Closes gh-15174	2025-07-09 17:33:11 -06:00
Josh Cummings	2c87270dbc	Use authorizeHttpRequests ... Issue gh-15174	2025-07-09 17:33:11 -06:00
Josh Cummings	da182a2d7c	Remove Deprecated OpenSaml Components ... Closes gh-17306	2025-07-09 14:06:51 -06:00
Rob Winch	e48fdd5ed4	Use UserWebTestClientConfigurer ... Closes gh-17496	2025-07-07 15:15:51 -05:00
Tran Ngoc Nhan	a439bc65d6	Remove EnableWebMvcSecurity ... Closes gh-17294 Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-07-07 13:46:03 -06:00
Josh Cummings	19e88f5e35	Polish Tests ... Issue gh-17298	2025-07-07 13:38:34 -06:00
Tran Ngoc Nhan	242956a63c	Remove deprecated elements from DaoAuthenticationProvider ... Closes gh-17298 Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-07-07 13:38:34 -06:00
Tran Ngoc Nhan	e52987d03c	Remove RoleHierarchyImpl Deprecations ... Closes gh-17297 Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-07-07 13:22:22 -06:00
Matt Magoffin	62252c1232	Default to XorCsrfChannelInterceptor in XML ... Change WebSocketMessageBrokerSecurityBeanDefinitionParser to use XorCsrfChannelInterceptor by default, so WebSocket XML configuration matches the default Xor-based configuration already in WebSocketMessageBrokerSecurityConfiguration. Closes gh-17260 Signed-off-by: Matt Magoffin <matt@solarnetwork.net>	2025-07-07 13:02:15 -06:00
Josh Cummings	a9636c72d1	Merge branch '6.5.x'	2025-07-07 12:54:26 -06:00
Josh Cummings	bc20bd6340	Merge branch '6.4.x' into 6.5.x ... Closes gh-17495	2025-07-07 12:53:59 -06:00
Josh Cummings	8461feb028	Merge branch '6.3.x' into 6.4.x ... Closes gh-17494	2025-07-07 12:53:47 -06:00
Josh Cummings	4f5b17334e	Pick Up csrfChannelInterceptor in XML ... Closes gh-17493	2025-07-07 12:53:27 -06:00
Josh Cummings	42283a5c1d	Add Missing File ... Issue gh-17484	2025-07-07 11:18:57 -06:00