-
Notifications
You must be signed in to change notification settings - Fork 41.6k
Closed
Description
If a RelyingPartyRegistrationRepository.class bean is detected, Spring Boot will automatically configure a WebSecurityConfigurerAdapter through the org.springframework.boot.autoconfigure.security.saml2.Saml2LoginConfiguration class.
If a developer wants to provide their own WebSecurityConfigurerAdapter the only option today is to create a secondary one, and override the @Order to become first in queue.
Expected Behavior
If a user provides a WebSecurityConfigurerAdapter, there is no need for Spring Boot to do it.
@mbhave FYI
PS. One possible solution, as we discussed, is to have a @ConditionalOnMissingBean like OAuth2WebSecurityConfiguration
@Configuration(proxyBeanMethods = false)
@ConditionalOnBean(ClientRegistrationRepository.class)
class OAuth2WebSecurityConfiguration {
...
@Configuration(proxyBeanMethods = false)
@ConditionalOnMissingBean(WebSecurityConfigurerAdapter.class)
static class OAuth2WebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
...
Metadata
Metadata
Assignees
Labels
type: enhancementA general enhancementA general enhancement