SEC-2781: Remove deprecations

2026-08-04 09:17:02 +00:00 · 2014-12-03 13:34:15 -06:00
parent 5bb0ce9a8f
commit 6e204fff72
177 changed files with 536 additions and 5022 deletions
@@ -49,8 +49,6 @@ public abstract class Elements {
    public static final String JEE = "jee";
    public static final String FILTER_SECURITY_METADATA_SOURCE = "filter-security-metadata-source";
    public static final String METHOD_SECURITY_METADATA_SOURCE = "method-security-metadata-source";
-    @Deprecated
-    public static final String FILTER_INVOCATION_DEFINITION_SOURCE = "filter-invocation-definition-source";
    public static final String LDAP_PASSWORD_COMPARE = "password-compare";
    public static final String DEBUG = "debug";
    public static final String HTTP_FIREWALL = "http-firewall";
@@ -173,7 +173,6 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
            parsers.put(Elements.DEBUG, new DebugBeanDefinitionParser());
            parsers.put(Elements.HTTP, new HttpSecurityBeanDefinitionParser());
            parsers.put(Elements.HTTP_FIREWALL, new HttpFirewallBeanDefinitionParser());
-            parsers.put(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
            parsers.put(Elements.FILTER_SECURITY_METADATA_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
            parsers.put(Elements.FILTER_CHAIN, new FilterChainBeanDefinitionParser());
            filterChainMapBDD = new FilterChainMapBeanDefinitionDecorator();
@@ -52,7 +52,6 @@ public class AuthenticationManagerBeanDefinitionParser implements BeanDefinition

        String alias = element.getAttribute(ATT_ALIAS);

-        checkForDeprecatedSessionControllerRef(element, pc);
        List<BeanMetadataElement> providers = new ManagedList<BeanMetadataElement>();
        NamespaceHandlerResolver resolver = pc.getReaderContext().getNamespaceHandlerResolver();

@@ -113,16 +112,6 @@ public class AuthenticationManagerBeanDefinitionParser implements BeanDefinition
        return null;
    }

-    private void checkForDeprecatedSessionControllerRef(Element element, ParserContext pc) {
-        final String ATT_SESSION_CONTROLLER_REF = "session-controller-ref";
-
-        if (StringUtils.hasText(element.getAttribute(ATT_SESSION_CONTROLLER_REF))) {
-            pc.getReaderContext().warning(ATT_SESSION_CONTROLLER_REF + " is not supported in Spring Security " +
-                    " 3.0 and will be ignored. Use the attribute on the <concurrent-session-control> element instead.",
-                    pc.extractSource(element));
-        }
-    }
-
    /**
     * Provider which doesn't provide any service. Only used to prevent a configuration exception if the provider list
     * is empty (usually because a child ProviderManager from the &lt;http&gt; namespace, such as OpenID, is expected
@@ -84,7 +84,6 @@ final class AuthenticationConfigBuilder {

    private static final String ATT_AUTO_CONFIG = "auto-config";

-    private static final String ATT_ACCESS_DENIED_PAGE = "access-denied-page";
    private static final String ATT_ACCESS_DENIED_ERROR_PAGE = "error-page";
    private static final String ATT_ENTRY_POINT_REF = "entry-point-ref";

@@ -587,20 +586,9 @@ final class AuthenticationConfigBuilder {
    }

    private BeanMetadataElement createAccessDeniedHandler(Element element, ParserContext pc) {
-        String accessDeniedPage = element.getAttribute(ATT_ACCESS_DENIED_PAGE);
-        WebConfigUtils.validateHttpRedirect(accessDeniedPage, pc, pc.extractSource(element));
        Element accessDeniedElt = DomUtils.getChildElementByTagName(element, Elements.ACCESS_DENIED_HANDLER);
        BeanDefinitionBuilder accessDeniedHandler = BeanDefinitionBuilder.rootBeanDefinition(AccessDeniedHandlerImpl.class);

-        if (StringUtils.hasText(accessDeniedPage)) {
-            if (accessDeniedElt != null) {
-                pc.getReaderContext().error("The attribute " + ATT_ACCESS_DENIED_PAGE +
-                        " cannot be used with <" + Elements.ACCESS_DENIED_HANDLER + ">", pc.extractSource(accessDeniedElt));
-            }
-
-            accessDeniedHandler.addPropertyValue("errorPage", accessDeniedPage);
-        }
-
        if (accessDeniedElt != null) {
            String errorPage = accessDeniedElt.getAttribute("error-page");
            String ref = accessDeniedElt.getAttribute("ref");
@@ -5,14 +5,17 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;

+import org.springframework.beans.BeanMetadataElement;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.BeanDefinitionHolder;
 import org.springframework.beans.factory.config.RuntimeBeanReference;
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.ManagedList;
 import org.springframework.beans.factory.support.ManagedMap;
 import org.springframework.beans.factory.xml.BeanDefinitionDecorator;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.config.Elements;
+import org.springframework.security.web.DefaultSecurityFilterChain;
 import org.springframework.util.StringUtils;
 import org.springframework.util.xml.DomUtils;
 import org.w3c.dom.Element;
@@ -29,7 +32,7 @@ public class FilterChainMapBeanDefinitionDecorator implements BeanDefinitionDeco
    public BeanDefinitionHolder decorate(Node node, BeanDefinitionHolder holder, ParserContext parserContext) {
        BeanDefinition filterChainProxy = holder.getBeanDefinition();

-        Map filterChainMap = new LinkedHashMap();
+        ManagedList<BeanMetadataElement> securityFilterChains = new ManagedList<BeanMetadataElement>();
        Element elt = (Element)node;

        MatcherType matcherType = MatcherType.fromElement(elt);
@@ -53,7 +56,7 @@ public class FilterChainMapBeanDefinitionDecorator implements BeanDefinitionDeco
            BeanDefinition matcher = matcherType.createMatcher(path, null);

            if (filters.equals(HttpSecurityBeanDefinitionParser.OPT_FILTERS_NONE)) {
-                filterChainMap.put(matcher, Collections.EMPTY_LIST);
+                securityFilterChains.add(createSecurityFilterChain(matcher, new ManagedList(0)));
            } else {
                String[] filterBeanNames = StringUtils.tokenizeToStringArray(filters, ",");
                ManagedList filterChain = new ManagedList(filterBeanNames.length);
@@ -62,15 +65,19 @@ public class FilterChainMapBeanDefinitionDecorator implements BeanDefinitionDeco
                    filterChain.add(new RuntimeBeanReference(name));
                }

-                filterChainMap.put(matcher, filterChain);
+                securityFilterChains.add(createSecurityFilterChain(matcher, filterChain));
            }
        }

-        ManagedMap map = new ManagedMap(filterChainMap.size());
-        map.putAll(filterChainMap);
-
-        filterChainProxy.getPropertyValues().addPropertyValue("filterChainMap", map);
+        filterChainProxy.getConstructorArgumentValues().addGenericArgumentValue(securityFilterChains);

        return holder;
    }
+
+    private BeanDefinition createSecurityFilterChain(BeanDefinition matcher, ManagedList<?> filters) {
+        BeanDefinitionBuilder sfc = BeanDefinitionBuilder.rootBeanDefinition(DefaultSecurityFilterChain.class);
+        sfc.addConstructorArgValue(matcher);
+        sfc.addConstructorArgValue(filters);
+        return sfc.getBeanDefinition();
+    }
 }
@@ -128,14 +128,15 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit

            BeanDefinition matcher = matcherType.createMatcher(path, method);
            BeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);
-            attributeBuilder.addConstructorArgValue(access);

            if (useExpressions) {
                logger.info("Creating access control expression attribute '" + access + "' for " + path);
                // The single expression will be parsed later by the ExpressionFilterInvocationSecurityMetadataSource
-                attributeBuilder.setFactoryMethod("createSingleAttributeList");
+                attributeBuilder.addConstructorArgValue(new String[] { access });
+                attributeBuilder.setFactoryMethod("createList");

            } else {
+                attributeBuilder.addConstructorArgValue(access);
                attributeBuilder.setFactoryMethod("createListFromCommaDelimitedString");
            }

@@ -151,7 +151,7 @@ public class FormLoginBeanDefinitionParser {

        this.loginProcessingUrl = loginUrl;

-        BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.authentication.logout.LogoutFilter$FilterProcessUrlRequestMatcher");
+        BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
        matcherBuilder.addConstructorArgValue(loginUrl);

        filterBuilder.addPropertyValue("requiresAuthenticationRequestMatcher", matcherBuilder.getBeanDefinition());
@@ -119,16 +119,13 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
    }

    private BeanDefinition getLogoutRequestMatcher(String logoutUrl) {
+        BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
+        matcherBuilder.addConstructorArgValue(logoutUrl);
        if(this.csrfEnabled) {
-            BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
-            matcherBuilder.addConstructorArgValue(logoutUrl);
            matcherBuilder.addConstructorArgValue("POST");
-            return matcherBuilder.getBeanDefinition();
-        } else {
-            BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter$FilterProcessUrlRequestMatcher");
-            matcherBuilder.addConstructorArgValue(logoutUrl);
-            return matcherBuilder.getBeanDefinition();
        }
+
+        return matcherBuilder.getBeanDefinition();
    }

    ManagedList<BeanMetadataElement> getLogoutHandlers() {
@@ -1,7 +1,5 @@
 package org.springframework.security.config.http;

-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.RootBeanDefinition;
@@ -23,10 +21,7 @@ public enum MatcherType {
    regex (RegexRequestMatcher.class),
    ciRegex (RegexRequestMatcher.class);

-    private static final Log logger = LogFactory.getLog(MatcherType.class);
-
    private static final String ATT_MATCHER_TYPE = "request-matcher";
-    private static final String ATT_PATH_TYPE = "path-type";

    private final Class<? extends RequestMatcher> type;

@@ -56,11 +51,6 @@ public enum MatcherType {
            return valueOf(elt.getAttribute(ATT_MATCHER_TYPE));
        }

-        if (StringUtils.hasText(elt.getAttribute(ATT_PATH_TYPE))) {
-            logger.warn("'" + ATT_PATH_TYPE + "' is deprecated. Please use '" + ATT_MATCHER_TYPE +"' instead.");
-            return valueOf(elt.getAttribute(ATT_PATH_TYPE));
-        }
-
        return ant;
    }
 }
@@ -137,7 +137,7 @@ public final class MessageSecurityBeanDefinitionParser implements BeanDefinition

    static class MessageSecurityPostProcessor implements BeanDefinitionRegistryPostProcessor {
        private static final String CLIENT_INBOUND_CHANNEL_BEAN_ID = "clientInboundChannel";
-        
+
        private static final String INTERCEPTORS_PROP = "interceptors";

        private static final String CUSTOM_ARG_RESOLVERS_PROP = "customArgumentResolvers";
@@ -148,7 +148,6 @@ public final class MessageSecurityBeanDefinitionParser implements BeanDefinition
            this.inboundSecurityInterceptorId = inboundSecurityInterceptorId;
        }

-        @Override
        public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {
            String[] beanNames = registry.getBeanDefinitionNames();
            for(String beanName : beanNames) {
@@ -181,7 +180,6 @@ public final class MessageSecurityBeanDefinitionParser implements BeanDefinition
            inboundChannel.getPropertyValues().add(INTERCEPTORS_PROP, interceptors);
        }

-        @Override
        public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {

        }
@@ -12,11 +12,8 @@ base64 =
    ## Whether a string should be base64 encoded
    attribute base64 {xsd:boolean}
 request-matcher =
-    ## Supersedes the 'path-type' attribute. Defines the strategy use for matching incoming requests. Currently the options are 'ant' (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for case-insensitive regular expressions.
+    ## Defines the strategy use for matching incoming requests. Currently the options are 'ant' (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for case-insensitive regular expressions.
    attribute request-matcher {"ant" | "regex" | "ciRegex"}
-path-type =
-    ## Deprecated. Use request-matcher instead.
-    attribute path-type {"ant" | "regex"}
 port =
    ## Specifies an IP port number. Used to configure an embedded LDAP server, for example.
    attribute port { xsd:positiveInteger }
@@ -323,9 +320,6 @@ http.attlist &=
    attribute security-context-repository-ref {xsd:token}?
 http.attlist &=
    request-matcher?
-http.attlist &=
-    ## Deprecated. Use request-matcher instead.
-    path-type?
 http.attlist &=
    ## Provides versions of HttpServletRequest security methods such as isUserInRole() and getPrincipal() which are implemented by accessing the Spring SecurityContext. Defaults to "true".
    attribute servlet-api-provision {xsd:boolean}?
@@ -344,9 +338,6 @@ http.attlist &=
 http.attlist &=
    ## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "true"
    attribute once-per-request {xsd:boolean}?
-http.attlist &=
-    ## Deprecated in favour of the access-denied-handler element.
-    attribute access-denied-page {xsd:token}?
 http.attlist &=
    ## Prevents the jsessionid parameter from being added to rendered URLs.
    attribute disable-url-rewriting {xsd:boolean}?
@@ -476,9 +467,6 @@ openid-attribute.attlist &=
 filter-chain-map =
    ## Used to explicitly configure a FilterChainProxy instance with a FilterChainMap
    element filter-chain-map {filter-chain-map.attlist, filter-chain+}
-filter-chain-map.attlist &=
-    ## Deprecated. Use request-matcher instead.
-    path-type?
 filter-chain-map.attlist &=
    request-matcher?

@@ -508,16 +496,9 @@ fsmds.attlist &=
 fsmds.attlist &=
    ## Compare after forcing to lowercase
    attribute lowercase-comparisons {xsd:boolean}?
-fsmds.attlist &=
-    ## Deprecate. Use request-matcher instead.
-    path-type?
 fsmds.attlist &=
    request-matcher?

-filter-invocation-definition-source =
-    ## Deprecated synonym for filter-security-metadata-source
-    element filter-invocation-definition-source {fsmds.attlist, intercept-url+}
-
 http-basic =
    ## Adds support for basic authentication
    element http-basic {http-basic.attlist, empty}
@@ -34,9 +34,9 @@
  <xs:attributeGroup name="request-matcher">
      <xs:attribute name="request-matcher" use="required">
         <xs:annotation>
-            <xs:documentation>Supersedes the 'path-type' attribute. Defines the strategy use for matching incoming
-                requests. Currently the options are 'ant' (for ant path patterns), 'regex' for regular
-                expressions and 'ciRegex' for case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'ant'
+                (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for
+                case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
@@ -48,20 +48,6 @@
         </xs:simpleType>
      </xs:attribute>
  </xs:attributeGroup>
-  <xs:attributeGroup name="path-type">
-      <xs:attribute name="path-type" use="required">
-         <xs:annotation>
-            <xs:documentation>Deprecated. Use request-matcher instead.
-                </xs:documentation>
-         </xs:annotation>
-         <xs:simpleType>
-            <xs:restriction base="xs:token">
-               <xs:enumeration value="ant"/>
-               <xs:enumeration value="regex"/>
-            </xs:restriction>
-         </xs:simpleType>
-      </xs:attribute>
-  </xs:attributeGroup>
  <xs:attributeGroup name="port">
      <xs:attribute name="port" use="required" type="xs:positiveInteger">
         <xs:annotation>
@@ -1160,9 +1146,9 @@
      </xs:attribute>
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Supersedes the 'path-type' attribute. Defines the strategy use for matching incoming
-                requests. Currently the options are 'ant' (for ant path patterns), 'regex' for regular
-                expressions and 'ciRegex' for case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'ant'
+                (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for
+                case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
@@ -1173,18 +1159,6 @@
            </xs:restriction>
         </xs:simpleType>
      </xs:attribute>
-      <xs:attribute name="path-type">
-         <xs:annotation>
-            <xs:documentation>Deprecated. Use request-matcher instead.
-                </xs:documentation>
-         </xs:annotation>
-         <xs:simpleType>
-            <xs:restriction base="xs:token">
-               <xs:enumeration value="ant"/>
-               <xs:enumeration value="regex"/>
-            </xs:restriction>
-         </xs:simpleType>
-      </xs:attribute>
      <xs:attribute name="servlet-api-provision" type="xs:boolean">
         <xs:annotation>
            <xs:documentation>Provides versions of HttpServletRequest security methods such as isUserInRole() and
@@ -1228,12 +1202,6 @@
                </xs:documentation>
         </xs:annotation>
      </xs:attribute>
-      <xs:attribute name="access-denied-page" type="xs:token">
-         <xs:annotation>
-            <xs:documentation>Deprecated in favour of the access-denied-handler element.
-                </xs:documentation>
-         </xs:annotation>
-      </xs:attribute>
      <xs:attribute name="disable-url-rewriting" type="xs:boolean">
         <xs:annotation>
            <xs:documentation>Prevents the jsessionid parameter from being added to rendered URLs.
@@ -1534,23 +1502,11 @@
      </xs:complexType>
   </xs:element>
  <xs:attributeGroup name="filter-chain-map.attlist">
-      <xs:attribute name="path-type">
-         <xs:annotation>
-            <xs:documentation>Deprecated. Use request-matcher instead.
-                </xs:documentation>
-         </xs:annotation>
-         <xs:simpleType>
-            <xs:restriction base="xs:token">
-               <xs:enumeration value="ant"/>
-               <xs:enumeration value="regex"/>
-            </xs:restriction>
-         </xs:simpleType>
-      </xs:attribute>
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Supersedes the 'path-type' attribute. Defines the strategy use for matching incoming
-                requests. Currently the options are 'ant' (for ant path patterns), 'regex' for regular
-                expressions and 'ciRegex' for case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'ant'
+                (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for
+                case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
@@ -1657,23 +1613,11 @@
                </xs:documentation>
         </xs:annotation>
      </xs:attribute>
-      <xs:attribute name="path-type">
-         <xs:annotation>
-            <xs:documentation>Deprecated. Use request-matcher instead.
-                </xs:documentation>
-         </xs:annotation>
-         <xs:simpleType>
-            <xs:restriction base="xs:token">
-               <xs:enumeration value="ant"/>
-               <xs:enumeration value="regex"/>
-            </xs:restriction>
-         </xs:simpleType>
-      </xs:attribute>
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Supersedes the 'path-type' attribute. Defines the strategy use for matching incoming
-                requests. Currently the options are 'ant' (for ant path patterns), 'regex' for regular
-                expressions and 'ciRegex' for case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'ant'
+                (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for
+                case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
@@ -1685,26 +1629,6 @@
         </xs:simpleType>
      </xs:attribute>
  </xs:attributeGroup>
-  <xs:element name="filter-invocation-definition-source">
-      <xs:annotation>
-         <xs:documentation>Deprecated synonym for filter-security-metadata-source
-                </xs:documentation>
-      </xs:annotation>
-      <xs:complexType>
-         <xs:sequence>
-            <xs:element maxOccurs="unbounded" name="intercept-url">
-               <xs:annotation>
-                  <xs:documentation>Specifies the access attributes and/or filter list for a particular set of URLs.
-                </xs:documentation>
-               </xs:annotation>
-               <xs:complexType>
-                  <xs:attributeGroup ref="security:intercept-url.attlist"/>
-               </xs:complexType>
-            </xs:element>
-         </xs:sequence>
-         <xs:attributeGroup ref="security:fsmds.attlist"/>
-      </xs:complexType>
-   </xs:element>
  
  <xs:attributeGroup name="http-basic.attlist">
      <xs:attribute name="entry-point-ref" type="xs:token">
@@ -326,10 +326,6 @@ public class NamespaceHttpTests extends BaseSpringSpec {
        }
    }

-    // http@path-type is not available (instead request matcher instances are used)
-
-    // http@pattern is not available (instead see the tests http@request-matcher-ref ant or http@request-matcher-ref regex)
-
    def "http@realm"() {
        setup:
            loadConfig(RealmConfig)
@@ -38,7 +38,6 @@ import org.springframework.security.web.SecurityFilterChain
 import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator
 import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator
 import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler
-import org.springframework.security.web.access.expression.WebSecurityExpressionHandler
 import org.springframework.security.web.util.matcher.AnyRequestMatcher
 import org.springframework.test.util.ReflectionTestUtils

@@ -200,21 +199,20 @@ class WebSecurityConfigurationTests extends BaseSpringSpec {

    def "Override webSecurityExpressionHandler"() {
        setup:
-            WebSecurityExpressionHandler expressionHandler = Mock()
+            SecurityExpressionHandler expressionHandler = Mock()
            ExpressionParser parser = Mock()
            WebSecurityExpressionHandlerConfig.EH = expressionHandler
        when:
            loadConfig(WebSecurityExpressionHandlerConfig)
        then:
-            context.getBean(WebSecurityExpressionHandler) == expressionHandler
+            context.getBean(SecurityExpressionHandler) == expressionHandler
            1 * expressionHandler.getExpressionParser() >> parser
    }

    @EnableWebSecurity
    @Configuration
    static class WebSecurityExpressionHandlerConfig extends WebSecurityConfigurerAdapter {
-        @SuppressWarnings("deprecation")
-        static WebSecurityExpressionHandler EH
+        static SecurityExpressionHandler EH

        @Override
        public void configure(WebSecurity web) throws Exception {
@@ -234,7 +232,7 @@ class WebSecurityConfigurationTests extends BaseSpringSpec {
        when:
            loadConfig(WebSecurityExpressionHandlerDefaultsConfig)
        then:
-            WebSecurityExpressionHandler wseh = context.getBean(WebSecurityExpressionHandler)
+            SecurityExpressionHandler wseh = context.getBean(SecurityExpressionHandler)
            wseh instanceof DefaultWebSecurityExpressionHandler
    }

@@ -10,20 +10,11 @@ import org.springframework.security.web.access.ExceptionTranslationFilter
 * @author Luke Taylor
 */
 class AccessDeniedConfigTests extends AbstractHttpConfigTests {
-    private static final String ACCESS_DENIED_PAGE = 'access-denied-page';
-
-    def accessDeniedPageAttributeIsSupported() {
-        httpAccessDeniedPage ('/accessDenied') { }
-        createAppContext();
-
-        expect:
-        getFilter(ExceptionTranslationFilter.class).accessDeniedHandler.errorPage == '/accessDenied'
-
-    }
-
    def invalidAccessDeniedUrlIsDetected() {
        when:
-        httpAccessDeniedPage ('noLeadingSlash') { }
+        httpAutoConfig() {
+            'access-denied-handler'('error-page':'noLeadingSlash')
+        }
        createAppContext();
        then:
        thrown(BeanCreationException)
@@ -43,16 +34,6 @@ class AccessDeniedConfigTests extends AbstractHttpConfigTests {
        filter.accessDeniedHandler == adh
    }

-    def void accessDeniedPageAndAccessDeniedHandlerAreMutuallyExclusive() {
-        when:
-        httpAccessDeniedPage ('/accessDenied') {
-            'access-denied-handler'('error-page': '/go-away')
-        }
-        createAppContext();
-        then:
-        thrown(BeanDefinitionParsingException)
-    }
-
    def void accessDeniedHandlerPageAndRefAreMutuallyExclusive() {
        when:
        httpAutoConfig {
@@ -63,8 +44,4 @@ class AccessDeniedConfigTests extends AbstractHttpConfigTests {
        then:
        thrown(BeanDefinitionParsingException)
    }
-
-    def httpAccessDeniedPage(String page, Closure c) {
-        xml.http(['auto-config': 'true', 'access-denied-page': page], c)
-    }
 }
@@ -156,7 +156,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
        when: "authenticate successfully"
            response = new MockHttpServletResponse()
            request = new MockHttpServletRequest(session: request.session)
-            request.requestURI = "/j_spring_security_check"
+            request.servletPath = "/j_spring_security_check"
            request.setParameter(token.parameterName,token.token)
            request.setParameter("j_username","user")
            request.setParameter("j_password","password")
@@ -190,7 +190,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
        when: "authenticate successfully"
            response = new MockHttpServletResponse()
            request = new MockHttpServletRequest(session: request.session)
-            request.requestURI = "/j_spring_security_check"
+            request.servletPath = "/j_spring_security_check"
            request.setParameter(token.parameterName,token.token)
            request.setParameter("j_username","user")
            request.setParameter("j_password","password")
@@ -281,7 +281,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
            request.method = "POST"
            request.setParameter("j_username","user")
            request.setParameter("j_password","password")
-            request.requestURI = "/j_spring_security_check"
+            request.servletPath = "/j_spring_security_check"
        when:
            springSecurityFilterChain.doFilter(request,response,chain)
        then:
@@ -104,18 +104,4 @@ class FormLoginConfigTests extends AbstractHttpConfigTests {
        apf.usernameParameter == 'xname';
        apf.passwordParameter == 'xpass'
    }
-
-    def 'SEC-2455: http@login-processing-url'() {
-        when:
-            xml.http {
-                'form-login'('login-processing-url':'/authenticate')
-            }
-            createAppContext()
-
-            def apf = getFilter(UsernamePasswordAuthenticationFilter);
-
-        then:
-            apf.filterProcessesUrl == null // SEC-2455 setFilterProcessesUrl was not invoked
-            FieldUtils.getFieldValue(apf,'requiresAuthenticationRequestMatcher.filterProcessesUrl') == '/authenticate'
-    }
 }
@@ -116,7 +116,7 @@ class OpenIDConfigTests extends AbstractHttpConfigTests {
        then: "Remember-me choice is added to page"
        response.getContentAsString().contains(AbstractRememberMeServices.DEFAULT_PARAMETER)
        when: "Login is submitted with remember-me selected"
-        request.setRequestURI("/j_spring_openid_security_check")
+        request.servletPath = "/j_spring_openid_security_check"
        request.setParameter(OpenIDAuthenticationFilter.DEFAULT_CLAIMED_IDENTITY_FIELD, "http://hey.openid.com/")
        request.setParameter(AbstractRememberMeServices.DEFAULT_PARAMETER, "on")
        response = new MockHttpServletResponse();
@@ -13,8 +13,9 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package org.springframework.security.config.http;
+package org.springframework.security.config.http

+import org.springframework.security.crypto.codec.Base64;

 import java.security.Principal

@@ -125,4 +126,39 @@ class InterceptUrlConfigTests extends AbstractHttpConfigTests {
        then: 'The response is unauthorized'
            response.status == HttpServletResponse.SC_UNAUTHORIZED
   }
+
+    def "intercept-url supports hasAnyRoles"() {
+        setup:
+            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET')
+            MockHttpServletResponse response = new MockHttpServletResponse()
+            MockFilterChain chain = new MockFilterChain()
+            xml.http('use-expressions':true) {
+                'http-basic'()
+                'intercept-url'(pattern: '/**', access: "hasAnyRole('ROLE_DEVELOPER','ROLE_USER')")
+                csrf(disabled:true)
+            }
+        when:
+            createAppContext()
+        then: 'no error'
+            noExceptionThrown()
+        when: 'ROLE_USER can access'
+            login(request, 'user', 'password')
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: 'The response is OK'
+            response.status == HttpServletResponse.SC_OK
+        when: 'ROLE_A cannot access'
+            request = new MockHttpServletRequest(method:'GET')
+            response = new MockHttpServletResponse()
+            chain = new MockFilterChain()
+            login(request, 'bob', 'bobspassword')
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: 'The response is Forbidden'
+            response.status == HttpServletResponse.SC_FORBIDDEN
+
+    }
+
+    def login(MockHttpServletRequest request, String username, String password) {
+        String toEncode = username + ':' + password
+        request.addHeader('Authorization','Basic ' + new String(Base64.encode(toEncode.getBytes('UTF-8'))))
+    }
 }
@@ -1,26 +0,0 @@
-package org.springframework.security.config.http
-
-import org.springframework.security.util.FieldUtils
-import org.springframework.security.web.authentication.logout.LogoutFilter
-
-/**
- *
- * @author Rob Winch
- */
-class LogoutConfigTests extends AbstractHttpConfigTests {
-
-    def 'SEC-2455: logout@logout-url'() {
-        when:
-            httpAutoConfig {
-                'logout'('logout-url':'/logout')
-                csrf(disabled:true)
-            }
-            createAppContext()
-
-            def lf = getFilter(LogoutFilter);
-
-        then:
-            lf.filterProcessesUrl == null // SEC-2455 setFilterProcessesUrl was not invoked
-            FieldUtils.getFieldValue(lf,'logoutRequestMatcher.filterProcessesUrl') == '/logout'
-    }
-}
@@ -135,7 +135,9 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {

    def accessDeniedPageWorksWithPlaceholders() {
        System.setProperty("accessDenied", "/go-away");
-        xml.http('auto-config': 'true', 'access-denied-page': '${accessDenied}')
+        xml.http('auto-config': 'true') {
+            'access-denied-handler'('error-page' : '${accessDenied}') {}
+        }
        createAppContext();

        expect:
@@ -285,7 +285,7 @@ class SessionManagementConfigTests extends AbstractHttpConfigTests {

            MockHttpServletRequest request = new MockHttpServletRequest();
            request.getSession();
-            request.setRequestURI("/j_spring_security_check");
+            request.servletPath = "/j_spring_security_check"
            request.setMethod("POST");
            request.setParameter("j_username", "user");
            request.setParameter("j_password", "password");
@@ -8,7 +8,6 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.authentication.dao.ReflectionSaltSource;
 import org.springframework.security.authentication.encoding.ShaPasswordEncoder;
 import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.authentication.AuthenticationProviderBeanDefinitionParser;
 import org.springframework.security.config.util.InMemoryXmlApplicationContext;
 import org.springframework.security.util.FieldUtils;
 import org.springframework.beans.factory.parsing.BeanDefinitionParsingException;
@@ -153,8 +152,12 @@ public class AuthenticationProviderBeanDefinitionParserTests {
                "         <b:property name='userPropertyToUse' value='username'/>" +
                "    </b:bean>" +
                "    <b:bean id='customUserService' " +
-                "           class='org.springframework.security.core.userdetails.memory.InMemoryDaoImpl'>" +
-                "        <b:property name='userMap' value='bob=f117f0862384e9497ff4f470e3522606,ROLE_A'/>" +
+                "           class='org.springframework.security.provisioning.InMemoryUserDetailsManager'>" +
+                "        <b:constructor-arg>" +
+                "            <b:props>" +
+                "                <b:prop key='bob'>f117f0862384e9497ff4f470e3522606,ROLE_A</b:prop>" +
+                "            </b:props>" +
+                "        </b:constructor-arg>" +
                "    </b:bean>");
        getProvider().authenticate(bob);
    }
@@ -98,7 +98,7 @@ public class SessionManagementConfigServlet31Tests {
        Method method = mock(Method.class);
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.getSession();
-        request.setRequestURI("/j_spring_security_check");
+        request.setServletPath("/j_spring_security_check");
        request.setMethod("POST");
        request.setParameter("j_username", "user");
        request.setParameter("j_password", "password");
@@ -124,7 +124,7 @@ public class SessionManagementConfigServlet31Tests {
        Method method = mock(Method.class);
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.getSession();
-        request.setRequestURI("/j_spring_security_check");
+        request.setServletPath("/j_spring_security_check");
        request.setMethod("POST");
        request.setParameter("j_username", "user");
        request.setParameter("j_password", "password");
@@ -30,9 +30,9 @@ public class MethodSecurityInterceptorWithAopConfigTests {

    static final String ACCESS_MANAGER_XML =
        "<b:bean id='accessDecisionManager' class='org.springframework.security.access.vote.AffirmativeBased'>" +
-        "   <b:property name='decisionVoters'>" +
+        "   <b:constructor-arg>" +
        "       <b:list><b:bean class='org.springframework.security.access.vote.RoleVoter'/></b:list>" +
-        "   </b:property>" +
+        "   </b:constructor-arg>" +
        "</b:bean>";

    static final String TARGET_BEAN_AND_INTERCEPTOR =
@@ -104,7 +104,7 @@
    <bean id="fcv" class="org.springframework.security.config.http.DefaultFilterChainValidator" />

    <bean id="newFilterChainProxyRegex" class="org.springframework.security.web.FilterChainProxy">
-        <sec:filter-chain-map path-type="regex">
+        <sec:filter-chain-map request-matcher="regex">
            <sec:filter-chain pattern="\A/foo/.*\Z" filters="mockFilter"/>
            <sec:filter-chain pattern="\A/s[oO]me/other/path/.*\Z" filters="sif,mockFilter,mockFilter2"/>
            <sec:filter-chain pattern="\A/do/not/filter\Z" filters="none"/>