DaoAuthenticationProvider uses DelegatingPasswordEncoder

This means that passwords will be encoded with BCrypt by default

Fixes: gh-2775

samples/boot/helloworld/src/main/java/org/springframework/security/samples/config/SecurityConfig.java

@@ -20,6 +20,7 @@ import org.springframework.security.config.annotation.authentication.builders.Au
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.userdetails.User;
 
 /**
  * @author Joe Grandja
@@ -44,7 +45,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
 		auth
 			.inMemoryAuthentication()
-				.withUser("user").password("password").roles("USER");
+				.withUser(User.withDefaultPasswordEncoder().username("user").password("password").roles("USER"));
 	}
 	// @formatter:on
 }

samples/javaconfig/form/src/main/java/org/springframework/security/samples/config/SecurityConfig.java

@@ -20,6 +20,7 @@ import org.springframework.security.config.annotation.authentication.builders.Au
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.userdetails.User;
 
 @EnableWebSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
@@ -47,7 +48,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 			AuthenticationManagerBuilder auth) throws Exception {
 		auth
 			.inMemoryAuthentication()
-				.withUser("user").password("password").roles("USER");
+				.withUser(User.withDefaultPasswordEncoder().username("user").password("password").roles("USER"));
 	}
 	// @formatter:on
 }

samples/javaconfig/hellomvc/src/main/java/org/springframework/security/samples/config/SecurityConfig.java

@@ -18,6 +18,7 @@ package org.springframework.security.samples.config;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.userdetails.User;
 
 @EnableWebSecurity
 public class SecurityConfig {
@@ -28,7 +29,7 @@ public class SecurityConfig {
 			AuthenticationManagerBuilder auth) throws Exception {
 		auth
 			.inMemoryAuthentication()
-				.withUser("user").password("password").roles("USER");
+				.withUser(User.withDefaultPasswordEncoder().username("user").password("password").roles("USER"));
 	}
 	// @formatter:on
 }

samples/javaconfig/helloworld/src/main/java/org/springframework/security/samples/config/SecurityConfig.java

@@ -18,6 +18,7 @@ package org.springframework.security.samples.config;
 import org.springframework.context.annotation.Bean;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 
@@ -27,9 +28,8 @@ public class SecurityConfig {
 	// @formatter:off
 	@Bean
 	public UserDetailsService userDetailsService() throws Exception {
-		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
-		manager.createUser(User.withUsername("user").password("password").roles("USER").build());
-		return manager;
+		UserDetails user = User.withDefaultPasswordEncoder().username("user").password("password").roles("USER").build();
+		return new InMemoryUserDetailsManager(user);
 	}
 	// @formatter:on
 }

samples/javaconfig/inmemory/src/main/java/org/springframework/security/samples/config/SecurityConfig.java

@@ -15,21 +15,23 @@
  */
 package org.springframework.security.samples.config;
 
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.context.annotation.Bean;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 
 @EnableWebSecurity
 public class SecurityConfig {
 
 	// @formatter:off
-	@Autowired
-	public void configureGlobal(
-			AuthenticationManagerBuilder auth) throws Exception {
-		auth
-			.inMemoryAuthentication()
-				.withUser("user").password("password").roles("USER").and()
-				.withUser("admin").password("password").roles("USER","ADMIN");
+	@Bean
+	public UserDetailsService userDetailsService() throws Exception {
+		User.UserBuilder builder = User.withDefaultPasswordEncoder();
+		UserDetails user = builder.username("user").password("password").roles("USER").build();
+		UserDetails admin = builder.username("admin").password("password").roles("USER", "ADMIN").build();
+		return new InMemoryUserDetailsManager(user, admin);
 	}
 		// @formatter:on
 }

samples/javaconfig/jdbc/src/main/java/org/springframework/security/samples/config/SecurityConfig.java

@@ -20,6 +20,7 @@ import javax.sql.DataSource;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.userdetails.User;
 
 @EnableWebSecurity
 public class SecurityConfig {
@@ -33,7 +34,7 @@ public class SecurityConfig {
 			.jdbcAuthentication()
 				.dataSource(dataSource)
 				.withDefaultSchema()
-				.withUser("user").password("password").roles("USER");
+				.withUser(User.withDefaultPasswordEncoder().username("user").password("password").roles("USER"));
 	}
 	// @formatter:on
-}
+}

samples/xml/helloworld/src/main/webapp/WEB-INF/spring/security.xml

@@ -6,6 +6,6 @@
 	<http />
 
 	<user-service>
-		<user name="user" password="password" authorities="ROLE_USER" />
+		<user name="user" password="{noop}password" authorities="ROLE_USER" />
 	</user-service>
-</b:beans>
+</b:beans>