Commit Graph
3308 Commits
Author SHA1 Message Date
Josh Cummings 0c42016781 Merge branch '7.0.x' 2026-02-26 17:11:06 -07:00
Josh Cummings 1575610d49 Add Tests
Issue gh-18486

Signed-off-by: Josh Cummings <[email protected]>
2026-02-26 17:10:55 -07:00
Michael Lück 3a14745d92 Delegate calls of hasAuthority to AuthorizationManager#hasAuthority
Closes gh-18486

Signed-off-by: Michael Lück <[email protected]>
2026-02-26 17:10:55 -07:00
Andrey Litvitski 6d4726bfb7 Mark targetDomainObject as @Nullable in PermissionEvaluator
Closes: gh-18259

Signed-off-by: Andrey Litvitski <[email protected]>
2026-02-24 10:55:06 -06:00
Robert Winch ac06067d02 Revert "Mark targetDomainObject as @Nullable in PermissionEvaluator"
This reverts commit 9f1381c382.
2026-02-24 09:40:54 -06:00
Andrey Litvitski 9f1381c382 Mark targetDomainObject as @Nullable in PermissionEvaluator
Closes: gh-18259

Signed-off-by: Andrey Litvitski <[email protected]>
2026-02-24 08:27:44 -06:00
Robert Winch cfb3bf38d8 Merge Fix: Handle null authority string in AuthoritiesAuthorizationManager into main 2026-02-23 10:54:00 -06:00
Robert Winch 151bcf3b0b Merge Fix: Handle null authority string in AuthoritiesAuthorizationManager into 7.0.x 2026-02-23 10:53:40 -06:00
Robert Winch 1116241ee3 Fix Checks for NullPointerException in AuthoritiesAuthorizationManager
- Fix checkstyle
- Fix the test to use Collection that throws NullPointerException on .contains(null) to replicate the reported issue

Closes gh-18544

Signed-off-by: Robert Winch <[email protected]>
2026-02-23 10:47:11 -06:00
Khyojae d87dc9ae57 Fix: Handle null authority string in AuthoritiesAuthorizationManager
This prevents NPE when GrantedAuthority.getAuthority() returns null. Closes gh-18543

Signed-off-by: Khyojae <[email protected]>
2026-02-23 09:30:28 -06:00
Robert Winch 21978cab22 Fix Build Errors for Improve AOT RuntimeHits
- Saml2RuntimeHints consistently uses String in separate method for
  to ensure no classpath issues
- Fix Whitespace/Checkstyle
- Add Missing Nullability Annotations
2026-02-20 17:28:35 -06:00
Josh Long 2dd2863550 aot improvements
Signed-off-by: Josh Long <[email protected]>
2026-02-20 17:28:35 -06:00
Minu Kim 18068c9099 fix compile warning in spring-security-test
Signed-off-by: Minu Kim <[email protected]>
2026-02-19 14:26:20 -06:00
Tran Ngoc Nhan dbf7f4cfe5 Remove unused @Nullable
Signed-off-by: Tran Ngoc Nhan <[email protected]>
2026-02-19 10:56:54 -06:00
earlgrey02 5194826606 implement single-line RSA key support
Signed-off-by: earlgrey02 <[email protected]>
2026-02-17 17:29:04 -07:00
Tran Ngoc Nhan da0cd0bc68 Remove unused import
Signed-off-by: Tran Ngoc Nhan <[email protected]>
2026-02-17 16:59:55 -07:00
Tran Ngoc Nhan 17933ddab3 Resolve feedback
Signed-off-by: Tran Ngoc Nhan <[email protected]>
2026-02-17 16:59:55 -07:00
Tran Ngoc Nhan 9323775c5f Update javadoc and apply StringUtils#hasLength
Signed-off-by: Tran Ngoc Nhan <[email protected]>
2026-02-17 16:59:55 -07:00
Tran Ngoc Nhan 4cc5f543ab Add author
Signed-off-by: Tran Ngoc Nhan <[email protected]>
2026-02-17 16:59:55 -07:00
Tran Ngoc Nhan e91b098c7c Update javadoc
Signed-off-by: Tran Ngoc Nhan <[email protected]>
2026-02-17 16:59:55 -07:00
Robert Winch 6a6c7a7a78 Add missing @Nullable to setters of Nullable Fields
There are setters and builder methods that initialize members that are
`@Nullable` but do not accept `@Nullable` parameters.

For example:

```
private @Nullable Object foo;

public void setFoo(Object foo) {
    this.foo = foo;
}
```

It is an unnecessary restriction that the parameter is unable to be null
since the field can be null.

This commit fixes these inconsistencies.

Closes gh-18618
2026-01-29 13:58:42 -06:00
Robert Winch b591a0a757 TestingAuthenticationToken.credentials should be @Nullable
Closes gh-18615
2026-01-29 10:17:22 -06:00
Andrey Litvitski 0a182f1f20 Add @Nullable to changePassword parameters in UserDetailsManager
Closes: gh-18257

Signed-off-by: Andrey Litvitski <[email protected]>
2026-01-23 15:06:10 -06:00
Robert Winch d7fbf3673a Fix consistency with Nullability Usage
Issue gh-18564
2026-01-23 10:42:53 -06:00
Robert Winch 1cfb3033e9 Run ./gradlew foramt
Fixes formatting for gh-18516
2026-01-21 16:08:04 -06:00
chanjin-lee 021f84b2df Core: Fix Javadoc invalid references and improve clarity
- Update package-info to reference AuthorizationManager instead of AccessDecisionManager
- Improve RoleHierarchyUtils documentation with fromHierarchy() and builder-based alternatives
- Refine AuthenticationTrustResolver return description by removing redundant comma and symbol

Signed-off-by: chanjin-lee <[email protected]>
2026-01-21 16:08:04 -06:00
chanjin-lee e5b934d1a5 Core: Remove javadoc warnings
Closes gh-18449

Signed-off-by: chanjin-lee <[email protected]>
2026-01-21 16:08:04 -06:00
Robert Winch 9f8ac34c3b Remove @NullUnmarked
Closes gh-18491
2026-01-21 14:11:25 -06:00
Robert Winch 6e9b4f86a4 Fix nullability for JDK 25
Closes gh-18511
2026-01-16 10:53:19 -06:00
Marcus Hert da Coregio 8254f589b8 Create Jackson Mixin for OneTimeTokenAuthentication
Closes gh-18095

Signed-off-by: Marcus Hert da Coregio <[email protected]>
2026-01-14 10:35:02 -07:00
Andrey Litvitski 13f6286e04 Use DefaultParameterNameDiscoverer#getSharedInstance
Closes: gh-18330

Signed-off-by: Andrey Litvitski <[email protected]>
2026-01-12 13:37:32 -06:00
Tran Ngoc Nhan 79815e044e Fix typos
Signed-off-by: Tran Ngoc Nhan <[email protected]>
2026-01-08 13:35:43 -06:00
Joe Grandja e6b4d461e7 Fix OAuth2AuthorizationServerJacksonModule type validator configuration
Closes gh-18102
2025-10-30 07:19:45 -04:00
Josh Cummings 3a84894bf4 Revert "Add AuthorizationProxyMixin"
This reverts commit 743817fc15.
2025-10-27 17:30:44 -06:00
Josh Cummings 743817fc15 Add AuthorizationProxyMixin
This commit adds Jackson configuration specific to
authorization proxies created by Spring Security

Closes gh-18077
2025-10-20 17:16:21 -06:00
Josh Cummings 0a2f55d485 Clarify Nullability in Granted Authority Lambda
Issue gh-17999
2025-10-20 15:22:24 -06:00
Andrey Litvitski 9b61533db2 Mark GrantedAuthority#getAuthority as @Nullable
Closes: gh-17999

Signed-off-by: Andrey Litvitski <[email protected]>
2025-10-20 15:22:24 -06:00
Josh Cummings eb43830260 Polish JavaDoc
1. Removed comment about not changing field name in a
serialized object as this is true for all fields in a
Java-serialize POJO
2. Added example value for the constructor that demonstrates
the relationship between a role and an authority

Signed-off-by: Josh Cummings <[email protected]>
2025-10-20 15:18:11 -06:00
Yanming Zhou b55c28cf25 Polish SimpleGrantedAuthority
1. Add Javadoc to state that role is prefixed.
2. Rename constructor argument from `role` to `authority` for better readability.

Signed-off-by: Yanming Zhou <[email protected]>
2025-10-20 15:18:11 -06:00
Rob Winch 9dc27bee03 Link to gh-18077 2025-10-19 17:03:19 -05:00
Rob Winch d309f1887e Remove Extra Blank Line from CoreJacksonModule 2025-10-19 17:03:19 -05:00
Rob Winch 50568da1e5 Add Jackson 3 TestingAuthenticationToken Support
Without this many of the tests fail when using Jackson 3
2025-10-19 17:03:19 -05:00
Sébastien Deleuze 48854c3ac9 Deprecate Jackson 2 support
This commit does not cover webauthn which is a special case (uses
jackson sub-package for Jackson 2 support) which will be handled in
a distinct commit.

See gh-17832
Signed-off-by: Sébastien Deleuze <[email protected]>
2025-10-19 17:03:19 -05:00
Sébastien Deleuze 65a14d6c6d Add Jackson 3 support
This commit adds support for Jackson 3 which has the following
major differences with the Jackson 2 one:
 - jackson subpackage instead of jackson2
 - Jackson type prefix instead of Jackson2
 - JsonMapper instead of ObjectMapper
 - For configuration, JsonMapper.Builder instead of ObjectMapper
   since the latter is now immutable
 - Remove custom support for unmodifiable collections
 - Use safe default typing via a PolymorphicTypeValidator

Jackson 3 changes compared to Jackson 2 are documented in
https://cowtowncoder.medium.com/jackson-3-0-0-ga-released-1f669cda529a
and
https://github.com/FasterXML/jackson/blob/main/jackson3/MIGRATING_TO_JACKSON_3.md.

This commit does not cover webauthn which is a special case (uses
jackson sub-package for Jackson 2 support) which will be handled in
a distinct commit.

See gh-17832
Signed-off-by: Sébastien Deleuze <[email protected]>
2025-10-19 17:03:19 -05:00
Josh Cummings a435175723 Clean Up Generic Typing in Builder
Issue gh-17997
2025-10-17 11:13:00 -06:00
Josh Cummings b1a50a25b6 Check If toBuilder Is Implemented
Since RC1 is right around the corner, let's change the API
footprint as little as possible by using reflection to check
if a class has declared toBuilder themselves. If they have, we
can assume that that class's builder will produce that class.

Issue gh-18052
2025-10-16 13:41:45 -06:00
Josh Cummings 2e7cdd7b14 Revert "Merge branch 'builder-enhancements'"
This reverts commit 95644fb73c, reversing
changes made to fbf7bb3be1.

Reverting this commit will allow us more time to
consider the ideal way to add this support to the public API.
2025-10-16 13:41:45 -06:00
parthokr 938a5a7c77 Fix typo in AuthenticationProvider Javadoc
Signed-off-by: parthokr <[email protected]>
2025-10-16 13:54:00 -05:00
Josh Cummings 21ff7688cc Move Builder to Authentication
Leaving the Builder in Authentication allows
authentication implementations to implement Builder
without needing to implement BuildableAuthentication.

Issue gh-18052
2025-10-15 12:01:11 -06:00
Josh Cummings 4102007119 Add Builder#authentication
This commit consolidates logic common to applying one
authenticaiton to another. Specifically, it will copy the
authorities in one authentication into the builder instance
of another.

Closes gh-18053
2025-10-15 12:01:11 -06:00