Release version 3.2.3.RELEASE

2026-07-11 22:00:04 +00:00 · 2014-03-25 12:04:52 -07:00
282 changed files with 4325 additions and 9611 deletions
@@ -18,4 +18,5 @@ build/
 *.ipr
 *.iws
 .gradle/
-atlassian-ide-plugin.xml
+atlassian-ide-plugin.xml
+/samples
@@ -1,58 +0,0 @@
-= Spring Security
-
-Spring Security provides security services for the http://docs.spring.io[Spring IO Platform]. Spring Security 3.1 requires Spring 3.0.3 as
-a minimum and also requires Java 5.
-
-For a detailed list of features and access to the latest release, please visit http://spring.io/projects[Spring projects].
-
-== Downloading Artifacts
-See https://github.com/spring-projects/spring-framework/wiki/Downloading-Spring-artifacts[downloading Spring artifacts] for Maven repository information.
-
-== Documentation
-Be sure to read the http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/[Spring Security Reference].
-Extensive JavaDoc for the Spring Security code is also available in the http://docs.spring.io/spring-security/site/docs/current/apidocs/[Spring Security API Documentation].
-
-== Quick Start
-We recommend you visit http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/[Spring Security Reference] and read the "Getting Started" page.
-
-== Building from Source
-Spring Security uses a http://gradle.org[Gradle]-based build system.
-In the instructions below, http://vimeo.com/34436402[`./gradlew`] is invoked from the root of the source tree and serves as
-a cross-platform, self-contained bootstrap mechanism for the build.
-
-=== Prerequisites
-http://help.github.com/set-up-git-redirect[Git] and the http://www.oracle.com/technetwork/java/javase/downloads[JDK7 build].
-
-Be sure that your `JAVA_HOME` environment variable points to the `jdk1.7.0` folder extracted from the JDK download.
-
-=== Check out sources
-[indent=0]
----
-git clone git@github.com:spring-projects/spring-security.git
----
-
-=== Install all spring-\* jars into your local Maven cache
-[indent=0]
----
-./gradlew install
----
-
-=== Compile and test; build all jars, distribution zips, and docs
-[indent=0]
----
-./gradlew build
----
-
-Discover more commands with `./gradlew tasks`.
-See also the https://github.com/spring-projects/spring-framework/wiki/Gradle-build-and-release-FAQ[Gradle build and release FAQ].
-
-== Getting Support
-Check out the http://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
-http://spring.io/services[Commercial support] is available too.
-
-== Contributing
-http://help.github.com/send-pull-requests[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/master/CONTRIBUTING.md[contributor guidelines] for details.
-
-== License
-Spring Security is Open Source software released under the
-http://www.apache.org/licenses/LICENSE-2.0.html[Apache 2.0 license].
@@ -2,14 +2,13 @@

 dependencies {
    compile project(':spring-security-core'),
-            springCoreDependency,
            'aopalliance:aopalliance:1.0',
            "org.springframework:spring-aop:$springVersion",
            "org.springframework:spring-context:$springVersion",
            "org.springframework:spring-tx:$springVersion",
            "org.springframework:spring-jdbc:$springVersion"

-    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache:$ehcacheVersion"

    testCompile "org.springframework:spring-beans:$springVersion",
                "org.springframework:spring-context-support:$springVersion",
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-acl</artifactId>
-  <version>3.2.10.RELEASE</version>
+  <version>3.2.3.RELEASE</version>
  <name>spring-security-acl</name>
  <description>spring-security-acl</description>
  <url>http://spring.io/spring-security</url>
@@ -30,6 +31,17 @@
    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
    <url>https://github.com/spring-projects/spring-security</url>
  </scm>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -40,25 +52,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.10.RELEASE</version>
+      <version>3.2.3.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <exclusions>
        <exclusion>
@@ -70,13 +82,13 @@
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-tx</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -88,8 +100,8 @@
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache-core</artifactId>
-      <version>1.7.2</version>
+      <artifactId>ehcache</artifactId>
+      <version>1.6.2</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
@@ -102,7 +114,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -120,7 +132,7 @@
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
-      <version>1.10.19</version>
+      <version>1.9.5</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -132,31 +144,20 @@
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-beans</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context-support</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>
@@ -3,7 +3,6 @@ package org.springframework.security.acls;
 import java.io.Serializable;
 import java.util.Arrays;
 import java.util.List;
-import java.util.Locale;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -122,9 +121,8 @@ public class AclPermissionEvaluator implements PermissionEvaluator {

            try {
                p = permissionFactory.buildFromName(permString);
-            }
-            catch (IllegalArgumentException notfound) {
-                p = permissionFactory.buildFromName(permString.toUpperCase(Locale.ENGLISH));
+            } catch(IllegalArgumentException notfound) {
+                p = permissionFactory.buildFromName(permString.toUpperCase());
            }

            if (p != null) {
@@ -4,8 +4,6 @@ import static org.junit.Assert.assertTrue;
 import static org.mockito.Matchers.*;
 import static org.mockito.Mockito.*;

-import java.util.Locale;
-
 import org.junit.Test;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AclService;
@@ -38,26 +36,4 @@ public class AclPermissionEvaluatorTests {

        assertTrue(pe.hasPermission(mock(Authentication.class), new Object(), "READ"));
    }
-
-    @Test
-    public void resolvePermissionNonEnglishLocale() {
-        Locale systemLocale = Locale.getDefault();
-        Locale.setDefault(new Locale("tr"));
-
-        AclService service = mock(AclService.class);
-        AclPermissionEvaluator pe = new AclPermissionEvaluator(service);
-        ObjectIdentity oid = mock(ObjectIdentity.class);
-        ObjectIdentityRetrievalStrategy oidStrategy = mock(ObjectIdentityRetrievalStrategy.class);
-        when(oidStrategy.getObjectIdentity(anyObject())).thenReturn(oid);
-        pe.setObjectIdentityRetrievalStrategy(oidStrategy);
-        pe.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
-        Acl acl = mock(Acl.class);
-
-        when(service.readAclById(any(ObjectIdentity.class), anyList())).thenReturn(acl);
-        when(acl.isGranted(anyList(), anyList(), eq(false))).thenReturn(true);
-
-        assertTrue(pe.hasPermission(mock(Authentication.class), new Object(), "write"));
-
-        Locale.setDefault(systemLocale);
-    }
 }
@@ -1,28 +1,11 @@
 package org.springframework.security.acls.jdbc;

-import static org.mockito.Mockito.*;
 import static org.junit.Assert.*;
-import static org.fest.assertions.Assertions.*;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
-import java.io.Serializable;
-import java.util.List;

+import net.sf.ehcache.Cache;
+import net.sf.ehcache.CacheManager;
 import net.sf.ehcache.Ehcache;
-import net.sf.ehcache.Element;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.ArgumentCaptor;
-import org.mockito.Captor;
-import org.mockito.Mock;
-import org.mockito.runners.MockitoJUnitRunner;
+import org.junit.*;
 import org.springframework.security.acls.domain.AclAuthorizationStrategy;
 import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
 import org.springframework.security.acls.domain.AclImpl;
@@ -36,43 +19,50 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.util.FieldUtils;
-import org.springframework.test.util.ReflectionTestUtils;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.util.*;

 /**
 * Tests {@link EhCacheBasedAclCache}
 *
 * @author Andrei Stefan
 */
-@RunWith(MockitoJUnitRunner.class)
 public class EhCacheBasedAclCacheTests {
    private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";

-    @Mock
-    private Ehcache cache;
-    @Captor
-    private ArgumentCaptor<Element> element;
+    private static CacheManager cacheManager;

-    private EhCacheBasedAclCache myCache;
+    @BeforeClass
+    public static void initCacheManaer() {
+        cacheManager = CacheManager.create();
+        // Use disk caching immediately (to test for serialization issue reported in SEC-527)
+        cacheManager.addCache(new Cache("ehcachebasedacltests", 0, true, false, 600, 300));
+    }

-    private MutableAcl acl;
-
-    @Before
-    public void setup() {
-        myCache = new EhCacheBasedAclCache(cache);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-
-        acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
+    @AfterClass
+    public static void shutdownCacheManager() {
+        cacheManager.removalAll();
+        cacheManager.shutdown();
    }

    @After
-    public void cleanup() {
+    public void clearContext() {
        SecurityContextHolder.clearContext();
    }

+    private Ehcache getCache() {
+        Ehcache cache = cacheManager.getCache("ehcachebasedacltests");
+        cache.removeAll();
+
+        return cache;
+    }
+
    @Test(expected=IllegalArgumentException.class)
    public void constructorRejectsNullParameters() throws Exception {
        new EhCacheBasedAclCache(null);
@@ -80,6 +70,9 @@ public class EhCacheBasedAclCacheTests {

    @Test
    public void methodsRejectNullParameters() throws Exception {
+        Ehcache cache = new MockEhcache();
+        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
+
        try {
            Serializable id = null;
            myCache.evictFromCache(id);
@@ -129,6 +122,12 @@ public class EhCacheBasedAclCacheTests {
    // SEC-527
    @Test
    public void testDiskSerializationOfMutableAclObjectInstance() throws Exception {
+        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
+        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
+                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
+                new SimpleGrantedAuthority("ROLE_GENERAL"));
+        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
+
        // Serialization test
        File file = File.createTempFile("SEC_TEST", ".object");
        FileOutputStream fos = new FileOutputStream(file);
@@ -151,117 +150,111 @@ public class EhCacheBasedAclCacheTests {
    }

    @Test
-    public void clearCache() throws Exception {
-        myCache.clearCache();
+    public void cacheOperationsAclWithoutParent() throws Exception {
+        Ehcache cache = getCache();
+        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);

-        verify(cache).removeAll();
-    }
+        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
+        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
+                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
+                new SimpleGrantedAuthority("ROLE_GENERAL"));
+        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());

-    @Test
-    public void putInCache() throws Exception {
+        assertEquals(0, cache.getDiskStoreSize());
        myCache.putInCache(acl);
+        assertEquals(cache.getSize(), 2);
+        assertEquals(2, cache.getDiskStoreSize());
+        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
+        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));

-        verify(cache, times(2)).put(element.capture());
-        assertThat(element.getValue().getKey()).isEqualTo(acl.getId());
-        assertThat(element.getValue().getObjectValue()).isEqualTo(acl);
-        assertThat(element.getAllValues().get(0).getKey()).isEqualTo(acl.getObjectIdentity());
-        assertThat(element.getAllValues().get(0).getObjectValue()).isEqualTo(acl);
+        // Check we can get from cache the same objects we put in
+        assertEquals(myCache.getFromCache(Long.valueOf(1)), acl);
+        assertEquals(myCache.getFromCache(identity), acl);
+
+        // Put another object in cache
+        ObjectIdentity identity2 = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(101));
+        MutableAcl acl2 = new AclImpl(identity2, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
+
+        myCache.putInCache(acl2);
+        assertEquals(cache.getSize(), 4);
+        assertEquals(4, cache.getDiskStoreSize());
+
+        // Try to evict an entry that doesn't exist
+        myCache.evictFromCache(Long.valueOf(3));
+        myCache.evictFromCache(new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(102)));
+        assertEquals(cache.getSize(), 4);
+        assertEquals(4, cache.getDiskStoreSize());
+
+        myCache.evictFromCache(Long.valueOf(1));
+        assertEquals(cache.getSize(), 2);
+        assertEquals(2, cache.getDiskStoreSize());
+
+        // Check the second object inserted
+        assertEquals(myCache.getFromCache(Long.valueOf(2)), acl2);
+        assertEquals(myCache.getFromCache(identity2), acl2);
+
+        myCache.evictFromCache(identity2);
+        assertEquals(cache.getSize(), 0);
    }

+    @SuppressWarnings("unchecked")
    @Test
-    public void putInCacheAclWithParent() throws Exception {
+    public void cacheOperationsAclWithParent() throws Exception {
+        Ehcache cache = getCache();
+        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
+
        Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_GENERAL");
        auth.setAuthenticated(true);
        SecurityContextHolder.getContext().setAuthentication(auth);

+        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(1));
        ObjectIdentity identityParent = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(2));
        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
                new SimpleGrantedAuthority("ROLE_GENERAL"));
+        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
        MutableAcl parentAcl = new AclImpl(identityParent, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
+
        acl.setParent(parentAcl);

+        assertEquals(0, cache.getDiskStoreSize());
        myCache.putInCache(acl);
+        assertEquals(cache.getSize(), 4);
+        assertEquals(4, cache.getDiskStoreSize());
+        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
+        assertTrue(cache.isElementOnDisk(Long.valueOf(1)));
+        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));
+        assertFalse(cache.isElementInMemory(Long.valueOf(1)));
+        cache.flush();
+        // Wait for the spool to be written to disk (it's asynchronous)
+        Map spool = (Map) FieldUtils.getFieldValue(cache, "diskStore.spool");

-        verify(cache, times(4)).put(element.capture());
+        while(spool.size() > 0) {
+            Thread.sleep(50);
+        }

-        List<Element> allValues = element.getAllValues();
-
-        assertThat(allValues.get(0).getKey()).isEqualTo(parentAcl.getObjectIdentity());
-        assertThat(allValues.get(0).getObjectValue()).isEqualTo(parentAcl);
-
-        assertThat(allValues.get(1).getKey()).isEqualTo(parentAcl.getId());
-        assertThat(allValues.get(1).getObjectValue()).isEqualTo(parentAcl);
-
-
-        assertThat(allValues.get(2).getKey()).isEqualTo(acl.getObjectIdentity());
-        assertThat(allValues.get(2).getObjectValue()).isEqualTo(acl);
-
-        assertThat(allValues.get(3).getKey()).isEqualTo(acl.getId());
-        assertThat(allValues.get(3).getObjectValue()).isEqualTo(acl);
+        // Check we can get from cache the same objects we put in
+        AclImpl aclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(1));
+        // For the checks on transient fields, we need to be sure that the object is being loaded from the cache,
+        // not from the ehcache spool or elsewhere...
+        assertFalse(acl == aclFromCache);
+        assertEquals(acl, aclFromCache);
+        // SEC-951 check transient fields are set on parent
+        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "aclAuthorizationStrategy"));
+        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "permissionGrantingStrategy"));
+        assertEquals(acl, myCache.getFromCache(identity));
+        assertNotNull(FieldUtils.getFieldValue(aclFromCache, "aclAuthorizationStrategy"));
+        AclImpl parentAclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(2));
+        assertEquals(parentAcl, parentAclFromCache);
+        assertNotNull(FieldUtils.getFieldValue(parentAclFromCache, "aclAuthorizationStrategy"));
+        assertEquals(parentAcl, myCache.getFromCache(identityParent));
    }

-    @Test
-    public void getFromCacheSerializable() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
+    //~ Inner Classes ==================================================================================================

-        assertThat(myCache.getFromCache(acl.getId())).isEqualTo(acl);
-    }
-
-    @Test
-    public void getFromCacheSerializablePopulatesTransient() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.putInCache(acl);
-
-        ReflectionTestUtils.setField(acl, "permissionGrantingStrategy", null);
-        ReflectionTestUtils.setField(acl, "aclAuthorizationStrategy", null);
-
-        MutableAcl fromCache = myCache.getFromCache(acl.getId());
-
-        assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
-        assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
-    }
-
-    @Test
-    public void getFromCacheObjectIdentity() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
-
-        assertThat(myCache.getFromCache(acl.getId())).isEqualTo(acl);
-    }
-
-    @Test
-    public void getFromCacheObjectIdentityPopulatesTransient() throws Exception {
-        when(cache.get(acl.getObjectIdentity())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.putInCache(acl);
-
-        ReflectionTestUtils.setField(acl, "permissionGrantingStrategy", null);
-        ReflectionTestUtils.setField(acl, "aclAuthorizationStrategy", null);
-
-        MutableAcl fromCache = myCache.getFromCache(acl.getObjectIdentity());
-
-        assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
-        assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
-    }
-
-    @Test
-    public void evictCacheSerializable() throws Exception {
-        when(cache.get(acl.getObjectIdentity())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.evictFromCache(acl.getObjectIdentity());
-
-        verify(cache).remove(acl.getId());
-        verify(cache).remove(acl.getObjectIdentity());
-    }
-
-    @Test
-    public void evictCacheObjectIdentity() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.evictFromCache(acl.getId());
-
-        verify(cache).remove(acl.getId());
-        verify(cache).remove(acl.getObjectIdentity());
+    private class MockEhcache extends Cache {
+        public MockEhcache() {
+            super("cache", 0, true, true, 0, 0);
+        }
    }
 }
@@ -1,7 +1,6 @@

 dependencies {
    compile project(':spring-security-core'),
-            springCoreDependency,
            "org.springframework:spring-beans:$springVersion",
            "org.springframework:spring-context:$springVersion"

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-aspects</artifactId>
-  <version>3.2.10.RELEASE</version>
+  <version>3.2.3.RELEASE</version>
  <name>spring-security-aspects</name>
  <description>spring-security-aspects</description>
  <url>http://spring.io/spring-security</url>
@@ -30,29 +31,40 @@
    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
    <url>https://github.com/spring-projects/spring-security</url>
  </scm>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
  <dependencies>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.10.RELEASE</version>
+      <version>3.2.3.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-beans</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <exclusions>
        <exclusion>
@@ -90,7 +102,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -102,7 +114,7 @@
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
-      <version>1.10.19</version>
+      <version>1.9.5</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -114,25 +126,14 @@
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>
@@ -2,14 +2,15 @@ import groovy.text.SimpleTemplateEngine

 buildscript {
    repositories {
-        maven { url "https://repo.spring.io/plugins-release" }
+        maven { url "http://repo.springsource.org/plugins-release" }
    }
    dependencies {
-        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.7")
-        classpath("org.springframework.build.gradle:spring-io-plugin:0.0.3.RELEASE")
-        classpath("org.gradle.api.plugins:gradle-tomcat-plugin:1.2.3")
+        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.5")
+        classpath("org.springframework.build.gradle:bundlor-plugin:0.1.2")
+        classpath("org.gradle.api.plugins:gradle-tomcat-plugin:0.9.8")
        classpath('me.champeau.gradle:gradle-javadoc-hotfix-plugin:0.1')
-        classpath('org.asciidoctor:asciidoctor-gradle-plugin:1.5.1')
+        classpath('org.asciidoctor:asciidoctor-gradle-plugin:0.7.0')
+        classpath('org.asciidoctor:asciidoctor-java-integration:0.1.4.preview.1')
    }
 }

@@ -24,8 +25,8 @@ allprojects {

    ext.releaseBuild = version.endsWith('RELEASE')
    ext.snapshotBuild = version.endsWith('SNAPSHOT')
-    ext.springVersion = '3.2.18.RELEASE'
-    ext.spring4Version = '4.1.6.RELEASE'
+    ext.springVersion = '3.2.8.RELEASE'
+    ext.spring4Version = '4.0.2.RELEASE'
    ext.springLdapVersion = '1.3.2.RELEASE'
    ext.springLdap2Version = '2.0.1.RELEASE'

@@ -60,7 +61,7 @@ ext.javaProjects = subprojects.findAll { project -> project.name != 'docs' && pr
 ext.sampleProjects = subprojects.findAll { project -> project.name.startsWith('spring-security-samples') }
 ext.itestProjects = subprojects.findAll { project -> project.name.startsWith('itest') }
 ext.coreModuleProjects = javaProjects - sampleProjects - itestProjects
-ext.aspectjProjects = [project(':spring-security-aspects'), project(':spring-security-samples-aspectj-xml'), project(':spring-security-samples-aspectj-jc')]
+ext.aspectjProjects = [project(':spring-security-aspects'), project(':spring-security-samples-aspectj-xml')]

 configure(allprojects - javaProjects) {
    task afterEclipseImport {
@@ -97,17 +98,36 @@ configure(javaProjects) {
 }

 configure(coreModuleProjects) {
+    apply plugin: 'bundlor'
    apply plugin: 'emma'
-    apply plugin: 'spring-io'
-
-    ext.springIoVersion = project.hasProperty('platformVersion') ? platformVersion : '1.1.5.RELEASE'

+    bundlor.doFirst {
+        def templateText = file("template.mf").text
+        bundlor.manifestTemplate = new SimpleTemplateEngine().createTemplate(templateText).make(bundlorProperties).toString()
+    }
    configurations {
        jacoco //Configuration Group used by Sonar to provide Code Coverage using JaCoCo
+        spring4TestRuntime.extendsFrom testRuntime
    }
+    configurations.spring4TestRuntime {
+        resolutionStrategy.eachDependency { DependencyResolveDetails details ->
+            if (details.requested.group == 'org.springframework') {
+                details.useVersion spring4Version
+            }
+            if (details.requested.name == 'ehcache') {
+                details.useVersion '2.6.5'
+            }
+            if (details.requested.name == 'ehcache-terracotta') {
+                details.useVersion '2.1.1'
+            }
+            if (details.requested.group == 'org.springframework.ldap') {
+                details.useVersion springLdap2Version
+            }
+        }
+    }
+
    dependencies {
        jacoco "org.jacoco:org.jacoco.agent:0.6.2.201302030002:runtime"
-        springIoVersions "io.spring.platform:platform-versions:${springIoVersion}@properties"
    }
    test {
        jvmArgs "-javaagent:${configurations.jacoco.asPath}=destfile=${buildDir}/jacoco.exec,includes=${project.group}.*"
@@ -115,6 +135,14 @@ configure(coreModuleProjects) {
    integrationTest {
        jvmArgs "-javaagent:${configurations.jacoco.asPath}=destfile=${buildDir}/jacoco.exec,includes=${project.group}.*"
    }
+    task spring4Test(type: Test) {
+        jvmArgs = ['-ea', '-Xmx500m', '-XX:MaxPermSize=128M']
+        exclude "**/EhCacheBasedAclCacheTests.class", "**/Issue55Tests.class"
+        classpath = sourceSets.test.output + sourceSets.main.output + configurations.spring4TestRuntime
+        testResultsDir = file("$buildDir/spring4-test-results/")
+        testReportDir = file("$buildDir/reports/spring4-tests/")
+    }
+    check.dependsOn spring4Test
 }

 configure (aspectjProjects) {
@@ -138,7 +166,6 @@ task dist(type: Zip) {
    def zipRootDir = "${project.name}-$version"
    into(zipRootDir) {
        from(rootDir) {
-            include '*.adoc'
            include '*.txt'
        }
        into('docs') {
@@ -167,5 +194,5 @@ artifacts {
 }

 task wrapper(type: Wrapper) {
-    gradleVersion = '1.12'
+    gradleVersion = '1.10-rc-2'
 }
@@ -30,7 +30,7 @@ class AspectJPlugin implements Plugin<Project> {
        }

        if (project.configurations.findByName('ajtools') == null) {
-            project.configurations.create('ajtools')
+            project.configurations.add('ajtools')
            project.dependencies {
                ajtools "org.aspectj:aspectjtools:${project.aspectjVersion}"
                optional "org.aspectj:aspectjrt:${project.aspectjVersion}"
@@ -38,10 +38,10 @@ class AspectJPlugin implements Plugin<Project> {
        }

        if (project.configurations.findByName('aspectpath') == null) {
-            project.configurations.create('aspectpath')
+            project.configurations.add('aspectpath')
        }

-        project.tasks.create(name: 'compileAspect', overwrite: true, description: 'Compiles AspectJ Source', type: Ajc) {
+        project.tasks.add(name: 'compileAspect', overwrite: true, description: 'Compiles AspectJ Source', type: Ajc) {
            dependsOn project.configurations*.getTaskDependencyFromProjectDependency(true, "compileJava")

            dependsOn project.processResources
@@ -54,7 +54,7 @@ class AspectJPlugin implements Plugin<Project> {
        project.tasks.compileJava.dependsOn project.tasks.compileAspect


-        project.tasks.create(name: 'compileTestAspect', overwrite: true, description: 'Compiles AspectJ Test Source', type: Ajc) {
+        project.tasks.add(name: 'compileTestAspect', overwrite: true, description: 'Compiles AspectJ Test Source', type: Ajc) {
            dependsOn project.processTestResources, project.compileJava, project.jar
            sourceSet = project.sourceSets.test
            inputs.files(sourceSet.allSource)
@@ -21,7 +21,7 @@ class EmmaPlugin implements Plugin<Project> {
        def emmaCoverageFile = "${rootProject.buildDir}/emma/emma.ec"

        if (project.configurations.findByName('emma_rt') == null) {
-            project.configurations.create('emma_rt')
+            project.configurations.add('emma_rt')
            project.dependencies {
                emma_rt 'emma:emma:2.0.5312'
            }
@@ -64,7 +64,7 @@ class EmmaPlugin implements Plugin<Project> {
        CoverageReport task;

        if (reportTasks.isEmpty()) {
-            task = rootProject.tasks.create('coverageReport', CoverageReport.class);
+            task = rootProject.tasks.add('coverageReport', CoverageReport.class);
            task.dataPath = [emmaMetaDataFile, emmaCoverageFile];
        } else {
            task = reportTasks[0];
@@ -17,7 +17,7 @@ import org.gradle.api.file.FileCollection
 */
 class TrangPlugin implements Plugin<Project> {
    public void apply(Project project) {
-        Task rncToXsd = project.tasks.create('rncToXsd', RncToXsd.class)
+        Task rncToXsd = project.tasks.add('rncToXsd', RncToXsd.class)
        rncToXsd.description = 'Converts .rnc to .xsd'
        rncToXsd.group = 'Build'
    }
@@ -2,13 +2,12 @@
 dependencies {
    compile project(':spring-security-core'),
            project(':spring-security-web'),
-            springCoreDependency,
            "org.springframework:spring-context:$springVersion",
            "org.springframework:spring-beans:$springVersion",
            "org.springframework:spring-web:$springVersion",
-            "org.jasig.cas.client:cas-client-core:3.3.3"
+            "org.jasig.cas.client:cas-client-core:3.2.1"

-    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache:$ehcacheVersion"

-    provided "javax.servlet:javax.servlet-api:$servletApiVersion"
+    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
 }
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-cas</artifactId>
-  <version>3.2.10.RELEASE</version>
+  <version>3.2.3.RELEASE</version>
  <name>spring-security-cas</name>
  <description>spring-security-cas</description>
  <url>http://spring.io/spring-security</url>
@@ -30,112 +31,6 @@
    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
    <url>https://github.com/spring-projects/spring-security</url>
  </scm>
-  <dependencies>
-    <dependency>
-      <groupId>org.jasig.cas.client</groupId>
-      <artifactId>cas-client-core</artifactId>
-      <version>3.3.3</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-core</artifactId>
-      <version>3.2.10.RELEASE</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-web</artifactId>
-      <version>3.2.10.RELEASE</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-beans</artifactId>
-      <version>3.2.18.RELEASE</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-context</artifactId>
-      <version>3.2.18.RELEASE</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <version>3.2.18.RELEASE</version>
-      <scope>compile</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>commons-logging</artifactId>
-          <groupId>commons-logging</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-web</artifactId>
-      <version>3.2.18.RELEASE</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>commons-logging</groupId>
-      <artifactId>commons-logging</artifactId>
-      <version>1.1.1</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache-core</artifactId>
-      <version>1.7.2</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>javax.servlet-api</artifactId>
-      <version>3.0.1</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>ch.qos.logback</groupId>
-      <artifactId>logback-classic</artifactId>
-      <version>0.9.29</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <version>4.11</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.easytesting</groupId>
-      <artifactId>fest-assert</artifactId>
-      <version>1.4</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.mockito</groupId>
-      <artifactId>mockito-core</artifactId>
-      <version>1.10.19</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>jcl-over-slf4j</artifactId>
-      <version>1.7.5</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-test</artifactId>
-      <version>3.2.18.RELEASE</version>
-      <scope>test</scope>
-    </dependency>
-  </dependencies>
  <build>
    <plugins>
      <plugin>
@@ -147,4 +42,110 @@
      </plugin>
    </plugins>
  </build>
+  <dependencies>
+    <dependency>
+      <groupId>org.jasig.cas.client</groupId>
+      <artifactId>cas-client-core</artifactId>
+      <version>3.2.1</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.security</groupId>
+      <artifactId>spring-security-core</artifactId>
+      <version>3.2.3.RELEASE</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.security</groupId>
+      <artifactId>spring-security-web</artifactId>
+      <version>3.2.3.RELEASE</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-beans</artifactId>
+      <version>3.2.8.RELEASE</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-context</artifactId>
+      <version>3.2.8.RELEASE</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-core</artifactId>
+      <version>3.2.8.RELEASE</version>
+      <scope>compile</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>commons-logging</artifactId>
+          <groupId>commons-logging</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-web</artifactId>
+      <version>3.2.8.RELEASE</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>commons-logging</groupId>
+      <artifactId>commons-logging</artifactId>
+      <version>1.1.1</version>
+      <scope>compile</scope>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <groupId>net.sf.ehcache</groupId>
+      <artifactId>ehcache</artifactId>
+      <version>1.6.2</version>
+      <scope>compile</scope>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-servlet-api</artifactId>
+      <version>7.0.33</version>
+      <scope>provided</scope>
+    </dependency>
+    <dependency>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
+      <version>0.9.29</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.10</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.easytesting</groupId>
+      <artifactId>fest-assert</artifactId>
+      <version>1.4</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <version>1.9.5</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>jcl-over-slf4j</artifactId>
+      <version>1.7.5</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-test</artifactId>
+      <version>3.2.8.RELEASE</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
 </project>
@@ -49,7 +49,9 @@ public class ServiceProperties implements InitializingBean {
    //~ Methods ========================================================================================================

    public void afterPropertiesSet() throws Exception {
-        Assert.hasLength(this.service, "service cannot be empty.");
+        if(!authenticateAllArtifacts) {
+            Assert.hasLength(this.service, "service must be specified unless authenticateAllArtifacts is true.");
+        }
        Assert.hasLength(this.artifactParameter, "artifactParameter cannot be empty.");
        Assert.hasLength(this.serviceParameter, "serviceParameter cannot be empty.");
    }
@@ -15,8 +15,6 @@
 */
 package org.springframework.security.cas.web.authentication;

-import java.net.MalformedURLException;
-import java.net.URL;
 import java.util.regex.Pattern;

 import javax.servlet.http.HttpServletRequest;
@@ -52,13 +50,11 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
     *            string from containing the artifact name and value. This can
     *            be created using {@link #createArtifactPattern(String)}.
     */
-    DefaultServiceAuthenticationDetails(String casService, HttpServletRequest request, Pattern artifactPattern) throws MalformedURLException {
+    DefaultServiceAuthenticationDetails(HttpServletRequest request, Pattern artifactPattern) {
        super(request);
-        URL casServiceUrl = new URL(casService);
-        int port = getServicePort(casServiceUrl);
        final String query = getQueryString(request,artifactPattern);
-        this.serviceUrl = UrlUtils.buildFullRequestUrl(casServiceUrl.getProtocol(),
-                casServiceUrl.getHost(), port,
+        this.serviceUrl = UrlUtils.buildFullRequestUrl(request.getScheme(),
+                request.getServerName(), request.getServerPort(),
                request.getRequestURI(), query);
    }

@@ -132,17 +128,4 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
        Assert.hasLength(artifactParameterName);
        return Pattern.compile("&?"+Pattern.quote(artifactParameterName)+"=[^&]*");
    }
-
-    /**
-     * Gets the port from the casServiceURL ensuring to return the proper value if the default port is being used.
-     * @param casServiceUrl the casServerUrl to be used (i.e. "https://example.com/context/j_spring_security_cas_check")
-     * @return the port that is configured for the casServerUrl
-     */
-    private static int getServicePort(URL casServiceUrl) {
-        int port = casServiceUrl.getPort();
-        if(port == -1) {
-            port = casServiceUrl.getDefaultPort();
-        }
-        return port;
-    }
 }
@@ -15,18 +15,12 @@
 */
 package org.springframework.security.cas.web.authentication;

-import java.net.MalformedURLException;
 import java.util.regex.Pattern;

 import javax.servlet.http.HttpServletRequest;

-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
 import org.springframework.security.authentication.AuthenticationDetailsSource;
 import org.springframework.security.cas.ServiceProperties;
-import org.springframework.util.Assert;

 /**
 * The {@code AuthenticationDetailsSource} that is set on the
@@ -39,33 +33,20 @@ import org.springframework.util.Assert;
 * @author Rob Winch
 */
 public class ServiceAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest,
-        ServiceAuthenticationDetails>, ApplicationContextAware {
+        ServiceAuthenticationDetails> {
    //~ Instance fields ================================================================================================

    private final Pattern artifactPattern;

-    private ServiceProperties serviceProperties;
-
    //~ Constructors ===================================================================================================

    /**
     * Creates an implementation that uses the default CAS artifactParameterName.
-     * @deprecated Use ServiceAuthenticationDetailsSource(ServiceProperties)
     */
-    @Deprecated
    public ServiceAuthenticationDetailsSource() {
        this(ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
    }

-    /**
-     * Creates an implementation that uses the specified ServiceProperites and the default CAS artifactParameterName.
-     *
-     * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
-     */
-    public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties) {
-        this(serviceProperties,ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
-    }
-
    /**
     * Creates an implementation that uses the specified artifactParameterName
     *
@@ -73,27 +54,11 @@ public class ServiceAuthenticationDetailsSource implements AuthenticationDetails
     *            the artifactParameterName that is removed from the current
     *            URL. The result becomes the service url. Cannot be null and
     *            cannot be an empty String.
-     * @deprecated Use ServiceAuthenticationDetailsSource(ServiceProperties,String)
     */
    public ServiceAuthenticationDetailsSource(final String artifactParameterName) {
        this.artifactPattern = DefaultServiceAuthenticationDetails.createArtifactPattern(artifactParameterName);
    }

-    /**
-     * Creates an implementation that uses the specified artifactParameterName
-     *
-     * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
-     * @param artifactParameterName
-     *            the artifactParameterName that is removed from the current
-     *            URL. The result becomes the service url. Cannot be null and
-     *            cannot be an empty String.
-     */
-    public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties, String artifactParameterName) {
-        Assert.notNull(serviceProperties, "serviceProperties cannot be null");
-        this.serviceProperties = serviceProperties;
-        this.artifactPattern = DefaultServiceAuthenticationDetails.createArtifactPattern(artifactParameterName);
-    }
-
    //~ Methods ========================================================================================================

    /**
@@ -101,17 +66,6 @@ public class ServiceAuthenticationDetailsSource implements AuthenticationDetails
     * @return the {@code ServiceAuthenticationDetails} containing information about the current request
     */
    public ServiceAuthenticationDetails buildDetails(HttpServletRequest context) {
-        try {
-            return new DefaultServiceAuthenticationDetails(serviceProperties.getService(),context,artifactPattern);
-        } catch (MalformedURLException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Override
-    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-        if(serviceProperties == null) {
-            serviceProperties = applicationContext.getBean(ServiceProperties.class);
-        }
+        return new DefaultServiceAuthenticationDetails(context,artifactPattern);
    }
 }
@@ -36,13 +36,10 @@ public class ServicePropertiesTests {
    }

    @Test
-    public void nullServiceWhenAuthenticateAllTokens() throws Exception {
+    public void allowNullServiceWhenAuthenticateAllTokens() throws Exception {
        ServiceProperties sp = new ServiceProperties();
        sp.setAuthenticateAllArtifacts(true);
-        try {
-            sp.afterPropertiesSet();
-            fail("Expected Exception");
-        }catch(IllegalArgumentException success) {}
+        sp.afterPropertiesSet();
        sp.setAuthenticateAllArtifacts(false);
        try {
            sp.afterPropertiesSet();
@@ -18,21 +18,11 @@ import static org.junit.Assert.assertEquals;

 import java.util.regex.Pattern;

-import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.xml.XmlBeanDefinitionReader;
-import org.springframework.context.ConfigurableApplicationContext;
-import org.springframework.context.support.ClassPathXmlApplicationContext;
-import org.springframework.context.support.GenericApplicationContext;
-import org.springframework.context.support.GenericXmlApplicationContext;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.cas.ServiceProperties;
 import org.springframework.security.web.util.UrlUtils;
-import org.springframework.test.context.ContextConfiguration;
-import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;

 /**
 *
@@ -42,13 +32,9 @@ public class DefaultServiceAuthenticationDetailsTests {
    private DefaultServiceAuthenticationDetails details;
    private MockHttpServletRequest request;
    private Pattern artifactPattern;
-    private String casServiceUrl;
-
-    private ConfigurableApplicationContext context;

    @Before
    public void setUp() {
-        casServiceUrl = "https://localhost:8443/j_spring_security_cas";
        request = new MockHttpServletRequest();
        request.setScheme("https");
        request.setServerName("localhost");
@@ -58,82 +44,45 @@ public class DefaultServiceAuthenticationDetailsTests {

    }

-    @After
-    public void cleanup() {
-        if(context != null) {
-            context.close();
-        }
-    }
-
    @Test
    public void getServiceUrlNullQuery() throws Exception {
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
-        assertEquals(UrlUtils.buildFullRequestUrl(request), details.getServiceUrl());
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
+        assertEquals(UrlUtils.buildFullRequestUrl(request),details.getServiceUrl());
    }

    @Test
-    public void getServiceUrlTicketOnlyParam() throws Exception {
+    public void getServiceUrlTicketOnlyParam() {
        request.setQueryString("ticket=123");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
        String serviceUrl = details.getServiceUrl();
        request.setQueryString(null);
        assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
    }

    @Test
-    public void getServiceUrlTicketFirstMultiParam() throws Exception {
+    public void getServiceUrlTicketFirstMultiParam() {
        request.setQueryString("ticket=123&other=value");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
        String serviceUrl = details.getServiceUrl();
        request.setQueryString("other=value");
        assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
    }

    @Test
-    public void getServiceUrlTicketLastMultiParam() throws Exception {
+    public void getServiceUrlTicketLastMultiParam() {
        request.setQueryString("other=value&ticket=123");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
        String serviceUrl = details.getServiceUrl();
        request.setQueryString("other=value");
        assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
    }

    @Test
-    public void getServiceUrlTicketMiddleMultiParam() throws Exception {
+    public void getServiceUrlTicketMiddleMultiParam() {
        request.setQueryString("other=value&ticket=123&last=this");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
        String serviceUrl = details.getServiceUrl();
        request.setQueryString("other=value&last=this");
        assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
    }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeader() throws Exception {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
-        assertEquals("https://example.com/cas-sample/secure/",details.getServiceUrl());
-    }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeaderPassivity() {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        ServiceAuthenticationDetails details = loadServiceAuthenticationDetails("defaultserviceauthenticationdetails-passivity.xml");
-        assertEquals("https://example.com/cas-sample/secure/", details.getServiceUrl());
-    }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeaderExplicit() {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        ServiceAuthenticationDetails details = loadServiceAuthenticationDetails("defaultserviceauthenticationdetails-explicit.xml");
-        assertEquals("https://example.com/cas-sample/secure/", details.getServiceUrl());
-    }
-
-    private ServiceAuthenticationDetails loadServiceAuthenticationDetails(String resourceName) {
-        context = new GenericXmlApplicationContext(getClass(), resourceName);
-        ServiceAuthenticationDetailsSource source = context.getBean(ServiceAuthenticationDetailsSource.class);
-        return source.buildDetails(request);
-    }
 }
@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
-
-    <bean id="serviceProperties"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-    <bean id="serviceProperties2"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example2.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-
-    <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
-        <constructor-arg ref="serviceProperties"/>
-    </bean>
-</beans>
@@ -1,15 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
-
-    <bean id="serviceProperties"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-
-    <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
-</beans>
@@ -14,7 +14,7 @@ Import-Template:
 org.springframework.security.core.*;version="${secRange}",
 org.springframework.security.authentication.*;version="${secRange}",
 org.springframework.security.web.*;version="${secRange}",
- org.springframework.beans.*;version="${springRange}",
+ org.springframework.beans.factory;version="${springRange}",
 org.springframework.cache.*;version="${springRange}";resolution:=optional,
 org.springframework.context.*;version="${springRange}",
 org.springframework.dao;version="${springRange}",
@@ -10,7 +10,6 @@ compileTestJava.dependsOn(':spring-security-core:compileTestJava')
 dependencies {
    // NB: Don't add other compile time dependencies to the config module as this breaks tooling
    compile project(':spring-security-core'),
-            springCoreDependency,
            'aopalliance:aopalliance:1.0',
            "org.springframework:spring-aop:$springVersion",
            "org.springframework:spring-context:$springVersion",
@@ -19,14 +18,13 @@ dependencies {
    optional project(':spring-security-web'),
             project(':spring-security-ldap'),
             project(':spring-security-openid'),
-             project(':spring-security-aspects'),
             "org.springframework:spring-web:$springVersion",
             "org.springframework:spring-webmvc:$springVersion",
             "org.aspectj:aspectjweaver:$aspectjVersion",
             "org.springframework:spring-jdbc:$springVersion",
             "org.springframework:spring-tx:$springVersion"

-    provided "javax.servlet:javax.servlet-api:$servletApiVersion"
+    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"

    testCompile project(':spring-security-cas'),
                project(':spring-security-core').sourceSets.test.output,
@@ -36,8 +34,10 @@ dependencies {
                "org.springframework:spring-jdbc:$springVersion",
                "org.springframework:spring-orm:$springVersion",
                "org.springframework:spring-tx:$springVersion",
+                "org.spockframework:spock-core:$spockVersion",
+                "org.spockframework:spock-spring:$spockVersion",
                "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-                "org.eclipse.persistence:javax.persistence:2.0.5",
+                "org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.1.Final",
                "org.hibernate:hibernate-entitymanager:4.1.0.Final",
                "org.codehaus.groovy:groovy-all:$groovyVersion",
                "org.apache.directory.server:apacheds-core:$apacheDsVersion",
@@ -48,15 +48,12 @@ dependencies {
                'org.apache.directory.shared:shared-ldap:0.9.15',
                'ldapsdk:ldapsdk:4.1',
                powerMockDependencies,
+                "org.springframework.data:spring-data-jpa:1.2.0.RELEASE",
+                "org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.0.Final",
                 "org.hibernate:hibernate-entitymanager:3.6.10.Final",
-                "org.hsqldb:hsqldb:2.2.8",
-                spockDependencies
-
+                "org.hsqldb:hsqldb:2.2.8"
    testCompile('org.openid4java:openid4java-nodeps:0.9.6') {
-        exclude group: 'com.google.code.guice', module: 'guice'
-    }
-    testCompile('org.springframework.data:spring-data-jpa:1.4.1.RELEASE') {
-        exclude group: 'org.aspectj', module: 'aspectjrt'
+       exclude group: 'com.google.code.guice', module: 'guice'
    }

    testRuntime "org.hsqldb:hsqldb:$hsqlVersion",
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-config</artifactId>
-  <version>3.2.10.RELEASE</version>
+  <version>3.2.3.RELEASE</version>
  <name>spring-security-config</name>
  <description>spring-security-config</description>
  <url>http://spring.io/spring-security</url>
@@ -30,6 +31,17 @@
    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
    <url>https://github.com/spring-projects/spring-security</url>
  </scm>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -40,31 +52,31 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.10.RELEASE</version>
+      <version>3.2.3.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-beans</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <exclusions>
        <exclusion>
@@ -87,66 +99,59 @@
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-aspects</artifactId>
-      <version>3.2.10.RELEASE</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-ldap</artifactId>
-      <version>3.2.10.RELEASE</version>
+      <version>3.2.3.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-openid</artifactId>
-      <version>3.2.10.RELEASE</version>
+      <version>3.2.3.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.10.RELEASE</version>
+      <version>3.2.3.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-tx</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>javax.servlet-api</artifactId>
-      <version>3.0.1</version>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-servlet-api</artifactId>
+      <version>7.0.33</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -170,7 +175,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -228,9 +233,15 @@
      <scope>test</scope>
    </dependency>
    <dependency>
-      <groupId>org.eclipse.persistence</groupId>
-      <artifactId>javax.persistence</artifactId>
-      <version>2.0.5</version>
+      <groupId>org.hibernate.javax.persistence</groupId>
+      <artifactId>hibernate-jpa-2.0-api</artifactId>
+      <version>1.0.0.Final</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.hibernate.javax.persistence</groupId>
+      <artifactId>hibernate-jpa-2.0-api</artifactId>
+      <version>1.0.1.Final</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -239,6 +250,18 @@
      <version>4.1.0.Final</version>
      <scope>test</scope>
    </dependency>
+    <dependency>
+      <groupId>org.hibernate</groupId>
+      <artifactId>hibernate-entitymanager</artifactId>
+      <version>3.6.10.Final</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.hsqldb</groupId>
+      <artifactId>hsqldb</artifactId>
+      <version>2.2.8</version>
+      <scope>test</scope>
+    </dependency>
    <dependency>
      <groupId>org.hsqldb</groupId>
      <artifactId>hsqldb</artifactId>
@@ -248,7 +271,7 @@
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
-      <version>1.10.19</version>
+      <version>1.9.5</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -266,43 +289,37 @@
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-api-mockito</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-api-support</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-core</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-module-junit4</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-module-junit4-common</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-reflect</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -316,36 +333,18 @@
      <artifactId>spock-core</artifactId>
      <version>0.7-groovy-2.0</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>junit-dep</artifactId>
-          <groupId>junit</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.spockframework</groupId>
      <artifactId>spock-spring</artifactId>
      <version>0.7-groovy-2.0</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>junit-dep</artifactId>
-          <groupId>junit</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework.data</groupId>
      <artifactId>spring-data-jpa</artifactId>
-      <version>1.4.1.RELEASE</version>
+      <version>1.2.0.RELEASE</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>aspectjrt</artifactId>
-          <groupId>org.aspectj</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework.ldap</groupId>
@@ -356,37 +355,26 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-cas</artifactId>
-      <version>3.2.10.RELEASE</version>
+      <version>3.2.3.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-expression</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-orm</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>
@@ -1,61 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.authentication.ldap
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
-import org.springframework.security.config.annotation.BaseSpringSpec
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.ldap.NamespaceLdapAuthenticationProviderTestsConfigs.LdapAuthenticationProviderConfig
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
-import org.springframework.security.ldap.authentication.LdapAuthenticationProvider
-import org.springframework.security.ldap.authentication.PasswordComparisonAuthenticator
-import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator
-import org.springframework.security.ldap.userdetails.PersonContextMapper
-import org.springframework.test.util.ReflectionTestUtils
-
-import static org.springframework.security.config.annotation.authentication.ldap.NamespaceLdapAuthenticationProviderTestsConfigs.*
-
-/**
- *
- * @author Rob Winch
- *
- */
-class LdapAuthenticationProviderConfigurerTests extends BaseSpringSpec {
-
-    def "authentication-manager support multiple default ldap contexts (ports dynamically allocated)"() {
-        when:
-            loadConfig(MultiLdapAuthenticationProvidersConfig)
-        then:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class MultiLdapAuthenticationProvidersConfig extends WebSecurityConfigurerAdapter {
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .ldapAuthentication()
-                    .groupSearchBase("ou=groups")
-                    .userDnPatterns("uid={0},ou=people")
-                    .and()
-                .ldapAuthentication()
-                    .groupSearchBase("ou=groups")
-                    .userDnPatterns("uid={0},ou=people")
-        }
-    }
-}
@@ -1,13 +1,7 @@
 package org.springframework.security.config.ldap

-
-import static org.mockito.Mockito.*
-
 import java.text.MessageFormat
-
 import org.springframework.beans.factory.config.PropertyPlaceholderConfigurer
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder
 import org.springframework.security.config.AbstractXmlConfigTests
 import org.springframework.security.config.BeanIds
 import org.springframework.security.util.FieldUtils
@@ -42,7 +36,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {


    def simpleProviderAuthenticatesCorrectly() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
        xml.'authentication-manager'{
            'ldap-authentication-provider'('group-search-filter':'member={0}')
        }
@@ -72,7 +66,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
    }

    def supportsPasswordComparisonAuthentication() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
        xml.'authentication-manager'{
            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people')
            'password-compare'
@@ -89,7 +83,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
    }

    def supportsPasswordComparisonAuthenticationWithHashAttribute() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
        xml.'authentication-manager'{
            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
                'password-compare'('password-attribute': 'uid', hash: 'plaintext')
@@ -108,7 +102,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
    }

    def supportsPasswordComparisonAuthenticationWithPasswordEncoder() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
        xml.'authentication-manager'{
            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
                'password-compare'('password-attribute': 'uid') {
@@ -128,28 +122,6 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
        notThrown(AuthenticationException)
    }

-    def 'SEC-2472: Supports Crypto PasswordEncoder'() {
-        setup:
-        xml.'ldap-server'(ldif:'test-server.ldif')
-        xml.'authentication-manager'{
-            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
-                'password-compare'() {
-                    'password-encoder'(ref: 'pe')
-                }
-            }
-        }
-        xml.'b:bean'(id:'pe','class':BCryptPasswordEncoder.class.name)
-
-        createAppContext('')
-        def am = appContext.getBean(BeanIds.AUTHENTICATION_MANAGER)
-
-        when:
-        def auth = am.authenticate(new UsernamePasswordAuthenticationToken("bcrypt", 'password'))
-
-        then:
-        auth != null
-    }
-
    def inetOrgContextMapperIsSupported()  {
        xml.'ldap-server'(url: 'ldap://127.0.0.1:343/dc=springframework,dc=org')
        xml.'authentication-manager'{
@@ -15,12 +15,10 @@
 */
 package org.springframework.security.config.annotation.authentication.ldap

-import org.springframework.beans.factory.config.AutowireCapableBeanFactory
 import org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory;
 import org.springframework.context.annotation.AnnotationConfigApplicationContext;
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.context.annotation.Import
 import org.springframework.ldap.core.ContextSource;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
 import org.springframework.security.authentication.AuthenticationManager
@@ -29,13 +27,7 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.SecurityBuilder;
 import org.springframework.security.config.annotation.authentication.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication
-import org.springframework.security.config.annotation.configuration.AutowireBeanFactoryObjectPostProcessor
-import org.springframework.security.config.annotation.configuration.AutowireBeanFactoryObjectPostProcessorTests
-import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
 import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
 import org.springframework.security.ldap.server.ApacheDSContainer;
@@ -65,7 +57,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
            auth
                .ldapAuthentication()
                    .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
        }
    }

@@ -83,7 +74,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
            auth
                .ldapAuthentication()
                    .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                    .groupRoleAttribute("group")
        }
    }
@@ -102,7 +92,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
            auth
                .ldapAuthentication()
                    .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                    .groupSearchFilter("ou=groupName");
        }
    }
@@ -121,7 +110,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
            auth
                .ldapAuthentication()
                    .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                    .rolePrefix("role_")
        }
    }
@@ -132,7 +120,7 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
        AuthenticationManager auth = context.getBean(AuthenticationManager)
        then:
        auth
-        auth.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword")).authorities.collect { it.authority }.sort() == ["ROLE_DEVELOPERS"]
+        auth.authenticate(new UsernamePasswordAuthenticationToken("admin","password")).authorities.collect { it.authority }.sort() == ["ROLE_ADMIN","ROLE_USER"]
    }

    @Configuration
@@ -142,29 +130,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
                .ldapAuthentication()
                    .contextSource(contextSource())
                    .groupSearchBase("ou=groups")
-                    .groupSearchFilter("(member={0})")
-                    .userDnPatterns("uid={0},ou=people");
-        }
-    }
-
-    def "SEC-2472: Can use crypto PasswordEncoder"() {
-        setup:
-        loadConfig(PasswordEncoderConfig)
-        when:
-        AuthenticationManager auth = context.getBean(AuthenticationManager)
-        then:
-        auth.authenticate(new UsernamePasswordAuthenticationToken("bcrypt","password")).authorities.collect { it.authority }.sort() == ["ROLE_DEVELOPERS"]
-    }
-
-    @Configuration
-    static class PasswordEncoderConfig extends BaseLdapServerConfig {
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .ldapAuthentication()
-                    .contextSource(contextSource())
-                    .passwordEncoder(new BCryptPasswordEncoder())
-                    .groupSearchBase("ou=groups")
-                    .groupSearchFilter("(member={0})")
                    .userDnPatterns("uid={0},ou=people");
        }
    }
@@ -177,44 +142,23 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
    static abstract class BaseLdapServerConfig extends BaseLdapProviderConfig {
        @Bean
        public ApacheDSContainer ldapServer() throws Exception {
-            ApacheDSContainer apacheDSContainer = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/test-server.ldif");
-            apacheDSContainer.setPort(getPort());
+            ApacheDSContainer apacheDSContainer = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/users.ldif");
+            apacheDSContainer.setPort(33389);
            return apacheDSContainer;
        }
    }

    @Configuration
-    @EnableGlobalAuthentication
-    @Import(ObjectPostProcessorConfiguration)
    static abstract class BaseLdapProviderConfig {

        @Bean
        public BaseLdapPathContextSource contextSource() throws Exception {
            DefaultSpringSecurityContextSource contextSource = new DefaultSpringSecurityContextSource(
-                    "ldap://127.0.0.1:"+ getPort() + "/dc=springframework,dc=org")
+                    "ldap://127.0.0.1:33389/dc=springframework,dc=org")
            contextSource.userDn = "uid=admin,ou=system"
            contextSource.password = "secret"
-            contextSource.afterPropertiesSet()
+            contextSource.afterPropertiesSet();
            return contextSource;
        }
-
-        @Bean
-        public AuthenticationManager authenticationManager(AuthenticationManagerBuilder auth) {
-            configure(auth)
-            auth.build()
-        }
-
-        abstract protected void configure(AuthenticationManagerBuilder auth)
-    }
-
-    static Integer port;
-
-    static int getPort() {
-        if(port == null) {
-            ServerSocket socket = new ServerSocket(0)
-            port = socket.localPort
-            socket.close()
-        }
-        port
    }
 }
@@ -40,7 +40,7 @@ class NamespaceLdapAuthenticationProviderTests extends BaseSpringSpec {
        when:
            loadConfig(LdapAuthenticationProviderConfig)
        then:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password")).authorities*.authority.sort() == ['ROLE_USER']
    }

    def "ldap-authentication-provider custom"() {
@@ -75,6 +75,6 @@ class NamespaceLdapAuthenticationProviderTests extends BaseSpringSpec {
            LdapAuthenticationProvider provider = findAuthenticationProvider(LdapAuthenticationProvider)
        then:
            provider.authenticator instanceof PasswordComparisonAuthenticator
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password")).authorities*.authority.sort() == ['ROLE_USER']
    }
 }
@@ -56,7 +56,7 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
                    .userSearchFilter("(uid={0})") // ldap-authentication-provider@user-search-filter
                    // .contextSource(contextSource) // ldap-authentication-provider@server-ref
                    .contextSource()
-                        .ldif("classpath:users.xldif") // ldap-server@ldif
+                        .ldif("classpath:user.ldif") // ldap-server@ldif
                        .managerDn("uid=admin,ou=system") // ldap-server@manager-dn
                        .managerPassword("secret") // ldap-server@manager-password
                        .port(33399) // ldap-server@port
@@ -28,16 +28,6 @@ sn: Alex
 uid: ben
 userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=

-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$FBAKClV1zBIOOC9XMXf3AO8RoGXYVYsfvUdoLxGkd/BnXEn4tqT3u
-
 dn: uid=bob,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
@@ -68,22 +58,11 @@ sn: Mouse
 uid: jerry
 userPassword: jerryspassword

-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$lDa0YFNHAt63MjIzK/wUqeM0qjIhzPhp3RNI/MLUQEAUbzhB/SnnS
-
 dn: cn=developers,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfNames
 cn: developers
 ou: developer
-member: uid=bcrypt,ou=people,dc=springframework,dc=org
 member: uid=ben,ou=people,dc=springframework,dc=org
 member: uid=bob,ou=people,dc=springframework,dc=org

@@ -0,0 +1,42 @@
+dn: ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: groups
+
+dn: ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: people
+
+dn: uid=admin,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Rod Johnson
+sn: Johnson
+uid: admin
+userPassword: password
+
+dn: uid=user,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Dianne Emu
+sn: Emu
+uid: user
+userPassword: password
+
+dn: cn=user,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: user
+uniqueMember: uid=admin,ou=people,dc=springframework,dc=org
+uniqueMember: uid=user,ou=people,dc=springframework,dc=org
+
+dn: cn=admin,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: admin
+uniqueMember: uid=admin,ou=people,dc=springframework,dc=org
@@ -1,92 +0,0 @@
-dn: ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: groups
-
-dn: ou=subgroups,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: subgroups
-
-dn: ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: people
-
-dn: ou=otherpeople,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: otherpeople
-
-dn: uid=ben,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Ben Alex
-sn: Alex
-uid: ben
-userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=
-
-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$lDa0YFNHAt63MjIzK/wUqeM0qjIhzPhp3RNI/MLUQEAUbzhB/SnnS
-
-dn: uid=bob,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Bob Hamilton
-sn: Hamilton
-uid: bob
-userPassword: bobspassword
-
-dn: uid=joe,ou=otherpeople,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Joe Smeth
-sn: Smeth
-uid: joe
-userPassword: joespassword
-
-dn: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Mouse, Jerry
-sn: Mouse
-uid: jerry
-userPassword: jerryspassword
-
-dn: cn=developers,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: developers
-ou: developer
-member: uid=ben,ou=people,dc=springframework,dc=org
-member: uid=bob,ou=people,dc=springframework,dc=org
-
-dn: cn=managers,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: managers
-ou: manager
-member: uid=ben,ou=people,dc=springframework,dc=org
-member: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
-
-dn: cn=submanagers,ou=subgroups,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: submanagers
-ou: submanager
-member: uid=ben,ou=people,dc=springframework,dc=org
@@ -29,6 +29,8 @@ import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.DelegatingFilterProxy;

+import com.google.inject.internal.ImmutableList.Builder;
+
 /**
 * <p>A base {@link SecurityBuilder} that allows {@link SecurityConfigurer} to be
 * applied to it. This makes modifying the {@link SecurityBuilder} a strategy
@@ -56,8 +58,6 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
    private final LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>> configurers =
            new LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>>();

-    private final List<SecurityConfigurer<O, B>> configurersAddedInInitializing = new ArrayList<SecurityConfigurer<O, B>>();
-
    private final Map<Class<Object>,Object> sharedObjects = new HashMap<Class<Object>,Object>();

    private final boolean allowConfigurersOfSameType;
@@ -124,9 +124,9 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
    @SuppressWarnings("unchecked")
    public <C extends SecurityConfigurerAdapter<O, B>> C apply(C configurer)
            throws Exception {
+        add(configurer);
        configurer.addObjectPostProcessor(objectPostProcessor);
        configurer.setBuilder((B) this);
-        add(configurer);
        return configurer;
    }

@@ -200,7 +200,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
            configs.add(configurer);
            this.configurers.put(clazz, configs);
            if(buildState.isInitializing()) {
-                this.configurersAddedInInitializing.add(configurer);
+                configurer.init((B)this);
            }
        }
    }
@@ -365,11 +365,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
    private void init() throws Exception {
        Collection<SecurityConfigurer<O,B>> configurers = getConfigurers();

-        for (SecurityConfigurer<O, B> configurer : configurers) {
-            configurer.init((B) this);
-        }
-
-        for (SecurityConfigurer<O, B> configurer : configurersAddedInInitializing) {
+        for(SecurityConfigurer<O,B> configurer : configurers ) {
            configurer.init((B) this);
        }
    }
@@ -138,31 +138,19 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil

    /**
     * Add JDBC authentication to the {@link AuthenticationManagerBuilder} and
-     * return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
-     * of the JDBC authentication.
-     *
-     * <p>
-     * When using with a persistent data store, it is best to add users external
-     * of configuration using something like <a
-     * href="http://flywaydb.org/">Flyway</a> or <a
-     * href="http://www.liquibase.org/">Liquibase</a> to create the schema and
-     * adding users to ensure these steps are only done once and that the
-     * optimal SQL is used.
-     * </p>
+     * return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the
+     * JDBC authentication.
     *
     * <p>
     * This method also ensure that a {@link UserDetailsService} is available
     * for the {@link #getDefaultUserDetailsService()} method. Note that
     * additional {@link UserDetailsService}'s may override this
-     * {@link UserDetailsService} as the default. See the <a href=
-     * "http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#user-schema"
-     * >User Schema</a> section of the reference for the default schema.
+     * {@link UserDetailsService} as the default.
     * </p>
     *
-     * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
-     *         of the JDBC authentication
-     * @throws Exception
-     *             if an error occurs when adding the JDBC authentication
+     * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the
+     * JDBC authentication
+     * @throws Exception if an error occurs when adding the JDBC authentication
     */
    public JdbcUserDetailsManagerConfigurer<AuthenticationManagerBuilder> jdbcAuthentication()
            throws Exception {
@@ -61,7 +61,7 @@ public class AuthenticationConfiguration {
    }

    @Bean
-    public static GlobalAuthenticationConfigurerAdapter enableGlobalAuthenticationAutowiredConfigurer(ApplicationContext context) {
+    public GlobalAuthenticationConfigurerAdapter enableGlobalAuthenticationAutowiredConfigurer(ApplicationContext context) {
        return new EnableGlobalAuthenticationAutowiredConfigurer(context);
    }

@@ -115,6 +115,7 @@ public class AuthenticationConfiguration {
        ProxyFactoryBean proxyFactory = new ProxyFactoryBean();
        proxyFactory = objectPostProcessor.postProcess(proxyFactory);
        proxyFactory.setTargetSource(lazyTargetSource);
+        proxyFactory.setInterfaces(new Class[] { interfaceName, LazyBean.class });
        return (T) proxyFactory.getObject();
    }

@@ -122,6 +123,8 @@ public class AuthenticationConfiguration {
        return lazyBean(AuthenticationManager.class);
    }

+    private interface LazyBean {}
+
    private static class EnableGlobalAuthenticationAutowiredConfigurer extends GlobalAuthenticationConfigurerAdapter {
        private final ApplicationContext context;
        private static final Log logger = LogFactory.getLog(EnableGlobalAuthenticationAutowiredConfigurer.class);
@@ -40,10 +40,6 @@ import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;
 import org.springframework.security.ldap.userdetails.UserDetailsContextMapper;
-import org.springframework.util.Assert;
-
-import java.io.IOException;
-import java.net.ServerSocket;

 /**
 * Configures LDAP {@link AuthenticationProvider} in the {@link ProviderManagerBuilder}.
@@ -64,7 +60,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
    private BaseLdapPathContextSource contextSource;
    private ContextSourceBuilder contextSourceBuilder = new ContextSourceBuilder();
    private UserDetailsContextMapper userDetailsContextMapper;
-    private Object passwordEncoder;
+    private PasswordEncoder passwordEncoder;
    private String passwordAttribute;
    private LdapAuthoritiesPopulator ldapAuthoritiesPopulator;

@@ -153,9 +149,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
     */
    private PasswordComparisonAuthenticator createPasswordCompareAuthenticator(BaseLdapPathContextSource contextSource) {
        PasswordComparisonAuthenticator ldapAuthenticator = new PasswordComparisonAuthenticator(contextSource);
-        if(passwordAttribute != null) {
-            ldapAuthenticator.setPasswordAttributeName(passwordAttribute);
-        }
+        ldapAuthenticator.setPasswordAttributeName(passwordAttribute);
        ldapAuthenticator.setPasswordEncoder(passwordEncoder);
        return ldapAuthenticator;
    }
@@ -210,26 +204,12 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
     *
     * @param passwordEncoder the {@link PasswordEncoder} to use
     * @return the {@link LdapAuthenticationProviderConfigurer} for further customization
-     * @deprecated Use {@link #passwordEncoder(org.springframework.security.crypto.password.PasswordEncoder)} instead
     */
    public LdapAuthenticationProviderConfigurer<B> passwordEncoder(PasswordEncoder passwordEncoder) {
        this.passwordEncoder = passwordEncoder;
        return this;
    }

-    /**
-     * Specifies the {@link org.springframework.security.crypto.password.PasswordEncoder} to be used when authenticating with
-     * password comparison.
-     *
-     * @param passwordEncoder the {@link org.springframework.security.crypto.password.PasswordEncoder} to use
-     * @return the {@link LdapAuthenticationProviderConfigurer} for further customization
-     */
-    public LdapAuthenticationProviderConfigurer<B> passwordEncoder(final org.springframework.security.crypto.password.PasswordEncoder passwordEncoder) {
-        Assert.notNull(passwordEncoder, "passwordEncoder must not be null.");
-        this.passwordEncoder = passwordEncoder;
-        return this;
-    }
-
    /**
     * If your users are at a fixed location in the directory (i.e. you can work
     * out the DN directly from the username without doing a directory search),
@@ -393,8 +373,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
        private String ldif = "classpath*:*.ldif";
        private String managerPassword;
        private String managerDn;
-        private Integer port;
-        private static final int DEFAULT_PORT = 33389;
+        private int port = 33389;
        private String root = "dc=springframework,dc=org";
        private String url;

@@ -439,7 +418,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
        }

        /**
-         * The port to connect to LDAP to (the default is 33389 or random available port if unavailable).
+         * The port to connect to LDAP to (the default is 33389).
         * @param port the port to connect to
         * @return the {@link ContextSourceBuilder} for further customization
         */
@@ -499,43 +478,14 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
                return contextSource;
            }
            ApacheDSContainer apacheDsContainer = new ApacheDSContainer(root, ldif);
-            apacheDsContainer.setPort(getPort());
+            apacheDsContainer.setPort(port);
            postProcess(apacheDsContainer);
            return contextSource;
        }

-        private int getPort() {
-            if(port == null) {
-                port = getDefaultPort();
-            }
-            return port;
-        }
-
-        private int getDefaultPort() {
-            ServerSocket serverSocket = null;
-            try {
-                try {
-                    serverSocket = new ServerSocket(DEFAULT_PORT);
-                } catch (IOException e) {
-                    try {
-                        serverSocket = new ServerSocket(0);
-                    } catch(IOException e2) {
-                        return DEFAULT_PORT;
-                    }
-                }
-                return serverSocket.getLocalPort();
-            } finally {
-                if(serverSocket != null) {
-                    try {
-                        serverSocket.close();
-                    } catch (IOException e) {}
-                }
-            }
-        }
-
        private String getProviderUrl() {
            if(url == null) {
-                return "ldap://127.0.0.1:" + getPort() + "/" + root;
+                return "ldap://127.0.0.1:" + port + "/" + root;
            }
            return url;
        }
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.method.configuration;
+
+import java.util.Map;
+
+import org.springframework.aop.config.AopConfigUtils;
+import org.springframework.beans.factory.support.BeanDefinitionRegistry;
+import org.springframework.context.annotation.ImportBeanDefinitionRegistrar;
+import org.springframework.core.annotation.AnnotationAttributes;
+import org.springframework.core.type.AnnotationMetadata;
+
+/**
+ * Registers an
+ * {@link org.springframework.aop.aspectj.annotation.AnnotationAwareAspectJAutoProxyCreator
+ * AnnotationAwareAspectJAutoProxyCreator} against the current
+ * {@link BeanDefinitionRegistry} as appropriate based on a given @
+ * {@link EnableGlobalMethodSecurity} annotation.
+ *
+ * <p>
+ * Note: This class is necessary because AspectJAutoProxyRegistrar only supports
+ * EnableAspectJAutoProxy.
+ * </p>
+ *
+ * @author Rob Winch
+ * @since 3.2
+ */
+class GlobalMethodSecurityAspectJAutoProxyRegistrar implements
+        ImportBeanDefinitionRegistrar {
+
+    /**
+     * Register, escalate, and configure the AspectJ auto proxy creator based on
+     * the value of the @{@link EnableGlobalMethodSecurity#proxyTargetClass()}
+     * attribute on the importing {@code @Configuration} class.
+     */
+    public void registerBeanDefinitions(
+            AnnotationMetadata importingClassMetadata,
+            BeanDefinitionRegistry registry) {
+
+        AopConfigUtils
+                .registerAspectJAnnotationAutoProxyCreatorIfNecessary(registry);
+
+        Map<String, Object> annotationAttributes = importingClassMetadata
+                .getAnnotationAttributes(EnableGlobalMethodSecurity.class
+                        .getName());
+        AnnotationAttributes enableAJAutoProxy = AnnotationAttributes
+                .fromMap(annotationAttributes);
+
+        if (enableAJAutoProxy.getBoolean("proxyTargetClass")) {
+            AopConfigUtils.forceAutoProxyCreatorToUseClassProxying(registry);
+        }
+    }
+
+}
@@ -1,42 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.method.configuration;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.support.BeanDefinitionRegistry;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Role;
-import org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor;
-import org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect;
-
-/**
- * Creates the AnnotationSecurityAspect for use with AspectJ based security.
- *
- * @author Rob Winch
- * @since 3.2
- */
-class GlobalMethodSecurityAspectJConfiguration {
-
-    @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-    @Bean
-    public AnnotationSecurityAspect annotationSecurityAspect(@Qualifier("methodSecurityInterceptor") MethodInterceptor methodSecurityInterceptor) {
-        AnnotationSecurityAspect result = AnnotationSecurityAspect.aspectOf();
-        result.setSecurityInterceptor((AspectJMethodSecurityInterceptor )methodSecurityInterceptor);
-        return result;
-    }
-}
@@ -24,8 +24,10 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.annotation.*;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.ImportAware;
+import org.springframework.context.annotation.Role;
 import org.springframework.core.annotation.AnnotationAttributes;
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.core.type.AnnotationMetadata;
@@ -46,7 +48,6 @@ import org.springframework.security.access.intercept.AfterInvocationProviderMana
 import org.springframework.security.access.intercept.RunAsManager;
 import org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor;
 import org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor;
-import org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor;
 import org.springframework.security.access.method.DelegatingMethodSecurityMetadataSource;
 import org.springframework.security.access.method.MethodSecurityMetadataSource;
 import org.springframework.security.access.prepost.PostInvocationAdviceProvider;
@@ -86,8 +87,8 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
    private AuthenticationManagerBuilder auth;
    private boolean disableAuthenticationRegistry;
    private AnnotationAttributes enableMethodSecurity;
-    private ApplicationContext context;
    private MethodSecurityExpressionHandler expressionHandler;
+    private AuthenticationConfiguration authenticationConfiguration;

    /**
     * Creates the default MethodInterceptor which is a MethodSecurityInterceptor using the following methods to
@@ -110,7 +111,7 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
     */
    @Bean
    public MethodInterceptor methodSecurityInterceptor() throws Exception {
-        MethodSecurityInterceptor methodSecurityInterceptor = isAspectJ() ? new AspectJMethodSecurityInterceptor() : new MethodSecurityInterceptor();
+        MethodSecurityInterceptor methodSecurityInterceptor = new MethodSecurityInterceptor();
        methodSecurityInterceptor
                .setAccessDecisionManager(accessDecisionManager());
        methodSecurityInterceptor
@@ -352,13 +353,14 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
        this.defaultMethodExpressionHandler.setPermissionEvaluator(permissionEvaluators.get(0));
    }

-    @Autowired
-    public void setApplicationContext(ApplicationContext context) {
-        this.context = context;
+    @Autowired(required = false)
+    public void setAuthenticationConfiguration(AuthenticationConfiguration authenticationConfiguration) {
+        this.authenticationConfiguration = authenticationConfiguration;
    }

    private AuthenticationConfiguration getAuthenticationConfiguration() {
-        return context.getBean(AuthenticationConfiguration.class);
+        Assert.notNull(authenticationConfiguration, "authenticationConfiguration cannot be null");
+        return authenticationConfiguration;
    }

    private boolean prePostEnabled() {
@@ -377,10 +379,6 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
        return (Integer) enableMethodSecurity().get("order");
    }

-    private boolean isAspectJ() {
-        return enableMethodSecurity().getEnum("mode") == AdviceMode.ASPECTJ;
-    }
-
    private AnnotationAttributes enableMethodSecurity() {
        if (enableMethodSecurity == null) {
            // if it is null look at this instance (i.e. a subclass was used)
@@ -48,7 +48,7 @@ final class GlobalMethodSecuritySelector implements ImportSelector {

        AdviceMode mode = attributes.getEnum("mode");
        String autoProxyClassName = AdviceMode.PROXY == mode ? AutoProxyRegistrar.class.getName()
-                : GlobalMethodSecurityAspectJConfiguration.class.getName();
+                : GlobalMethodSecurityAspectJAutoProxyRegistrar.class.getName();
        if(skipMethodSecurityConfiguration) {
            return new String[] { autoProxyClassName };
        }
@@ -25,7 +25,6 @@ import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.security.web.util.matcher.RegexRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.util.ObjectUtils;

 /**
 * A base class for registering {@link RequestMatcher}'s. For example, it might allow for specifying which
@@ -52,20 +51,6 @@ public abstract class AbstractRequestMatcherRegistry<C> {
        return requestMatchers(ANY_REQUEST);
    }

-    /**
-     * Maps a {@link List} of
-     * {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
-     * instances.
-     *
-     * @param method the {@link HttpMethod} to use for any
-     * {@link HttpMethod}.
-     *
-     * @return the object that is chained after creating the {@link RequestMatcher}
-     */
-    public C antMatchers(HttpMethod method) {
-        return antMatchers(method, new String[] { "/**" });
-    }
-
    /**
     * Maps a {@link List} of {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} instances.
     *
@@ -113,7 +113,7 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>> extends S
     * been added using {@link #addFilterAfter(Filter, Class)} or
     * {@link #addFilterBefore(Filter, Class)}.
     *
-     * @param filter the {@link Filter} to register after the type {@code afterFilter}
+     * @param filter the {@link Filter} to register before the type {@code afterFilter}
     * @param afterFilter the Class of the known {@link Filter}.
     * @return the {@link HttpSecurity} for further customizations
     */
@@ -171,4 +171,4 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>> extends S
     * @return the {@link HttpSecurity} for further customizations
     */
    H addFilter(Filter filter);
-}
+}
@@ -1000,7 +1000,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
     *                 .and()
     *             .formLogin()
     *                 .and()
-     *             .requiresChannel()
+     *             .channelSecurity()
     *                 .anyRequest().requiresSecure();
     *     }
     *
@@ -40,7 +40,6 @@ import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.SecurityConfigurer;
 import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
 import org.springframework.security.config.annotation.web.builders.WebSecurity;
-import org.springframework.security.context.DelegatingApplicationListener;
 import org.springframework.security.web.FilterChainProxy;
 import org.springframework.security.web.FilterInvocation;
 import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
@@ -73,11 +72,6 @@ public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAwa

    private ClassLoader beanClassLoader;

-    @Bean
-    public static DelegatingApplicationListener delegatingApplicationListener() {
-        return new DelegatingApplicationListener();
-    }
-
    @Bean
    @DependsOn(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
    public SecurityExpressionHandler<FilterInvocation> webSecurityExpressionHandler() {
@@ -18,18 +18,11 @@ package org.springframework.security.config.annotation.web.configuration;

 import java.lang.reflect.Field;
 import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
-import java.util.Set;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.springframework.aop.TargetSource;
-import org.springframework.aop.framework.Advised;
-import org.springframework.aop.target.LazyInitTargetSource;
 import org.springframework.beans.FatalBeanException;
-import org.springframework.beans.factory.BeanFactoryUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
 import org.springframework.core.annotation.Order;
@@ -217,7 +210,7 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
     * @throws Exception
     */
    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return new AuthenticationManagerDelegator(authenticationBuilder, context);
+        return new AuthenticationManagerDelegator(authenticationBuilder);
    }

    /**
@@ -420,14 +413,12 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
        private AuthenticationManagerBuilder delegateBuilder;
        private AuthenticationManager delegate;
        private final Object delegateMonitor = new Object();
-        private Set<String> beanNames;

-        AuthenticationManagerDelegator(AuthenticationManagerBuilder delegateBuilder, ApplicationContext context) {
+        AuthenticationManagerDelegator(AuthenticationManagerBuilder delegateBuilder) {
            Assert.notNull(delegateBuilder,"delegateBuilder cannot be null");
            Field parentAuthMgrField = ReflectionUtils.findField(AuthenticationManagerBuilder.class, "parentAuthenticationManager");
            ReflectionUtils.makeAccessible(parentAuthMgrField);
-            beanNames = getAuthenticationManagerBeanNames(context);
-            validateBeanCycle(ReflectionUtils.getField(parentAuthMgrField, delegateBuilder), beanNames);
+            validateBeanCycle(ReflectionUtils.getField(parentAuthMgrField, delegateBuilder));
            this.delegateBuilder = delegateBuilder;
        }

@@ -446,24 +437,16 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
            return delegate.authenticate(authentication);
        }

-        private static Set<String> getAuthenticationManagerBeanNames(ApplicationContext applicationContext) {
-             String[] beanNamesForType = BeanFactoryUtils.beanNamesForTypeIncludingAncestors(applicationContext, AuthenticationManager.class);
-             return new HashSet<String>(Arrays.asList(beanNamesForType));
-        }
-
-        private static void validateBeanCycle(Object auth, Set<String> beanNames) {
-            if(auth != null && !beanNames.isEmpty()) {
-                if(auth instanceof Advised){
-                    Advised advised = (Advised) auth;
-                    TargetSource targetSource = advised.getTargetSource();
-                    if(targetSource instanceof LazyInitTargetSource) {
-                        LazyInitTargetSource lits = (LazyInitTargetSource) targetSource;
-                        if(beanNames.contains(lits.getTargetBeanName())) {
-                            throw new FatalBeanException("A dependency cycle was detected when trying to resolve the AuthenticationManager. Please ensure you have configured authentication.");
-                        }
+        private static void validateBeanCycle(Object auth) {
+            if(auth != null) {
+                String lazyBeanClassName = AuthenticationConfiguration.class.getName() + "$LazyBean";
+                Class<?>[] interfaces = auth.getClass().getInterfaces();
+                for(Class<?> i : interfaces) {
+                    String className = i.getName();
+                    if(className.equals(lazyBeanClassName)) {
+                        throw new FatalBeanException("A dependency cycle was detected when trying to resolve the AuthenticationManager. Please ensure you have configured authentication.");
                    }
                }
-                beanNames = Collections.emptySet();
            }
        }
    }
@@ -151,8 +151,7 @@ abstract class AbstractInterceptUrlConfigurer<C extends AbstractInterceptUrlConf
     * @return the default {@code AccessDecisionManager}
     */
    private AccessDecisionManager createDefaultAccessDecisionManager(H http) {
-        AffirmativeBased result = new AffirmativeBased(getDecisionVoters(http));
-        return postProcess(result);
+        return new AffirmativeBased(getDecisionVoters(http));
    }

    /**
@@ -97,7 +97,7 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>> extends Abst
     * @return the {@link CsrfConfigurer} for further customizations
     */
    public CsrfConfigurer<H> requireCsrfProtectionMatcher(RequestMatcher requireCsrfProtectionMatcher) {
-        Assert.notNull(requireCsrfProtectionMatcher, "requireCsrfProtectionMatcher cannot be null");
+        Assert.notNull(csrfTokenRepository, "requireCsrfProtectionMatcher cannot be null");
        this.requireCsrfProtectionMatcher = requireCsrfProtectionMatcher;
        return this;
    }
@@ -32,13 +32,12 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint;
-import org.springframework.security.web.authentication.RememberMeServices;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.security.web.util.matcher.MediaTypeRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher;
-import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.web.accept.ContentNegotiationStrategy;
 import org.springframework.web.accept.HeaderContentNegotiationStrategy;

@@ -168,10 +167,6 @@ public final class HttpBasicConfigurer<B extends HttpSecurityBuilder<B>> extends
        if(authenticationDetailsSource != null) {
            basicAuthenticationFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
        }
-        RememberMeServices rememberMeServices = http.getSharedObject(RememberMeServices.class);
-        if(rememberMeServices != null) {
-            basicAuthenticationFilter.setRememberMeServices(rememberMeServices);
-        }
        basicAuthenticationFilter = postProcess(basicAuthenticationFilter);
        http.addFilter(basicAuthenticationFilter);
    }
@@ -23,7 +23,6 @@ import javax.servlet.http.HttpSession;
 import org.springframework.security.config.annotation.SecurityConfigurer;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.security.web.authentication.logout.LogoutHandler;
@@ -99,16 +98,6 @@ public final class LogoutConfigurer<H extends HttpSecurityBuilder<H>> extends Ab
        return this;
    }

-    /**
-     * Specifies if {@link SecurityContextLogoutHandler} should clear the {@link Authentication} at the time of logout.
-     * @param clearAuthentication true {@link SecurityContextLogoutHandler} should clear the {@link Authentication} (default), or false otherwise.
-     * @return the {@link LogoutConfigurer} for further customization
-     */
-    public LogoutConfigurer<H> clearAuthentication(boolean clearAuthentication) {
-        contextLogoutHandler.setClearAuthentication(clearAuthentication);
-        return this;
-    }
-
    /**
     * The URL that triggers log out to occur (default is "/logout"). If CSRF
     * protection is enabled (default), then the request must also be a POST.
@@ -305,9 +294,7 @@ public final class LogoutConfigurer<H extends HttpSecurityBuilder<H>> extends Ab
        }
        if(http.getConfigurer(CsrfConfigurer.class) != null) {
            this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl, "POST");
-        } else {
-            this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl);
        }
-        return this.logoutRequestMatcher;
+        return new AntPathRequestMatcher(this.logoutUrl);
    }
 }
@@ -22,15 +22,10 @@ import java.util.List;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;

-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationListener;
-import org.springframework.context.event.GenericApplicationListenerAdapter;
-import org.springframework.context.event.SmartApplicationListener;
 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.context.DelegatingApplicationListener;
 import org.springframework.security.core.session.SessionRegistry;
 import org.springframework.security.core.session.SessionRegistryImpl;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
@@ -88,12 +83,11 @@ import org.springframework.util.Assert;
 * @see ConcurrentSessionFilter
 */
 public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractHttpConfigurer<SessionManagementConfigurer<H>,H> {
-    private final SessionAuthenticationStrategy DEFAULT_SESSION_FIXATION_STRATEGY = createDefaultSessionFixationProtectionStrategy();
-    private SessionAuthenticationStrategy sessionFixationAuthenticationStrategy = DEFAULT_SESSION_FIXATION_STRATEGY;
+    private SessionAuthenticationStrategy sessionFixationAuthenticationStrategy = createDefaultSessionFixationProtectionStrategy();
    private SessionAuthenticationStrategy sessionAuthenticationStrategy;
    private InvalidSessionStrategy invalidSessionStrategy;
    private List<SessionAuthenticationStrategy> sessionAuthenticationStrategies = new ArrayList<SessionAuthenticationStrategy>();
-    private SessionRegistry sessionRegistry;
+    private SessionRegistry sessionRegistry = new SessionRegistryImpl();
    private Integer maximumSessions;
    private String expiredUrl;
    private boolean maxSessionsPreventsLogin;
@@ -373,14 +367,14 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
                http.setSharedObject(RequestCache.class, new NullRequestCache());
            }
        }
-        http.setSharedObject(SessionAuthenticationStrategy.class, getSessionAuthenticationStrategy(http));
+        http.setSharedObject(SessionAuthenticationStrategy.class, getSessionAuthenticationStrategy());
        http.setSharedObject(InvalidSessionStrategy.class, getInvalidSessionStrategy());
    }

    @Override
    public void configure(H http) throws Exception {
        SecurityContextRepository securityContextRepository = http.getSharedObject(SecurityContextRepository.class);
-        SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository, getSessionAuthenticationStrategy(http));
+        SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository, getSessionAuthenticationStrategy());
        if(sessionAuthenticationErrorUrl != null) {
            sessionManagementFilter.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler(sessionAuthenticationErrorUrl));
        }
@@ -395,7 +389,7 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>

        http.addFilter(sessionManagementFilter);
        if(isConcurrentSessionControlEnabled()) {
-            ConcurrentSessionFilter concurrentSessionFilter = new ConcurrentSessionFilter(getSessionRegistry(http), expiredUrl);
+            ConcurrentSessionFilter concurrentSessionFilter = new ConcurrentSessionFilter(sessionRegistry, expiredUrl);
            concurrentSessionFilter = postProcess(concurrentSessionFilter);
            http.addFilter(concurrentSessionFilter);
        }
@@ -450,16 +444,12 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
     *
     * @return the {@link SessionAuthenticationStrategy} to use
     */
-    private SessionAuthenticationStrategy getSessionAuthenticationStrategy(H http) {
+    private SessionAuthenticationStrategy getSessionAuthenticationStrategy() {
        if(sessionAuthenticationStrategy != null) {
            return sessionAuthenticationStrategy;
        }
        List<SessionAuthenticationStrategy> delegateStrategies = sessionAuthenticationStrategies;
-        if(DEFAULT_SESSION_FIXATION_STRATEGY == sessionFixationAuthenticationStrategy) {
-            sessionFixationAuthenticationStrategy = postProcess(sessionFixationAuthenticationStrategy);
-        }
        if(isConcurrentSessionControlEnabled()) {
-            SessionRegistry sessionRegistry = getSessionRegistry(http);
            ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry);
            concurrentSessionControlStrategy.setMaximumSessions(maximumSessions);
            concurrentSessionControlStrategy.setExceptionIfMaximumExceeded(maxSessionsPreventsLogin);
@@ -476,28 +466,6 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
        return sessionAuthenticationStrategy;
    }

-    private SessionRegistry getSessionRegistry(H http) {
-        if(sessionRegistry == null) {
-            SessionRegistryImpl sessionRegistry = new SessionRegistryImpl();
-            registerDelegateApplicationListener(http, sessionRegistry);
-            this.sessionRegistry = sessionRegistry;
-        }
-        return sessionRegistry;
-    }
-
-    private void registerDelegateApplicationListener(H http, ApplicationListener<?> delegate) {
-        ApplicationContext context = http.getSharedObject(ApplicationContext.class);
-        if(context == null) {
-            return;
-        }
-        if(context.getBeansOfType(DelegatingApplicationListener.class).isEmpty()) {
-            return;
-        }
-        DelegatingApplicationListener delegating = context.getBean(DelegatingApplicationListener.class);
-        SmartApplicationListener smartListener = new GenericApplicationListenerAdapter(delegate);
-        delegating.addListener(smartListener);
-    }
-
    /**
     * Returns true if the number of concurrent sessions per user should be restricted.
     * @return
@@ -208,7 +208,7 @@ public class HeadersBeanDefinitionParser implements BeanDefinitionParser {
                        }
                        String fromParameter = getAttribute(frameElt, ATT_FROM_PARAMETER, "from");
                        allowFromStrategy.addPropertyValue("allowFromParameterName", fromParameter);
-                        builder.addConstructorArgValue(allowFromStrategy.getBeanDefinition());
+                        builder.addConstructorArgValue(allowFromStrategy);
                    }
                } else {
                    parserContext.getReaderContext().error("One of 'strategy' and 'strategy-ref' must be set.",
@@ -123,8 +123,7 @@ abstract class BaseSpringSpec extends Specification {
    AuthenticationManager getAuthenticationManager() {
        try {
            authenticationManager().delegateBuilder.getObject()
-        } catch(NoSuchBeanDefinitionException e) {
-        } catch(MissingPropertyException e) {}
+        } catch(NoSuchBeanDefinitionException e) {}
        findFilter(FilterSecurityInterceptor).authenticationManager
    }

@@ -16,12 +16,7 @@
 package org.springframework.security.config.annotation.authentication.configuration;

 import org.springframework.aop.framework.ProxyFactoryBean
-import org.springframework.beans.BeansException
 import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.beans.factory.config.BeanPostProcessor
-import org.springframework.beans.factory.config.ConfigurableListableBeanFactory
-import org.springframework.beans.factory.support.BeanDefinitionRegistry
-import org.springframework.beans.factory.support.BeanDefinitionRegistryPostProcessor
 import org.springframework.context.ApplicationContext
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
@@ -330,44 +325,4 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
            null
        }
    }
-
-    def "SEC-2822: Cannot Force Authentication already built"() {
-        setup:
-        loadConfig(Sec2822WebSecurity,Sec2822UseAuth,Sec2822Config)
-        when:
-        AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
-        config.getAuthenticationManager()
-        then:
-        noExceptionThrown()
-    }
-
-    @Configuration
-    @Import(AuthenticationConfiguration)
-    static class Sec2822Config {}
-
-    @Configuration
-    @EnableWebSecurity
-    static class Sec2822WebSecurity extends WebSecurityConfigurerAdapter {
-        @Autowired
-        public void configureGlobal(AuthenticationManagerBuilder auth) {
-            auth.inMemoryAuthentication()
-        }
-    }
-
-    @Configuration
-    static class Sec2822UseAuth {
-        @Autowired
-        public void useAuthenticationManager(AuthenticationConfiguration auth) {
-            auth.authenticationManager
-        }
-
-        // Ensures that Sec2822UseAuth is initialized before Sec2822WebSecurity
-        // must have additional GlobalAuthenticationConfigurerAdapter to trigger SEC-2822
-        @Bean
-        public static GlobalAuthenticationConfigurerAdapter bootGlobalAuthenticationConfigurerAdapter() {
-            new BootGlobalAuthenticationConfigurerAdapter()
-        }
-
-        static class BootGlobalAuthenticationConfigurerAdapter extends GlobalAuthenticationConfigurerAdapter { }
-    }
 }
@@ -15,13 +15,6 @@
 */
 package org.springframework.security.config.annotation.method.configuration

-import org.springframework.beans.BeansException
-import org.springframework.beans.factory.config.BeanPostProcessor
-import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
-
-import javax.sql.DataSource
-
 import static org.fest.assertions.Assertions.assertThat
 import static org.junit.Assert.fail

@@ -346,63 +339,4 @@ public class GlobalMethodSecurityConfigurationTests extends BaseSpringSpec {
            new MethodSecurityServiceImpl()
        }
    }
-
-    def "SEC-2815: @EnableGlobalMethodSecurity does not trigger eager initialization of Beans in GlobalAuthenticationConfigurer"() {
-        setup:
-        Sec2815Config.dataSource = Mock(DataSource)
-        when: 'load a Configuration that uses a Bean (DataSource) in a GlobalAuthenticationConfigurerAdapter'
-        loadConfig(Sec2815Config)
-        then: 'The Bean (DataSource) is still properly post processed with all BeanPostProcessor'
-        context.getBean(MockBeanPostProcessor).beforeInit['dataSource']
-        context.getBean(MockBeanPostProcessor).afterInit['dataSource']
-    }
-
-    @EnableGlobalMethodSecurity(prePostEnabled = true)
-    static class Sec2815Config {
-        static DataSource dataSource;
-
-        @Bean
-        public MethodSecurityService service() {
-            new MethodSecurityServiceImpl()
-        }
-
-        @Bean
-        public MockBeanPostProcessor mockBeanPostProcessor() {
-            new MockBeanPostProcessor()
-        }
-
-        @Bean
-        public DataSource dataSource() {
-            dataSource
-        }
-
-        @Configuration
-        static class AuthConfig extends GlobalAuthenticationConfigurerAdapter {
-            @Autowired
-            DataSource dataSource
-
-            @Override
-            void init(AuthenticationManagerBuilder auth) throws Exception {
-                auth.inMemoryAuthentication()
-            }
-        }
-    }
-
-
-    static class MockBeanPostProcessor implements BeanPostProcessor {
-        Map<String,Object> beforeInit = new HashMap<String,Object>()
-        Map<String,Object> afterInit = new HashMap<String,Object>()
-
-        @Override
-        Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
-            beforeInit[beanName] = bean
-            bean
-        }
-
-        @Override
-        Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
-            afterInit[beanName] = bean
-            bean
-        }
-    }
 }
@@ -15,14 +15,11 @@
 */
 package org.springframework.security.config.annotation.method.configuration

-import org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor
-
 import static org.fest.assertions.Assertions.assertThat
 import static org.junit.Assert.fail

 import java.lang.reflect.Method

-import org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect
 import org.springframework.aop.aspectj.annotation.AnnotationAwareAspectJAutoProxyCreator
 import org.springframework.beans.factory.BeanCreationException
 import org.springframework.context.ConfigurableApplicationContext
@@ -191,8 +188,8 @@ public class NamespaceGlobalMethodSecurityTests extends BaseSpringSpec {
        when:
            context = new AnnotationConfigApplicationContext(AspectJModeConfig)
        then:
-            context.getBean(AnnotationSecurityAspect)
-            context.getBean(AspectJMethodSecurityInterceptor)
+            AnnotationAwareAspectJAutoProxyCreator autoProxyCreator = context.getBean(AnnotationAwareAspectJAutoProxyCreator)
+            autoProxyCreator.proxyTargetClass == true
    }

    @Configuration
@@ -204,8 +201,8 @@ public class NamespaceGlobalMethodSecurityTests extends BaseSpringSpec {
        when:
            context = new AnnotationConfigApplicationContext(BaseMethodConfig,AspectJModeExtendsGMSCConfig)
        then:
-            context.getBean(AnnotationSecurityAspect)
-            context.getBean(AspectJMethodSecurityInterceptor)
+            AnnotationAwareAspectJAutoProxyCreator autoProxyCreator = context.getBean(AnnotationAwareAspectJAutoProxyCreator)
+            autoProxyCreator.proxyTargetClass == false
    }

    @Configuration
@@ -15,13 +15,10 @@
 */
 package org.springframework.security.config.annotation.web.configuration;

-import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.beans.FatalBeanException;
-import org.springframework.context.annotation.AnnotationConfigApplicationContext
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.security.authentication.AuthenticationManager
-import org.springframework.security.authentication.TestingAuthenticationToken
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
@@ -47,48 +44,6 @@ public class Sec2515Tests extends BaseSpringSpec {
        }
    }

-    def "Custom Name Prevent StackOverflow with bean graph cycle"() {
-        when:
-           loadConfig(StackOverflowSecurityConfig)
-        then:
-            thrown(FatalBeanException)
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class CustomBeanNameStackOverflowSecurityConfig extends WebSecurityConfigurerAdapter {
-
-        @Override
-        @Bean(name="custom")
-        public AuthenticationManager authenticationManagerBean()
-                throws Exception {
-            return super.authenticationManagerBean();
-        }
-    }
-
-    def "SEC-2549: Can load with child classloader"() {
-        setup:
-            CanLoadWithChildConfig.AM = Mock(AuthenticationManager)
-            context = new AnnotationConfigApplicationContext()
-            context.classLoader = new URLClassLoader(new URL[0], context.classLoader)
-            context.register(CanLoadWithChildConfig)
-            context.refresh()
-        when:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user", "password"))
-        then:
-            noExceptionThrown()
-            1 * CanLoadWithChildConfig.AM.authenticate(_) >> new TestingAuthenticationToken("user","password","ROLE_USER")
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class CanLoadWithChildConfig extends WebSecurityConfigurerAdapter {
-        static AuthenticationManager AM
-        @Bean
-        public AuthenticationManager am() {
-            AM
-        }
-    }

    def "SEC-2515: @Bean still works when configure(AuthenticationManagerBuilder) used"() {
        when:
@@ -13,9 +13,7 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package org.springframework.security.config.annotation.web.configuration
-
-import java.lang.reflect.Modifier
+package org.springframework.security.config.annotation.web.configuration;

 import static org.junit.Assert.*

@@ -344,9 +342,4 @@ class WebSecurityConfigurationTests extends BaseSpringSpec {
    @EnableWebSecurity
    @Configuration
    static class ChildConfig extends WebSecurityConfigurerAdapter { }
-
-    def "SEC-2773: delegatingApplicationListener is static method"() {
-        expect: 'delegatingApplicationListener to prevent premature instantiation of WebSecurityConfiguration'
-        Modifier.isStatic(WebSecurityConfiguration.metaClass.methods.find { it.name == 'delegatingApplicationListener'}.modifiers)
-    }
 }
@@ -15,8 +15,6 @@
 */
 package org.springframework.security.config.annotation.web.configurers

-import org.springframework.security.web.util.matcher.AntPathRequestMatcher
-
 import javax.servlet.http.HttpServletResponse

 import org.springframework.context.annotation.Configuration
@@ -237,7 +235,6 @@ class CsrfConfigurerTests extends BaseSpringSpec {
        setup:
            CsrfTokenRepositoryConfig.repo = Mock(CsrfTokenRepository)
            (1.._) * CsrfTokenRepositoryConfig.repo.loadToken(_) >> csrfToken
-            (1.._) * CsrfTokenRepositoryConfig.repo.generateToken(_) >> csrfToken
            loadConfig(CsrfTokenRepositoryConfig)
            request.method = "POST"
            request.getSession()
@@ -339,18 +336,6 @@ class CsrfConfigurerTests extends BaseSpringSpec {
            currentAuthentication != null
    }

-    def "SEC-2543: CSRF means logout requires POST"() {
-        setup:
-            loadConfig(LogoutConfig)
-            login()
-            request.servletPath = "/logout"
-            request.method = "GET"
-        when:
-            springSecurityFilterChain.doFilter(request,response,chain)
-        then: "logout with GET is not performed"
-            currentAuthentication != null
-    }
-
    @Configuration
    @EnableWebSecurity
    static class LogoutConfig extends WebSecurityConfigurerAdapter {
@@ -363,36 +348,9 @@ class CsrfConfigurerTests extends BaseSpringSpec {
        }
    }

-    def "CSRF can explicitly enable GET for logout"() {
-        setup:
-            loadConfig(LogoutAllowsGetConfig)
-            login()
-            request.servletPath = "/logout"
-            request.method = "GET"
-        when:
-            springSecurityFilterChain.doFilter(request,response,chain)
-        then: "logout with GET is not performed"
-            currentAuthentication == null
-    }
-
-    @Configuration
-    @EnableWebSecurity
-    static class LogoutAllowsGetConfig extends WebSecurityConfigurerAdapter {
-        static AccessDeniedHandler deniedHandler
-
-        @Override
-        protected void configure(HttpSecurity http) throws Exception {
-            http
-                .formLogin().and()
-                .logout()
-                    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
-        }
-    }
-
    def "csrf disables POST requests from RequestCache"() {
        setup:
            CsrfDisablesPostRequestFromRequestCacheConfig.repo = Mock(CsrfTokenRepository)
-            (1.._) * CsrfDisablesPostRequestFromRequestCacheConfig.repo.generateToken(_) >> csrfToken
            loadConfig(CsrfDisablesPostRequestFromRequestCacheConfig)
            request.servletPath = "/some-url"
            request.requestURI = "/some-url"
@@ -419,7 +377,6 @@ class CsrfConfigurerTests extends BaseSpringSpec {
    def "csrf enables GET requests with RequestCache"() {
        setup:
            CsrfDisablesPostRequestFromRequestCacheConfig.repo = Mock(CsrfTokenRepository)
-            (1.._) * CsrfDisablesPostRequestFromRequestCacheConfig.repo.generateToken(_) >> csrfToken
            loadConfig(CsrfDisablesPostRequestFromRequestCacheConfig)
            request.servletPath = "/some-url"
            request.requestURI = "/some-url"
@@ -467,13 +424,6 @@ class CsrfConfigurerTests extends BaseSpringSpec {
        }
    }

-    def 'SEC-2749: requireCsrfProtectionMatcher null'() {
-        when:
-        new CsrfConfigurer<>().requireCsrfProtectionMatcher(null)
-        then:
-        thrown(IllegalArgumentException)
-    }
-
    def clearCsrfToken() {
        request.removeAllParameters()
    }
@@ -19,12 +19,8 @@ import static org.springframework.security.config.annotation.web.configurers.Exp

 import javax.servlet.http.HttpServletResponse

-import org.springframework.beans.BeansException
 import org.springframework.beans.factory.BeanCreationException
-import org.springframework.beans.factory.config.BeanPostProcessor
 import org.springframework.context.ApplicationListener
-import org.springframework.context.annotation.Bean
-import org.springframework.security.access.AccessDecisionManager;
 import org.springframework.context.annotation.Configuration
 import org.springframework.security.access.event.AuthorizedEvent
 import org.springframework.security.access.vote.AffirmativeBased
@@ -35,7 +31,7 @@ import org.springframework.security.config.annotation.authentication.builders.Au
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
-import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurerConfigs.CustomExpressionRootConfig
+import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurerConfigs.CustomExpressionRootConfig;
 import org.springframework.security.core.authority.AuthorityUtils
 import org.springframework.security.web.access.intercept.FilterSecurityInterceptor

@@ -544,48 +540,4 @@ public class ExpressionUrlAuthorizationConfigurerTests extends BaseSpringSpec {
        then: "custom bean expression denies access"
            response.status == HttpServletResponse.SC_FORBIDDEN
    }
-
-    def "SEC-3011: Default AccessDecisionManager postProcessed"() {
-        when:
-        loadConfig(Sec3011Config)
-        then:
-        context.getBean(MockBeanPostProcessor).beans.find { it instanceof AccessDecisionManager }
-    }
-
-    @EnableWebSecurity
-    static class Sec3011Config extends WebSecurityConfigurerAdapter {
-        protected void configure(HttpSecurity http) throws Exception {
-            http
-                .authorizeRequests()
-                    .anyRequest().authenticated();
-        }
-
-        @Override
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .inMemoryAuthentication();
-        }
-
-        @Bean
-        static MockBeanPostProcessor mbpp() {
-            return new MockBeanPostProcessor();
-        }
-    }
-
-    static class MockBeanPostProcessor implements BeanPostProcessor {
-        List<Object> beans = new ArrayList<Object>();
-
-        public Object postProcessBeforeInitialization(Object bean,
-                String beanName) throws BeansException {
-            beans.add(bean);
-            return bean;
-        }
-
-        public Object postProcessAfterInitialization(Object bean,
-                String beanName) throws BeansException {
-
-            return bean;
-        }
-
-    }
 }
@@ -24,7 +24,6 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
 import org.springframework.security.web.AuthenticationEntryPoint
 import org.springframework.security.web.access.ExceptionTranslationFilter
-import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter;
 import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter

@@ -134,29 +133,4 @@ class HttpBasicConfigurerTests extends BaseSpringSpec {
                .inMemoryAuthentication()
        }
    }
-
-    def "SEC-3019: Basic Authentication uses RememberMe Config"() {
-        when:
-            loadConfig(BasicUsesRememberMeConfig)
-        then:
-            findFilter(BasicAuthenticationFilter).rememberMeServices == findFilter(RememberMeAuthenticationFilter).rememberMeServices
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class BasicUsesRememberMeConfig extends WebSecurityConfigurerAdapter {
-
-        @Override
-        protected void configure(HttpSecurity http) throws Exception {
-            http
-                .httpBasic().and()
-                .rememberMe()
-        }
-
-        @Override
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .inMemoryAuthentication()
-        }
-    }
 }
@@ -15,20 +15,19 @@
 */
 package org.springframework.security.config.annotation.web.configurers

-import org.springframework.context.ApplicationListener
-import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.mock.web.MockHttpSession
-import org.springframework.security.authentication.TestingAuthenticationToken
 import org.springframework.security.config.annotation.BaseSpringSpec
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
+import org.springframework.security.config.annotation.ObjectPostProcessor
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.core.session.SessionRegistry
-import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy
-import org.springframework.security.web.authentication.session.SessionFixationProtectionEvent
+import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
+import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
 import org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy
+import org.springframework.security.web.context.SecurityContextPersistenceFilter
+import org.springframework.security.web.context.SecurityContextRepository
 import org.springframework.security.web.session.ConcurrentSessionFilter
 import org.springframework.security.web.session.SessionManagementFilter

@@ -142,29 +141,6 @@ class NamespaceSessionManagementTests extends BaseSpringSpec {
        }
    }

-    def "SEC-2913: Default JavaConfig session fixation AuthenticationStrategy has NullEventPublisher"() {
-        setup:
-            loadConfig(SFPPostProcessedConfig)
-        when:
-            findSessionAuthenticationStrategy(SessionFixationProtectionStrategy).onSessionChange("id", new MockHttpSession(), new TestingAuthenticationToken("u","p","ROLE_USER"))
-        then:
-            context.getBean(MockEventListener).events
-    }
-
-    @EnableWebSecurity
-    static class SFPPostProcessedConfig extends WebSecurityConfigurerAdapter {
-        @Override
-        protected void configure(HttpSecurity http) throws Exception {
-            http
-                .sessionManagement()
-        }
-
-        @Bean
-        public MockEventListener eventListener() {
-            new MockEventListener()
-        }
-    }
-
    def "http/session-management@session-fixation-protection=newSession"() {
        when:
            loadConfig(SFPNewSessionSessionManagementConfig)
@@ -187,13 +163,4 @@ class NamespaceSessionManagementTests extends BaseSpringSpec {
                        .newSession()
        }
    }
-
-    static class MockEventListener implements ApplicationListener<SessionFixationProtectionEvent> {
-        List<SessionFixationProtectionEvent> events = []
-
-        public void onApplicationEvent(SessionFixationProtectionEvent event) {
-            events.add(event)
-        }
-
-    }
 }
@@ -21,7 +21,7 @@ import org.springframework.context.annotation.Configuration
 import org.springframework.mock.web.MockFilterChain
 import org.springframework.mock.web.MockHttpServletRequest
 import org.springframework.mock.web.MockHttpServletResponse
-import org.springframework.security.authentication.AuthenticationTrustResolver
+import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.config.annotation.AnyObjectPostProcessor
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
@@ -33,13 +33,11 @@ import org.springframework.security.web.access.ExceptionTranslationFilter
 import org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy
 import org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy
 import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy
-import org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy
 import org.springframework.security.web.context.NullSecurityContextRepository
 import org.springframework.security.web.context.SecurityContextPersistenceFilter
 import org.springframework.security.web.context.SecurityContextRepository
 import org.springframework.security.web.savedrequest.RequestCache
 import org.springframework.security.web.session.ConcurrentSessionFilter
-import org.springframework.security.web.session.HttpSessionDestroyedEvent
 import org.springframework.security.web.session.SessionManagementFilter

 /**
@@ -156,14 +154,12 @@ class SessionManagementConfigurerTests extends BaseSpringSpec {
    def 'session fixation and enable concurrency control'() {
        setup: "context where session fixation is disabled and concurrency control is enabled"
            loadConfig(ConcurrencyControlConfig)
-            def authenticatedSession
        when: "authenticate successfully"
            request.servletPath = "/login"
            request.method = "POST"
            request.setParameter("username", "user");
            request.setParameter("password","password")
            springSecurityFilterChain.doFilter(request, response, chain)
-            authenticatedSession = request.session
        then: "authentication is sucessful"
            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
            response.redirectedUrl == "/"
@@ -177,17 +173,6 @@ class SessionManagementConfigurerTests extends BaseSpringSpec {
        then:
            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
            response.redirectedUrl == '/login?error'
-        when: 'SEC-2574: When Session Expires and authentication attempted'
-            context.publishEvent(new HttpSessionDestroyedEvent(authenticatedSession))
-            super.setup()
-            request.servletPath = "/login"
-            request.method = "POST"
-            request.setParameter("username", "user");
-            request.setParameter("password","password")
-            springSecurityFilterChain.doFilter(request, response, chain)
-        then: "authentication is successful"
-            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
-            response.redirectedUrl == "/"
    }

    @EnableWebSecurity
@@ -232,8 +217,6 @@ class SessionManagementConfigurerTests extends BaseSpringSpec {
            1 * opp.postProcess(_ as CompositeSessionAuthenticationStrategy) >> {CompositeSessionAuthenticationStrategy o -> o}
        and: "RegisterSessionAuthenticationStrategy is registered with ObjectPostProcessor"
            1 * opp.postProcess(_ as RegisterSessionAuthenticationStrategy) >> {RegisterSessionAuthenticationStrategy o -> o}
-        and: "SessionFixationProtectionStrategy is registered with ObjectPostProcessor"
-            1 * opp.postProcess(_ as SessionFixationProtectionStrategy) >> {SessionFixationProtectionStrategy o -> o}
    }

    def "use sharedObject trustResolver"() {
@@ -29,8 +29,8 @@ import spock.lang.*
 */
 class XsdDocumentedTests extends Specification {

-    def ignoredIds = ['nsa-any-user-service','nsa-any-user-service-parents','nsa-authentication','nsa-message-security','nsa-ldap','nsa-method-security','nsa-web']
-    @Shared def reference = new File('../docs/manual/src/docs/asciidoc/index.adoc')
+    def ignoredIds = ['nsa-any-user-service','nsa-any-user-service-parents','nsa-authentication','nsa-ldap','nsa-method-security','nsa-web']
+    @Shared def reference = new File('../docs/manual/src/asciidoc/index.adoc')

    @Shared File schema31xDocument = new File('src/main/resources/org/springframework/security/config/spring-security-3.1.xsd')
    @Shared File schemaDocument = new File('src/main/resources/org/springframework/security/config/spring-security-3.2.xsd')
@@ -119,7 +119,6 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
            CsrfTokenRepository repo = appContext.getBean("repo",CsrfTokenRepository)
            CsrfToken token = new DefaultCsrfToken("X-CSRF-TOKEN","_csrf", "abc")
            when(repo.loadToken(any(HttpServletRequest))).thenReturn(token)
-            when(repo.generateToken(any(HttpServletRequest))).thenReturn(token)
            request.setParameter(token.parameterName,token.token)
            request.servletPath = "/some-url"
            request.requestURI = "/some-url"
@@ -154,7 +153,6 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
            CsrfTokenRepository repo = appContext.getBean("repo",CsrfTokenRepository)
            CsrfToken token = new DefaultCsrfToken("X-CSRF-TOKEN","_csrf", "abc")
            when(repo.loadToken(any(HttpServletRequest))).thenReturn(token)
-        when(repo.generateToken(any(HttpServletRequest))).thenReturn(token)
            request.setParameter(token.parameterName,token.token)
            request.servletPath = "/some-url"
            request.requestURI = "/some-url"
@@ -254,7 +252,6 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
            CsrfTokenRepository repo = appContext.getBean("repo",CsrfTokenRepository)
            CsrfToken token = new DefaultCsrfToken("X-CSRF-TOKEN","_csrf", "abc")
            when(repo.loadToken(any(HttpServletRequest))).thenReturn(token)
-            when(repo.generateToken(any(HttpServletRequest))).thenReturn(token)
            request.setParameter(token.parameterName,token.token)
            request.method = "POST"
            request.setParameter("j_username","user")
@@ -172,26 +172,6 @@ class HttpHeadersConfigTests extends AbstractHttpConfigTests {
        assertHeaders(response, ['X-Frame-Options':'ALLOW-FROM https://example.com'])
    }

-    def 'http headers frame-options ALLOW-FROM with whitelist strategy'() {
-        when:
-        httpAutoConfig {
-            'headers'() {
-                'frame-options'(policy : 'ALLOW-FROM', strategy: 'whitelist', value : 'https://example.com')
-            }
-        }
-        createAppContext()
-
-        def hf = getFilter(HeaderWriterFilter)
-        MockHttpServletResponse response = new MockHttpServletResponse()
-
-        def request = new MockHttpServletRequest()
-        request.setParameter("from", "https://example.com");
-        hf.doFilter(request, response, new MockFilterChain())
-
-        then:
-        assertHeaders(response, ['X-Frame-Options':'ALLOW-FROM https://example.com'])
-    }
-
    def 'http headers header a=b'() {
        when:
        httpAutoConfig {
@@ -1,100 +0,0 @@
-/*
- * Copyright 2002-2015 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configurers;
-
-import static org.fest.assertions.Assertions.assertThat;
-
-import javax.servlet.http.HttpServletResponse;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.http.HttpMethod;
-import org.springframework.mock.web.MockFilterChain;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.web.FilterChainProxy;
-import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
-
-/**
- * @author Rob Winch
- *
- */
-public class AuthorizeRequestsTests {
-    AnnotationConfigWebApplicationContext context;
-
-    MockHttpServletRequest request;
-    MockHttpServletResponse response;
-    MockFilterChain chain;
-
-    @Autowired
-    FilterChainProxy springSecurityFilterChain;
-
-    @Before
-    public void setup() {
-        request = new MockHttpServletRequest();
-        response = new MockHttpServletResponse();
-        chain = new MockFilterChain();
-    }
-
-    @After
-    public void cleanup() {
-        if(context != null) {
-            context.close();
-        }
-    }
-
-    // SEC-3135
-    @Test
-    public void antMatchersMethodAndNoPatterns() throws Exception {
-        loadConfig(AntMatchersNoPatternsConfig.class);
-        request.setMethod("POST");
-
-        springSecurityFilterChain.doFilter(request, response, chain);
-
-        assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_FORBIDDEN);
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class AntMatchersNoPatternsConfig extends WebSecurityConfigurerAdapter {
-        protected void configure(HttpSecurity http) throws Exception {
-            http
-                .authorizeRequests()
-                    .antMatchers(HttpMethod.POST).denyAll();
-        }
-
-        @Override
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .inMemoryAuthentication();
-        }
-    }
-
-    public void loadConfig(Class<?>... configs) {
-        context = new AnnotationConfigWebApplicationContext();
-        context.register(configs);
-        context.refresh();
-
-        context.getAutowireCapableBeanFactory().autowireBean(this);
-    }
-}
@@ -1,105 +0,0 @@
-/*
- * Copyright 2002-2015 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configurers;
-
-import static org.fest.assertions.Assertions.assertThat;
-
-import javax.servlet.http.HttpServletResponse;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.http.HttpMethod;
-import org.springframework.mock.web.MockFilterChain;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.web.FilterChainProxy;
-import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
-
-/**
- * @author Rob Winch
- *
- */
-public class HttpSecurityAntMatchersTests {
-    AnnotationConfigWebApplicationContext context;
-
-    MockHttpServletRequest request;
-    MockHttpServletResponse response;
-    MockFilterChain chain;
-
-    @Autowired
-    FilterChainProxy springSecurityFilterChain;
-
-    @Before
-    public void setup() {
-        request = new MockHttpServletRequest();
-        response = new MockHttpServletResponse();
-        chain = new MockFilterChain();
-    }
-
-    @After
-    public void cleanup() {
-        if(context != null) {
-            context.close();
-        }
-    }
-
-    // SEC-3135
-    @Test
-    public void antMatchersMethodAndNoPatterns() throws Exception {
-        loadConfig(AntMatchersNoPatternsConfig.class);
-        request.setMethod("POST");
-
-        springSecurityFilterChain.doFilter(request, response, chain);
-
-        assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_FORBIDDEN);
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class AntMatchersNoPatternsConfig extends WebSecurityConfigurerAdapter {
-        protected void configure(HttpSecurity http) throws Exception {
-            http
-                .requestMatchers()
-                    .antMatchers(HttpMethod.POST)
-                    .and()
-                .authorizeRequests()
-                    .anyRequest().denyAll();
-        }
-
-        @Override
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .inMemoryAuthentication();
-        }
-    }
-
-    public void loadConfig(Class<?>... configs) {
-        context = new AnnotationConfigWebApplicationContext();
-        context.register(configs);
-        context.refresh();
-
-        context.getAutowireCapableBeanFactory().autowireBean(this);
-    }
-
-
-}
@@ -1,110 +0,0 @@
-/*
- * Copyright 2002-2015 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configurers;
-
-import static org.fest.assertions.Assertions.assertThat;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.mock.web.MockFilterChain;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.FilterChainProxy;
-import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
-import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
-
-/**
- * @author Rob Winch
- *
- */
-public class HttpSecurityLogoutTests {
-    AnnotationConfigWebApplicationContext context;
-
-    MockHttpServletRequest request;
-    MockHttpServletResponse response;
-    MockFilterChain chain;
-
-    @Autowired
-    FilterChainProxy springSecurityFilterChain;
-
-    @Before
-    public void setup() {
-        request = new MockHttpServletRequest();
-        response = new MockHttpServletResponse();
-        chain = new MockFilterChain();
-    }
-
-    @After
-    public void cleanup() {
-        if(context != null) {
-            context.close();
-        }
-    }
-
-    // SEC-2848
-    @Test
-    public void clearAuthenticationFalse() throws Exception {
-        loadConfig(ClearAuthenticationFalseConfig.class);
-
-        SecurityContext currentContext = SecurityContextHolder.createEmptyContext();
-        currentContext.setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER"));
-
-        request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, currentContext);
-        request.setMethod("POST");
-        request.setServletPath("/logout");
-
-        springSecurityFilterChain.doFilter(request, response, chain);
-
-        assertThat(currentContext.getAuthentication()).isNotNull();
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class ClearAuthenticationFalseConfig extends WebSecurityConfigurerAdapter {
-        protected void configure(HttpSecurity http) throws Exception {
-            http
-                .csrf().disable()
-                .logout()
-                    .clearAuthentication(false);
-        }
-
-        @Override
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .inMemoryAuthentication();
-        }
-    }
-
-    public void loadConfig(Class<?>... configs) {
-        context = new AnnotationConfigWebApplicationContext();
-        context.register(configs);
-        context.refresh();
-
-        context.getAutowireCapableBeanFactory().autowireBean(this);
-    }
-
-
-}
@@ -1,67 +0,0 @@
-/*
- * Copyright 2002-2015 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.http.customconfigurer;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.context.ApplicationContext;
-import org.springframework.security.config.annotation.SecurityConfigurerAdapter;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configurers.FormLoginConfigurer;
-import org.springframework.security.web.DefaultSecurityFilterChain;
-
-/**
- * @author Rob Winch
- *
- */
-public class CustomConfigurer extends SecurityConfigurerAdapter<DefaultSecurityFilterChain,HttpSecurity> {
-
-	@Value("${permitAllPattern}")
-	private String permitAllPattern;
-
-	private String loginPage = "/login";
-
-	/* (non-Javadoc)
-	 * @see org.springframework.security.config.annotation.SecurityConfigurerAdapter#init(org.springframework.security.config.annotation.SecurityBuilder)
-	 */
-	@SuppressWarnings("unchecked")
-	@Override
-	public void init(HttpSecurity http) throws Exception {
-		// autowire this bean
-		ApplicationContext context = http.getSharedObject(ApplicationContext.class);
-		context.getAutowireCapableBeanFactory().autowireBean(this);
-
-		http
-			.authorizeRequests()
-				.antMatchers(permitAllPattern).permitAll()
-				.anyRequest().authenticated();
-
-		if(http.getConfigurer(FormLoginConfigurer.class) == null) {
-			// only apply if formLogin() was not invoked by the user
-			http
-				.formLogin()
-					.loginPage(loginPage);
-		}
-	}
-
-	public CustomConfigurer loginPage(String loginPage) {
-		this.loginPage = loginPage;
-		return this;
-	}
-
-	public static CustomConfigurer customConfigurer() {
-		return new CustomConfigurer();
-	}
-}
@@ -1,164 +0,0 @@
-/*
- * Copyright 2002-2015 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.http.customconfigurer;
-
-import static org.fest.assertions.Assertions.assertThat;
-import static org.springframework.security.config.http.customconfigurer.CustomConfigurer.customConfigurer;
-
-import java.util.Properties;
-
-import javax.servlet.http.HttpServletResponse;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.config.PropertyPlaceholderConfigurer;
-import org.springframework.context.ConfigurableApplicationContext;
-import org.springframework.context.annotation.AnnotationConfigApplicationContext;
-import org.springframework.context.annotation.Bean;
-import org.springframework.mock.web.MockFilterChain;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.web.FilterChainProxy;
-
-/**
- * @author Rob Winch
- *
- */
-public class CustomHttpSecurityConfigurerTests {
-	@Autowired
-	ConfigurableApplicationContext context;
-
-	@Autowired
-	FilterChainProxy springSecurityFilterChain;
-
-	MockHttpServletRequest request;
-	MockHttpServletResponse response;
-	MockFilterChain chain;
-
-	@Before
-	public void setup() {
-		request = new MockHttpServletRequest();
-		response = new MockHttpServletResponse();
-		chain = new MockFilterChain();
-		request.setMethod("GET");
-	}
-
-	@After
-	public void cleanup() {
-		if(context != null) {
-			context.close();
-		}
-	}
-
-	@Test
-	public void customConfiguerPermitAll() throws Exception {
-		loadContext(Config.class);
-
-		request.setPathInfo("/public/something");
-
-		springSecurityFilterChain.doFilter(request, response, chain);
-
-		assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
-	}
-
-	@Test
-	public void customConfiguerFormLogin() throws Exception {
-		loadContext(Config.class);
-		request.setPathInfo("/requires-authentication");
-
-		springSecurityFilterChain.doFilter(request, response, chain);
-
-		assertThat(response.getRedirectedUrl()).endsWith("/custom");
-	}
-
-	@Test
-	public void customConfiguerCustomizeDisablesCsrf() throws Exception {
-		loadContext(ConfigCustomize.class);
-		request.setPathInfo("/public/something");
-		request.setMethod("POST");
-
-		springSecurityFilterChain.doFilter(request, response, chain);
-
-		assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
-	}
-
-	@Test
-	public void customConfiguerCustomizeFormLogin() throws Exception {
-		loadContext(ConfigCustomize.class);
-		request.setPathInfo("/requires-authentication");
-
-		springSecurityFilterChain.doFilter(request, response, chain);
-
-		assertThat(response.getRedirectedUrl()).endsWith("/other");
-	}
-
-	private void loadContext(Class<?> clazz) {
-		AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext(clazz);
-		context.getAutowireCapableBeanFactory().autowireBean(this);
-	}
-
-	@EnableWebSecurity
-	static class Config extends WebSecurityConfigurerAdapter {
-
-		@Override
-		protected void configure(HttpSecurity http) throws Exception {
-			http
-				.apply(customConfigurer())
-					.loginPage("/custom");
-		}
-
-		@Bean
-		public static PropertyPlaceholderConfigurer propertyPlaceholderConfigurer() {
-			// Typically externalize this as a properties file
-			Properties properties = new Properties();
-			properties.setProperty("permitAllPattern", "/public/**");
-
-			PropertyPlaceholderConfigurer propertyPlaceholderConfigurer = new PropertyPlaceholderConfigurer();
-			propertyPlaceholderConfigurer.setProperties(properties);
-			return propertyPlaceholderConfigurer;
-		}
-	}
-
-	@EnableWebSecurity
-	static class ConfigCustomize extends WebSecurityConfigurerAdapter {
-
-		@Override
-		protected void configure(HttpSecurity http) throws Exception {
-			http
-				.apply(customConfigurer())
-					.and()
-				.csrf().disable()
-				.formLogin()
-					.loginPage("/other");
-		}
-
-		@Bean
-		public static PropertyPlaceholderConfigurer propertyPlaceholderConfigurer() {
-			// Typically externalize this as a properties file
-			Properties properties = new Properties();
-			properties.setProperty("permitAllPattern", "/public/**");
-
-			PropertyPlaceholderConfigurer propertyPlaceholderConfigurer = new PropertyPlaceholderConfigurer();
-			propertyPlaceholderConfigurer.setProperties(properties);
-			return propertyPlaceholderConfigurer;
-		}
-	}
-}
@@ -16,7 +16,6 @@ Import-Template:
 org.openid4java.*;version="${openid4javaRange}";resolution:=optional,
 org.springframework.security.access.*;version="${secRange}",
 org.springframework.security.authentication.*;version="${secRange}",
- org.springframework.security.context.*;version="${secRange}";resolution:=optional,
 org.springframework.security.core.*;version="${secRange}",
 org.springframework.security.crypto.bcrypt.*;version="${secRange}",
 org.springframework.security.crypto.password.*;version="${secRange}",
@@ -8,19 +8,16 @@ configurations {
    included

    compile.extendsFrom included
-
-    testCompile.exclude group: 'org.mockito', module: 'mockito-all'
 }

 dependencies {
-    compile springCoreDependency,
-            'aopalliance:aopalliance:1.0',
+    compile 'aopalliance:aopalliance:1.0',
            "org.springframework:spring-aop:$springVersion",
            "org.springframework:spring-beans:$springVersion",
            "org.springframework:spring-context:$springVersion",
            "org.springframework:spring-expression:$springVersion"

-    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion",
+    optional "net.sf.ehcache:ehcache:$ehcacheVersion",
             'javax.annotation:jsr250-api:1.0',
             "org.aspectj:aspectjrt:$aspectjVersion",
             "org.springframework:spring-jdbc:$springVersion",
@@ -33,7 +30,8 @@ dependencies {
                "org.slf4j:jcl-over-slf4j:$slf4jVersion",
                powerMockDependencies

-    testRuntime "org.hsqldb:hsqldb:$hsqlVersion"
+    testRuntime "org.hsqldb:hsqldb:$hsqlVersion",
+                "cglib:cglib-nodep:$cglibVersion"
 }

 classes.doLast {
@@ -45,7 +43,7 @@ classes.doLast {

 sourceJar.from cryptoProject.sourceSets.main.java

-configure(project.tasks.withType(Test)) {
+configure([test,spring4Test]) {
    systemProperties['springSecurityVersion'] = version
    systemProperties['springVersion'] = springVersion
 }
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-core</artifactId>
-  <version>3.2.10.RELEASE</version>
+  <version>3.2.3.RELEASE</version>
  <name>spring-security-core</name>
  <description>spring-security-core</description>
  <url>http://spring.io/spring-security</url>
@@ -30,6 +31,17 @@
    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
    <url>https://github.com/spring-projects/spring-security</url>
  </scm>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -40,25 +52,25 @@
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-beans</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <exclusions>
        <exclusion>
@@ -70,7 +82,7 @@
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-expression</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -89,8 +101,8 @@
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache-core</artifactId>
-      <version>1.7.2</version>
+      <artifactId>ehcache</artifactId>
+      <version>1.6.2</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
@@ -104,17 +116,23 @@
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-tx</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
+    <dependency>
+      <groupId>cglib</groupId>
+      <artifactId>cglib-nodep</artifactId>
+      <version>2.2</version>
+      <scope>test</scope>
+    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-classic</artifactId>
@@ -126,36 +144,18 @@
      <artifactId>commons-collections</artifactId>
      <version>3.2</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.easytesting</groupId>
      <artifactId>fest-assert</artifactId>
      <version>1.4</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.hsqldb</groupId>
@@ -166,121 +166,56 @@
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
-      <version>1.10.19</version>
+      <version>1.9.5</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-api-mockito</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-api-support</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-core</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-module-junit4</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-module-junit4-common</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-reflect</artifactId>
-      <version>1.6.2</version>
+      <version>1.5.1</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>jcl-over-slf4j</artifactId>
      <version>1.7.5</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
-      <version>3.2.18.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
    </dependency>
  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>
@@ -46,14 +46,8 @@ public abstract class AbstractMethodSecurityMetadataSource implements MethodSecu
            if (target != null) {
                targetClass = target instanceof Class<?> ? (Class<?>)target : AopProxyUtils.ultimateTargetClass(target);
            }
-            Collection<ConfigAttribute> attrs = getAttributes(mi.getMethod(), targetClass);
-            if(attrs != null && !attrs.isEmpty()) {
-                return attrs;
-            }
-            if(target != null && !(target instanceof Class<?>)) {
-                attrs = getAttributes(mi.getMethod(), target.getClass());
-            }
-            return attrs;
+
+            return getAttributes(mi.getMethod(), targetClass);
        }

        throw new IllegalArgumentException("Object must be a non-null MethodInvocation");
@@ -92,9 +92,6 @@ public class RoleVoter implements AccessDecisionVoter<Object> {
    }

    public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
-        if(authentication == null) {
-            return ACCESS_DENIED;
-        }
        int result = ACCESS_ABSTAIN;
        Collection<? extends GrantedAuthority> authorities = extractAuthorities(authentication);

@@ -85,7 +85,7 @@ public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationT
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        if (isAuthenticated) {
            throw new IllegalArgumentException(
-                "Once created you cannot set this token to authenticated. Create a new instance using the constructor which takes a GrantedAuthority list will mark this as authenticated.");
+                "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        }

        super.setAuthenticated(false);
@@ -18,7 +18,6 @@ package org.springframework.security.authentication.dao;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.authentication.InternalAuthenticationServiceException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.encoding.PasswordEncoder;
 import org.springframework.security.authentication.encoding.PlaintextPasswordEncoder;
@@ -107,11 +106,11 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
            }
            throw notFound;
        } catch (Exception repositoryProblem) {
-            throw new InternalAuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
+            throw new AuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
        }

        if (loadedUser == null) {
-            throw new InternalAuthenticationServiceException(
+            throw new AuthenticationServiceException(
                    "UserDetailsService returned null, which is an interface contract violation");
        }
        return loadedUser;
@@ -19,15 +19,8 @@ import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.util.Assert;

 /**
- * <p>
- * Wraps a delegate {@link Callable} with logic for setting up a
- * {@link SecurityContext} before invoking the delegate {@link Callable} and
- * then removing the {@link SecurityContext} after the delegate has completed.
- * </p>
- * <p>
- * If there is a {@link SecurityContext} that already exists, it will be
- * restored after the {@link #call()} method is invoked.
- * </p>
+ * Wraps a delegate {@link Callable} with logic for setting up a {@link SecurityContext} before invoking the delegate
+ * {@link Callable} and then removing the {@link SecurityContext} after the delegate has completed.
 *
 * @author Rob Winch
 * @since 3.2
@@ -36,67 +29,41 @@ public final class DelegatingSecurityContextCallable<V> implements Callable<V> {

    private final Callable<V> delegate;

+    private final SecurityContext securityContext;

    /**
-     * The {@link SecurityContext} that the delegate {@link Callable} will be
-     * ran as.
+     * Creates a new {@link DelegatingSecurityContextCallable} with a specific {@link SecurityContext}.
+     * @param delegate the delegate {@link DelegatingSecurityContextCallable} to run with the specified
+     * {@link SecurityContext}. Cannot be null.
+     * @param securityContext the {@link SecurityContext} to establish for the delegate {@link Callable}. Cannot be
+     * null.
     */
-    private final SecurityContext delegateSecurityContext;
-
-    /**
-     * The {@link SecurityContext} that was on the {@link SecurityContextHolder}
-     * prior to being set to the delegateSecurityContext.
-     */
-    private SecurityContext originalSecurityContext;
-
-    /**
-     * Creates a new {@link DelegatingSecurityContextCallable} with a specific
-     * {@link SecurityContext}.
-     * @param delegate the delegate {@link DelegatingSecurityContextCallable} to run with
-     * the specified {@link SecurityContext}. Cannot be null.
-     * @param securityContext the {@link SecurityContext} to establish for the delegate
-     * {@link Callable}. Cannot be null.
-     */
-    public DelegatingSecurityContextCallable(Callable<V> delegate,
-            SecurityContext securityContext) {
+    public DelegatingSecurityContextCallable(Callable<V> delegate, SecurityContext securityContext) {
        Assert.notNull(delegate, "delegate cannot be null");
        Assert.notNull(securityContext, "securityContext cannot be null");
        this.delegate = delegate;
-        this.delegateSecurityContext = securityContext;
+        this.securityContext = securityContext;
    }

    /**
-     * Creates a new {@link DelegatingSecurityContextCallable} with the
-     * {@link SecurityContext} from the {@link SecurityContextHolder}.
-     * @param delegate the delegate {@link Callable} to run under the current
-     * {@link SecurityContext}. Cannot be null.
+     * Creates a new {@link DelegatingSecurityContextCallable} with the {@link SecurityContext} from the
+     * {@link SecurityContextHolder}.
+     * @param delegate the delegate {@link Callable} to run under the current {@link SecurityContext}. Cannot be null.
     */
    public DelegatingSecurityContextCallable(Callable<V> delegate) {
        this(delegate, SecurityContextHolder.getContext());
    }

    public V call() throws Exception {
-        this.originalSecurityContext = SecurityContextHolder.getContext();
-
        try {
-            SecurityContextHolder.setContext(delegateSecurityContext);
+            SecurityContextHolder.setContext(securityContext);
            return delegate.call();
        }
        finally {
-            SecurityContext emptyContext = SecurityContextHolder.createEmptyContext();
-            if(emptyContext.equals(originalSecurityContext)) {
-                SecurityContextHolder.clearContext();
-            } else {
-                SecurityContextHolder.setContext(originalSecurityContext);
-            }
-            this.originalSecurityContext = null;
+            SecurityContextHolder.clearContext();
        }
    }

-    public String toString() {
-        return delegate.toString();
-    }
-
    /**
     * Creates a {@link DelegatingSecurityContextCallable} and with the given {@link Callable} and
     * {@link SecurityContext}, but if the securityContext is null will defaults to the current {@link SecurityContext}
@@ -17,16 +17,8 @@ import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.util.Assert;

 /**
- * <p>
- * Wraps a delegate {@link Runnable} with logic for setting up a {@link SecurityContext}
- * before invoking the delegate {@link Runnable} and then removing the
- * {@link SecurityContext} after the delegate has completed.
- * </p>
- *
- * <p>
- * If there is a {@link SecurityContext} that already exists, it will be
- * restored after the {@link #run()} method is invoked.
- * </p>
+ * Wraps a delegate {@link Runnable} with logic for setting up a {@link SecurityContext} before invoking the delegate
+ * {@link Runnable} and then removing the {@link SecurityContext} after the delegate has completed.
 *
 * @author Rob Winch
 * @since 3.2
@@ -35,66 +27,40 @@ public final class DelegatingSecurityContextRunnable implements Runnable {

    private final Runnable delegate;

-    /**
-     * The {@link SecurityContext} that the delegate {@link Runnable} will be
-     * ran as.
-     */
-    private final SecurityContext delegateSecurityContext;
+    private final SecurityContext securityContext;

    /**
-     * The {@link SecurityContext} that was on the {@link SecurityContextHolder}
-     * prior to being set to the delegateSecurityContext.
+     * Creates a new {@link DelegatingSecurityContextRunnable} with a specific {@link SecurityContext}.
+     * @param delegate the delegate {@link Runnable} to run with the specified {@link SecurityContext}. Cannot be null.
+     * @param securityContext the {@link SecurityContext} to establish for the delegate {@link Runnable}. Cannot be
+     * null.
     */
-    private SecurityContext originalSecurityContext;
-
-    /**
-     * Creates a new {@link DelegatingSecurityContextRunnable} with a specific
-     * {@link SecurityContext}.
-     * @param delegate the delegate {@link Runnable} to run with the specified
-     * {@link SecurityContext}. Cannot be null.
-     * @param securityContext the {@link SecurityContext} to establish for the delegate
-     * {@link Runnable}. Cannot be null.
-     */
-    public DelegatingSecurityContextRunnable(Runnable delegate,
-            SecurityContext securityContext) {
+    public DelegatingSecurityContextRunnable(Runnable delegate, SecurityContext securityContext) {
        Assert.notNull(delegate, "delegate cannot be null");
        Assert.notNull(securityContext, "securityContext cannot be null");
        this.delegate = delegate;
-        this.delegateSecurityContext = securityContext;
+        this.securityContext = securityContext;
    }

    /**
-     * Creates a new {@link DelegatingSecurityContextRunnable} with the
-     * {@link SecurityContext} from the {@link SecurityContextHolder}.
-     * @param delegate the delegate {@link Runnable} to run under the current
-     * {@link SecurityContext}. Cannot be null.
+     * Creates a new {@link DelegatingSecurityContextRunnable} with the {@link SecurityContext} from the
+     * {@link SecurityContextHolder}.
+     * @param delegate the delegate {@link Runnable} to run under the current {@link SecurityContext}. Cannot be null.
     */
    public DelegatingSecurityContextRunnable(Runnable delegate) {
        this(delegate, SecurityContextHolder.getContext());
    }

    public void run() {
-        this.originalSecurityContext = SecurityContextHolder.getContext();
-
        try {
-            SecurityContextHolder.setContext(delegateSecurityContext);
+            SecurityContextHolder.setContext(securityContext);
            delegate.run();
        }
        finally {
-            SecurityContext emptyContext = SecurityContextHolder.createEmptyContext();
-            if(emptyContext.equals(originalSecurityContext)) {
-                SecurityContextHolder.clearContext();
-            } else {
-                SecurityContextHolder.setContext(originalSecurityContext);
-            }
-            this.originalSecurityContext = null;
+            SecurityContextHolder.clearContext();
        }
    }

-    public String toString() {
-        return delegate.toString();
-    }
-
    /**
     * Factory method for creating a {@link DelegatingSecurityContextRunnable}.
     *
@@ -1,57 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-package org.springframework.security.context;
-
-import org.springframework.context.ApplicationEvent;
-import org.springframework.context.ApplicationListener;
-import org.springframework.context.event.SmartApplicationListener;
-import org.springframework.util.Assert;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Used for delegating to a number of SmartApplicationListener instances. This is useful when needing to register an
- * SmartApplicationListener with the ApplicationContext programmatically.
- *
- * @author Rob Winch
- */
-public final class DelegatingApplicationListener implements ApplicationListener<ApplicationEvent> {
-    private List<SmartApplicationListener> listeners = new ArrayList<SmartApplicationListener>();
-
-    @Override
-    public void onApplicationEvent(ApplicationEvent event) {
-        if(event == null) {
-            return;
-        }
-        for(SmartApplicationListener listener : listeners) {
-            Object source = event.getSource();
-            if(source != null && listener.supportsEventType(event.getClass()) && listener.supportsSourceType(source.getClass())) {
-                listener.onApplicationEvent(event);
-            }
-        }
-    }
-
-    /**
-     * Adds a new SmartApplicationListener to use.
-     *
-     * @param smartApplicationListener the SmartApplicationListener to use. Cannot be null.
-     */
-    public void addListener(SmartApplicationListener smartApplicationListener) {
-        Assert.notNull(smartApplicationListener, "smartApplicationListener cannot be null");
-        listeners.add(smartApplicationListener);
-    }
-}
@@ -1,469 +0,0 @@
-package org.springframework.security.core;
-
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import java.math.BigInteger;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Iterator;
-import java.util.List;
-import java.util.ListIterator;
-import java.util.Locale;
-import java.util.Properties;
-import java.util.Stack;
-
-/**
- * Generic implementation of version comparison.
- *
- * NOTE: This is a copy from https://svn.apache.org/repos/asf/maven/maven-3/tags/maven-3.1.0/maven-artifact/src/main/java/org/apache/maven/artifact/versioning/ComparableVersion.java
- *
- * <p>Features:
- * <ul>
- * <li>mixing of '<code>-</code>' (dash) and '<code>.</code>' (dot) separators,</li>
- * <li>transition between characters and digits also constitutes a separator:
- *     <code>1.0alpha1 =&gt; [1, 0, alpha, 1]</code></li>
- * <li>unlimited number of version components,</li>
- * <li>version components in the text can be digits or strings,</li>
- * <li>strings are checked for well-known qualifiers and the qualifier ordering is used for version ordering.
- *     Well-known qualifiers (case insensitive) are:<ul>
- *     <li><code>alpha</code> or <code>a</code></li>
- *     <li><code>beta</code> or <code>b</code></li>
- *     <li><code>milestone</code> or <code>m</code></li>
- *     <li><code>rc</code> or <code>cr</code></li>
- *     <li><code>snapshot</code></li>
- *     <li><code>(the empty string)</code> or <code>ga</code> or <code>final</code></li>
- *     <li><code>sp</code></li>
- *     </ul>
- *     Unknown qualifiers are considered after known qualifiers, with lexical order (always case insensitive),
- *   </li>
- * <li>a dash usually precedes a qualifier, and is always less important than something preceded with a dot.</li>
- * </ul></p>
- *
- * @see <a href="https://cwiki.apache.org/confluence/display/MAVENOLD/Versioning">"Versioning" on Maven Wiki</a>
- * @author <a href="mailto:kenney@apache.org">Kenney Westerhof</a>
- * @author <a href="mailto:hboutemy@apache.org">HervÃ© Boutemy</a>
- */
-class ComparableVersion
-        implements Comparable<ComparableVersion>
-{
-    private String value;
-
-    private String canonical;
-
-    private ListItem items;
-
-    private interface Item
-    {
-        final int INTEGER_ITEM = 0;
-        final int STRING_ITEM = 1;
-        final int LIST_ITEM = 2;
-
-        int compareTo( Item item );
-
-        int getType();
-
-        boolean isNull();
-    }
-
-    /**
-     * Represents a numeric item in the version item list.
-     */
-    private static class IntegerItem
-            implements Item
-    {
-        private static final BigInteger BigInteger_ZERO = new BigInteger( "0" );
-
-        private final BigInteger value;
-
-        public static final IntegerItem ZERO = new IntegerItem();
-
-        private IntegerItem()
-        {
-            this.value = BigInteger_ZERO;
-        }
-
-        public IntegerItem( String str )
-        {
-            this.value = new BigInteger( str );
-        }
-
-        public int getType()
-        {
-            return INTEGER_ITEM;
-        }
-
-        public boolean isNull()
-        {
-            return BigInteger_ZERO.equals( value );
-        }
-
-        public int compareTo( Item item )
-        {
-            if ( item == null )
-            {
-                return BigInteger_ZERO.equals( value ) ? 0 : 1; // 1.0 == 1, 1.1 > 1
-            }
-
-            switch ( item.getType() )
-            {
-                case INTEGER_ITEM:
-                    return value.compareTo( ( (IntegerItem) item ).value );
-
-                case STRING_ITEM:
-                    return 1; // 1.1 > 1-sp
-
-                case LIST_ITEM:
-                    return 1; // 1.1 > 1-1
-
-                default:
-                    throw new RuntimeException( "invalid item: " + item.getClass() );
-            }
-        }
-
-        public String toString()
-        {
-            return value.toString();
-        }
-    }
-
-    /**
-     * Represents a string in the version item list, usually a qualifier.
-     */
-    private static class StringItem
-            implements Item
-    {
-        private static final String[] QUALIFIERS = { "alpha", "beta", "milestone", "rc", "snapshot", "", "sp" };
-
-        private static final List<String> _QUALIFIERS = Arrays.asList( QUALIFIERS );
-
-        private static final Properties ALIASES = new Properties();
-        static
-        {
-            ALIASES.put( "ga", "" );
-            ALIASES.put( "final", "" );
-            ALIASES.put( "cr", "rc" );
-        }
-
-        /**
-         * A comparable value for the empty-string qualifier. This one is used to determine if a given qualifier makes
-         * the version older than one without a qualifier, or more recent.
-         */
-        private static final String RELEASE_VERSION_INDEX = String.valueOf( _QUALIFIERS.indexOf( "" ) );
-
-        private String value;
-
-        public StringItem( String value, boolean followedByDigit )
-        {
-            if ( followedByDigit && value.length() == 1 )
-            {
-                // a1 = alpha-1, b1 = beta-1, m1 = milestone-1
-                switch ( value.charAt( 0 ) )
-                {
-                    case 'a':
-                        value = "alpha";
-                        break;
-                    case 'b':
-                        value = "beta";
-                        break;
-                    case 'm':
-                        value = "milestone";
-                        break;
-                }
-            }
-            this.value = ALIASES.getProperty( value , value );
-        }
-
-        public int getType()
-        {
-            return STRING_ITEM;
-        }
-
-        public boolean isNull()
-        {
-            return ( comparableQualifier( value ).compareTo( RELEASE_VERSION_INDEX ) == 0 );
-        }
-
-        /**
-         * Returns a comparable value for a qualifier.
-         *
-         * This method takes into account the ordering of known qualifiers then unknown qualifiers with lexical ordering.
-         *
-         * just returning an Integer with the index here is faster, but requires a lot of if/then/else to check for -1
-         * or QUALIFIERS.size and then resort to lexical ordering. Most comparisons are decided by the first character,
-         * so this is still fast. If more characters are needed then it requires a lexical sort anyway.
-         *
-         * @param qualifier
-         * @return an equivalent value that can be used with lexical comparison
-         */
-        public static String comparableQualifier( String qualifier )
-        {
-            int i = _QUALIFIERS.indexOf( qualifier );
-
-            return i == -1 ? ( _QUALIFIERS.size() + "-" + qualifier ) : String.valueOf( i );
-        }
-
-        public int compareTo( Item item )
-        {
-            if ( item == null )
-            {
-                // 1-rc < 1, 1-ga > 1
-                return comparableQualifier( value ).compareTo( RELEASE_VERSION_INDEX );
-            }
-            switch ( item.getType() )
-            {
-                case INTEGER_ITEM:
-                    return -1; // 1.any < 1.1 ?
-
-                case STRING_ITEM:
-                    return comparableQualifier( value ).compareTo( comparableQualifier( ( (StringItem) item ).value ) );
-
-                case LIST_ITEM:
-                    return -1; // 1.any < 1-1
-
-                default:
-                    throw new RuntimeException( "invalid item: " + item.getClass() );
-            }
-        }
-
-        public String toString()
-        {
-            return value;
-        }
-    }
-
-    /**
-     * Represents a version list item. This class is used both for the global item list and for sub-lists (which start
-     * with '-(number)' in the version specification).
-     */
-    private static class ListItem
-            extends ArrayList<Item>
-            implements Item
-    {
-        public int getType()
-        {
-            return LIST_ITEM;
-        }
-
-        public boolean isNull()
-        {
-            return ( size() == 0 );
-        }
-
-        void normalize()
-        {
-            for( ListIterator<Item> iterator = listIterator( size() ); iterator.hasPrevious(); )
-            {
-                Item item = iterator.previous();
-                if ( item.isNull() )
-                {
-                    iterator.remove(); // remove null trailing items: 0, "", empty list
-                }
-                else
-                {
-                    break;
-                }
-            }
-        }
-
-        public int compareTo( Item item )
-        {
-            if ( item == null )
-            {
-                if ( size() == 0 )
-                {
-                    return 0; // 1-0 = 1- (normalize) = 1
-                }
-                Item first = get( 0 );
-                return first.compareTo( null );
-            }
-            switch ( item.getType() )
-            {
-                case INTEGER_ITEM:
-                    return -1; // 1-1 < 1.0.x
-
-                case STRING_ITEM:
-                    return 1; // 1-1 > 1-sp
-
-                case LIST_ITEM:
-                    Iterator<Item> left = iterator();
-                    Iterator<Item> right = ( (ListItem) item ).iterator();
-
-                    while ( left.hasNext() || right.hasNext() )
-                    {
-                        Item l = left.hasNext() ? left.next() : null;
-                        Item r = right.hasNext() ? right.next() : null;
-
-                        // if this is shorter, then invert the compare and mul with -1
-                        int result = l == null ? -1 * r.compareTo( l ) : l.compareTo( r );
-
-                        if ( result != 0 )
-                        {
-                            return result;
-                        }
-                    }
-
-                    return 0;
-
-                default:
-                    throw new RuntimeException( "invalid item: " + item.getClass() );
-            }
-        }
-
-        public String toString()
-        {
-            StringBuilder buffer = new StringBuilder( "(" );
-            for( Iterator<Item> iter = iterator(); iter.hasNext(); )
-            {
-                buffer.append( iter.next() );
-                if ( iter.hasNext() )
-                {
-                    buffer.append( ',' );
-                }
-            }
-            buffer.append( ')' );
-            return buffer.toString();
-        }
-    }
-
-    public ComparableVersion( String version )
-    {
-        parseVersion( version );
-    }
-
-    public final void parseVersion( String version )
-    {
-        this.value = version;
-
-        items = new ListItem();
-
-        version = version.toLowerCase( Locale.ENGLISH );
-
-        ListItem list = items;
-
-        Stack<Item> stack = new Stack<Item>();
-        stack.push( list );
-
-        boolean isDigit = false;
-
-        int startIndex = 0;
-
-        for ( int i = 0; i < version.length(); i++ )
-        {
-            char c = version.charAt( i );
-
-            if ( c == '.' )
-            {
-                if ( i == startIndex )
-                {
-                    list.add( IntegerItem.ZERO );
-                }
-                else
-                {
-                    list.add( parseItem( isDigit, version.substring( startIndex, i ) ) );
-                }
-                startIndex = i + 1;
-            }
-            else if ( c == '-' )
-            {
-                if ( i == startIndex )
-                {
-                    list.add( IntegerItem.ZERO );
-                }
-                else
-                {
-                    list.add( parseItem( isDigit, version.substring( startIndex, i ) ) );
-                }
-                startIndex = i + 1;
-
-                if ( isDigit )
-                {
-                    list.normalize(); // 1.0-* = 1-*
-
-                    if ( ( i + 1 < version.length() ) && Character.isDigit( version.charAt( i + 1 ) ) )
-                    {
-                        // new ListItem only if previous were digits and new char is a digit,
-                        // ie need to differentiate only 1.1 from 1-1
-                        list.add( list = new ListItem() );
-
-                        stack.push( list );
-                    }
-                }
-            }
-            else if ( Character.isDigit( c ) )
-            {
-                if ( !isDigit && i > startIndex )
-                {
-                    list.add( new StringItem( version.substring( startIndex, i ), true ) );
-                    startIndex = i;
-                }
-
-                isDigit = true;
-            }
-            else
-            {
-                if ( isDigit && i > startIndex )
-                {
-                    list.add( parseItem( true, version.substring( startIndex, i ) ) );
-                    startIndex = i;
-                }
-
-                isDigit = false;
-            }
-        }
-
-        if ( version.length() > startIndex )
-        {
-            list.add( parseItem( isDigit, version.substring( startIndex ) ) );
-        }
-
-        while ( !stack.isEmpty() )
-        {
-            list = (ListItem) stack.pop();
-            list.normalize();
-        }
-
-        canonical = items.toString();
-    }
-
-    private static Item parseItem( boolean isDigit, String buf )
-    {
-        return isDigit ? new IntegerItem( buf ) : new StringItem( buf, false );
-    }
-
-    public int compareTo( ComparableVersion o )
-    {
-        return items.compareTo( o.items );
-    }
-
-    public String toString()
-    {
-        return value;
-    }
-
-    public boolean equals( Object o )
-    {
-        return ( o instanceof ComparableVersion ) && canonical.equals( ( (ComparableVersion) o ).canonical );
-    }
-
-    public int hashCode()
-    {
-        return canonical.hashCode();
-    }
-}
@@ -23,7 +23,7 @@ public class SpringSecurityCoreVersion {
     */
    public static final long SERIAL_VERSION_UID = 320L;

-    static final String MIN_SPRING_VERSION = "3.2.18.RELEASE";
+    static final String MIN_SPRING_VERSION = "3.2.8.RELEASE";

    static {
        performVersionChecks();
@@ -38,15 +38,6 @@ public class SpringSecurityCoreVersion {
     * Performs version checks
     */
    private static void performVersionChecks() {
-        performVersionChecks(MIN_SPRING_VERSION);
-    }
-
-    /**
-     * Perform version checks with specific min Spring Version
-     *
-     * @param minSpringVersion
-     */
-    private static void performVersionChecks(String minSpringVersion) {
        // Check Spring Compatibility
        String springVersion = SpringVersion.getVersion();
        String version = getVersion();
@@ -56,8 +47,8 @@ public class SpringSecurityCoreVersion {
        }

        logger.info("You are running with Spring Security Core " + version);
-        if (new ComparableVersion(springVersion).compareTo(new ComparableVersion(minSpringVersion)) < 0) {
-            logger.warn("**** You are advised to use Spring " + minSpringVersion +
+        if (springVersion.compareTo(MIN_SPRING_VERSION) < 0) {
+            logger.warn("**** You are advised to use Spring " + MIN_SPRING_VERSION +
                    " or later with this version. You are running: " + springVersion);
        }
    }
@@ -1,20 +1,20 @@
 AbstractAccessDecisionManager.accessDenied=Zugriff verweigert
-AbstractLdapAuthenticationProvider.emptyPassword=Ung\u00FCltige Anmeldedaten
+AbstractLdapAuthenticationProvider.emptyPassword=Ung\u00FCltige Benutzerberechtigungen
 AbstractSecurityInterceptor.authenticationNotFound=Im SecurityContext wurde keine Authentifikation gefunden
-AbstractUserDetailsAuthenticationProvider.badCredentials=Ung\u00FCltige Anmeldedaten
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Die G\u00FCltigkeit der Anmeldedaten ist abgelaufen
+AbstractUserDetailsAuthenticationProvider.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Die G\u00FCltigkeit der Benutzerberechtigungen ist abgelaufen
 AbstractUserDetailsAuthenticationProvider.disabled=Der Benutzer ist deaktiviert
 AbstractUserDetailsAuthenticationProvider.expired=Die G\u00FCltigkeit des Benutzerkontos ist abgelaufen
 AbstractUserDetailsAuthenticationProvider.locked=Das Benutzerkonto ist gesperrt
 AbstractUserDetailsAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterst\u00FCtzt
-AccountStatusUserDetailsChecker.credentialsExpired=Die G\u00FCltigkeit der Anmeldedaten ist abgelaufen
+AccountStatusUserDetailsChecker.credentialsExpired=Die G\u00FCltigkeit der Benutzerberechtigungen ist abgelaufen
 AccountStatusUserDetailsChecker.disabled=Der Benutzer ist deaktiviert
 AccountStatusUserDetailsChecker.expired=Die G\u00FCltigkeit des Benutzerkontos ist abgelaufen
 AccountStatusUserDetailsChecker.locked=Das Benutzerkonto ist gesperrt
 AclEntryAfterInvocationProvider.noPermission=Authentifikation {0} hat KEINE Berechtigungen bez\u00FCglich des Dom\u00E4nen-Objekts {1}
 AnonymousAuthenticationProvider.incorrectKey=Das angegebene AnonymousAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
-BindAuthenticator.badCredentials=Ung\u00FCltige Anmeldedaten
-BindAuthenticator.emptyPassword=Ung\u00FCltige Anmeldedaten
+BindAuthenticator.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+BindAuthenticator.emptyPassword=Ung\u00FCltige Benutzerberechtigungen
 CasAuthenticationProvider.incorrectKey=Das angegebene CasAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
 CasAuthenticationProvider.noServiceTicket=Es konnte kein CAS Service-Ticket zur Pr\u00FCfung geliefert werden
 ConcurrentSessionControlStrategy.exceededAllowed=Die maximale Sitzungs-Anzahl von {0} f\u00FCr diesen Nutzer wurde \u00FCberschritten
@@ -30,14 +30,14 @@ DigestAuthenticationFilter.nonceNotTwoTokens=Nonce sollte zwei Elemente beinhalt
 DigestAuthenticationFilter.usernameNotFound=Benutzername {0} wurde nicht gefunden
 #JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
 #JdbcDaoImpl.notFound=User {0} not found
-LdapAuthenticationProvider.badCredentials=Ung\u00FCltige Anmeldedaten
-LdapAuthenticationProvider.credentialsExpired=Die G\u00FCltigkeit der Anmeldedaten ist abgelaufen
+LdapAuthenticationProvider.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+LdapAuthenticationProvider.credentialsExpired=Die G\u00FCltigkeit der Benutzerberechtigungen ist abgelaufen
 LdapAuthenticationProvider.disabled=Der Benutzer ist deaktiviert
 LdapAuthenticationProvider.expired=Die G\u00FCltigkeit des Benutzerkontos ist abgelaufen
 LdapAuthenticationProvider.locked=Das Benutzerkonto ist gesperrt
 LdapAuthenticationProvider.emptyUsername=Ein leerer Benutzername ist nicht erlaubt
 LdapAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterst\u00FCtzt
-PasswordComparisonAuthenticator.badCredentials=Ung\u00FCltige Anmeldedaten
+PasswordComparisonAuthenticator.badCredentials=Ung\u00FCltige Benutzerberechtigungen
 #PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
 ProviderManager.providerNotFound=F\u00FCr {0} wurde kein AuthenticationProvider gefunden
 RememberMeAuthenticationProvider.incorrectKey=Das angegebene RememberMeAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
@@ -1,47 +0,0 @@
-AbstractAccessDecisionManager.accessDenied=Access is denied
-AbstractLdapAuthenticationProvider.emptyPassword=Empty Password
-AbstractSecurityInterceptor.authenticationNotFound=An Authentication object was not found in the SecurityContext
-AbstractUserDetailsAuthenticationProvider.badCredentials=Bad credentials
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=User credentials have expired
-AbstractUserDetailsAuthenticationProvider.disabled=User is disabled
-AbstractUserDetailsAuthenticationProvider.expired=User account has expired
-AbstractUserDetailsAuthenticationProvider.locked=User account is locked
-AbstractUserDetailsAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
-AccountStatusUserDetailsChecker.credentialsExpired=User credentials have expired
-AccountStatusUserDetailsChecker.disabled=User is disabled
-AccountStatusUserDetailsChecker.expired=User account has expired
-AccountStatusUserDetailsChecker.locked=User account is locked
-AclEntryAfterInvocationProvider.noPermission=Authentication {0} has NO permissions to the domain object {1}
-AnonymousAuthenticationProvider.incorrectKey=The presented AnonymousAuthenticationToken does not contain the expected key
-BindAuthenticator.badCredentials=Bad credentials
-BindAuthenticator.emptyPassword=Empty Password
-CasAuthenticationProvider.incorrectKey=The presented CasAuthenticationToken does not contain the expected key
-CasAuthenticationProvider.noServiceTicket=Failed to provide a CAS service ticket to validate
-ConcurrentSessionControlStrategy.exceededAllowed=Maximum sessions of {0} for this principal exceeded
-DigestAuthenticationFilter.incorrectRealm=Response realm name {0} does not match system realm name of {1}
-DigestAuthenticationFilter.incorrectResponse=Incorrect response
-DigestAuthenticationFilter.missingAuth=Missing mandatory digest value for 'auth' QOP; received header {0}
-DigestAuthenticationFilter.missingMandatory=Missing mandatory digest value; received header {0}
-DigestAuthenticationFilter.nonceCompromised=Nonce token compromised {0}
-DigestAuthenticationFilter.nonceEncoding=Nonce is not encoded in Base64; received nonce {0}
-DigestAuthenticationFilter.nonceExpired=Nonce has expired/timed out
-DigestAuthenticationFilter.nonceNotNumeric=Nonce token should have yielded a numeric first token, but was {0}
-DigestAuthenticationFilter.nonceNotTwoTokens=Nonce should have yielded two tokens but was {0}
-DigestAuthenticationFilter.usernameNotFound=Username {0} not found
-JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
-JdbcDaoImpl.notFound=User {0} not found
-LdapAuthenticationProvider.badCredentials=Bad credentials
-LdapAuthenticationProvider.credentialsExpired=User credentials have expired
-LdapAuthenticationProvider.disabled=User is disabled
-LdapAuthenticationProvider.expired=User account has expired
-LdapAuthenticationProvider.locked=User account is locked
-LdapAuthenticationProvider.emptyUsername=Empty username not allowed
-LdapAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
-PasswordComparisonAuthenticator.badCredentials=Bad credentials
-PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
-ProviderManager.providerNotFound=No AuthenticationProvider found for {0}
-RememberMeAuthenticationProvider.incorrectKey=The presented RememberMeAuthenticationToken does not contain the expected key
-RunAsImplAuthenticationProvider.incorrectKey=The presented RunAsUserToken does not contain the expected key
-SubjectDnX509PrincipalExtractor.noMatching=No matching pattern was found in subjectDN: {0}
-SwitchUserFilter.noCurrentUser=No current user associated with this request
-SwitchUserFilter.noOriginalAuthentication=Could not find original Authentication object
@@ -1,21 +1,5 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
 package org.springframework.security.access.annotation;

-import static org.fest.assertions.Assertions.assertThat;
 import static org.junit.Assert.assertEquals;

 import java.util.Collection;
@@ -23,10 +7,10 @@ import java.util.Collection;
 import javax.annotation.security.PermitAll;
 import javax.annotation.security.RolesAllowed;

-import org.junit.Assert;
+import junit.framework.Assert;
+
 import org.junit.Test;
 import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.intercept.method.MockMethodInvocation;

 /**
 * @author Luke Taylor
@@ -74,87 +58,7 @@ public class Jsr250MethodDefinitionSourceTests {
        assertEquals("ADMIN", accessAttributes.toArray()[0].toString());
    }

-    // JSR-250 Spec Tests
-
-    /**
-     *  Class-level annotations only affect the class they annotate and their members, that
-     *  is, its methods and fields. They never affect a member declared by a superclass,
-     * even if it is not hidden or overridden by the class in question.
-     * @throws Exception
-     */
-    @Test
-    public void classLevelAnnotationsOnlyAffectTheClassTheyAnnotateAndTheirMembers() throws Exception {
-        Child target = new Child();
-        MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "notOverriden");
-
-        Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
-        assertThat(accessAttributes).isNull();
-    }
-
-    @Test
-    public void classLevelAnnotationsOnlyAffectTheClassTheyAnnotateAndTheirMembersOverriden() throws Exception {
-        Child target = new Child();
-        MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "overriden");
-
-        Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
-        assertEquals(1, accessAttributes.size());
-        assertEquals("DERIVED", accessAttributes.toArray()[0].toString());
-    }
-
-    @Test
-    public void classLevelAnnotationsImpactMemberLevel() throws Exception {
-        Child target = new Child();
-        MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "defaults");
-
-        Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
-        assertEquals(1, accessAttributes.size());
-        assertEquals("DERIVED", accessAttributes.toArray()[0].toString());
-    }
-
-    @Test
-    public void classLevelAnnotationsIgnoredByExplicitMemberAnnotation() throws Exception {
-        Child target = new Child();
-        MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "explicitMethod");
-
-        Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
-        assertEquals(1, accessAttributes.size());
-        assertEquals("EXPLICIT", accessAttributes.toArray()[0].toString());
-    }
-
-    /**
-     * The interfaces implemented by a class never contribute annotations to the class
-     * itself or any of its members.
-     * @throws Exception
-     */
-    @Test
-    public void interfacesNeverContributeAnnotationsMethodLevel() throws Exception {
-        Parent target = new Parent();
-        MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "interfaceMethod");
-
-        Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
-        assertThat(accessAttributes).isEmpty();
-    }
-
-    @Test
-    public void interfacesNeverContributeAnnotationsClassLevel() throws Exception {
-        Parent target = new Parent();
-        MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "notOverriden");
-
-        Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
-        assertThat(accessAttributes).isEmpty();
-    }
-
-    @Test
-    public void annotationsOnOverriddenMemberIgnored() throws Exception {
-        Child target = new Child();
-        MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "overridenIgnored");
-
-        Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
-        assertEquals(1, accessAttributes.size());
-        assertEquals("DERIVED", accessAttributes.toArray()[0].toString());
-    }
-
-    //~ Inner Classes ======================================================================================================
+//~ Inner Classes ======================================================================================================

    public static class A {

@@ -174,29 +78,4 @@ public class Jsr250MethodDefinitionSourceTests {
        @RolesAllowed("ADMIN")
        public void adminMethod() {}
    }
-
-    // JSR-250 Spec
-
-    @RolesAllowed("IPARENT")
-    interface IParent {
-        @RolesAllowed("INTERFACEMETHOD")
-        void interfaceMethod();
-    }
-
-    static class Parent implements IParent {
-        public void interfaceMethod() {}
-        public void notOverriden() {}
-        public void overriden() {}
-        @RolesAllowed("OVERRIDENIGNORED")
-        public void overridenIgnored() {}
-    }
-
-    @RolesAllowed("DERIVED")
-    class Child extends Parent {
-        public void overriden() {}
-        public void overridenIgnored() {}
-        public void defaults() {}
-        @RolesAllowed("EXPLICIT")
-        public void explicitMethod() {}
-    }
 }
@@ -14,11 +14,13 @@
 */
 package org.springframework.security.access.annotation;

-import static org.fest.assertions.Assertions.assertThat;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.Assert.*;
+
+import org.junit.*;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.access.SecurityConfig;
+import org.springframework.security.access.intercept.method.MockMethodInvocation;
+import org.springframework.security.core.GrantedAuthority;

 import java.lang.annotation.ElementType;
 import java.lang.annotation.Inherited;
@@ -26,17 +28,7 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 import java.lang.reflect.Method;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.EnumSet;
-import java.util.List;
-
-import org.junit.Test;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.SecurityConfig;
-import org.springframework.security.access.annotation.sec2150.MethodInvocationFactory;
-import org.springframework.security.access.intercept.method.MockMethodInvocation;
-import org.springframework.security.core.GrantedAuthority;
+import java.util.*;


 /**
@@ -186,14 +178,6 @@ public class SecuredAnnotationSecurityMetadataSourceTests {
        assertEquals("CUSTOM", attrs[0].getAttribute());
    }

-    @Test
-    public void proxyFactoryInterfaceAttributesFound() throws Exception {
-        MockMethodInvocation mi = MethodInvocationFactory.createSec2150MethodInvocation();
-        Collection<ConfigAttribute> attributes = mds.getAttributes(mi);
-        assertThat(attributes.size()).isEqualTo(1);
-        assertThat(attributes).onProperty("attribute").containsOnly("ROLE_PERSON");
-    }
-
    // Inner classes
    class Department extends Entity {
        public Department(String name) {
@@ -206,7 +190,6 @@ public class SecuredAnnotationSecurityMetadataSourceTests {
        Department someUserMethod3(Department dept);
    }

-    @SuppressWarnings("serial")
    class DepartmentServiceImpl extends BusinessServiceImpl<Department> implements DepartmentService {
        @Secured({"ROLE_ADMIN"})
        public Department someUserMethod3(final Department dept) {
@@ -1,21 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.access.annotation.sec2150;
-
-public interface CrudRepository {
-
-    Iterable<Object> findAll();
-}
@@ -1,36 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.access.annotation.sec2150;
-
-import org.springframework.aop.framework.ProxyFactory;
-import org.springframework.security.access.intercept.method.MockMethodInvocation;
-
-public class MethodInvocationFactory {
-
-    /**
-     * In order to reproduce the bug for SEC-2150, we must have a proxy object
-     * that implements TargetSourceAware and implements our annotated interface.
-     *
-     * @return
-     * @throws NoSuchMethodException
-     */
-    public static MockMethodInvocation createSec2150MethodInvocation() throws NoSuchMethodException {
-        ProxyFactory factory = new ProxyFactory(new Class[] {PersonRepository.class});
-        factory.setTargetClass(CrudRepository.class);
-        PersonRepository repository = (PersonRepository) factory.getProxy();
-        return new MockMethodInvocation(repository, PersonRepository.class , "findAll");
-    }
-}
@@ -1,30 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.access.annotation.sec2150;
-
-import org.springframework.security.access.annotation.Secured;
-import org.springframework.security.access.prepost.PreAuthorize;
-
-/**
- * Note that JSR-256 states that annotations have no impact when placed on
- * interfaces, so SEC-2150 is not impacted by JSR-256 support.
- *
- * @author Rob Winch
- *
- */
-@Secured("ROLE_PERSON")
-@PreAuthorize("hasRole('ROLE_PERSON')")
-public interface PersonRepository extends CrudRepository {}
@@ -1,31 +1,23 @@
 package org.springframework.security.access.expression.method;

-import static org.fest.assertions.Assertions.assertThat;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.*;

 import java.lang.annotation.ElementType;
 import java.lang.annotation.Inherited;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
-import java.util.Collection;
 import java.util.List;

 import org.junit.Before;
 import org.junit.Test;
-import org.springframework.expression.Expression;
 import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.annotation.sec2150.MethodInvocationFactory;
 import org.springframework.security.access.intercept.method.MockMethodInvocation;
 import org.springframework.security.access.prepost.PostAuthorize;
 import org.springframework.security.access.prepost.PostFilter;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.access.prepost.PreFilter;
 import org.springframework.security.access.prepost.PrePostAnnotationSecurityMetadataSource;
-import org.springframework.test.util.ReflectionTestUtils;

 /**
 *
@@ -156,15 +148,6 @@ public class PrePostAnnotationSecurityMetadataSourceTests {
        assertEquals(1, attrs.length);
    }

-    @Test
-    public void proxyFactoryInterfaceAttributesFound() throws Exception {
-        MockMethodInvocation mi = MethodInvocationFactory.createSec2150MethodInvocation();
-        Collection<ConfigAttribute> attributes = mds.getAttributes(mi);
-        assertThat(attributes.size()).isEqualTo(1);
-        Expression expression = (Expression) ReflectionTestUtils.getField(attributes.iterator().next(),"authorizeExpression");
-        assertThat(expression.getExpressionString()).isEqualTo("hasRole('ROLE_PERSON')");
-    }
-
    //~ Inner Classes ==================================================================================================

    public static interface ReturnVoid {
@@ -1,7 +1,6 @@
 package org.springframework.security.access.vote;

 import static org.junit.Assert.*;
-import static org.fest.assertions.Assertions.*;

 import org.junit.Test;
 import org.springframework.security.access.AccessDecisionVoter;
@@ -22,13 +21,4 @@ public class RoleVoterTests {
        // Vote on attribute list that has two attributes A and C (i.e. only one matching)
        assertEquals(AccessDecisionVoter.ACCESS_GRANTED, voter.vote(userAB, this, SecurityConfig.createList("A","C")));
    }
-
-    // SEC-3128
-    @Test
-    public void nullAuthenticationDenies() {
-        RoleVoter voter = new RoleVoter();
-        voter.setRolePrefix("");
-        Authentication notAuthenitcated = null;
-        assertThat(voter.vote(notAuthenitcated, this, SecurityConfig.createList("A"))).isEqualTo(AccessDecisionVoter.ACCESS_DENIED);
-    }
 }
@@ -15,7 +15,6 @@

 package org.springframework.security.authentication;

-import static org.fest.assertions.Assertions.assertThat;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
@@ -59,8 +58,6 @@ public class UsernamePasswordAuthenticationTokenTests {
            token.setAuthenticated(true);
            fail("Should have prohibited setAuthenticated(true)");
        } catch (IllegalArgumentException expected) {
-            // SEC-2540
-            assertThat(expected).hasMessage("Once created you cannot set this token to authenticated. Create a new instance using the constructor which takes a GrantedAuthority list will mark this as authenticated.");
        }
    }

@@ -34,7 +34,6 @@ import org.springframework.security.authentication.AuthenticationServiceExceptio
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.CredentialsExpiredException;
 import org.springframework.security.authentication.DisabledException;
-import org.springframework.security.authentication.InternalAuthenticationServiceException;
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -173,8 +172,9 @@ public class DaoAuthenticationProviderTests extends TestCase {

        try {
            provider.authenticate(token);
-            fail("Should have thrown InternalAuthenticationServiceException");
-        } catch (InternalAuthenticationServiceException expected) {
+            fail("Should have thrown AuthenticationServiceException");
+        } catch (AuthenticationServiceException expected) {
+            assertTrue(true);
        }
    }

@@ -17,9 +17,6 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;

 import java.util.concurrent.Callable;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;

 import org.junit.After;
 import org.junit.Before;
@@ -48,14 +45,9 @@ public class DelegatingSecurityContextCallableTests {

    private Callable<Object> callable;

-    private ExecutorService executor;
-
-    private SecurityContext originalSecurityContext;
-
    @Before
    @SuppressWarnings("serial")
    public void setUp() throws Exception {
-        originalSecurityContext = SecurityContextHolder.createEmptyContext();
        when(delegate.call()).thenAnswer(new Returns(callableResult) {
            @Override
            public Object answer(InvocationOnMock invocation) throws Throwable {
@@ -63,7 +55,6 @@ public class DelegatingSecurityContextCallableTests {
                return super.answer(invocation);
            }
        });
-        executor = Executors.newFixedThreadPool(1);
    }

    @After
@@ -97,27 +88,15 @@ public class DelegatingSecurityContextCallableTests {

    @Test
    public void call() throws Exception {
-        callable = new DelegatingSecurityContextCallable<Object>(delegate,
-                securityContext);
-        assertWrapped(callable);
+        callable = new DelegatingSecurityContextCallable<Object>(delegate, securityContext);
+        assertWrapped(callable.call());
    }

    @Test
    public void callDefaultSecurityContext() throws Exception {
        SecurityContextHolder.setContext(securityContext);
        callable = new DelegatingSecurityContextCallable<Object>(delegate);
-        SecurityContextHolder.clearContext(); // ensure callable is what sets up the
-                                                // SecurityContextHolder
-        assertWrapped(callable);
-    }
-
-    // SEC-3031
-    @Test
-    public void callOnSameThread() throws Exception {
-        originalSecurityContext = securityContext;
-        SecurityContextHolder.setContext(originalSecurityContext);
-        callable = new DelegatingSecurityContextCallable<Object>(delegate,
-                securityContext);
+        SecurityContextHolder.clearContext(); // ensure callable is what sets up the SecurityContextHolder
        assertWrapped(callable.call());
    }

@@ -137,35 +116,19 @@ public class DelegatingSecurityContextCallableTests {
    public void createNullSecurityContext() throws Exception {
        SecurityContextHolder.setContext(securityContext);
        callable = DelegatingSecurityContextCallable.create(delegate, null);
-        SecurityContextHolder.clearContext(); // ensure callable is what sets up the
-                                                // SecurityContextHolder
-        assertWrapped(callable);
+        SecurityContextHolder.clearContext(); // ensure callable is what sets up the SecurityContextHolder
+        assertWrapped(callable.call());
    }

    @Test
    public void create() throws Exception {
        callable = DelegatingSecurityContextCallable.create(delegate, securityContext);
-        assertWrapped(callable);
+        assertWrapped(callable.call());
    }

-    // --- toString
-
-    // SEC-2682
-    @Test
-    public void toStringDelegates() {
-        callable = new DelegatingSecurityContextCallable<Object>(delegate,
-                securityContext);
-        assertThat(callable.toString()).isEqualTo(delegate.toString());
-    }
-
-    private void assertWrapped(Callable<Object> callable) throws Exception {
-        Future<Object> submit = executor.submit(callable);
-        assertWrapped(submit.get());
-    }
-
-    private void assertWrapped(Object callableResult) throws Exception {
+    private void assertWrapped(Object actualResult) throws Exception {
+        assertThat(actualResult).isEqualTo(callableResult);
        verify(delegate).call();
-        assertThat(SecurityContextHolder.getContext()).isEqualTo(
-                originalSecurityContext);
+        assertThat(SecurityContextHolder.getContext()).isEqualTo(SecurityContextHolder.createEmptyContext());
    }
 }
@@ -16,10 +16,6 @@ import static org.fest.assertions.Assertions.assertThat;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.verify;

-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
@@ -28,8 +24,6 @@ import org.mockito.Mock;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.runners.MockitoJUnitRunner;
 import org.mockito.stubbing.Answer;
-import org.springframework.core.task.SyncTaskExecutor;
-import org.springframework.core.task.support.ExecutorServiceAdapter;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;

@@ -49,21 +43,15 @@ public class DelegatingSecurityContextRunnableTests {

    private Runnable runnable;

-    private ExecutorService executor;
-
-    private SecurityContext originalSecurityContext;
-
    @Before
    public void setUp() throws Exception {
-        originalSecurityContext = SecurityContextHolder.createEmptyContext();
        doAnswer(new Answer<Object>() {
            public Object answer(InvocationOnMock invocation) throws Throwable {
                assertThat(SecurityContextHolder.getContext()).isEqualTo(securityContext);
                return null;
            }
-        }).when(delegate).run();
-
-        executor = Executors.newFixedThreadPool(1);
+        })
+        .when(delegate).run();
    }

    @After
@@ -98,27 +86,17 @@ public class DelegatingSecurityContextRunnableTests {
    @Test
    public void call() throws Exception {
        runnable = new DelegatingSecurityContextRunnable(delegate, securityContext);
-        assertWrapped(runnable);
+        runnable.run();
+        assertWrapped();
    }

    @Test
    public void callDefaultSecurityContext() throws Exception {
        SecurityContextHolder.setContext(securityContext);
        runnable = new DelegatingSecurityContextRunnable(delegate);
-        SecurityContextHolder.clearContext(); // ensure runnable is what sets up the
-                                                // SecurityContextHolder
-        assertWrapped(runnable);
-    }
-
-    // SEC-3031
-    @Test
-    public void callOnSameThread() throws Exception {
-        originalSecurityContext = securityContext;
-        SecurityContextHolder.setContext(originalSecurityContext);
-        executor = synchronousExecutor();
-        runnable = new DelegatingSecurityContextRunnable(delegate,
-                securityContext);
-        assertWrapped(runnable);
+        SecurityContextHolder.clearContext(); // ensure runnable is what sets up the SecurityContextHolder
+        runnable.run();
+        assertWrapped();
    }

    // --- create ---
@@ -134,38 +112,23 @@ public class DelegatingSecurityContextRunnableTests {
    }

    @Test
-    public void createNullSecurityContext() throws Exception {
+    public void createNullSecurityContext() {
        SecurityContextHolder.setContext(securityContext);
        runnable = DelegatingSecurityContextRunnable.create(delegate, null);
-        SecurityContextHolder.clearContext(); // ensure runnable is what sets up the
-                                                // SecurityContextHolder
-        assertWrapped(runnable);
+        SecurityContextHolder.clearContext(); // ensure runnable is what sets up the SecurityContextHolder
+        runnable.run();
+        assertWrapped();
    }

    @Test
-    public void create() throws Exception {
+    public void create() {
        runnable = DelegatingSecurityContextRunnable.create(delegate, securityContext);
-        assertWrapped(runnable);
+        runnable.run();
+        assertWrapped();
    }

-    // --- toString
-
-    // SEC-2682
-    @Test
-    public void toStringDelegates() {
-        runnable = new DelegatingSecurityContextRunnable(delegate, securityContext);
-        assertThat(runnable.toString()).isEqualTo(delegate.toString());
-    }
-
-    private void assertWrapped(Runnable runnable) throws Exception {
-        Future<?> submit = executor.submit(runnable);
-        submit.get();
+    private void assertWrapped() {
        verify(delegate).run();
-        assertThat(SecurityContextHolder.getContext()).isEqualTo(
-                originalSecurityContext);
-    }
-
-    private static ExecutorService synchronousExecutor() {
-        return new ExecutorServiceAdapter(new SyncTaskExecutor());
+        assertThat(SecurityContextHolder.getContext()).isEqualTo(SecurityContextHolder.createEmptyContext());
    }
 }
@@ -1,72 +0,0 @@
-package org.springframework.security.context;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.Mock;
-import org.mockito.runners.MockitoJUnitRunner;
-import org.springframework.context.ApplicationEvent;
-import org.springframework.context.ApplicationListener;
-import org.springframework.context.event.SmartApplicationListener;
-import org.springframework.security.core.session.SessionDestroyedEvent;
-
-import static org.junit.Assert.*;
-import static org.mockito.Matchers.any;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-@RunWith(MockitoJUnitRunner.class)
-public class DelegatingApplicationListenerTests {
-    @Mock
-    SmartApplicationListener delegate;
-
-    ApplicationEvent event;
-
-    DelegatingApplicationListener listener;
-
-    @Before
-    public void setup() {
-        event = new ApplicationEvent(this) {};
-        listener = new DelegatingApplicationListener();
-        listener.addListener(delegate);
-    }
-
-    @Test
-    public void processEventNull() {
-        listener.onApplicationEvent(null);
-
-        verify(delegate,never()).onApplicationEvent(any(ApplicationEvent.class));
-    }
-
-    @Test
-    public void processEventSuccess() {
-        when(delegate.supportsEventType(event.getClass())).thenReturn(true);
-        when(delegate.supportsSourceType(event.getSource().getClass())).thenReturn(true);
-        listener.onApplicationEvent(event);
-
-        verify(delegate).onApplicationEvent(event);
-    }
-
-    @Test
-    public void processEventEventTypeNotSupported() {
-        when(delegate.supportsSourceType(event.getSource().getClass())).thenReturn(true);
-        listener.onApplicationEvent(event);
-
-        verify(delegate,never()).onApplicationEvent(any(ApplicationEvent.class));
-    }
-
-    @Test
-    public void processEventSourceTypeNotSupported() {
-        when(delegate.supportsEventType(event.getClass())).thenReturn(true);
-        listener.onApplicationEvent(event);
-
-        verify(delegate,never()).onApplicationEvent(any(ApplicationEvent.class));
-    }
-
-    @Test(expected = IllegalArgumentException.class)
-    public void addNull() {
-        listener.addListener(null);
-    }
-
-}
@@ -34,7 +34,6 @@ import org.powermock.core.classloader.annotations.PrepareForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
 import org.powermock.reflect.Whitebox;
 import org.springframework.core.SpringVersion;
-import org.springframework.test.util.ReflectionTestUtils;

 /**
 * Checks that the embedded version information is up to date.
@@ -129,20 +128,6 @@ public class SpringSecurityCoreVersionTests {
        verify(logger, never()).warn(any());
    }

-    // SEC-2697
-    @Test
-    public void noWarnIfSpringPatchVersionDoubleDigits() throws Exception {
-        String minSpringVersion = "3.2.8.RELEASE";
-        spy(SpringSecurityCoreVersion.class);
-        spy(SpringVersion.class);
-        when(SpringSecurityCoreVersion.getVersion()).thenReturn("3.2.0.RELEASE");
-        when(SpringVersion.getVersion()).thenReturn("3.2.10.RELEASE");
-
-        performChecks(minSpringVersion);
-
-        verify(logger, never()).warn(any());
-    }
-
    @Test
    public void noLoggingIfPropertySet() throws Exception {
        spy(SpringSecurityCoreVersion.class);
@@ -164,7 +149,4 @@ public class SpringSecurityCoreVersionTests {
        Whitebox.invokeMethod(SpringSecurityCoreVersion.class, "performVersionChecks");
    }

-    private void performChecks(String minSpringVersion) throws Exception {
-        Whitebox.invokeMethod(SpringSecurityCoreVersion.class, "performVersionChecks", minSpringVersion);
-    }
 }
@@ -23,18 +23,16 @@ import org.springframework.security.core.SpringSecurityMessageSource;

 import java.util.Locale;

+
 /**
 * Tests {@link org.springframework.security.core.SpringSecurityMessageSource}.
 */
 public class SpringSecurityMessageSourceTests extends TestCase {
-    // ~ Methods
-    // ========================================================================================================
+    //~ Methods ========================================================================================================

    public void testOperation() {
        SpringSecurityMessageSource msgs = new SpringSecurityMessageSource();
-        assertEquals("\u4E0D\u5141\u8BB8\u8BBF\u95EE", msgs.getMessage(
-                "AbstractAccessDecisionManager.accessDenied", null,
-                Locale.SIMPLIFIED_CHINESE));
+        assertEquals("\u4E0D\u5141\u8BB8\u8BBF\u95EE", msgs.getMessage("AbstractAccessDecisionManager.accessDenied", null, Locale.SIMPLIFIED_CHINESE));
    }

    public void testReplacableLookup() {
@@ -44,28 +42,11 @@ public class SpringSecurityMessageSourceTests extends TestCase {

        // Cause a message to be generated
        MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
-        assertEquals("Le jeton nonce est compromis FOOBAR", messages.getMessage(
-                "DigestAuthenticationFilter.nonceCompromised", new Object[] { "FOOBAR" },
+        assertEquals("Le jeton nonce est compromis FOOBAR",
+            messages.getMessage("DigestAuthenticationFilter.nonceCompromised", new Object[] {"FOOBAR"},
                "ERROR - FAILED TO LOOKUP"));

        // Revert to original Locale
        LocaleContextHolder.setLocale(before);
    }
-
-    // SEC-3013
-    public void germanSystemLocaleWithEnglishLocaleContextHolder() {
-        Locale beforeSystem = Locale.getDefault();
-        Locale.setDefault(Locale.GERMAN);
-
-        Locale beforeHolder = LocaleContextHolder.getLocale();
-        LocaleContextHolder.setLocale(Locale.US);
-
-        MessageSourceAccessor msgs = SpringSecurityMessageSource.getAccessor();
-        assertEquals("Access is denied", msgs.getMessage(
-                "AbstractAccessDecisionManager.accessDenied", "Ooops"));
-
-        // Revert to original Locale
-        Locale.setDefault(beforeSystem);
-        LocaleContextHolder.setLocale(beforeHolder);
-    }
 }
@@ -4,7 +4,7 @@
 // isJdk6 = jdkVersion >= '1.6'
 int maxAESKeySize = javax.crypto.Cipher.getMaxAllowedKeyLength('AES')

-configure(project.tasks.withType(Test)) {
+configure([test,spring4Test]) {
    if (maxAESKeySize < 256) {
        println "AES keysize limited to $maxAESKeySize, skipping EncryptorsTests"
        exclude '**/EncryptorsTests.class'
--- a/Show More
+++ b/Show More