Release version 3.2.0.RC2

.gitignore

@@ -18,4 +18,4 @@ build/
 *.ipr
 *.iws
 .gradle/
-atlassian-ide-plugin.xml
+atlassian-ide-plugin.xml

CONTRIBUTING.md

@@ -16,7 +16,7 @@ Is there already an issue that addresses your concern? Do a bit of searching in
 If you're considering anything more than correcting a typo or fixing a minor bug , please discuss it on the [Spring Security forums](http://forum.springsource.org/forumdisplay.php?33-Security) before submitting a pull request. We're happy to provide guidance but please spend an hour or two researching the subject on your own including searching the forums for prior discussions.
 
 # Sign the Contributor License Agreement
-If you have not previously done so, please fill out and submit the [SpringSource CLA form](https://support.springsource.com/spring_committer_signup). You'll receive a token when this process is complete. Keep track of this, you may be asked for it later!
+If you have not previously done so, please fill out and submit the SpringSource CLA form. You'll receive a token when this process is complete. Keep track of this, you may be asked for it later!
 
 * For **Project** select _Spring Security_
 * For **Project Lead** enter _Rob Winch_

acl/acl.gradle

@@ -8,7 +8,7 @@ dependencies {
             "org.springframework:spring-tx:$springVersion",
             "org.springframework:spring-jdbc:$springVersion"
 
-    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
 
     testCompile "org.springframework:spring-beans:$springVersion",
                 "org.springframework:spring-context-support:$springVersion",

acl/pom.xml

@@ -4,13 +4,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-acl</artifactId>
-  <version>4.0.0.M2</version>
+  <version>3.2.0.RC2</version>
   <name>spring-security-acl</name>
   <description>spring-security-acl</description>
-  <url>http://spring.io/spring-security</url>
+  <url>http://springsource.org/spring-security</url>
   <organization>
-    <name>spring.io</name>
-    <url>http://spring.io/</url>
+    <name>SpringSource</name>
+    <url>http://springsource.org/</url>
   </organization>
   <licenses>
     <license>
@@ -23,13 +23,13 @@
     <developer>
       <id>rwinch</id>
       <name>Rob Winch</name>
-      <email>rwinch@gopivotal.com</email>
+      <email>rwinch@vmware.com</email>
     </developer>
   </developers>
   <scm>
-    <connection>scm:git:git://github.com/spring-projects/spring-security</connection>
-    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
-    <url>https://github.com/spring-projects/spring-security</url>
+    <connection>scm:git:git://github.com/SpringSource/spring-security</connection>
+    <developerConnection>scm:git:git://github.com/SpringSource/spring-security</developerConnection>
+    <url>https://github.com/SpringSource/spring-security</url>
   </scm>
   <build>
     <plugins>
@@ -44,8 +44,8 @@
   </build>
   <repositories>
     <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
+      <id>spring-snasphot</id>
+      <url>http://repo.springsource.org/libs-snapshot</url>
     </repository>
   </repositories>
   <dependencies>
@@ -58,25 +58,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-aop</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -88,13 +88,13 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-jdbc</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-tx</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -106,8 +106,8 @@
     </dependency>
     <dependency>
       <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache-core</artifactId>
-      <version>2.6.5</version>
+      <artifactId>ehcache</artifactId>
+      <version>1.6.2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
@@ -120,7 +120,7 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -132,7 +132,7 @@
     <dependency>
       <groupId>org.hsqldb</groupId>
       <artifactId>hsqldb</artifactId>
-      <version>2.3.1</version>
+      <version>1.8.0.10</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -150,19 +150,19 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context-support</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

acl/src/main/java/org/springframework/security/acls/domain/AclFormattingUtils.java

@@ -98,7 +98,7 @@ public abstract class AclFormattingUtils {
     }
 
     private static String printBinary(int i, char on, char off) {
-        String s = Integer.toBinaryString(i);
+        String s = Integer.toString(i, 2);
         String pattern = Permission.THIRTY_TWO_RESERVED_OFF;
         String temp2 = pattern.substring(0, pattern.length() - s.length()) + s;
 

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -119,9 +119,6 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
      * @param acl containing the ACEs to insert
      */
     protected void createEntries(final MutableAcl acl) {
-        if(acl.getEntries().isEmpty()) {
-            return;
-        }
         jdbcTemplate.batchUpdate(insertEntry,
             new BatchPreparedStatementSetter() {
                 public int getBatchSize() {

acl/src/main/resources/createAclSchema.sql

@@ -5,12 +5,12 @@
 -- drop table acl_class;
 -- drop table acl_sid;
 
+
 create table acl_sid(
     id bigint generated by default as identity(start with 100) not null primary key,
     principal boolean not null,
     sid varchar_ignorecase(100) not null,
-    constraint unique_uk_1 unique(sid,principal)
-);
+    constraint unique_uk_1 unique(sid,principal));
 
 create table acl_class(
     id bigint generated by default as identity(start with 100) not null primary key,

acl/src/main/resources/createAclSchemaMySQL.sql

@@ -1,46 +0,0 @@
--- ACL Schema SQL for MySQL 5.5+ / MariaDB equivalent
-
--- drop table acl_entry;
--- drop table acl_object_identity;
--- drop table acl_class;
--- drop table acl_sid;
-
-CREATE TABLE acl_sid (
-    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
-    principal BOOLEAN NOT NULL,
-    sid VARCHAR(100) NOT NULL,
-    UNIQUE KEY unique_acl_sid (sid, principal)
-) ENGINE=InnoDB;
-
-CREATE TABLE acl_class (
-    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
-    class VARCHAR(100) NOT NULL,
-    UNIQUE KEY uk_acl_class (class)
-) ENGINE=InnoDB;
-
-CREATE TABLE acl_object_identity (
-    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
-    object_id_class BIGINT UNSIGNED NOT NULL,
-    object_id_identity BIGINT NOT NULL,
-    parent_object BIGINT UNSIGNED,
-    owner_sid BIGINT UNSIGNED,
-    entries_inheriting BOOLEAN NOT NULL,
-    UNIQUE KEY uk_acl_object_identity (object_id_class, object_id_identity),
-    CONSTRAINT fk_acl_object_identity_parent FOREIGN KEY (parent_object) REFERENCES acl_object_identity (id),
-    CONSTRAINT fk_acl_object_identity_class FOREIGN KEY (object_id_class) REFERENCES acl_class (id),
-    CONSTRAINT fk_acl_object_identity_owner FOREIGN KEY (owner_sid) REFERENCES acl_sid (id)
-) ENGINE=InnoDB;
-
-CREATE TABLE acl_entry (
-    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
-    acl_object_identity BIGINT UNSIGNED NOT NULL,
-    ace_order INTEGER NOT NULL,
-    sid BIGINT UNSIGNED NOT NULL,
-    mask INTEGER UNSIGNED NOT NULL,
-    granting BOOLEAN NOT NULL,
-    audit_success BOOLEAN NOT NULL,
-    audit_failure BOOLEAN NOT NULL,
-    UNIQUE KEY unique_acl_entry (acl_object_identity, ace_order),
-    CONSTRAINT fk_acl_entry_object FOREIGN KEY (acl_object_identity) REFERENCES acl_object_identity (id),
-    CONSTRAINT fk_acl_entry_acl FOREIGN KEY (sid) REFERENCES acl_sid (id)
-) ENGINE=InnoDB;

acl/src/main/resources/createAclSchemaOracle.sql

@@ -1,82 +0,0 @@
--- ACL Schema SQL for Oracle Database 10g+
-
--- drop trigger acl_sid_id_trigger;
--- drop trigger acl_class_id_trigger;
--- drop trigger acl_object_identity_id_trigger;
--- drop trigger acl_entry_id_trigger;
--- drop sequence acl_sid_sequence;
--- drop sequence acl_class_sequence;
--- drop sequence acl_object_identity_sequence;
--- drop sequence acl_entry_sequence;
--- drop table acl_entry;
--- drop table acl_object_identity;
--- drop table acl_class;
--- drop table acl_sid;
-
-CREATE TABLE acl_sid (
-    id NUMBER(38) NOT NULL PRIMARY KEY,
-    principal NUMBER(1) NOT NULL CHECK (principal in (0, 1)),
-    sid NVARCHAR2(100) NOT NULL,
-    CONSTRAINT unique_acl_sid UNIQUE (sid, principal)
-);
-CREATE SEQUENCE acl_sid_sequence START WITH 1 INCREMENT BY 1 NOMAXVALUE;
-CREATE OR REPLACE TRIGGER acl_sid_id_trigger
-    BEFORE INSERT ON acl_sid
-    FOR EACH ROW
-BEGIN
-    SELECT acl_sid_sequence.nextval INTO :new.id FROM dual;
-END;
-
-CREATE TABLE acl_class (
-    id NUMBER(38) NOT NULL PRIMARY KEY,
-    class NVARCHAR2(100) NOT NULL,
-    CONSTRAINT uk_acl_class UNIQUE (class)
-);
-CREATE SEQUENCE acl_class_sequence START WITH 1 INCREMENT BY 1 NOMAXVALUE;
-CREATE OR REPLACE TRIGGER acl_class_id_trigger
-    BEFORE INSERT ON acl_class
-    FOR EACH ROW
-BEGIN
-    SELECT acl_class_sequence.nextval INTO :new.id FROM dual;
-END;
-
-CREATE TABLE acl_object_identity (
-    id NUMBER(38) NOT NULL PRIMARY KEY,
-    object_id_class NUMBER(38) NOT NULL,
-    object_id_identity NUMBER(38) NOT NULL,
-    parent_object NUMBER(38),
-    owner_sid NUMBER(38),
-    entries_inheriting NUMBER(1) NOT NULL CHECK (entries_inheriting in (0, 1)),
-    CONSTRAINT uk_acl_object_identity UNIQUE (object_id_class, object_id_identity),
-    CONSTRAINT fk_acl_object_identity_parent FOREIGN KEY (parent_object) REFERENCES acl_object_identity (id),
-    CONSTRAINT fk_acl_object_identity_class FOREIGN KEY (object_id_class) REFERENCES acl_class (id),
-    CONSTRAINT fk_acl_object_identity_owner FOREIGN KEY (owner_sid) REFERENCES acl_sid (id)
-);
-CREATE SEQUENCE acl_object_identity_sequence START WITH 1 INCREMENT BY 1 NOMAXVALUE;
-CREATE OR REPLACE TRIGGER acl_object_identity_id_trigger
-    BEFORE INSERT ON acl_object_identity
-    FOR EACH ROW
-BEGIN
-    SELECT acl_object_identity_sequence.nextval INTO :new.id FROM dual;
-END;
-
-CREATE TABLE acl_entry (
-    id NUMBER(38) NOT NULL PRIMARY KEY,
-    acl_object_identity NUMBER(38) NOT NULL,
-    ace_order INTEGER NOT NULL,
-    sid NUMBER(38) NOT NULL,
-    mask INTEGER NOT NULL,
-    granting NUMBER(1) NOT NULL CHECK (granting in (0, 1)),
-    audit_success NUMBER(1) NOT NULL CHECK (audit_success in (0, 1)),
-    audit_failure NUMBER(1) NOT NULL CHECK (audit_failure in (0, 1)),
-    CONSTRAINT unique_acl_entry UNIQUE (acl_object_identity, ace_order),
-    CONSTRAINT fk_acl_entry_object FOREIGN KEY (acl_object_identity) REFERENCES acl_object_identity (id),
-    CONSTRAINT fk_acl_entry_acl FOREIGN KEY (sid) REFERENCES acl_sid (id)
-);
-CREATE SEQUENCE acl_entry_sequence START WITH 1 INCREMENT BY 1 NOMAXVALUE;
-CREATE OR REPLACE TRIGGER acl_entry_id_trigger
-    BEFORE INSERT ON acl_entry
-    FOR EACH ROW
-BEGIN
-    SELECT acl_entry_sequence.nextval INTO :new.id FROM dual;
-END;

acl/src/main/resources/createAclSchemaSqlServer.sql

@@ -1,46 +0,0 @@
--- ACL Schema SQL for Microsoft SQL Server 2008+
-
--- drop table acl_entry;
--- drop table acl_object_identity;
--- drop table acl_class;
--- drop table acl_sid;
-
-CREATE TABLE acl_sid (
-    id BIGINT NOT NULL IDENTITY PRIMARY KEY,
-    principal BIT NOT NULL,
-    sid VARCHAR(100) NOT NULL,
-    CONSTRAINT unique_acl_sid UNIQUE (sid, principal)
-);
-
-CREATE TABLE acl_class (
-    id BIGINT NOT NULL IDENTITY PRIMARY KEY,
-    class VARCHAR(100) NOT NULL,
-    CONSTRAINT uk_acl_class UNIQUE (class)
-);
-
-CREATE TABLE acl_object_identity (
-    id BIGINT NOT NULL IDENTITY PRIMARY KEY,
-    object_id_class BIGINT NOT NULL,
-    object_id_identity BIGINT NOT NULL,
-    parent_object BIGINT,
-    owner_sid BIGINT,
-    entries_inheriting BIT NOT NULL,
-    CONSTRAINT uk_acl_object_identity UNIQUE (object_id_class, object_id_identity),
-    CONSTRAINT fk_acl_object_identity_parent FOREIGN KEY (parent_object) REFERENCES acl_object_identity (id),
-    CONSTRAINT fk_acl_object_identity_class FOREIGN KEY (object_id_class) REFERENCES acl_class (id),
-    CONSTRAINT fk_acl_object_identity_owner FOREIGN KEY (owner_sid) REFERENCES acl_sid (id)
-);
-
-CREATE TABLE acl_entry (
-    id BIGINT NOT NULL IDENTITY PRIMARY KEY,
-    acl_object_identity BIGINT NOT NULL,
-    ace_order INTEGER NOT NULL,
-    sid BIGINT NOT NULL,
-    mask INTEGER NOT NULL,
-    granting BIT NOT NULL,
-    audit_success BIT NOT NULL,
-    audit_failure BIT NOT NULL,
-    CONSTRAINT unique_acl_entry UNIQUE (acl_object_identity, ace_order),
-    CONSTRAINT fk_acl_entry_object FOREIGN KEY (acl_object_identity) REFERENCES acl_object_identity (id),
-    CONSTRAINT fk_acl_entry_acl FOREIGN KEY (sid) REFERENCES acl_sid (id)
-);

acl/src/test/java/org/springframework/security/acls/AclFormattingUtilsTests.java

@@ -124,12 +124,4 @@ public class AclFormattingUtilsTests extends TestCase {
 
         Assert.assertEquals("............................xxxx", AclFormattingUtils.printBinary(15, 'x'));
     }
-
-    public void testPrintBinaryNegative() {
-        Assert.assertEquals("*...............................", AclFormattingUtils.printBinary(0x80000000));
-    }
-
-    public void testPrintBinaryMinusOne() {
-        Assert.assertEquals("********************************", AclFormattingUtils.printBinary(0xffffffff));
-    }
 }

acl/src/test/java/org/springframework/security/acls/jdbc/EhCacheBasedAclCacheTests.java

@@ -1,34 +1,11 @@
 package org.springframework.security.acls.jdbc;
 
-import static org.mockito.Matchers.*;
-import static org.mockito.Mockito.*;
 import static org.junit.Assert.*;
-import static org.fest.assertions.Assertions.*;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
-import java.io.Serializable;
-import java.util.List;
-import java.util.Map;
 
 import net.sf.ehcache.Cache;
 import net.sf.ehcache.CacheManager;
 import net.sf.ehcache.Ehcache;
-import net.sf.ehcache.Element;
-
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.ArgumentCaptor;
-import org.mockito.Captor;
-import org.mockito.Mock;
-import org.mockito.runners.MockitoJUnitRunner;
+import org.junit.*;
 import org.springframework.security.acls.domain.AclAuthorizationStrategy;
 import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
 import org.springframework.security.acls.domain.AclImpl;
@@ -42,44 +19,50 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.util.FieldUtils;
-import org.springframework.test.util.ReflectionTestUtils;
-import org.springframework.util.ReflectionUtils;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.util.*;
 
 /**
  * Tests {@link EhCacheBasedAclCache}
  *
  * @author Andrei Stefan
  */
-@RunWith(MockitoJUnitRunner.class)
 public class EhCacheBasedAclCacheTests {
     private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";
 
-    @Mock
-    private Ehcache cache;
-    @Captor
-    private ArgumentCaptor<Element> element;
+    private static CacheManager cacheManager;
 
-    private EhCacheBasedAclCache myCache;
+    @BeforeClass
+    public static void initCacheManaer() {
+        cacheManager = CacheManager.create();
+        // Use disk caching immediately (to test for serialization issue reported in SEC-527)
+        cacheManager.addCache(new Cache("ehcachebasedacltests", 0, true, false, 600, 300));
+    }
 
-    private MutableAcl acl;
-
-    @Before
-    public void setup() {
-        myCache = new EhCacheBasedAclCache(cache);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-
-        acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
+    @AfterClass
+    public static void shutdownCacheManager() {
+        cacheManager.removalAll();
+        cacheManager.shutdown();
     }
 
     @After
-    public void cleanup() {
+    public void clearContext() {
         SecurityContextHolder.clearContext();
     }
 
+    private Ehcache getCache() {
+        Ehcache cache = cacheManager.getCache("ehcachebasedacltests");
+        cache.removeAll();
+
+        return cache;
+    }
+
     @Test(expected=IllegalArgumentException.class)
     public void constructorRejectsNullParameters() throws Exception {
         new EhCacheBasedAclCache(null);
@@ -87,6 +70,9 @@ public class EhCacheBasedAclCacheTests {
 
     @Test
     public void methodsRejectNullParameters() throws Exception {
+        Ehcache cache = new MockEhcache();
+        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
+
         try {
             Serializable id = null;
             myCache.evictFromCache(id);
@@ -136,6 +122,12 @@ public class EhCacheBasedAclCacheTests {
     // SEC-527
     @Test
     public void testDiskSerializationOfMutableAclObjectInstance() throws Exception {
+        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
+        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
+                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
+                new SimpleGrantedAuthority("ROLE_GENERAL"));
+        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
+
         // Serialization test
         File file = File.createTempFile("SEC_TEST", ".object");
         FileOutputStream fos = new FileOutputStream(file);
@@ -158,117 +150,111 @@ public class EhCacheBasedAclCacheTests {
     }
 
     @Test
-    public void clearCache() throws Exception {
-        myCache.clearCache();
+    public void cacheOperationsAclWithoutParent() throws Exception {
+        Ehcache cache = getCache();
+        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
 
-        verify(cache).removeAll();
-    }
+        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
+        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
+                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
+                new SimpleGrantedAuthority("ROLE_GENERAL"));
+        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
 
-    @Test
-    public void putInCache() throws Exception {
+        assertEquals(0, cache.getDiskStoreSize());
         myCache.putInCache(acl);
+        assertEquals(cache.getSize(), 2);
+        assertEquals(2, cache.getDiskStoreSize());
+        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
+        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));
 
-        verify(cache, times(2)).put(element.capture());
-        assertThat(element.getValue().getKey()).isEqualTo(acl.getId());
-        assertThat(element.getValue().getObjectValue()).isEqualTo(acl);
-        assertThat(element.getAllValues().get(0).getKey()).isEqualTo(acl.getObjectIdentity());
-        assertThat(element.getAllValues().get(0).getObjectValue()).isEqualTo(acl);
+        // Check we can get from cache the same objects we put in
+        assertEquals(myCache.getFromCache(Long.valueOf(1)), acl);
+        assertEquals(myCache.getFromCache(identity), acl);
+
+        // Put another object in cache
+        ObjectIdentity identity2 = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(101));
+        MutableAcl acl2 = new AclImpl(identity2, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
+
+        myCache.putInCache(acl2);
+        assertEquals(cache.getSize(), 4);
+        assertEquals(4, cache.getDiskStoreSize());
+
+        // Try to evict an entry that doesn't exist
+        myCache.evictFromCache(Long.valueOf(3));
+        myCache.evictFromCache(new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(102)));
+        assertEquals(cache.getSize(), 4);
+        assertEquals(4, cache.getDiskStoreSize());
+
+        myCache.evictFromCache(Long.valueOf(1));
+        assertEquals(cache.getSize(), 2);
+        assertEquals(2, cache.getDiskStoreSize());
+
+        // Check the second object inserted
+        assertEquals(myCache.getFromCache(Long.valueOf(2)), acl2);
+        assertEquals(myCache.getFromCache(identity2), acl2);
+
+        myCache.evictFromCache(identity2);
+        assertEquals(cache.getSize(), 0);
     }
 
+    @SuppressWarnings("unchecked")
     @Test
-    public void putInCacheAclWithParent() throws Exception {
+    public void cacheOperationsAclWithParent() throws Exception {
+        Ehcache cache = getCache();
+        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
+
         Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_GENERAL");
         auth.setAuthenticated(true);
         SecurityContextHolder.getContext().setAuthentication(auth);
 
+        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(1));
         ObjectIdentity identityParent = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(2));
         AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
                 new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
                 new SimpleGrantedAuthority("ROLE_GENERAL"));
+        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
         MutableAcl parentAcl = new AclImpl(identityParent, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
+
         acl.setParent(parentAcl);
 
+        assertEquals(0, cache.getDiskStoreSize());
         myCache.putInCache(acl);
+        assertEquals(cache.getSize(), 4);
+        assertEquals(4, cache.getDiskStoreSize());
+        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
+        assertTrue(cache.isElementOnDisk(Long.valueOf(1)));
+        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));
+        assertFalse(cache.isElementInMemory(Long.valueOf(1)));
+        cache.flush();
+        // Wait for the spool to be written to disk (it's asynchronous)
+        Map spool = (Map) FieldUtils.getFieldValue(cache, "diskStore.spool");
 
-        verify(cache, times(4)).put(element.capture());
+        while(spool.size() > 0) {
+            Thread.sleep(50);
+        }
 
-        List<Element> allValues = element.getAllValues();
-
-        assertThat(allValues.get(0).getKey()).isEqualTo(parentAcl.getObjectIdentity());
-        assertThat(allValues.get(0).getObjectValue()).isEqualTo(parentAcl);
-
-        assertThat(allValues.get(1).getKey()).isEqualTo(parentAcl.getId());
-        assertThat(allValues.get(1).getObjectValue()).isEqualTo(parentAcl);
-
-
-        assertThat(allValues.get(2).getKey()).isEqualTo(acl.getObjectIdentity());
-        assertThat(allValues.get(2).getObjectValue()).isEqualTo(acl);
-
-        assertThat(allValues.get(3).getKey()).isEqualTo(acl.getId());
-        assertThat(allValues.get(3).getObjectValue()).isEqualTo(acl);
+        // Check we can get from cache the same objects we put in
+        AclImpl aclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(1));
+        // For the checks on transient fields, we need to be sure that the object is being loaded from the cache,
+        // not from the ehcache spool or elsewhere...
+        assertFalse(acl == aclFromCache);
+        assertEquals(acl, aclFromCache);
+        // SEC-951 check transient fields are set on parent
+        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "aclAuthorizationStrategy"));
+        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "permissionGrantingStrategy"));
+        assertEquals(acl, myCache.getFromCache(identity));
+        assertNotNull(FieldUtils.getFieldValue(aclFromCache, "aclAuthorizationStrategy"));
+        AclImpl parentAclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(2));
+        assertEquals(parentAcl, parentAclFromCache);
+        assertNotNull(FieldUtils.getFieldValue(parentAclFromCache, "aclAuthorizationStrategy"));
+        assertEquals(parentAcl, myCache.getFromCache(identityParent));
     }
 
-    @Test
-    public void getFromCacheSerializable() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
+    //~ Inner Classes ==================================================================================================
 
-        assertThat(myCache.getFromCache(acl.getId())).isEqualTo(acl);
-    }
-
-    @Test
-    public void getFromCacheSerializablePopulatesTransient() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.putInCache(acl);
-
-        ReflectionTestUtils.setField(acl, "permissionGrantingStrategy", null);
-        ReflectionTestUtils.setField(acl, "aclAuthorizationStrategy", null);
-
-        MutableAcl fromCache = myCache.getFromCache(acl.getId());
-
-        assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
-        assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
-    }
-
-    @Test
-    public void getFromCacheObjectIdentity() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
-
-        assertThat(myCache.getFromCache(acl.getId())).isEqualTo(acl);
-    }
-
-    @Test
-    public void getFromCacheObjectIdentityPopulatesTransient() throws Exception {
-        when(cache.get(acl.getObjectIdentity())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.putInCache(acl);
-
-        ReflectionTestUtils.setField(acl, "permissionGrantingStrategy", null);
-        ReflectionTestUtils.setField(acl, "aclAuthorizationStrategy", null);
-
-        MutableAcl fromCache = myCache.getFromCache(acl.getObjectIdentity());
-
-        assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
-        assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
-    }
-
-    @Test
-    public void evictCacheSerializable() throws Exception {
-        when(cache.get(acl.getObjectIdentity())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.evictFromCache(acl.getObjectIdentity());
-
-        verify(cache).remove(acl.getId());
-        verify(cache).remove(acl.getObjectIdentity());
-    }
-
-    @Test
-    public void evictCacheObjectIdentity() throws Exception {
-        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
-
-        myCache.evictFromCache(acl.getId());
-
-        verify(cache).remove(acl.getId());
-        verify(cache).remove(acl.getObjectIdentity());
+    private class MockEhcache extends Cache {
+        public MockEhcache() {
+            super("cache", 0, true, true, 0, 0);
+        }
     }
 }

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcMutableAclServiceTests.java

@@ -105,7 +105,6 @@ public class JdbcMutableAclServiceTests extends AbstractTransactionalJUnit4Sprin
         jdbcTemplate.execute("drop table acl_object_identity");
         jdbcTemplate.execute("drop table acl_class");
         jdbcTemplate.execute("drop table acl_sid");
-        aclCache.clearCache();
     }
 
     @Test

acl/template.mf

@@ -0,0 +1,24 @@
+Implementation-Title: org.springframework.security.acls
+Implementation-Version: ${version}
+Bundle-SymbolicName: org.springframework.security.acls
+Bundle-Name: Spring Security Acls
+Bundle-Vendor: SpringSource
+Bundle-Version: ${version}
+Bundle-ManifestVersion: 2
+Ignored-Existing-Headers:
+ Import-Package,
+ Export-Package
+Import-Template:
+ org.aopalliance.*;version="${aopAllianceRange}",
+ org.apache.commons.logging.*;version="${cloggingRange}",
+ org.springframework.cache.*;version="${springRange}";resolution:=optional,
+ org.springframework.security.core.*;version="${secRange}",
+ org.springframework.security.access.*;version="${secRange}",
+ org.springframework.security.util.*;version="${secRange}",
+ org.springframework.context.*;version="${springRange}";resolution:=optional,
+ org.springframework.dao.*;version="${springRange}";resolution:=optional,
+ org.springframework.jdbc.core.*;version="${springRange}";resolution:=optional,
+ org.springframework.transaction.support.*;version="${springRange}";resolution:=optional,
+ org.springframework.util.*;version="${springRange}";resolution:=optional,
+ net.sf.ehcache.*;version="${ehcacheRange}";resolution:=optional,
+ javax.sql.*;version="0";resolution:=optional

aspects/pom.xml

@@ -4,13 +4,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-aspects</artifactId>
-  <version>4.0.0.M2</version>
+  <version>3.2.0.RC2</version>
   <name>spring-security-aspects</name>
   <description>spring-security-aspects</description>
-  <url>http://spring.io/spring-security</url>
+  <url>http://springsource.org/spring-security</url>
   <organization>
-    <name>spring.io</name>
-    <url>http://spring.io/</url>
+    <name>SpringSource</name>
+    <url>http://springsource.org/</url>
   </organization>
   <licenses>
     <license>
@@ -23,13 +23,13 @@
     <developer>
       <id>rwinch</id>
       <name>Rob Winch</name>
-      <email>rwinch@gopivotal.com</email>
+      <email>rwinch@vmware.com</email>
     </developer>
   </developers>
   <scm>
-    <connection>scm:git:git://github.com/spring-projects/spring-security</connection>
-    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
-    <url>https://github.com/spring-projects/spring-security</url>
+    <connection>scm:git:git://github.com/SpringSource/spring-security</connection>
+    <developerConnection>scm:git:git://github.com/SpringSource/spring-security</developerConnection>
+    <url>https://github.com/SpringSource/spring-security</url>
   </scm>
   <build>
     <plugins>
@@ -44,33 +44,33 @@
   </build>
   <repositories>
     <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
+      <id>spring-snasphot</id>
+      <url>http://repo.springsource.org/libs-snapshot</url>
     </repository>
   </repositories>
   <dependencies>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -108,7 +108,7 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -132,13 +132,13 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-aop</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

aspects/template.mf

@@ -0,0 +1,16 @@
+Implementation-Title: org.springframework.security.aspects
+Implementation-Version: ${version}
+Bundle-SymbolicName: org.springframework.security.aspects
+Bundle-Name: Spring Security Aspects
+Bundle-Vendor: SpringSource
+Bundle-ManifestVersion: 2
+Bundle-Version: ${version}
+Ignored-Existing-Headers:
+ Import-Package,
+ Export-Package
+Import-Template:
+ org.aspectj.*;version="${aspectjRange}";resolution:=optional,
+ org.apache.commons.logging.*;version="${cloggingRange}",
+ org.springframework.security.core.*;version="${secRange}",
+ org.springframework.security.access.intercept.aspectj;version="${secRange}",
+ org.springframework.beans.factory;version="${springRange}"

bom/build.gradle

@@ -1,9 +0,0 @@
-apply plugin: 'maven-bom'
-apply from: "$rootDir/gradle/maven-deployment.gradle"
-
-generatePom.enabled = false
-sonarRunner.skipProject = true
-
-mavenBom {
-    projects = coreModuleProjects
-}

build.gradle

@@ -2,15 +2,14 @@ import groovy.text.SimpleTemplateEngine
 
 buildscript {
     repositories {
-        maven { url "https://repo.spring.io/plugins-release" }
+        maven { url "http://repo.springsource.org/plugins-release" }
     }
     dependencies {
-        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.6")
-        classpath("org.springframework.build.gradle:spring-io-plugin:0.0.3.RELEASE")
-        classpath("org.gradle.api.plugins:gradle-tomcat-plugin:1.2.3")
+        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.3")
+        classpath("org.springframework.build.gradle:bundlor-plugin:0.1.2")
+        classpath("org.gradle.api.plugins:gradle-tomcat-plugin:0.9.8")
         classpath('me.champeau.gradle:gradle-javadoc-hotfix-plugin:0.1')
         classpath('org.asciidoctor:asciidoctor-gradle-plugin:0.7.0')
-        classpath('org.asciidoctor:asciidoctor-java-integration:0.1.4.preview.1')
     }
 }
 
@@ -25,19 +24,16 @@ allprojects {
 
     ext.releaseBuild = version.endsWith('RELEASE')
     ext.snapshotBuild = version.endsWith('SNAPSHOT')
-    ext.springVersion = '4.1.0.RC2'
-    ext.springLdapVersion = '2.0.1.RELEASE'
 
     group = 'org.springframework.security'
 
     repositories {
-       mavenCentral()
-       maven { url "https://repo.spring.io/libs-snapshot" }
-       maven { url "https://repo.spring.io/plugins-release" }
+       maven { url "http://repo.springsource.org/libs-snapshot" }
+       maven { url "http://repo.springsource.org/plugins-release" }
        maven { url "http://repo.terracotta.org/maven2/" }
     }
 
-    eclipse.project.name = "${project.name}-4.0.x"
+    eclipse.project.name = "${project.name}-3.2.x"
 }
 
 sonarRunner {
@@ -55,11 +51,11 @@ sonarRunner {
 }
 
 // Set up different subproject lists for individual configuration
-ext.javaProjects = subprojects.findAll { project -> project.name != 'docs' && project.name != 'manual' && project.name != 'guides' && project.name != 'spring-security-bom' }
+ext.javaProjects = subprojects.findAll { project -> project.name != 'docs' && project.name != 'manual' && project.name != 'guides' }
 ext.sampleProjects = subprojects.findAll { project -> project.name.startsWith('spring-security-samples') }
 ext.itestProjects = subprojects.findAll { project -> project.name.startsWith('itest') }
 ext.coreModuleProjects = javaProjects - sampleProjects - itestProjects
-ext.aspectjProjects = [project(':spring-security-aspects'), project(':spring-security-samples-aspectj-xml'), project(':spring-security-samples-aspectj-jc')]
+ext.aspectjProjects = [project(':spring-security-aspects'), project(':spring-security-samples-aspectj-xml')]
 
 configure(allprojects - javaProjects) {
     task afterEclipseImport {
@@ -80,7 +76,7 @@ configure(allprojects - javaProjects) {
     }
 }
 
-configure(subprojects - coreModuleProjects - project(':spring-security-samples-messages-jc') - project(':spring-security-bom')) {
+configure(subprojects - coreModuleProjects) {
     tasks.findByPath("artifactoryPublish")?.enabled = false
     sonarRunner {
         skipProject = true
@@ -96,17 +92,32 @@ configure(javaProjects) {
 }
 
 configure(coreModuleProjects) {
+    apply plugin: 'bundlor'
     apply plugin: 'emma'
-    apply plugin: 'spring-io'
-
-    ext.springIoVersion = project.hasProperty('platformVersion') ? platformVersion : '1.1.0.BUILD-SNAPSHOT'
 
+    bundlor.doFirst {
+        def templateText = file("template.mf").text
+        bundlor.manifestTemplate = new SimpleTemplateEngine().createTemplate(templateText).make(bundlorProperties).toString()
+    }
     configurations {
         jacoco //Configuration Group used by Sonar to provide Code Coverage using JaCoCo
+        spring4TestRuntime.extendsFrom testRuntime
+    }
+    configurations.spring4TestRuntime {
+        resolutionStrategy.eachDependency { DependencyResolveDetails details ->
+            if (details.requested.group == 'org.springframework') {
+                details.useVersion '4.0.0.RC1'
+            }
+            if (details.requested.name == 'ehcache') {
+                details.useVersion '2.6.5'
+            }
+            if (details.requested.name == 'ehcache-terracotta') {
+                details.useVersion '2.1.1'
+            }
+        }
     }
 
     dependencies {
-        springIoVersions "io.spring.platform:platform-versions:${springIoVersion}@properties"
         jacoco "org.jacoco:org.jacoco.agent:0.6.2.201302030002:runtime"
     }
     test {
@@ -115,6 +126,14 @@ configure(coreModuleProjects) {
     integrationTest {
         jvmArgs "-javaagent:${configurations.jacoco.asPath}=destfile=${buildDir}/jacoco.exec,includes=${project.group}.*"
     }
+    task spring4Test(type: Test) {
+        jvmArgs = ['-ea', '-Xmx500m', '-XX:MaxPermSize=128M']
+        exclude "**/EhCacheBasedAclCacheTests.class", "**/Issue55Tests.class"
+        classpath = sourceSets.test.output + sourceSets.main.output + configurations.spring4TestRuntime
+        testResultsDir = file("$buildDir/spring4-test-results/")
+        testReportDir = file("$buildDir/reports/spring4-tests/")
+    }
+    check.dependsOn spring4Test
 }
 
 configure (aspectjProjects) {
@@ -166,5 +185,5 @@ artifacts {
 }
 
 task wrapper(type: Wrapper) {
-    gradleVersion = '1.12'
+    gradleVersion = '1.8'
 }

buildSrc/src/main/groovy/MavenBomPlugin.groovy

@@ -1,19 +0,0 @@
-import org.gradle.api.DefaultTask
-import org.gradle.api.GradleException
-import org.gradle.api.Plugin
-import org.gradle.api.Project
-import org.gradle.api.Task
-import org.gradle.api.plugins.*
-import org.gradle.api.tasks.*
-import org.gradle.api.tasks.TaskAction
-
-public class MavenBomPlugin implements Plugin<Project> {
-	static String MAVEN_BOM_TASK_NAME = "mavenBom"
-
-	public void apply(Project project) {
-		project.plugins.apply(JavaPlugin)
-		project.plugins.apply(MavenPlugin)
-		project.task(MAVEN_BOM_TASK_NAME, type: MavenBomTask, group: 'Generate', description: 'Configures the pom as a Maven Build of Materials (BOM)')
-		project.install.dependsOn project.mavenBom
-	}
-}

buildSrc/src/main/groovy/MavenBomTask.groovy

@@ -1,55 +0,0 @@
-import groovy.xml.MarkupBuilder
-
-import org.gradle.api.DefaultTask
-import org.gradle.api.Project
-import org.gradle.api.tasks.*
-
-public class MavenBomTask extends DefaultTask {
-
-    Set<Project> projects
-
-    File bomFile
-
-
-    public MavenBomTask() {
-        this.group = "Generate"
-        this.description = "Generates a Maven Build of Materials (BOM). See http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Importing_Dependencies"
-        this.projects = project.subprojects
-        this.bomFile = project.file("${->project.buildDir}/maven-bom/${->project.name}-${->project.version}.txt")
-    }
-
-    @TaskAction
-    public void configureBom() {
-        project.configurations.archives.artifacts.clear()
-
-        bomFile.parentFile.mkdirs()
-        bomFile.write("Maven Build of Materials (BOM). See http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Importing_Dependencies")
-        project.artifacts {
-            // work around GRADLE-2406 by attaching text artifact
-            archives(bomFile)
-        }
-        project.install {
-            repositories.mavenInstaller {
-                pom.whenConfigured {
-                    packaging = "pom"
-                    withXml {
-                        asNode().children().last() + {
-                            delegate.dependencyManagement {
-                                delegate.dependencies {
-                                    projects.sort { dep -> "$dep.group:$dep.name" }.each { p ->
-
-                                        delegate.dependency {
-                                            delegate.groupId(p.group)
-                                            delegate.artifactId(p.name)
-                                            delegate.version(p.version)
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
-}

buildSrc/src/main/resources/META-INF/gradle-plugins/maven-bom.properties

@@ -1 +0,0 @@
-implementation-class=MavenBomPlugin

cas/cas.gradle

@@ -5,9 +5,9 @@ dependencies {
             "org.springframework:spring-context:$springVersion",
             "org.springframework:spring-beans:$springVersion",
             "org.springframework:spring-web:$springVersion",
-            "org.jasig.cas.client:cas-client-core:3.3.3"
+            "org.jasig.cas.client:cas-client-core:3.2.1"
 
-    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
 
-    provided "javax.servlet:javax.servlet-api:$servletApiVersion"
+    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
 }

cas/pom.xml

@@ -4,13 +4,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-cas</artifactId>
-  <version>4.0.0.M2</version>
+  <version>3.2.0.RC2</version>
   <name>spring-security-cas</name>
   <description>spring-security-cas</description>
-  <url>http://spring.io/spring-security</url>
+  <url>http://springsource.org/spring-security</url>
   <organization>
-    <name>spring.io</name>
-    <url>http://spring.io/</url>
+    <name>SpringSource</name>
+    <url>http://springsource.org/</url>
   </organization>
   <licenses>
     <license>
@@ -23,13 +23,13 @@
     <developer>
       <id>rwinch</id>
       <name>Rob Winch</name>
-      <email>rwinch@gopivotal.com</email>
+      <email>rwinch@vmware.com</email>
     </developer>
   </developers>
   <scm>
-    <connection>scm:git:git://github.com/spring-projects/spring-security</connection>
-    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
-    <url>https://github.com/spring-projects/spring-security</url>
+    <connection>scm:git:git://github.com/SpringSource/spring-security</connection>
+    <developerConnection>scm:git:git://github.com/SpringSource/spring-security</developerConnection>
+    <url>https://github.com/SpringSource/spring-security</url>
   </scm>
   <build>
     <plugins>
@@ -44,45 +44,45 @@
   </build>
   <repositories>
     <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
+      <id>spring-snasphot</id>
+      <url>http://repo.springsource.org/libs-snapshot</url>
     </repository>
   </repositories>
   <dependencies>
     <dependency>
       <groupId>org.jasig.cas.client</groupId>
       <artifactId>cas-client-core</artifactId>
-      <version>3.3.3</version>
+      <version>3.2.1</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -94,7 +94,7 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-web</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -106,15 +106,15 @@
     </dependency>
     <dependency>
       <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache-core</artifactId>
-      <version>2.6.5</version>
+      <artifactId>ehcache</artifactId>
+      <version>1.6.2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>javax.servlet-api</artifactId>
-      <version>3.0.1</version>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-servlet-api</artifactId>
+      <version>7.0.33</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
@@ -126,7 +126,7 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -150,7 +150,7 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

cas/src/main/java/org/springframework/security/cas/ServiceProperties.java

@@ -49,7 +49,9 @@ public class ServiceProperties implements InitializingBean {
     //~ Methods ========================================================================================================
 
     public void afterPropertiesSet() throws Exception {
-        Assert.hasLength(this.service, "service cannot be empty.");
+        if(!authenticateAllArtifacts) {
+            Assert.hasLength(this.service, "service must be specified unless authenticateAllArtifacts is true.");
+        }
         Assert.hasLength(this.artifactParameter, "artifactParameter cannot be empty.");
         Assert.hasLength(this.serviceParameter, "serviceParameter cannot be empty.");
     }

cas/src/main/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetails.java

@@ -15,8 +15,6 @@
  */
 package org.springframework.security.cas.web.authentication;
 
-import java.net.MalformedURLException;
-import java.net.URL;
 import java.util.regex.Pattern;
 
 import javax.servlet.http.HttpServletRequest;
@@ -52,13 +50,11 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
      *            string from containing the artifact name and value. This can
      *            be created using {@link #createArtifactPattern(String)}.
      */
-    DefaultServiceAuthenticationDetails(String casService, HttpServletRequest request, Pattern artifactPattern) throws MalformedURLException {
+    DefaultServiceAuthenticationDetails(HttpServletRequest request, Pattern artifactPattern) {
         super(request);
-        URL casServiceUrl = new URL(casService);
-        int port = getServicePort(casServiceUrl);
         final String query = getQueryString(request,artifactPattern);
-        this.serviceUrl = UrlUtils.buildFullRequestUrl(casServiceUrl.getProtocol(),
-                casServiceUrl.getHost(), port,
+        this.serviceUrl = UrlUtils.buildFullRequestUrl(request.getScheme(),
+                request.getServerName(), request.getServerPort(),
                 request.getRequestURI(), query);
     }
 
@@ -132,17 +128,4 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
         Assert.hasLength(artifactParameterName);
         return Pattern.compile("&?"+Pattern.quote(artifactParameterName)+"=[^&]*");
     }
-
-    /**
-     * Gets the port from the casServiceURL ensuring to return the proper value if the default port is being used.
-     * @param casServiceUrl the casServerUrl to be used (i.e. "https://example.com/context/j_spring_security_cas_check")
-     * @return the port that is configured for the casServerUrl
-     */
-    private static int getServicePort(URL casServiceUrl) {
-        int port = casServiceUrl.getPort();
-        if(port == -1) {
-            port = casServiceUrl.getDefaultPort();
-        }
-        return port;
-    }
 }

cas/src/main/java/org/springframework/security/cas/web/authentication/ServiceAuthenticationDetailsSource.java

@@ -15,18 +15,12 @@
  */
 package org.springframework.security.cas.web.authentication;
 
-import java.net.MalformedURLException;
 import java.util.regex.Pattern;
 
 import javax.servlet.http.HttpServletRequest;
 
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
 import org.springframework.security.authentication.AuthenticationDetailsSource;
 import org.springframework.security.cas.ServiceProperties;
-import org.springframework.util.Assert;
 
 /**
  * The {@code AuthenticationDetailsSource} that is set on the
@@ -39,33 +33,20 @@ import org.springframework.util.Assert;
  * @author Rob Winch
  */
 public class ServiceAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest,
-        ServiceAuthenticationDetails>, ApplicationContextAware {
+        ServiceAuthenticationDetails> {
     //~ Instance fields ================================================================================================
 
     private final Pattern artifactPattern;
 
-    private ServiceProperties serviceProperties;
-
     //~ Constructors ===================================================================================================
 
     /**
      * Creates an implementation that uses the default CAS artifactParameterName.
-     * @deprecated Use ServiceAuthenticationDetailsSource(ServiceProperties)
      */
-    @Deprecated
     public ServiceAuthenticationDetailsSource() {
         this(ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
     }
 
-    /**
-     * Creates an implementation that uses the specified ServiceProperites and the default CAS artifactParameterName.
-     *
-     * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
-     */
-    public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties) {
-        this(serviceProperties,ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
-    }
-
     /**
      * Creates an implementation that uses the specified artifactParameterName
      *
@@ -73,27 +54,11 @@ public class ServiceAuthenticationDetailsSource implements AuthenticationDetails
      *            the artifactParameterName that is removed from the current
      *            URL. The result becomes the service url. Cannot be null and
      *            cannot be an empty String.
-     * @deprecated Use ServiceAuthenticationDetailsSource(ServiceProperties,String)
      */
     public ServiceAuthenticationDetailsSource(final String artifactParameterName) {
         this.artifactPattern = DefaultServiceAuthenticationDetails.createArtifactPattern(artifactParameterName);
     }
 
-    /**
-     * Creates an implementation that uses the specified artifactParameterName
-     *
-     * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
-     * @param artifactParameterName
-     *            the artifactParameterName that is removed from the current
-     *            URL. The result becomes the service url. Cannot be null and
-     *            cannot be an empty String.
-     */
-    public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties, String artifactParameterName) {
-        Assert.notNull(serviceProperties, "serviceProperties cannot be null");
-        this.serviceProperties = serviceProperties;
-        this.artifactPattern = DefaultServiceAuthenticationDetails.createArtifactPattern(artifactParameterName);
-    }
-
     //~ Methods ========================================================================================================
 
     /**
@@ -101,17 +66,6 @@ public class ServiceAuthenticationDetailsSource implements AuthenticationDetails
      * @return the {@code ServiceAuthenticationDetails} containing information about the current request
      */
     public ServiceAuthenticationDetails buildDetails(HttpServletRequest context) {
-        try {
-            return new DefaultServiceAuthenticationDetails(serviceProperties.getService(),context,artifactPattern);
-        } catch (MalformedURLException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Override
-    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-        if(serviceProperties == null) {
-            serviceProperties = applicationContext.getBean(ServiceProperties.class);
-        }
+        return new DefaultServiceAuthenticationDetails(context,artifactPattern);
     }
 }

cas/src/test/java/org/springframework/security/cas/web/ServicePropertiesTests.java

@@ -36,13 +36,10 @@ public class ServicePropertiesTests {
     }
 
     @Test
-    public void nullServiceWhenAuthenticateAllTokens() throws Exception {
+    public void allowNullServiceWhenAuthenticateAllTokens() throws Exception {
         ServiceProperties sp = new ServiceProperties();
         sp.setAuthenticateAllArtifacts(true);
-        try {
-            sp.afterPropertiesSet();
-            fail("Expected Exception");
-        }catch(IllegalArgumentException success) {}
+        sp.afterPropertiesSet();
         sp.setAuthenticateAllArtifacts(false);
         try {
             sp.afterPropertiesSet();

cas/src/test/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetailsTests.java

@@ -18,21 +18,11 @@ import static org.junit.Assert.assertEquals;
 
 import java.util.regex.Pattern;
 
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.xml.XmlBeanDefinitionReader;
-import org.springframework.context.ConfigurableApplicationContext;
-import org.springframework.context.support.ClassPathXmlApplicationContext;
-import org.springframework.context.support.GenericApplicationContext;
-import org.springframework.context.support.GenericXmlApplicationContext;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.cas.ServiceProperties;
 import org.springframework.security.web.util.UrlUtils;
-import org.springframework.test.context.ContextConfiguration;
-import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 
 /**
  *
@@ -42,13 +32,9 @@ public class DefaultServiceAuthenticationDetailsTests {
     private DefaultServiceAuthenticationDetails details;
     private MockHttpServletRequest request;
     private Pattern artifactPattern;
-    private String casServiceUrl;
-
-    private ConfigurableApplicationContext context;
 
     @Before
     public void setUp() {
-        casServiceUrl = "https://localhost:8443/j_spring_security_cas";
         request = new MockHttpServletRequest();
         request.setScheme("https");
         request.setServerName("localhost");
@@ -58,82 +44,45 @@ public class DefaultServiceAuthenticationDetailsTests {
 
     }
 
-    @After
-    public void cleanup() {
-        if(context != null) {
-            context.close();
-        }
-    }
-
     @Test
     public void getServiceUrlNullQuery() throws Exception {
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
-        assertEquals(UrlUtils.buildFullRequestUrl(request), details.getServiceUrl());
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
+        assertEquals(UrlUtils.buildFullRequestUrl(request),details.getServiceUrl());
     }
 
     @Test
-    public void getServiceUrlTicketOnlyParam() throws Exception {
+    public void getServiceUrlTicketOnlyParam() {
         request.setQueryString("ticket=123");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString(null);
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
 
     @Test
-    public void getServiceUrlTicketFirstMultiParam() throws Exception {
+    public void getServiceUrlTicketFirstMultiParam() {
         request.setQueryString("ticket=123&other=value");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString("other=value");
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
 
     @Test
-    public void getServiceUrlTicketLastMultiParam() throws Exception {
+    public void getServiceUrlTicketLastMultiParam() {
         request.setQueryString("other=value&ticket=123");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString("other=value");
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
 
     @Test
-    public void getServiceUrlTicketMiddleMultiParam() throws Exception {
+    public void getServiceUrlTicketMiddleMultiParam() {
         request.setQueryString("other=value&ticket=123&last=this");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString("other=value&last=this");
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeader() throws Exception {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
-        assertEquals("https://example.com/cas-sample/secure/",details.getServiceUrl());
-    }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeaderPassivity() {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        ServiceAuthenticationDetails details = loadServiceAuthenticationDetails("defaultserviceauthenticationdetails-passivity.xml");
-        assertEquals("https://example.com/cas-sample/secure/", details.getServiceUrl());
-    }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeaderExplicit() {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        ServiceAuthenticationDetails details = loadServiceAuthenticationDetails("defaultserviceauthenticationdetails-explicit.xml");
-        assertEquals("https://example.com/cas-sample/secure/", details.getServiceUrl());
-    }
-
-    private ServiceAuthenticationDetails loadServiceAuthenticationDetails(String resourceName) {
-        context = new GenericXmlApplicationContext(getClass(), resourceName);
-        ServiceAuthenticationDetailsSource source = context.getBean(ServiceAuthenticationDetailsSource.class);
-        return source.buildDetails(request);
-    }
 }

cas/src/test/resources/org/springframework/security/cas/web/authentication/defaultserviceauthenticationdetails-explicit.xml

@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
-
-    <bean id="serviceProperties"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-    <bean id="serviceProperties2"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example2.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-
-    <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
-        <constructor-arg ref="serviceProperties"/>
-    </bean>
-</beans>

cas/src/test/resources/org/springframework/security/cas/web/authentication/defaultserviceauthenticationdetails-passivity.xml

@@ -1,15 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
-
-    <bean id="serviceProperties"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-
-    <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
-</beans>

cas/template.mf

@@ -0,0 +1,23 @@
+Implementation-Title: org.springframework.security.cas
+Implementation-Version: ${version}
+Bundle-SymbolicName: org.springframework.security.cas
+Bundle-Name: Spring Security CAS
+Bundle-Vendor: SpringSource
+Bundle-Version: ${version}
+Bundle-ManifestVersion: 2
+Ignored-Existing-Headers:
+ Import-Package,
+ Export-Package
+Import-Template:
+ org.apache.commons.logging.*;version="${cloggingRange}",
+ org.jasig.cas.client.*;version="${casRange}",
+ org.springframework.security.core.*;version="${secRange}",
+ org.springframework.security.authentication.*;version="${secRange}",
+ org.springframework.security.web.*;version="${secRange}",
+ org.springframework.beans.factory;version="${springRange}",
+ org.springframework.cache.*;version="${springRange}";resolution:=optional,
+ org.springframework.context.*;version="${springRange}",
+ org.springframework.dao;version="${springRange}",
+ org.springframework.util;version="${springRange}",
+ net.sf.ehcache.*;version="${ehcacheRange}";resolution:=optional,
+ javax.servlet.*;version="0"

config/config.gradle

@@ -18,27 +18,25 @@ dependencies {
     optional project(':spring-security-web'),
              project(':spring-security-ldap'),
              project(':spring-security-openid'),
-             project(':spring-security-messaging'),
-            "org.springframework:spring-web:$springVersion",
-            "org.springframework:spring-websocket:$springVersion",
+             "org.springframework:spring-web:$springVersion",
              "org.springframework:spring-webmvc:$springVersion",
              "org.aspectj:aspectjweaver:$aspectjVersion",
              "org.springframework:spring-jdbc:$springVersion",
              "org.springframework:spring-tx:$springVersion"
 
-    provided "javax.servlet:javax.servlet-api:$servletApiVersion"
+    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
 
     testCompile project(':spring-security-cas'),
                 project(':spring-security-core').sourceSets.test.output,
-                project(':spring-security-aspects'),
                 'javax.annotation:jsr250-api:1.0',
                 "org.springframework.ldap:spring-ldap-core:$springLdapVersion",
                 "org.springframework:spring-expression:$springVersion",
                 "org.springframework:spring-jdbc:$springVersion",
                 "org.springframework:spring-orm:$springVersion",
                 "org.springframework:spring-tx:$springVersion",
+                "org.spockframework:spock-core:$spockVersion",
                 "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-                "org.eclipse.persistence:javax.persistence:2.0.5",
+                "org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.1.Final",
                 "org.hibernate:hibernate-entitymanager:4.1.0.Final",
                 "org.codehaus.groovy:groovy-all:$groovyVersion",
                 "org.apache.directory.server:apacheds-core:$apacheDsVersion",
@@ -48,19 +46,13 @@ dependencies {
                 "org.apache.directory.server:apacheds-server-jndi:$apacheDsVersion",
                 'org.apache.directory.shared:shared-ldap:0.9.15',
                 'ldapsdk:ldapsdk:4.1',
-                powerMockDependencies,
-                 "org.hibernate:hibernate-entitymanager:3.6.10.Final",
-                "org.hsqldb:hsqldb:2.2.8",
-                spockDependencies
-
+                powerMockDependencies
     testCompile('org.openid4java:openid4java-nodeps:0.9.6') {
-        exclude group: 'com.google.code.guice', module: 'guice'
-    }
-    testCompile("org.springframework.data:spring-data-jpa:$springDataJpaVersion") {
-        exclude group: 'org.aspectj', module: 'aspectjrt'
+       exclude group: 'com.google.code.guice', module: 'guice'
     }
 
-    testRuntime "org.hsqldb:hsqldb:$hsqlVersion",
+
+    testRuntime "hsqldb:hsqldb:$hsqlVersion",
                 "cglib:cglib-nodep:2.2"
 }
 
@@ -68,6 +60,10 @@ test {
     inputs.file file("$rootDir/docs/manual/src/docbook/appendix-namespace.xml")
 }
 
+integrationTest {
+    systemProperties['apacheDSWorkDir'] = "${buildDir}/apacheDSWork"
+}
+
 rncToXsd {
     rncDir = file('src/main/resources/org/springframework/security/config/')
     xsdDir = rncDir

config/pom.xml

@@ -4,13 +4,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-config</artifactId>
-  <version>4.0.0.M2</version>
+  <version>3.2.0.RC2</version>
   <name>spring-security-config</name>
   <description>spring-security-config</description>
-  <url>http://spring.io/spring-security</url>
+  <url>http://springsource.org/spring-security</url>
   <organization>
-    <name>spring.io</name>
-    <url>http://spring.io/</url>
+    <name>SpringSource</name>
+    <url>http://springsource.org/</url>
   </organization>
   <licenses>
     <license>
@@ -23,13 +23,13 @@
     <developer>
       <id>rwinch</id>
       <name>Rob Winch</name>
-      <email>rwinch@gopivotal.com</email>
+      <email>rwinch@vmware.com</email>
     </developer>
   </developers>
   <scm>
-    <connection>scm:git:git://github.com/spring-projects/spring-security</connection>
-    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
-    <url>https://github.com/spring-projects/spring-security</url>
+    <connection>scm:git:git://github.com/SpringSource/spring-security</connection>
+    <developerConnection>scm:git:git://github.com/SpringSource/spring-security</developerConnection>
+    <url>https://github.com/SpringSource/spring-security</url>
   </scm>
   <build>
     <plugins>
@@ -44,8 +44,8 @@
   </build>
   <repositories>
     <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
+      <id>spring-snasphot</id>
+      <url>http://repo.springsource.org/libs-snapshot</url>
     </repository>
   </repositories>
   <dependencies>
@@ -58,31 +58,31 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-aop</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -108,70 +108,56 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-ldap</artifactId>
-      <version>4.0.0.M2</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-messaging</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-openid</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-jdbc</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-tx</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-web</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-webmvc</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-websocket</artifactId>
-      <version>4.1.0.RC2</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>javax.servlet-api</artifactId>
-      <version>3.0.1</version>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-servlet-api</artifactId>
+      <version>7.0.33</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
@@ -186,6 +172,12 @@
       <version>0.9.29</version>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>hsqldb</groupId>
+      <artifactId>hsqldb</artifactId>
+      <version>1.8.0.10</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>javax.annotation</groupId>
       <artifactId>jsr250-api</artifactId>
@@ -195,7 +187,7 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <version>4.11</version>
+      <version>4.10</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -253,9 +245,9 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.persistence</groupId>
-      <artifactId>javax.persistence</artifactId>
-      <version>2.0.5</version>
+      <groupId>org.hibernate.javax.persistence</groupId>
+      <artifactId>hibernate-jpa-2.0-api</artifactId>
+      <version>1.0.1.Final</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -264,24 +256,6 @@
       <version>4.1.0.Final</version>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>org.hibernate</groupId>
-      <artifactId>hibernate-entitymanager</artifactId>
-      <version>3.6.10.Final</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.hsqldb</groupId>
-      <artifactId>hsqldb</artifactId>
-      <version>2.2.8</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.hsqldb</groupId>
-      <artifactId>hsqldb</artifactId>
-      <version>2.3.1</version>
-      <scope>test</scope>
-    </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
@@ -305,12 +279,6 @@
       <artifactId>powermock-api-mockito</artifactId>
       <version>1.5.1</version>
       <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>mockito-all</artifactId>
-          <groupId>org.mockito</groupId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.powermock</groupId>
@@ -353,71 +321,35 @@
       <artifactId>spock-core</artifactId>
       <version>0.7-groovy-2.0</version>
       <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>junit-dep</artifactId>
-          <groupId>junit</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.spockframework</groupId>
-      <artifactId>spock-spring</artifactId>
-      <version>0.7-groovy-2.0</version>
-      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>junit-dep</artifactId>
-          <groupId>junit</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.data</groupId>
-      <artifactId>spring-data-jpa</artifactId>
-      <version>1.7.0.RC1</version>
-      <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>aspectjrt</artifactId>
-          <groupId>org.aspectj</groupId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework.ldap</groupId>
       <artifactId>spring-ldap-core</artifactId>
-      <version>2.0.1.RELEASE</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-aspects</artifactId>
-      <version>4.0.0.M2</version>
+      <version>1.3.2.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-cas</artifactId>
-      <version>4.0.0.M2</version>
+      <version>3.2.0.RC2</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-expression</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-orm</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.0.RC2</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

config/src/integration-test/groovy/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderConfigurerTests.groovy

@@ -1,61 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.authentication.ldap
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
-import org.springframework.security.config.annotation.BaseSpringSpec
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.ldap.NamespaceLdapAuthenticationProviderTestsConfigs.LdapAuthenticationProviderConfig
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
-import org.springframework.security.ldap.authentication.LdapAuthenticationProvider
-import org.springframework.security.ldap.authentication.PasswordComparisonAuthenticator
-import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator
-import org.springframework.security.ldap.userdetails.PersonContextMapper
-import org.springframework.test.util.ReflectionTestUtils
-
-import static org.springframework.security.config.annotation.authentication.ldap.NamespaceLdapAuthenticationProviderTestsConfigs.*
-
-/**
- *
- * @author Rob Winch
- *
- */
-class LdapAuthenticationProviderConfigurerTests extends BaseSpringSpec {
-
-    def "authentication-manager support multiple default ldap contexts (ports dynamically allocated)"() {
-        when:
-            loadConfig(MultiLdapAuthenticationProvidersConfig)
-        then:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class MultiLdapAuthenticationProvidersConfig extends WebSecurityConfigurerAdapter {
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .ldapAuthentication()
-                    .groupSearchBase("ou=groups")
-                    .userDnPatterns("uid={0},ou=people")
-                    .and()
-                .ldapAuthentication()
-                    .groupSearchBase("ou=groups")
-                    .userDnPatterns("uid={0},ou=people")
-        }
-    }
-}

config/src/integration-test/groovy/org/springframework/security/config/ldap/LdapProviderBeanDefinitionParserTests.groovy

@@ -1,13 +1,7 @@
 package org.springframework.security.config.ldap
 
-
-import static org.mockito.Mockito.*
-
 import java.text.MessageFormat
-
 import org.springframework.beans.factory.config.PropertyPlaceholderConfigurer
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder
 import org.springframework.security.config.AbstractXmlConfigTests
 import org.springframework.security.config.BeanIds
 import org.springframework.security.util.FieldUtils
@@ -42,7 +36,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
 
 
     def simpleProviderAuthenticatesCorrectly() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
         xml.'authentication-manager'{
             'ldap-authentication-provider'('group-search-filter':'member={0}')
         }
@@ -72,7 +66,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
     }
 
     def supportsPasswordComparisonAuthentication() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
         xml.'authentication-manager'{
             'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people')
             'password-compare'
@@ -89,7 +83,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
     }
 
     def supportsPasswordComparisonAuthenticationWithHashAttribute() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
         xml.'authentication-manager'{
             'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
                 'password-compare'('password-attribute': 'uid', hash: 'plaintext')
@@ -108,7 +102,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
     }
 
     def supportsPasswordComparisonAuthenticationWithPasswordEncoder() {
-        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'ldap-server'()
         xml.'authentication-manager'{
             'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
                 'password-compare'('password-attribute': 'uid') {
@@ -128,28 +122,6 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
         notThrown(AuthenticationException)
     }
 
-    def 'SEC-2472: Supports Crypto PasswordEncoder'() {
-        setup:
-        xml.'ldap-server'(ldif:'test-server.ldif')
-        xml.'authentication-manager'{
-            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
-                'password-compare'() {
-                    'password-encoder'(ref: 'pe')
-                }
-            }
-        }
-        xml.'b:bean'(id:'pe','class':BCryptPasswordEncoder.class.name)
-
-        createAppContext('')
-        def am = appContext.getBean(BeanIds.AUTHENTICATION_MANAGER)
-
-        when:
-        def auth = am.authenticate(new UsernamePasswordAuthenticationToken("bcrypt", 'password'))
-
-        then:
-        auth != null
-    }
-
     def inetOrgContextMapperIsSupported()  {
         xml.'ldap-server'(url: 'ldap://127.0.0.1:343/dc=springframework,dc=org')
         xml.'authentication-manager'{

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderBuilderSecurityBuilderTests.groovy

@@ -15,12 +15,10 @@
  */
 package org.springframework.security.config.annotation.authentication.ldap
 
-import org.springframework.beans.factory.config.AutowireCapableBeanFactory
 import org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory;
 import org.springframework.context.annotation.AnnotationConfigApplicationContext;
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.context.annotation.Import
 import org.springframework.ldap.core.ContextSource;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
 import org.springframework.security.authentication.AuthenticationManager
@@ -29,13 +27,7 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.SecurityBuilder;
 import org.springframework.security.config.annotation.authentication.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication
-import org.springframework.security.config.annotation.configuration.AutowireBeanFactoryObjectPostProcessor
-import org.springframework.security.config.annotation.configuration.AutowireBeanFactoryObjectPostProcessorTests
-import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
 import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
 import org.springframework.security.ldap.server.ApacheDSContainer;
@@ -65,7 +57,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
         }
     }
 
@@ -83,7 +74,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                     .groupRoleAttribute("group")
         }
     }
@@ -102,7 +92,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                     .groupSearchFilter("ou=groupName");
         }
     }
@@ -121,7 +110,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                     .rolePrefix("role_")
         }
     }
@@ -132,7 +120,7 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
         AuthenticationManager auth = context.getBean(AuthenticationManager)
         then:
         auth
-        auth.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword")).authorities.collect { it.authority }.sort() == ["ROLE_DEVELOPERS"]
+        auth.authenticate(new UsernamePasswordAuthenticationToken("admin","password")).authorities.collect { it.authority }.sort() == ["ROLE_ADMIN","ROLE_USER"]
     }
 
     @Configuration
@@ -142,29 +130,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
                 .ldapAuthentication()
                     .contextSource(contextSource())
                     .groupSearchBase("ou=groups")
-                    .groupSearchFilter("(member={0})")
-                    .userDnPatterns("uid={0},ou=people");
-        }
-    }
-
-    def "SEC-2472: Can use crypto PasswordEncoder"() {
-        setup:
-        loadConfig(PasswordEncoderConfig)
-        when:
-        AuthenticationManager auth = context.getBean(AuthenticationManager)
-        then:
-        auth.authenticate(new UsernamePasswordAuthenticationToken("bcrypt","password")).authorities.collect { it.authority }.sort() == ["ROLE_DEVELOPERS"]
-    }
-
-    @Configuration
-    static class PasswordEncoderConfig extends BaseLdapServerConfig {
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .ldapAuthentication()
-                    .contextSource(contextSource())
-                    .passwordEncoder(new BCryptPasswordEncoder())
-                    .groupSearchBase("ou=groups")
-                    .groupSearchFilter("(member={0})")
                     .userDnPatterns("uid={0},ou=people");
         }
     }
@@ -177,44 +142,23 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
     static abstract class BaseLdapServerConfig extends BaseLdapProviderConfig {
         @Bean
         public ApacheDSContainer ldapServer() throws Exception {
-            ApacheDSContainer apacheDSContainer = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/test-server.ldif");
-            apacheDSContainer.setPort(getPort());
+            ApacheDSContainer apacheDSContainer = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/users.ldif");
+            apacheDSContainer.setPort(33389);
             return apacheDSContainer;
         }
     }
 
     @Configuration
-    @EnableGlobalAuthentication
-    @Import(ObjectPostProcessorConfiguration)
     static abstract class BaseLdapProviderConfig {
 
         @Bean
         public BaseLdapPathContextSource contextSource() throws Exception {
             DefaultSpringSecurityContextSource contextSource = new DefaultSpringSecurityContextSource(
-                    "ldap://127.0.0.1:"+ getPort() + "/dc=springframework,dc=org")
+                    "ldap://127.0.0.1:33389/dc=springframework,dc=org")
             contextSource.userDn = "uid=admin,ou=system"
             contextSource.password = "secret"
-            contextSource.afterPropertiesSet()
+            contextSource.afterPropertiesSet();
             return contextSource;
         }
-
-        @Bean
-        public AuthenticationManager authenticationManager(AuthenticationManagerBuilder auth) {
-            configure(auth)
-            auth.build()
-        }
-
-        abstract protected void configure(AuthenticationManagerBuilder auth)
-    }
-
-    static Integer port;
-
-    static int getPort() {
-        if(port == null) {
-            ServerSocket socket = new ServerSocket(0)
-            port = socket.localPort
-            socket.close()
-        }
-        port
     }
 }

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/NamespaceLdapAuthenticationProviderTests.groovy

@@ -26,7 +26,6 @@ import org.springframework.security.config.annotation.authentication.builders.Au
 import org.springframework.security.config.annotation.authentication.ldap.NamespaceLdapAuthenticationProviderTestsConfigs.LdapAuthenticationProviderConfig;
 import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
 import org.springframework.security.ldap.authentication.PasswordComparisonAuthenticator;
-import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;
 import org.springframework.test.util.ReflectionTestUtils;
 
@@ -40,7 +39,7 @@ class NamespaceLdapAuthenticationProviderTests extends BaseSpringSpec {
         when:
             loadConfig(LdapAuthenticationProviderConfig)
         then:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password")).authorities*.authority.sort() == ['ROLE_USER']
     }
 
     def "ldap-authentication-provider custom"() {
@@ -58,23 +57,12 @@ class NamespaceLdapAuthenticationProviderTests extends BaseSpringSpec {
             provider.authenticator.userSearch.searchFilter == "(uid={0})"
     }
 
-    def "SEC-2490: ldap-authentication-provider custom LdapAuthoritiesPopulator"() {
-        setup:
-            LdapAuthoritiesPopulator LAP = Mock()
-            CustomAuthoritiesPopulatorConfig.LAP = LAP
-        when:
-            loadConfig(CustomAuthoritiesPopulatorConfig)
-            LdapAuthenticationProvider provider = findAuthenticationProvider(LdapAuthenticationProvider)
-        then:
-            provider.authoritiesPopulator == LAP
-    }
-
     def "ldap-authentication-provider password compare"() {
         when:
             loadConfig(PasswordCompareLdapConfig)
             LdapAuthenticationProvider provider = findAuthenticationProvider(LdapAuthenticationProvider)
         then:
             provider.authenticator instanceof PasswordComparisonAuthenticator
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password")).authorities*.authority.sort() == ['ROLE_USER']
     }
 }

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/NamespaceLdapAuthenticationProviderTestsConfigs.java

@@ -20,7 +20,6 @@ import org.springframework.security.authentication.encoding.PlaintextPasswordEnc
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;
 
 /**
@@ -56,7 +55,7 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
                     .userSearchFilter("(uid={0})") // ldap-authentication-provider@user-search-filter
                     // .contextSource(contextSource) // ldap-authentication-provider@server-ref
                     .contextSource()
-                        .ldif("classpath:users.xldif") // ldap-server@ldif
+                        .ldif("classpath:user.ldif") // ldap-server@ldif
                         .managerDn("uid=admin,ou=system") // ldap-server@manager-dn
                         .managerPassword("secret") // ldap-server@manager-password
                         .port(33399) // ldap-server@port
@@ -66,18 +65,6 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
         }
     }
 
-    @Configuration
-    @EnableWebSecurity
-    static class CustomAuthoritiesPopulatorConfig extends WebSecurityConfigurerAdapter {
-        static LdapAuthoritiesPopulator LAP;
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .ldapAuthentication()
-                    .userSearchFilter("(uid={0})")
-                    .ldapAuthoritiesPopulator(LAP);
-        }
-    }
-
     @Configuration
     @EnableWebSecurity
     static class PasswordCompareLdapConfig extends WebSecurityConfigurerAdapter {

config/src/integration-test/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParserTests.java

@@ -12,10 +12,7 @@
  */
 package org.springframework.security.config.ldap;
 
-import static org.junit.Assert.assertEquals;
-
-import java.io.IOException;
-import java.net.ServerSocket;
+import static org.junit.Assert.*;
 
 import org.junit.After;
 import org.junit.Test;
@@ -53,11 +50,10 @@ public class LdapServerBeanDefinitionParserTests {
     }
 
     @Test
-    public void useOfUrlAttributeCreatesCorrectContextSource() throws Exception {
-        int port = getDefaultPort();
+    public void useOfUrlAttributeCreatesCorrectContextSource() {
         // Create second "server" with a url pointing at embedded one
-        appCtx = new InMemoryXmlApplicationContext("<ldap-server ldif='classpath:test-server.ldif' port='" + port + "'/>" +
-                "<ldap-server ldif='classpath:test-server.ldif' id='blah' url='ldap://127.0.0.1:" + port + "/dc=springframework,dc=org' />");
+        appCtx = new InMemoryXmlApplicationContext("<ldap-server ldif='classpath:test-server.ldif' port='33388'/>" +
+                "<ldap-server ldif='classpath:test-server.ldif' id='blah' url='ldap://127.0.0.1:33388/dc=springframework,dc=org' />");
 
         // Check the default context source is still there.
         appCtx.getBean(BeanIds.CONTEXT_SOURCE);
@@ -87,16 +83,4 @@ public class LdapServerBeanDefinitionParserTests {
 
         assertEquals("classpath*:*.ldif", ReflectionTestUtils.getField(dsContainer, "ldifResources"));
     }
-
-    private int getDefaultPort() throws IOException {
-        ServerSocket server = null;
-        try {
-            server = new ServerSocket(0);
-            return server.getLocalPort();
-        } finally {
-            try {
-                server.close();
-            } catch(IOException e) {}
-        }
-    }
 }

config/src/integration-test/resources/test-server.ldif

@@ -28,16 +28,6 @@ sn: Alex
 uid: ben
 userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=
 
-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$FBAKClV1zBIOOC9XMXf3AO8RoGXYVYsfvUdoLxGkd/BnXEn4tqT3u
-
 dn: uid=bob,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
@@ -68,22 +58,11 @@ sn: Mouse
 uid: jerry
 userPassword: jerryspassword
 
-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$lDa0YFNHAt63MjIzK/wUqeM0qjIhzPhp3RNI/MLUQEAUbzhB/SnnS
-
 dn: cn=developers,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfNames
 cn: developers
 ou: developer
-member: uid=bcrypt,ou=people,dc=springframework,dc=org
 member: uid=ben,ou=people,dc=springframework,dc=org
 member: uid=bob,ou=people,dc=springframework,dc=org
 

config/src/integration-test/resources/users.ldif

@@ -0,0 +1,42 @@
+dn: ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: groups
+
+dn: ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: people
+
+dn: uid=admin,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Rod Johnson
+sn: Johnson
+uid: admin
+userPassword: password
+
+dn: uid=user,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Dianne Emu
+sn: Emu
+uid: user
+userPassword: password
+
+dn: cn=user,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: user
+uniqueMember: uid=admin,ou=people,dc=springframework,dc=org
+uniqueMember: uid=user,ou=people,dc=springframework,dc=org
+
+dn: cn=admin,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: admin
+uniqueMember: uid=admin,ou=people,dc=springframework,dc=org

config/src/integration-test/resources/users.xldif

@@ -1,92 +0,0 @@
-dn: ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: groups
-
-dn: ou=subgroups,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: subgroups
-
-dn: ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: people
-
-dn: ou=otherpeople,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: otherpeople
-
-dn: uid=ben,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Ben Alex
-sn: Alex
-uid: ben
-userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=
-
-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$lDa0YFNHAt63MjIzK/wUqeM0qjIhzPhp3RNI/MLUQEAUbzhB/SnnS
-
-dn: uid=bob,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Bob Hamilton
-sn: Hamilton
-uid: bob
-userPassword: bobspassword
-
-dn: uid=joe,ou=otherpeople,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Joe Smeth
-sn: Smeth
-uid: joe
-userPassword: joespassword
-
-dn: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Mouse, Jerry
-sn: Mouse
-uid: jerry
-userPassword: jerryspassword
-
-dn: cn=developers,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: developers
-ou: developer
-member: uid=ben,ou=people,dc=springframework,dc=org
-member: uid=bob,ou=people,dc=springframework,dc=org
-
-dn: cn=managers,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: managers
-ou: manager
-member: uid=ben,ou=people,dc=springframework,dc=org
-member: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
-
-dn: cn=submanagers,ou=subgroups,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: submanagers
-ou: submanager
-member: uid=ben,ou=people,dc=springframework,dc=org

config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java

@@ -29,6 +29,8 @@ import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.DelegatingFilterProxy;
 
+import com.google.inject.internal.ImmutableList.Builder;
+
 /**
  * <p>A base {@link SecurityBuilder} that allows {@link SecurityConfigurer} to be
  * applied to it. This makes modifying the {@link SecurityBuilder} a strategy

config/src/main/java/org/springframework/security/config/annotation/AbstractSecurityBuilder.java

@@ -39,7 +39,7 @@ public abstract class AbstractSecurityBuilder<O> implements SecurityBuilder<O> {
             object = doBuild();
             return object;
         }
-        throw new AlreadyBuiltException("This object has already been built");
+        throw new IllegalStateException("This object has already been built");
     }
 
     /**

config/src/main/java/org/springframework/security/config/annotation/SecurityBuilder.java

@@ -29,7 +29,7 @@ public interface SecurityBuilder<O> {
      * Builds the object and returns it or null.
      *
      * @return the Object to be built or null if the implementation allows it.
-     * @throws Exception if an error occurred when building the Object
+     * @throws Exception if an error occured when building the Object
      */
     O build() throws Exception;
 }

config/src/main/java/org/springframework/security/config/annotation/authentication/builders/AuthenticationManagerBuilder.java

@@ -18,8 +18,6 @@ package org.springframework.security.config.annotation.authentication.builders;
 import java.util.ArrayList;
 import java.util.List;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 import org.springframework.security.authentication.AuthenticationEventPublisher;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationProvider;
@@ -27,7 +25,6 @@ import org.springframework.security.authentication.ProviderManager;
 import org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.SecurityBuilder;
-import org.springframework.security.config.annotation.SecurityConfigurer;
 import org.springframework.security.config.annotation.authentication.ProviderManagerBuilder;
 import org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer;
 import org.springframework.security.config.annotation.authentication.configurers.provisioning.InMemoryUserDetailsManagerConfigurer;
@@ -48,7 +45,6 @@ import org.springframework.util.Assert;
  * @since 3.2
  */
 public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuilder<AuthenticationManager, AuthenticationManagerBuilder> implements ProviderManagerBuilder<AuthenticationManagerBuilder> {
-    private final Log logger = LogFactory.getLog(getClass());
 
     private AuthenticationManager parentAuthenticationManager;
     private List<AuthenticationProvider> authenticationProviders = new ArrayList<AuthenticationProvider>();
@@ -78,9 +74,6 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil
      */
     public AuthenticationManagerBuilder parentAuthenticationManager(
             AuthenticationManager authenticationManager) {
-        if(authenticationManager instanceof ProviderManager) {
-            eraseCredentials(((ProviderManager) authenticationManager).isEraseCredentialsAfterAuthentication());
-        }
         this.parentAuthenticationManager = authenticationManager;
         return this;
     }
@@ -138,31 +131,19 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil
 
     /**
      * Add JDBC authentication to the {@link AuthenticationManagerBuilder} and
-     * return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
-     * of the JDBC authentication.
-     *
-     * <p>
-     * When using with a persistent data store, it is best to add users external
-     * of configuration using something like <a
-     * href="http://flywaydb.org/">Flyway</a> or <a
-     * href="http://www.liquibase.org/">Liquibase</a> to create the schema and
-     * adding users to ensure these steps are only done once and that the
-     * optimal SQL is used.
-     * </p>
+     * return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the
+     * JDBC authentication.
      *
      * <p>
      * This method also ensure that a {@link UserDetailsService} is available
      * for the {@link #getDefaultUserDetailsService()} method. Note that
      * additional {@link UserDetailsService}'s may override this
-     * {@link UserDetailsService} as the default. See the <a href=
-     * "http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#user-schema"
-     * >User Schema</a> section of the reference for the default schema.
+     * {@link UserDetailsService} as the default.
      * </p>
      *
-     * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
-     *         of the JDBC authentication
-     * @throws Exception
-     *             if an error occurs when adding the JDBC authentication
+     * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the
+     * JDBC authentication
+     * @throws Exception if an error occurs when adding the JDBC authentication
      */
     public JdbcUserDetailsManagerConfigurer<AuthenticationManagerBuilder> jdbcAuthentication()
             throws Exception {
@@ -237,10 +218,6 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil
 
     @Override
     protected ProviderManager performBuild() throws Exception {
-        if(!isConfigured()) {
-            logger.debug("No authenticationProviders and no parentAuthenticationManager defined. Returning null.");
-            return null;
-        }
         ProviderManager providerManager = new ProviderManager(authenticationProviders, parentAuthenticationManager);
         if(eraseCredentials != null) {
             providerManager.setEraseCredentialsAfterAuthentication(eraseCredentials);
@@ -252,26 +229,6 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil
         return providerManager;
     }
 
-    /**
-     * Determines if the {@link AuthenticationManagerBuilder} is configured to
-     * build a non null {@link AuthenticationManager}. This means that either a
-     * non-null parent is specified or at least one
-     * {@link AuthenticationProvider} has been specified.
-     *
-     * <p>
-     * When using {@link SecurityConfigurer} instances, the
-     * {@link AuthenticationManagerBuilder} will not be configured until the
-     * {@link SecurityConfigurer#configure(SecurityBuilder)} methods. This means
-     * a {@link SecurityConfigurer} that is last could check this method and
-     * provide a default configuration in the
-     * {@link SecurityConfigurer#configure(SecurityBuilder)} method.
-     *
-     * @return
-     */
-    public boolean isConfigured() {
-        return !authenticationProviders.isEmpty() || parentAuthenticationManager != null;
-    }
-
     /**
      * Gets the default {@link UserDetailsService} for the
      * {@link AuthenticationManagerBuilder}. The result may be null in some

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/AuthenticationConfiguration.java

@@ -15,26 +15,10 @@
  */
 package org.springframework.security.config.annotation.authentication.configuration;
 
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.aop.framework.ProxyFactoryBean;
-import org.springframework.aop.target.LazyInitTargetSource;
-import org.springframework.beans.factory.BeanFactoryUtils;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.core.annotation.AnnotationAwareOrderComparator;
-import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter;
-import org.springframework.util.Assert;
 
 /**
  * Exports the authentication {@link Configuration}
@@ -45,97 +29,9 @@ import org.springframework.util.Assert;
  */
 @Configuration
 public class AuthenticationConfiguration {
-    private ApplicationContext applicationContext;
-
-    private AuthenticationManager authenticationManager;
-
-    private boolean authenticationManagerInitialized;
-
-    private List<GlobalAuthenticationConfigurerAdapter> globalAuthConfigures = Collections.emptyList();
-
-    private ObjectPostProcessor<Object> objectPostProcessor;
 
     @Bean
     public AuthenticationManagerBuilder authenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor) {
         return new AuthenticationManagerBuilder(objectPostProcessor);
     }
-
-    @Bean
-    public GlobalAuthenticationConfigurerAdapter enableGlobalAuthenticationAutowiredConfigurer(ApplicationContext context) {
-        return new EnableGlobalAuthenticationAutowiredConfigurer(context);
-    }
-
-    public AuthenticationManager getAuthenticationManager() throws Exception {
-        if(authenticationManagerInitialized) {
-            return authenticationManager;
-        }
-
-        AuthenticationManagerBuilder authBuilder = authenticationManagerBuilder(objectPostProcessor);
-        for(GlobalAuthenticationConfigurerAdapter config : globalAuthConfigures) {
-            authBuilder.apply(config);
-        }
-
-        authenticationManager = authBuilder.build();
-
-        if(authenticationManager == null) {
-            authenticationManager = getAuthenticationMangerBean();
-        }
-
-        this.authenticationManagerInitialized = true;
-        return authenticationManager;
-    }
-
-    @Autowired(required = false)
-    public void setGlobalAuthenticationConfigurers(List<GlobalAuthenticationConfigurerAdapter> configurers) throws Exception {
-        Collections.sort(configurers, AnnotationAwareOrderComparator.INSTANCE);
-        this.globalAuthConfigures = configurers;
-    }
-
-    @Autowired
-    public void setApplicationContext(ApplicationContext applicationContext) {
-        this.applicationContext = applicationContext;
-    }
-
-    @Autowired
-    public void setObjectPostProcessor(ObjectPostProcessor<Object> objectPostProcessor) {
-        this.objectPostProcessor = objectPostProcessor;
-    }
-
-
-    @SuppressWarnings("unchecked")
-    private <T> T lazyBean(Class<T> interfaceName) {
-        LazyInitTargetSource lazyTargetSource = new LazyInitTargetSource();
-        String[] beanNamesForType = BeanFactoryUtils.beanNamesForTypeIncludingAncestors(applicationContext, interfaceName);
-        if(beanNamesForType.length == 0) {
-            return null;
-        }
-        Assert.isTrue(beanNamesForType.length == 1 , "Expecting to only find a single bean for type " + interfaceName + ", but found " + Arrays.asList(beanNamesForType));
-        lazyTargetSource.setTargetBeanName(beanNamesForType[0]);
-        lazyTargetSource.setBeanFactory(applicationContext);
-        ProxyFactoryBean proxyFactory = new ProxyFactoryBean();
-        proxyFactory = objectPostProcessor.postProcess(proxyFactory);
-        proxyFactory.setTargetSource(lazyTargetSource);
-        return (T) proxyFactory.getObject();
-    }
-
-    private AuthenticationManager getAuthenticationMangerBean() {
-        return lazyBean(AuthenticationManager.class);
-    }
-
-    private static class EnableGlobalAuthenticationAutowiredConfigurer extends GlobalAuthenticationConfigurerAdapter {
-        private final ApplicationContext context;
-        private static final Log logger = LogFactory.getLog(EnableGlobalAuthenticationAutowiredConfigurer.class);
-
-        public EnableGlobalAuthenticationAutowiredConfigurer(ApplicationContext context) {
-            this.context = context;
-        }
-
-        @Override
-        public void init(AuthenticationManagerBuilder auth) {
-            Map<String, Object> beansWithAnnotation = context.getBeansWithAnnotation(EnableGlobalAuthentication.class);
-            if(logger.isDebugEnabled()) {
-                logger.debug("Eagerly initializing " + beansWithAnnotation);
-            }
-        }
-    }
-}
+}

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/EnableGlobalAuthentication.java

@@ -1,91 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.authentication.configuration;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.Retention;
-import java.lang.annotation.Target;
-
-import org.springframework.context.annotation.Import;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
-
-/**
- * The {@link EnableGlobalAuthentication} annotation signals that the annotated
- * class can be used to configure a global instance of
- * {@link AuthenticationManagerBuilder}. For example:
- *
- * <pre class="code">
- * &#064;Configuration
- * &#064;EnableGlobalAuthentication
- * public class MyGlobalAuthenticationConfiguration {
- *
- *     &#064;Autowired
- *     public void configureGlobal(AuthenticationManagerBuilder auth) {
- *        auth
- *            .inMemoryAuthentication()
- *                .withUser(&quot;user&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;).and()
- *                .withUser(&quot;admin&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;, &quot;ADMIN&quot;);
- *     }
- * }
- * </pre>
- *
- * Annotations that are annotated with {@link EnableGlobalAuthentication} also
- * signal that the annotated class can be used to configure a global instance of
- * {@link AuthenticationManagerBuilder}. For example:
- *
- * <pre class="code">
- * &#064;Configuration
- * &#064;EnableWebSecurity
- * public class MyWebSecurityConfiguration extends WebSecurityConfigurerAdapter {
- *
- *    &#064;Autowired
- *    public void configureGlobal(AuthenticationManagerBuilder auth) {
- *        auth
- *            .inMemoryAuthentication()
- *                .withUser(&quot;user&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;).and()
- *                .withUser(&quot;admin&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;, &quot;ADMIN&quot;);
- *    }
- *
- *    // Possibly overridden methods ...
- * }
- * </pre>
- *
- * The following annotations are annotated with {@link EnableGlobalAuthentication}
- *
- * <ul>
- *   <li> {@link EnableWebSecurity} </li>
- *   <li> {@link EnableWebMvcSecurity} </li>
- *   <li> {@link EnableGlobalMethodSecurity} </li>
- * </ul>
- *
- * Configuring {@link AuthenticationManagerBuilder} in a class without the {@link EnableGlobalAuthentication} annotation has
- * unpredictable results.
- *
- * @see EnableWebMvcSecurity
- * @see EnableWebSecurity
- * @see EnableGlobalMethodSecurity
- *
- * @author Rob Winch
- *
- */
-@Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
-@Target(value={java.lang.annotation.ElementType.TYPE})
-@Documented
-@Import(AuthenticationConfiguration.class)
-public @interface EnableGlobalAuthentication {}

config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/GlobalAuthenticationConfigurerAdapter.java

@@ -1,39 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.authentication.configurers;
-
-import org.springframework.core.annotation.Order;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.annotation.SecurityConfigurer;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
-
-/**
- * A {@link SecurityConfigurer} that can be exposed as a bean to configure the
- * global {@link AuthenticationManagerBuilder}. Beans of this type are
- * automatically used by {@link AuthenticationConfiguration} to configure the
- * global {@link AuthenticationManagerBuilder}.
- *
- * @since 3.2.1
- * @author Rob Winch
- */
-@Order(100)
-public abstract class GlobalAuthenticationConfigurerAdapter implements SecurityConfigurer<AuthenticationManager, AuthenticationManagerBuilder> {
-
-    public void init(AuthenticationManagerBuilder auth) throws Exception {}
-
-    public void configure(AuthenticationManagerBuilder auth) throws Exception {}
-}

config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java

@@ -36,14 +36,9 @@ import org.springframework.security.ldap.search.LdapUserSearch;
 import org.springframework.security.ldap.server.ApacheDSContainer;
 import org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.InetOrgPersonContextMapper;
-import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;
 import org.springframework.security.ldap.userdetails.UserDetailsContextMapper;
-import org.springframework.util.Assert;
-
-import java.io.IOException;
-import java.net.ServerSocket;
 
 /**
  * Configures LDAP {@link AuthenticationProvider} in the {@link ProviderManagerBuilder}.
@@ -64,15 +59,17 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
     private BaseLdapPathContextSource contextSource;
     private ContextSourceBuilder contextSourceBuilder = new ContextSourceBuilder();
     private UserDetailsContextMapper userDetailsContextMapper;
-    private Object passwordEncoder;
+    private PasswordEncoder passwordEncoder;
     private String passwordAttribute;
-    private LdapAuthoritiesPopulator ldapAuthoritiesPopulator;
 
     private LdapAuthenticationProvider build() throws Exception {
         BaseLdapPathContextSource contextSource = getContextSource();
         LdapAuthenticator ldapAuthenticator = createLdapAuthenticator(contextSource);
 
-        LdapAuthoritiesPopulator authoritiesPopulator = getLdapAuthoritiesPopulator();
+        DefaultLdapAuthoritiesPopulator authoritiesPopulator = new DefaultLdapAuthoritiesPopulator(
+                contextSource, groupSearchBase);
+        authoritiesPopulator.setGroupRoleAttribute(groupRoleAttribute);
+        authoritiesPopulator.setGroupSearchFilter(groupSearchFilter);
 
         LdapAuthenticationProvider ldapAuthenticationProvider = new LdapAuthenticationProvider(
                 ldapAuthenticator, authoritiesPopulator);
@@ -86,17 +83,6 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
         return ldapAuthenticationProvider;
     }
 
-    /**
-     * Specifies the {@link LdapAuthoritiesPopulator}.
-     *
-     * @param ldapAuthoritiesPopulator the {@link LdapAuthoritiesPopulator} the default is {@link DefaultLdapAuthoritiesPopulator}
-     * @return the {@link LdapAuthenticationProviderConfigurer} for further customizations
-     */
-    public LdapAuthenticationProviderConfigurer<B> ldapAuthoritiesPopulator(LdapAuthoritiesPopulator ldapAuthoritiesPopulator) {
-        this.ldapAuthoritiesPopulator = ldapAuthoritiesPopulator;
-        return this;
-    }
-
     /**
      * Adds an {@link ObjectPostProcessor} for this class.
      *
@@ -108,25 +94,6 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
         return this;
     }
 
-    /**
-     * Gets the {@link LdapAuthoritiesPopulator} and defaults to {@link DefaultLdapAuthoritiesPopulator}
-     *
-     * @return the {@link LdapAuthoritiesPopulator}
-     */
-    private LdapAuthoritiesPopulator getLdapAuthoritiesPopulator() {
-        if(ldapAuthoritiesPopulator != null) {
-            return ldapAuthoritiesPopulator;
-        }
-
-        DefaultLdapAuthoritiesPopulator defaultAuthoritiesPopulator = new DefaultLdapAuthoritiesPopulator(
-                contextSource, groupSearchBase);
-        defaultAuthoritiesPopulator.setGroupRoleAttribute(groupRoleAttribute);
-        defaultAuthoritiesPopulator.setGroupSearchFilter(groupSearchFilter);
-
-        this.ldapAuthoritiesPopulator = defaultAuthoritiesPopulator;
-        return defaultAuthoritiesPopulator;
-    }
-
     /**
      * Creates the {@link LdapAuthenticator} to use
      *
@@ -153,9 +120,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
      */
     private PasswordComparisonAuthenticator createPasswordCompareAuthenticator(BaseLdapPathContextSource contextSource) {
         PasswordComparisonAuthenticator ldapAuthenticator = new PasswordComparisonAuthenticator(contextSource);
-        if(passwordAttribute != null) {
-            ldapAuthenticator.setPasswordAttributeName(passwordAttribute);
-        }
+        ldapAuthenticator.setPasswordAttributeName(passwordAttribute);
         ldapAuthenticator.setPasswordEncoder(passwordEncoder);
         return ldapAuthenticator;
     }
@@ -210,26 +175,12 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
      *
      * @param passwordEncoder the {@link PasswordEncoder} to use
      * @return the {@link LdapAuthenticationProviderConfigurer} for further customization
-     * @deprecated Use {@link #passwordEncoder(org.springframework.security.crypto.password.PasswordEncoder)} instead
      */
     public LdapAuthenticationProviderConfigurer<B> passwordEncoder(PasswordEncoder passwordEncoder) {
         this.passwordEncoder = passwordEncoder;
         return this;
     }
 
-    /**
-     * Specifies the {@link org.springframework.security.crypto.password.PasswordEncoder} to be used when authenticating with
-     * password comparison.
-     *
-     * @param passwordEncoder the {@link org.springframework.security.crypto.password.PasswordEncoder} to use
-     * @return the {@link LdapAuthenticationProviderConfigurer} for further customization
-     */
-    public LdapAuthenticationProviderConfigurer<B> passwordEncoder(final org.springframework.security.crypto.password.PasswordEncoder passwordEncoder) {
-        Assert.notNull(passwordEncoder, "passwordEncoder must not be null.");
-        this.passwordEncoder = passwordEncoder;
-        return this;
-    }
-
     /**
      * If your users are at a fixed location in the directory (i.e. you can work
      * out the DN directly from the username without doing a directory search),
@@ -393,8 +344,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
         private String ldif = "classpath*:*.ldif";
         private String managerPassword;
         private String managerDn;
-        private Integer port;
-        private static final int DEFAULT_PORT = 33389;
+        private int port = 33389;
         private String root = "dc=springframework,dc=org";
         private String url;
 
@@ -439,7 +389,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
         }
 
         /**
-         * The port to connect to LDAP to (the default is 33389 or random available port if unavailable).
+         * The port to connect to LDAP to (the default is 33389).
          * @param port the port to connect to
          * @return the {@link ContextSourceBuilder} for further customization
          */
@@ -499,43 +449,14 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
                 return contextSource;
             }
             ApacheDSContainer apacheDsContainer = new ApacheDSContainer(root, ldif);
-            apacheDsContainer.setPort(getPort());
+            apacheDsContainer.setPort(port);
             postProcess(apacheDsContainer);
             return contextSource;
         }
 
-        private int getPort() {
-            if(port == null) {
-                port = getDefaultPort();
-            }
-            return port;
-        }
-
-        private int getDefaultPort() {
-            ServerSocket serverSocket = null;
-            try {
-                try {
-                    serverSocket = new ServerSocket(DEFAULT_PORT);
-                } catch (IOException e) {
-                    try {
-                        serverSocket = new ServerSocket(0);
-                    } catch(IOException e2) {
-                        return DEFAULT_PORT;
-                    }
-                }
-                return serverSocket.getLocalPort();
-            } finally {
-                if(serverSocket != null) {
-                    try {
-                        serverSocket.close();
-                    } catch (IOException e) {}
-                }
-            }
-        }
-
         private String getProviderUrl() {
             if(url == null) {
-                return "ldap://127.0.0.1:" + getPort() + "/" + root;
+                return "ldap://127.0.0.1:" + port + "/" + root;
             }
             return url;
         }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableGlobalMethodSecurity.java

@@ -23,7 +23,7 @@ import org.springframework.context.annotation.AdviceMode;
 import org.springframework.context.annotation.Import;
 import org.springframework.core.Ordered;
 import org.springframework.security.access.annotation.Secured;
-import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration;
 
 /**
@@ -44,8 +44,7 @@ import org.springframework.security.config.annotation.configuration.ObjectPostPr
 @Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
 @Target(value={java.lang.annotation.ElementType.TYPE})
 @Documented
-@Import({GlobalMethodSecuritySelector.class,ObjectPostProcessorConfiguration.class})
-@EnableGlobalAuthentication
+@Import({GlobalMethodSecuritySelector.class,ObjectPostProcessorConfiguration.class,AuthenticationConfiguration.class})
 public @interface EnableGlobalMethodSecurity {
 
     /**

config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityAspectJAutoProxyRegistrar.java

@@ -18,8 +18,6 @@ package org.springframework.security.config.annotation.method.configuration;
 import java.util.Map;
 
 import org.springframework.aop.config.AopConfigUtils;
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.BeanDefinitionRegistry;
 import org.springframework.context.annotation.ImportBeanDefinitionRegistrar;
 import org.springframework.core.annotation.AnnotationAttributes;
@@ -52,15 +50,18 @@ class GlobalMethodSecurityAspectJAutoProxyRegistrar implements
             AnnotationMetadata importingClassMetadata,
             BeanDefinitionRegistry registry) {
 
-        BeanDefinition interceptor = registry.getBeanDefinition("methodSecurityInterceptor");
+        AopConfigUtils
+                .registerAspectJAnnotationAutoProxyCreatorIfNecessary(registry);
 
-        BeanDefinitionBuilder aspect =
-                BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect");
-        aspect.setFactoryMethod("aspectOf");
-        aspect.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        aspect.addPropertyValue("securityInterceptor", interceptor);
+        Map<String, Object> annotationAttributes = importingClassMetadata
+                .getAnnotationAttributes(EnableGlobalMethodSecurity.class
+                        .getName());
+        AnnotationAttributes enableAJAutoProxy = AnnotationAttributes
+                .fromMap(annotationAttributes);
 
-        registry.registerBeanDefinition("annotationSecurityAspect$0", aspect.getBeanDefinition());
+        if (enableAJAutoProxy.getBoolean("proxyTargetClass")) {
+            AopConfigUtils.forceAutoProxyCreatorToUseClassProxying(registry);
+        }
     }
 
 }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java

@@ -16,15 +16,23 @@
 package org.springframework.security.config.annotation.method.configuration;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
 
 import org.aopalliance.intercept.MethodInterceptor;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.springframework.aop.framework.ProxyFactoryBean;
+import org.springframework.aop.target.LazyInitTargetSource;
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.context.annotation.*;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.ImportAware;
+import org.springframework.context.annotation.Role;
 import org.springframework.core.annotation.AnnotationAttributes;
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.core.type.AnnotationMetadata;
@@ -45,7 +53,6 @@ import org.springframework.security.access.intercept.AfterInvocationProviderMana
 import org.springframework.security.access.intercept.RunAsManager;
 import org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor;
 import org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor;
-import org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor;
 import org.springframework.security.access.method.DelegatingMethodSecurityMetadataSource;
 import org.springframework.security.access.method.MethodSecurityMetadataSource;
 import org.springframework.security.access.prepost.PostInvocationAdviceProvider;
@@ -60,7 +67,6 @@ import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 import org.springframework.util.Assert;
 
 /**
@@ -75,6 +81,7 @@ import org.springframework.util.Assert;
 @Configuration
 public class GlobalMethodSecurityConfiguration implements ImportAware {
     private static final Log logger = LogFactory.getLog(GlobalMethodSecurityConfiguration.class);
+    private ApplicationContext context;
     private ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<Object>() {
         public <T> T postProcess(T object) {
             throw new IllegalStateException(ObjectPostProcessor.class.getName()+ " is a required bean. Ensure you have used @"+EnableGlobalMethodSecurity.class.getName());
@@ -86,7 +93,6 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
     private boolean disableAuthenticationRegistry;
     private AnnotationAttributes enableMethodSecurity;
     private MethodSecurityExpressionHandler expressionHandler;
-    private AuthenticationConfiguration authenticationConfiguration;
 
     /**
      * Creates the default MethodInterceptor which is a MethodSecurityInterceptor using the following methods to
@@ -109,7 +115,7 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
      */
     @Bean
     public MethodInterceptor methodSecurityInterceptor() throws Exception {
-        MethodSecurityInterceptor methodSecurityInterceptor = isAspectJ() ? new AspectJMethodSecurityInterceptor() : new MethodSecurityInterceptor();
+        MethodSecurityInterceptor methodSecurityInterceptor = new MethodSecurityInterceptor();
         methodSecurityInterceptor
                 .setAccessDecisionManager(accessDecisionManager());
         methodSecurityInterceptor
@@ -242,11 +248,19 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
             auth = new AuthenticationManagerBuilder(objectPostProcessor);
             auth.authenticationEventPublisher(eventPublisher);
             configure(auth);
-            if(disableAuthenticationRegistry) {
-                authenticationManager = getAuthenticationConfiguration().getAuthenticationManager();
-            } else {
+            if(!disableAuthenticationRegistry) {
                 authenticationManager = auth.build();
             }
+            if(authenticationManager == null) {
+                try {
+                    authenticationManager = context.getBean(AuthenticationManagerBuilder.class).getOrBuild();
+                } catch(NoSuchBeanDefinitionException e) {
+                    logger.debug("Could not obtain the AuthenticationManagerBuilder. This is ok for now, we will try using an AuthenticationManager directly",e);
+                }
+            }
+            if(authenticationManager == null) {
+                authenticationManager = lazyBean(AuthenticationManager.class);
+            }
         }
         return authenticationManager;
     }
@@ -337,6 +351,11 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
         this.defaultMethodExpressionHandler.setTrustResolver(trustResolver);
     }
 
+    @Autowired
+    public void setApplicationContext(ApplicationContext context) {
+        this.context = context;
+    }
+
     @Autowired(required=false)
     public void setObjectPostProcessor(ObjectPostProcessor<Object> objectPostProcessor) {
         this.objectPostProcessor = objectPostProcessor;
@@ -351,14 +370,17 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
         this.defaultMethodExpressionHandler.setPermissionEvaluator(permissionEvaluators.get(0));
     }
 
-    @Autowired(required = false)
-    public void setAuthenticationConfiguration(AuthenticationConfiguration authenticationConfiguration) {
-        this.authenticationConfiguration = authenticationConfiguration;
-    }
-
-    private AuthenticationConfiguration getAuthenticationConfiguration() {
-        Assert.notNull(authenticationConfiguration, "authenticationConfiguration cannot be null");
-        return authenticationConfiguration;
+    @SuppressWarnings("unchecked")
+    private <T> T lazyBean(Class<T> interfaceName) {
+        LazyInitTargetSource lazyTargetSource = new LazyInitTargetSource();
+        String[] beanNamesForType = context.getBeanNamesForType(interfaceName);
+        Assert.isTrue(beanNamesForType.length == 1 , "Expecting to only find a single bean for type " + interfaceName + ", but found " + Arrays.asList(beanNamesForType));
+        lazyTargetSource.setTargetBeanName(beanNamesForType[0]);
+        lazyTargetSource.setBeanFactory(context);
+        ProxyFactoryBean proxyFactory = new ProxyFactoryBean();
+        proxyFactory.setTargetSource(lazyTargetSource);
+        proxyFactory.setInterfaces(new Class[] { interfaceName });
+        return (T) proxyFactory.getObject();
     }
 
     private boolean prePostEnabled() {
@@ -377,10 +399,6 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
         return (Integer) enableMethodSecurity().get("order");
     }
 
-    private boolean isAspectJ() {
-        return enableMethodSecurity().getEnum("mode") == AdviceMode.ASPECTJ;
-    }
-
     private AnnotationAttributes enableMethodSecurity() {
         if (enableMethodSecurity == null) {
             // if it is null look at this instance (i.e. a subclass was used)
@@ -396,4 +414,5 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
         }
         return this.enableMethodSecurity;
     }
-}
+
+}

config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

@@ -1000,7 +1000,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
      *                 .and()
      *             .formLogin()
      *                 .and()
-     *             .requiresChannel()
+     *             .channelSecurity()
      *                 .anyRequest().requiresSecure();
      *     }
      *

config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java

@@ -280,10 +280,7 @@ public final class WebSecurity extends
 
     @Override
     protected Filter performBuild() throws Exception {
-        Assert.state(!securityFilterChainBuilders.isEmpty(),
-                "At least one SecurityBuilder<? extends SecurityFilterChain> needs to be specified. Typically this done by adding a @Configuration that extends WebSecurityConfigurerAdapter. More advanced users can invoke "
-                        + WebSecurity.class.getSimpleName()
-                        + ".addSecurityFilterChainBuilder directly");
+        Assert.state(!securityFilterChainBuilders.isEmpty(), "At least one SecurityFilterBuilder needs to be specified. Invoke FilterChainProxyBuilder.securityFilterChains");
         int chainSize = ignoredRequests.size() + securityFilterChainBuilders.size();
         List<SecurityFilterChain> securityFilterChains = new ArrayList<SecurityFilterChain>(chainSize);
         for(RequestMatcher ignoredRequest : ignoredRequests) {

config/src/main/java/org/springframework/security/config/annotation/web/configuration/AutowiredWebSecurityConfigurersIgnoreParents.java

@@ -1,58 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configuration;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-
-import javax.servlet.Filter;
-
-import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
-import org.springframework.context.ApplicationContext;
-import org.springframework.security.config.annotation.SecurityConfigurer;
-import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
-import org.springframework.security.config.annotation.web.builders.WebSecurity;
-import org.springframework.util.Assert;
-
-
-/**
- * A class used to get all the {@link WebSecurityConfigurer} instances from the
- * current {@link ApplicationContext} but ignoring the parent.
- *
- * @author Rob Winch
- *
- */
-final class AutowiredWebSecurityConfigurersIgnoreParents {
-
-    private final ConfigurableListableBeanFactory beanFactory;
-
-    public AutowiredWebSecurityConfigurersIgnoreParents(ConfigurableListableBeanFactory beanFactory) {
-        Assert.notNull(beanFactory,"beanFactory cannot be null");
-        this.beanFactory = beanFactory;
-    }
-
-    @SuppressWarnings({ "rawtypes", "unchecked" })
-    public List<SecurityConfigurer<Filter, WebSecurity>> getWebSecurityConfigurers() {
-        List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers = new ArrayList<SecurityConfigurer<Filter, WebSecurity>>();
-        Map<String, WebSecurityConfigurer> beansOfType = beanFactory.getBeansOfType(WebSecurityConfigurer.class);
-        for(Entry<String,WebSecurityConfigurer> entry : beansOfType.entrySet()) {
-            webSecurityConfigurers.add(entry.getValue());
-        }
-        return webSecurityConfigurers;
-    }
-}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/EnableWebSecurity.java

@@ -20,7 +20,7 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
 import org.springframework.context.annotation.Import;
-import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration;
 import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
 
@@ -77,8 +77,7 @@ import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
 @Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
 @Target(value={java.lang.annotation.ElementType.TYPE})
 @Documented
-@Import({WebSecurityConfiguration.class,ObjectPostProcessorConfiguration.class})
-@EnableGlobalAuthentication
+@Import({WebSecurityConfiguration.class,ObjectPostProcessorConfiguration.class,AuthenticationConfiguration.class, SpringWebMvcImportSelector.class})
 public @interface EnableWebSecurity {
 
     /**

config/src/main/java/org/springframework/security/config/annotation/web/configuration/SpringWebMvcImportSelector.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.web.configuration;
+
+import org.springframework.context.annotation.ImportSelector;
+import org.springframework.core.type.AnnotationMetadata;
+import org.springframework.util.ClassUtils;
+
+/**
+ * Used by {@link EnableWebSecurity} to conditionaly import
+ * {@link WebMvcSecurityConfiguration} when the DispatcherServlet is present on the
+ * classpath.
+ *
+ * @author Rob Winch
+ * @since 3.2
+ */
+class SpringWebMvcImportSelector implements ImportSelector {
+
+    /* (non-Javadoc)
+     * @see org.springframework.context.annotation.ImportSelector#selectImports(org.springframework.core.type.AnnotationMetadata)
+     */
+    public String[] selectImports(AnnotationMetadata importingClassMetadata) {
+        boolean webmvcPresent = ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet", getClass().getClassLoader());
+        return webmvcPresent ? new String[] {"org.springframework.security.config.annotation.web.configuration.WebMvcSecurityConfiguration"} : new String[] {};
+    }
+}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebMvcSecurityConfiguration.java

@@ -13,13 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.config.annotation.web.servlet.configuration;
+package org.springframework.security.config.annotation.web.configuration;
 
 import java.util.List;
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.web.bind.support.AuthenticationPrincipalArgumentResolver;
 import org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor;
 import org.springframework.web.method.support.HandlerMethodArgumentResolver;
@@ -39,8 +38,7 @@ import org.springframework.web.servlet.support.RequestDataValueProcessor;
  * @since 3.2
  */
 @Configuration
-@EnableWebSecurity
-public class WebMvcSecurityConfiguration extends WebMvcConfigurerAdapter {
+class WebMvcSecurityConfiguration extends WebMvcConfigurerAdapter {
 
     @Override
     public void addArgumentResolvers(
@@ -50,6 +48,6 @@ public class WebMvcSecurityConfiguration extends WebMvcConfigurerAdapter {
 
     @Bean
     public RequestDataValueProcessor requestDataValueProcessor() {
-        return new CsrfRequestDataValueProcessor();
+        return CsrfRequestDataValueProcessor.create();
     }
-}
+}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java

@@ -23,8 +23,6 @@ import javax.servlet.Filter;
 
 import org.springframework.beans.factory.BeanClassLoaderAware;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.DependsOn;
@@ -112,7 +110,7 @@ public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAwa
      */
     @Autowired(required = false)
     public void setFilterChainProxySecurityConfigurer(ObjectPostProcessor<Object> objectPostProcessor,
-            @Value("#{@autowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers()}") List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers) throws Exception {
+            List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers) throws Exception {
         webSecurity = objectPostProcessor.postProcess(new WebSecurity(objectPostProcessor));
         if(debugEnabled != null) {
             webSecurity.debug(debugEnabled);
@@ -134,10 +132,6 @@ public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAwa
         this.webSecurityConfigurers = webSecurityConfigurers;
     }
 
-    @Bean
-    public AutowiredWebSecurityConfigurersIgnoreParents autowiredWebSecurityConfigurersIgnoreParents(ConfigurableListableBeanFactory beanFactory) {
-        return new AutowiredWebSecurityConfigurersIgnoreParents(beanFactory);
-    }
 
     /**
      * A custom verision of the Spring provided AnnotationAwareOrderComparator

config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java

@@ -16,30 +16,20 @@
 package org.springframework.security.config.annotation.web.configuration;
 
 
-import java.lang.reflect.Field;
 import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
-import java.util.Set;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.springframework.aop.TargetSource;
-import org.springframework.aop.framework.Advised;
-import org.springframework.aop.target.LazyInitTargetSource;
-import org.springframework.beans.FatalBeanException;
-import org.springframework.beans.factory.BeanFactoryUtils;
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
-import org.springframework.core.annotation.Order;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
 import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.builders.WebSecurity;
@@ -52,8 +42,6 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
 import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;
-import org.springframework.util.Assert;
-import org.springframework.util.ReflectionUtils;
 import org.springframework.web.accept.ContentNegotiationStrategy;
 import org.springframework.web.accept.HeaderContentNegotiationStrategy;
 
@@ -65,7 +53,6 @@ import org.springframework.web.accept.HeaderContentNegotiationStrategy;
  *
  * @author Rob Winch
  */
-@Order(100)
 public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigurer<WebSecurity> {
     private final Log logger = LogFactory.getLog(WebSecurityConfigurerAdapter.class);
 
@@ -79,10 +66,9 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
         }
     };
 
-    private AuthenticationConfiguration authenticationConfiguration;
     private AuthenticationManagerBuilder authenticationBuilder;
-    private AuthenticationManagerBuilder localConfigureAuthenticationBldr;
-    private boolean disableLocalConfigureAuthenticationBldr;
+    private AuthenticationManagerBuilder parentAuthenticationBuilder;
+    private boolean disableAuthenticationRegistration;
     private boolean authenticationManagerInitialized;
     private AuthenticationManager authenticationManager;
     private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
@@ -158,7 +144,7 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
      * @throws Exception
      */
     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-        this.disableLocalConfigureAuthenticationBldr = true;
+        this.disableAuthenticationRegistration = true;
     }
 
     /**
@@ -173,11 +159,11 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
         }
 
         DefaultAuthenticationEventPublisher eventPublisher = objectPostProcessor.postProcess(new DefaultAuthenticationEventPublisher());
-        localConfigureAuthenticationBldr.authenticationEventPublisher(eventPublisher);
+        parentAuthenticationBuilder.authenticationEventPublisher(eventPublisher);
 
         AuthenticationManager authenticationManager = authenticationManager();
         authenticationBuilder.parentAuthenticationManager(authenticationManager);
-        http = new HttpSecurity(objectPostProcessor,authenticationBuilder, localConfigureAuthenticationBldr.getSharedObjects());
+        http = new HttpSecurity(objectPostProcessor,authenticationBuilder, parentAuthenticationBuilder.getSharedObjects());
         http.setSharedObject(UserDetailsService.class, userDetailsService());
         http.setSharedObject(ApplicationContext.class, context);
         http.setSharedObject(ContentNegotiationStrategy.class, contentNegotiationStrategy);
@@ -217,7 +203,7 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
      * @throws Exception
      */
     public AuthenticationManager authenticationManagerBean() throws Exception {
-        return new AuthenticationManagerDelegator(authenticationBuilder, context);
+        return new AuthenticationManagerDelegator(authenticationBuilder);
     }
 
     /**
@@ -231,11 +217,22 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
      */
     protected AuthenticationManager authenticationManager() throws Exception {
         if(!authenticationManagerInitialized) {
-            configure(localConfigureAuthenticationBldr);
-            if(disableLocalConfigureAuthenticationBldr) {
-                authenticationManager = authenticationConfiguration.getAuthenticationManager();
+            configure(parentAuthenticationBuilder);
+            if(disableAuthenticationRegistration) {
+                try {
+                    authenticationManager = context.getBean(AuthenticationManagerBuilder.class).getOrBuild();
+                } catch(NoSuchBeanDefinitionException e) {
+                    logger.debug("Could not obtain the AuthenticationManagerBuilder. This is ok for now, we will try using an AuthenticationManager directly",e);
+                }
+                if(authenticationManager == null) {
+                    try {
+                        authenticationManager = context.getBean(AuthenticationManager.class);
+                    } catch(NoSuchBeanDefinitionException e) {
+                        logger.debug("The AuthenticationManager was not found. This is ok for now as it may not be required.",e);
+                    }
+                }
             } else {
-                authenticationManager = localConfigureAuthenticationBldr.build();
+                authenticationManager = parentAuthenticationBuilder.build();
             }
             authenticationManagerInitialized = true;
         }
@@ -263,7 +260,7 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
      */
     public UserDetailsService userDetailsServiceBean() throws Exception {
         AuthenticationManagerBuilder globalAuthBuilder = context.getBean(AuthenticationManagerBuilder.class);
-        return new UserDetailsServiceDelegator(Arrays.asList(localConfigureAuthenticationBldr, globalAuthBuilder));
+        return new UserDetailsServiceDelegator(Arrays.asList(parentAuthenticationBuilder, globalAuthBuilder));
     }
 
     /**
@@ -276,7 +273,7 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
      */
     protected UserDetailsService userDetailsService() {
         AuthenticationManagerBuilder globalAuthBuilder = context.getBean(AuthenticationManagerBuilder.class);
-        return new UserDetailsServiceDelegator(Arrays.asList(localConfigureAuthenticationBldr, globalAuthBuilder));
+        return new UserDetailsServiceDelegator(Arrays.asList(parentAuthenticationBuilder, globalAuthBuilder));
     }
 
     public void init(final WebSecurity web) throws Exception {
@@ -342,12 +339,12 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
         this.contentNegotiationStrategy = contentNegotiationStrategy;
     }
 
-    @Autowired
+    @Autowired(required=false)
     public void setObjectPostProcessor(ObjectPostProcessor<Object> objectPostProcessor) {
         this.objectPostProcessor = objectPostProcessor;
 
         authenticationBuilder = new AuthenticationManagerBuilder(objectPostProcessor);
-        localConfigureAuthenticationBldr = new AuthenticationManagerBuilder(objectPostProcessor) {
+        parentAuthenticationBuilder = new AuthenticationManagerBuilder(objectPostProcessor) {
             @Override
             public AuthenticationManagerBuilder eraseCredentials(boolean eraseCredentials) {
                 authenticationBuilder.eraseCredentials(eraseCredentials);
@@ -357,10 +354,6 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
         };
     }
 
-    @Autowired
-    public void setAuthenticationConfiguration(AuthenticationConfiguration authenticationConfiguration) {
-        this.authenticationConfiguration = authenticationConfiguration;
-    }
 
     /**
      * Delays the use of the {@link UserDetailsService} from the
@@ -420,15 +413,9 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
         private AuthenticationManagerBuilder delegateBuilder;
         private AuthenticationManager delegate;
         private final Object delegateMonitor = new Object();
-        private Set<String> beanNames;
 
-        AuthenticationManagerDelegator(AuthenticationManagerBuilder delegateBuilder, ApplicationContext context) {
-            Assert.notNull(delegateBuilder,"delegateBuilder cannot be null");
-            Field parentAuthMgrField = ReflectionUtils.findField(AuthenticationManagerBuilder.class, "parentAuthenticationManager");
-            ReflectionUtils.makeAccessible(parentAuthMgrField);
-            beanNames = getAuthenticationManagerBeanNames(context);
-            validateBeanCycle(ReflectionUtils.getField(parentAuthMgrField, delegateBuilder), beanNames);
-            this.delegateBuilder = delegateBuilder;
+        AuthenticationManagerDelegator(AuthenticationManagerBuilder authentication) {
+            this.delegateBuilder = authentication;
         }
 
         public Authentication authenticate(Authentication authentication) throws AuthenticationException {
@@ -445,26 +432,5 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
 
             return delegate.authenticate(authentication);
         }
-
-        private static Set<String> getAuthenticationManagerBeanNames(ApplicationContext applicationContext) {
-             String[] beanNamesForType = BeanFactoryUtils.beanNamesForTypeIncludingAncestors(applicationContext, AuthenticationManager.class);
-             return new HashSet<String>(Arrays.asList(beanNamesForType));
-        }
-
-        private static void validateBeanCycle(Object auth, Set<String> beanNames) {
-            if(auth != null && !beanNames.isEmpty()) {
-                if(auth instanceof Advised){
-                    Advised advised = (Advised) auth;
-                    TargetSource targetSource = advised.getTargetSource();
-                    if(targetSource instanceof LazyInitTargetSource) {
-                        LazyInitTargetSource lits = (LazyInitTargetSource) targetSource;
-                        if(beanNames.contains(lits.getTargetBeanName())) {
-                            throw new FatalBeanException("A dependency cycle was detected when trying to resolve the AuthenticationManager. Please ensure you have configured authentication.");
-                        }
-                    }
-                }
-                beanNames = Collections.emptySet();
-            }
-        }
     }
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java

@@ -15,22 +15,14 @@
  */
 package org.springframework.security.config.annotation.web.configurers;
 
-import java.util.LinkedHashMap;
-
-import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.web.access.AccessDeniedHandler;
-import org.springframework.security.web.access.AccessDeniedHandlerImpl;
-import org.springframework.security.web.access.DelegatingAccessDeniedHandler;
 import org.springframework.security.web.csrf.CsrfAuthenticationStrategy;
 import org.springframework.security.web.csrf.CsrfFilter;
 import org.springframework.security.web.csrf.CsrfLogoutHandler;
 import org.springframework.security.web.csrf.CsrfTokenRepository;
 import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
-import org.springframework.security.web.csrf.MissingCsrfTokenException;
-import org.springframework.security.web.session.InvalidSessionAccessDeniedHandler;
-import org.springframework.security.web.session.InvalidSessionStrategy;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 
@@ -58,7 +50,6 @@ import org.springframework.util.Assert;
  * <li>
  * {@link ExceptionHandlingConfigurer#accessDeniedHandler(AccessDeniedHandler)}
  * is used to determine how to handle CSRF attempts</li>
- * <li>{@link InvalidSessionStrategy}</li>
  * </ul>
  *
  * @author Rob Winch
@@ -109,9 +100,12 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>> extends Abst
         if(requireCsrfProtectionMatcher != null) {
             filter.setRequireCsrfProtectionMatcher(requireCsrfProtectionMatcher);
         }
-        AccessDeniedHandler accessDeniedHandler = createAccessDeniedHandler(http);
-        if(accessDeniedHandler != null) {
-            filter.setAccessDeniedHandler(accessDeniedHandler);
+        ExceptionHandlingConfigurer<H> exceptionConfig = http.getConfigurer(ExceptionHandlingConfigurer.class);
+        if(exceptionConfig != null) {
+            AccessDeniedHandler accessDeniedHandler = exceptionConfig.getAccessDeniedHandler();
+            if(accessDeniedHandler != null) {
+                filter.setAccessDeniedHandler(accessDeniedHandler);
+            }
         }
         LogoutConfigurer<H> logoutConfigurer = http.getConfigurer(LogoutConfigurer.class);
         if(logoutConfigurer != null) {
@@ -124,70 +118,4 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>> extends Abst
         filter = postProcess(filter);
         http.addFilter(filter);
     }
-
-    /**
-     * Gets the default {@link AccessDeniedHandler} from the
-     * {@link ExceptionHandlingConfigurer#getAccessDeniedHandler()} or create a
-     * {@link AccessDeniedHandlerImpl} if not available.
-     *
-     * @param http the {@link HttpSecurityBuilder}
-     * @return the {@link AccessDeniedHandler}
-     */
-    @SuppressWarnings("unchecked")
-    private AccessDeniedHandler getDefaultAccessDeniedHandler(H http) {
-        ExceptionHandlingConfigurer<H> exceptionConfig = http.getConfigurer(ExceptionHandlingConfigurer.class);
-        AccessDeniedHandler handler = null;
-        if(exceptionConfig != null) {
-            handler = exceptionConfig.getAccessDeniedHandler();
-        }
-        if(handler == null) {
-            handler = new AccessDeniedHandlerImpl();
-        }
-        return handler;
-    }
-
-    /**
-     * Gets the default {@link InvalidSessionStrategy} from the
-     * {@link SessionManagementConfigurer#getInvalidSessionStrategy()} or null
-     * if not available.
-     *
-     * @param http
-     *            the {@link HttpSecurityBuilder}
-     * @return the {@link InvalidSessionStrategy}
-     */
-    @SuppressWarnings("unchecked")
-    private InvalidSessionStrategy getInvalidSessionStrategy(H http) {
-        SessionManagementConfigurer<H> sessionManagement = http.getConfigurer(SessionManagementConfigurer.class);
-        if(sessionManagement == null) {
-            return null;
-        }
-        return sessionManagement.getInvalidSessionStrategy();
-    }
-
-    /**
-     * Creates the {@link AccessDeniedHandler} from the result of
-     * {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} and
-     * {@link #getInvalidSessionStrategy(HttpSecurityBuilder)}. If
-     * {@link #getInvalidSessionStrategy(HttpSecurityBuilder)} is non-null, then
-     * a {@link DelegatingAccessDeniedHandler} is used in combination with
-     * {@link InvalidSessionAccessDeniedHandler} and the
-     * {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)}. Otherwise,
-     * only {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} is used.
-     *
-     * @param http the {@link HttpSecurityBuilder}
-     * @return the {@link AccessDeniedHandler}
-     */
-    private AccessDeniedHandler createAccessDeniedHandler(H http) {
-        InvalidSessionStrategy invalidSessionStrategy = getInvalidSessionStrategy(http);
-        AccessDeniedHandler defaultAccessDeniedHandler = getDefaultAccessDeniedHandler(http);
-        if(invalidSessionStrategy == null) {
-            return defaultAccessDeniedHandler;
-        }
-
-        InvalidSessionAccessDeniedHandler invalidSessionDeniedHandler = new InvalidSessionAccessDeniedHandler(invalidSessionStrategy);
-        LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler> handlers =
-                new LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler>();
-        handlers.put(MissingCsrfTokenException.class, invalidSessionDeniedHandler);
-        return new DelegatingAccessDeniedHandler(handlers, defaultAccessDeniedHandler);
-    }
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java

@@ -132,11 +132,13 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
      *
      * @param requestMatchers the {@link RequestMatcher} instances to register to the {@link ConfigAttribute} instances
      * @param configAttributes the {@link ConfigAttribute} to be mapped by the {@link RequestMatcher} instances
+     * @return the {@link ExpressionUrlAuthorizationConfigurer} for further customization.
      */
-    private void interceptUrl(Iterable<? extends RequestMatcher> requestMatchers, Collection<ConfigAttribute> configAttributes) {
+    private ExpressionUrlAuthorizationConfigurer<H> interceptUrl(Iterable<? extends RequestMatcher> requestMatchers, Collection<ConfigAttribute> configAttributes) {
         for(RequestMatcher requestMatcher : requestMatchers) {
             REGISTRY.addMapping(new AbstractConfigAttributeRequestMatcherRegistry.UrlMapping(requestMatcher, configAttributes));
         }
+        return null;
     }
 
     @Override

config/src/main/java/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.java

@@ -294,9 +294,7 @@ public final class LogoutConfigurer<H extends HttpSecurityBuilder<H>> extends Ab
         }
         if(http.getConfigurer(CsrfConfigurer.class) != null) {
             this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl, "POST");
-        } else {
-            this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl);
         }
-        return this.logoutRequestMatcher;
+        return new AntPathRequestMatcher(this.logoutUrl);
     }
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurer.java

@@ -15,9 +15,7 @@
  */
 package org.springframework.security.config.annotation.web.configurers;
 
-import java.util.ArrayList;
 import java.util.Collections;
-import java.util.List;
 
 import org.springframework.http.MediaType;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
@@ -116,13 +114,12 @@ public final class RequestCacheConfigurer<H extends HttpSecurityBuilder<H>> exte
         return defaultCache;
     }
 
-    @SuppressWarnings("unchecked")
     private RequestMatcher createDefaultSavedRequestMatcher(H http) {
         ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
         if(contentNegotiationStrategy == null) {
             contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
         }
-
+        RequestMatcher getRequests = new AntPathRequestMatcher("/**", "GET");
         RequestMatcher notFavIcon = new NegatedRequestMatcher(new AntPathRequestMatcher("/**/favicon.ico"));
 
         MediaTypeRequestMatcher jsonRequest = new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.APPLICATION_JSON);
@@ -130,18 +127,6 @@ public final class RequestCacheConfigurer<H extends HttpSecurityBuilder<H>> exte
         RequestMatcher notJson = new NegatedRequestMatcher(jsonRequest);
 
         RequestMatcher notXRequestedWith = new NegatedRequestMatcher(new RequestHeaderRequestMatcher("X-Requested-With","XMLHttpRequest"));
-
-        boolean isCsrfEnabled = http.getConfigurer(CsrfConfigurer.class) != null;
-
-        List<RequestMatcher> matchers = new ArrayList<RequestMatcher>();
-        if(isCsrfEnabled) {
-            RequestMatcher getRequests = new AntPathRequestMatcher("/**", "GET");
-            matchers.add(0, getRequests);
-        }
-        matchers.add(notFavIcon);
-        matchers.add(notJson);
-        matchers.add(notXRequestedWith);
-
-        return new AndRequestMatcher(matchers);
+        return new AndRequestMatcher(getRequests, notFavIcon, notJson, notXRequestedWith);
     }
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java

@@ -42,7 +42,6 @@ import org.springframework.security.web.context.SecurityContextRepository;
 import org.springframework.security.web.savedrequest.NullRequestCache;
 import org.springframework.security.web.savedrequest.RequestCache;
 import org.springframework.security.web.session.ConcurrentSessionFilter;
-import org.springframework.security.web.session.InvalidSessionStrategy;
 import org.springframework.security.web.session.SessionManagementFilter;
 import org.springframework.security.web.session.SimpleRedirectInvalidSessionStrategy;
 import org.springframework.util.Assert;
@@ -67,7 +66,6 @@ import org.springframework.util.Assert;
  * <li>{@link RequestCache}</li>
  * <li>{@link SecurityContextRepository}</li>
  * <li>{@link SessionManagementConfigurer}</li>
- * <li>{@link InvalidSessionStrategy}</li>
  * </ul>
  *
  * <h2>Shared Objects Used</h2>
@@ -85,7 +83,6 @@ import org.springframework.util.Assert;
 public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractHttpConfigurer<SessionManagementConfigurer<H>,H> {
     private SessionAuthenticationStrategy sessionFixationAuthenticationStrategy = createDefaultSessionFixationProtectionStrategy();
     private SessionAuthenticationStrategy sessionAuthenticationStrategy;
-    private InvalidSessionStrategy invalidSessionStrategy;
     private List<SessionAuthenticationStrategy> sessionAuthenticationStrategies = new ArrayList<SessionAuthenticationStrategy>();
     private SessionRegistry sessionRegistry = new SessionRegistryImpl();
     private Integer maximumSessions;
@@ -368,7 +365,6 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
             }
         }
         http.setSharedObject(SessionAuthenticationStrategy.class, getSessionAuthenticationStrategy());
-        http.setSharedObject(InvalidSessionStrategy.class, getInvalidSessionStrategy());
     }
 
     @Override
@@ -379,7 +375,7 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
             sessionManagementFilter.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler(sessionAuthenticationErrorUrl));
         }
         if(invalidSessionUrl != null) {
-            sessionManagementFilter.setInvalidSessionStrategy(getInvalidSessionStrategy());
+            sessionManagementFilter.setInvalidSessionStrategy(new SimpleRedirectInvalidSessionStrategy(invalidSessionUrl));
         }
         AuthenticationTrustResolver trustResolver = http.getSharedObject(AuthenticationTrustResolver.class);
         if(trustResolver != null) {
@@ -395,23 +391,6 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
         }
     }
 
-    /**
-     * Gets the {@link InvalidSessionStrategy} to use. If
-     * {@link #invalidSessionUrl} is null, returns null otherwise
-     * {@link SimpleRedirectInvalidSessionStrategy} is used.
-     *
-     * @return the {@link InvalidSessionStrategy} to use
-     */
-    InvalidSessionStrategy getInvalidSessionStrategy() {
-        if(invalidSessionUrl == null) {
-            return null;
-        }
-        if(invalidSessionStrategy == null) {
-            invalidSessionStrategy = new SimpleRedirectInvalidSessionStrategy(invalidSessionUrl);
-        }
-        return invalidSessionStrategy;
-    }
-
     /**
      * Gets the {@link SessionCreationPolicy}. Can not be null.
      * @return the {@link SessionCreationPolicy}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurer.java

@@ -27,7 +27,6 @@ import org.springframework.security.access.vote.AuthenticatedVoter;
 import org.springframework.security.access.vote.RoleVoter;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource;
 import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
 import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -49,10 +48,10 @@ import org.springframework.util.Assert;
  * <pre>
  * protected void configure(HttpSecurity http) throws Exception {
  *     http
- *          .apply(new UrlAuthorizationConfigurer<HttpSecurity>()).getRegistry()
- *              .antMatchers("/users**","/sessions/**").hasRole("USER")
- *              .antMatchers("/signup").hasRole("ANONYMOUS")
- *              .anyRequest().hasRole("USER");
+ *         .apply(new UrlAuthorizationConfigurer()).getRegistry()
+ *             .antMatchers("/users**","/sessions/**").hasRole("USER")
+ *             .antMatchers("/signup").hasRole("ANONYMOUS")
+ *             .anyRequest().hasRole("USER")
  * }
  * </pre>
  *

config/src/main/java/org/springframework/security/config/annotation/web/messaging/MessageSecurityMetadataSourceRegistry.java

@@ -1,303 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-package org.springframework.security.config.annotation.web.messaging;
-
-import org.springframework.messaging.Message;
-import org.springframework.security.config.annotation.web.configurers.RememberMeConfigurer;
-import org.springframework.security.messaging.access.expression.ExpressionBasedMessageSecurityMetadataSourceFactory;
-import org.springframework.security.messaging.access.intercept.MessageSecurityMetadataSource;
-import org.springframework.security.messaging.util.matcher.MessageMatcher;
-import org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher;
-import org.springframework.util.AntPathMatcher;
-import org.springframework.util.Assert;
-import org.springframework.util.PathMatcher;
-import org.springframework.util.StringUtils;
-
-import java.util.*;
-
-/**
- * Allows mapping security constraints using {@link MessageMatcher} to the security expressions.
- *
- * @since 4.0
- * @author Rob Winch
- */
-public class MessageSecurityMetadataSourceRegistry {
-    private static final String permitAll = "permitAll";
-    private static final String denyAll = "denyAll";
-    private static final String anonymous = "anonymous";
-    private static final String authenticated = "authenticated";
-    private static final String fullyAuthenticated = "fullyAuthenticated";
-    private static final String rememberMe = "rememberMe";
-
-    private final LinkedHashMap<MatcherBuilder,String> matcherToExpression = new LinkedHashMap<MatcherBuilder,String>();
-
-    private PathMatcher pathMatcher = new AntPathMatcher();
-
-    /**
-     * Maps any {@link Message} to a security expression.
-     *
-     * @return the Expression to associate
-     */
-    public Constraint anyMessage() {
-        return matchers(MessageMatcher.ANY_MESSAGE);
-    }
-
-    /**
-     * Maps a {@link List} of {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher} instances.
-     *
-     * @param patterns the patterns to create {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher}
-     *                    from. Uses {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}.
-     *
-     * @return the {@link Constraint}  that is associated to the {@link MessageMatcher}
-     * @see {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)} 
-     */
-    public Constraint destinationMatchers(String... patterns) {
-        List<MatcherBuilder> matchers = new ArrayList<MatcherBuilder>(patterns.length);
-        for(String pattern : patterns) {
-            matchers.add(new PathMatcherMessageMatcherBuilder(pattern));
-        }
-        return new Constraint(matchers);
-    }
-
-    /**
-     * The {@link PathMatcher} to be used with the {@link MessageSecurityMetadataSourceRegistry#destinationMatchers(String...)}.
-     * The default is to use the default constructor of {@link AntPathMatcher}.
-     *
-     * @param pathMatcher the {@link PathMatcher} to use. Cannot be null.
-     * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization.
-     */
-    public MessageSecurityMetadataSourceRegistry pathMatcher(PathMatcher pathMatcher) {
-        Assert.notNull(pathMatcher, "pathMatcher cannot be null");
-        this.pathMatcher = pathMatcher;
-        return this;
-    }
-
-    /**
-     * Maps a {@link List} of {@link MessageMatcher} instances to a security expression.
-     *
-     * @param matchers the {@link MessageMatcher} instances to map.
-     * @return The {@link Constraint} that is associated to the {@link MessageMatcher} instances
-     */
-    public Constraint matchers(MessageMatcher<?>... matchers) {
-        List<MatcherBuilder> builders = new ArrayList<MatcherBuilder>(matchers.length);
-        for(MessageMatcher<?> matcher : matchers) {
-            builders.add(new PreBuiltMatcherBuilder(matcher));
-        }
-        return new Constraint(builders);
-    }
-
-    /**
-     * Allows subclasses to create creating a {@link MessageSecurityMetadataSource}.
-     *
-     * <p>This is not exposed so as not to confuse users of the API, which should never invoke this method.</p>
-     *
-     * @return the {@link MessageSecurityMetadataSource} to use
-     */
-    protected MessageSecurityMetadataSource createMetadataSource() {
-        LinkedHashMap<MessageMatcher<?>,String> matcherToExpression = new LinkedHashMap<MessageMatcher<?>,String>();
-        for(Map.Entry<MatcherBuilder,String> entry : this.matcherToExpression.entrySet()) {
-            matcherToExpression.put(entry.getKey().build(), entry.getValue());
-        }
-        return ExpressionBasedMessageSecurityMetadataSourceFactory.createExpressionMessageMetadataSource(matcherToExpression);
-    }
-
-    /**
-     * Represents the security constraint to be applied to the {@link MessageMatcher} instances.
-     */
-    public class Constraint {
-        private final List<MatcherBuilder> messageMatchers;
-
-        /**
-         * Creates a new instance
-         *
-         * @param messageMatchers the {@link MessageMatcher} instances to map to this constraint
-         */
-        private Constraint(List<MatcherBuilder> messageMatchers) {
-            Assert.notEmpty(messageMatchers, "messageMatchers cannot be null or empty");
-            this.messageMatchers = messageMatchers;
-        }
-
-        /**
-         * Shortcut for specifying {@link Message} instances require a particular role. If you do not want to have "ROLE_" automatically
-         * inserted see {@link #hasAuthority(String)}.
-         *
-         * @param role the role to require (i.e. USER, ADMIN, etc). Note, it should not start with "ROLE_" as
-         *             this is automatically inserted.
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasRole(String role) {
-            return access(MessageSecurityMetadataSourceRegistry.hasRole(role));
-        }
-
-        /**
-         * Shortcut for specifying {@link Message} instances require any of a number of roles. If you
-         * do not want to have "ROLE_" automatically inserted see
-         * {@link #hasAnyAuthority(String...)}
-         *
-         * @param roles
-         *            the roles to require (i.e. USER, ADMIN, etc). Note, it
-         *            should not start with "ROLE_" as this is automatically
-         *            inserted.
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further
-         *         customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasAnyRole(String... roles) {
-            return access(MessageSecurityMetadataSourceRegistry.hasAnyRole(roles));
-        }
-
-        /**
-         * Specify that {@link Message} instances require a particular authority.
-         *
-         * @param authority the authority to require (i.e. ROLE_USER, ROLE_ADMIN, etc).
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasAuthority(String authority) {
-            return access(MessageSecurityMetadataSourceRegistry.hasAuthority(authority));
-        }
-
-        /**
-         * Specify that {@link Message} instances requires any of a number authorities.
-         *
-         * @param authorities the requests require at least one of the authorities (i.e. "ROLE_USER","ROLE_ADMIN" would
-         *                    mean either "ROLE_USER" or "ROLE_ADMIN" is required).
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasAnyAuthority(String... authorities) {
-            return access(MessageSecurityMetadataSourceRegistry.hasAnyAuthority(authorities));
-        }
-
-        /**
-         * Specify that Messages are allowed by anyone.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry permitAll() {
-            return access(permitAll);
-        }
-
-        /**
-         * Specify that Messages are allowed by anonymous users.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry anonymous() {
-            return access(anonymous);
-        }
-
-        /**
-         * Specify that Messages are allowed by users that have been remembered.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         * @see {@link RememberMeConfigurer}
-         */
-        public MessageSecurityMetadataSourceRegistry rememberMe() {
-            return access(rememberMe);
-        }
-
-        /**
-         * Specify that Messages are not allowed by anyone.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry denyAll() {
-            return access(denyAll);
-        }
-
-        /**
-         * Specify that Messages are allowed by any authenticated user.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry authenticated() {
-            return access(authenticated);
-        }
-
-        /**
-         * Specify that Messages are allowed by users who have authenticated and were not "remembered".
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         * @see {@link RememberMeConfigurer}
-         */
-        public MessageSecurityMetadataSourceRegistry fullyAuthenticated() {
-            return access(fullyAuthenticated);
-        }
-
-        /**
-         * Allows specifying that Messages are secured by an arbitrary expression
-         *
-         * @param attribute the expression to secure the URLs (i.e. "hasRole('ROLE_USER') and hasRole('ROLE_SUPER')")
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry access(String attribute) {
-            for(MatcherBuilder messageMatcher : messageMatchers) {
-                matcherToExpression.put(messageMatcher, attribute);
-            }
-            return MessageSecurityMetadataSourceRegistry.this;
-        }
-    }
-
-    private static String hasAnyRole(String... authorities) {
-        String anyAuthorities = StringUtils.arrayToDelimitedString(authorities, "','ROLE_");
-        return "hasAnyRole('ROLE_" + anyAuthorities + "')";
-    }
-
-    private static String hasRole(String role) {
-        Assert.notNull(role, "role cannot be null");
-        if (role.startsWith("ROLE_")) {
-            throw new IllegalArgumentException("role should not start with 'ROLE_' since it is automatically inserted. Got '" + role + "'");
-        }
-        return "hasRole('ROLE_" + role + "')";
-    }
-
-    private static String hasAuthority(String authority) {
-        return "hasAuthority('" + authority + "')";
-    }
-
-    private static String hasAnyAuthority(String... authorities) {
-        String anyAuthorities = StringUtils.arrayToDelimitedString(authorities, "','");
-        return "hasAnyAuthority('" + anyAuthorities + "')";
-    }
-
-    private class PreBuiltMatcherBuilder implements MatcherBuilder {
-        private MessageMatcher<?> matcher;
-
-        private PreBuiltMatcherBuilder(MessageMatcher<?> matcher) {
-            this.matcher = matcher;
-        }
-
-        @Override
-        public MessageMatcher<?> build() {
-            return matcher;
-        }
-    }
-
-    private class PathMatcherMessageMatcherBuilder implements MatcherBuilder {
-        private final String pattern;
-
-        private PathMatcherMessageMatcherBuilder(String pattern) {
-            this.pattern = pattern;
-        }
-
-        @Override
-        public MessageMatcher<?> build() {
-            return new SimpDestinationMessageMatcher(pattern, pathMatcher);
-        }
-    }
-
-    private interface MatcherBuilder {
-        MessageMatcher<?> build();
-    }
-}

config/src/main/java/org/springframework/security/config/annotation/web/servlet/configuration/EnableWebMvcSecurity.java

@@ -1,39 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.servlet.configuration;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.Retention;
-import java.lang.annotation.Target;
-
-import org.springframework.context.annotation.Import;
-import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
-
-
-/**
- * Add this annotation to an {@code @Configuration} class to have the Spring Security
- * configuration integrate with Spring MVC.
- *
- * @author Rob Winch
- * @since 3.2
- */
-@Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
-@Target(value={java.lang.annotation.ElementType.TYPE})
-@Documented
-@Import(WebMvcSecurityConfiguration.class)
-@EnableGlobalAuthentication
-public @interface EnableWebMvcSecurity {
-}

config/src/main/java/org/springframework/security/config/annotation/web/socket/AbstractSecurityWebSocketMessageBrokerConfigurer.java

@@ -1,112 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-package org.springframework.security.config.annotation.web.socket;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.core.Ordered;
-import org.springframework.core.annotation.Order;
-import org.springframework.messaging.simp.config.ChannelRegistration;
-import org.springframework.security.access.AccessDecisionVoter;
-import org.springframework.security.access.vote.AffirmativeBased;
-import org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry;
-import org.springframework.security.messaging.access.expression.ExpressionBasedMessageSecurityMetadataSourceFactory;
-import org.springframework.security.messaging.access.expression.MessageExpressionVoter;
-import org.springframework.security.messaging.access.intercept.ChannelSecurityInterceptor;
-import org.springframework.security.messaging.access.intercept.MessageSecurityMetadataSource;
-import org.springframework.security.messaging.context.SecurityContextChannelInterceptor;
-import org.springframework.security.messaging.util.matcher.MessageMatcher;
-import org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher;
-import org.springframework.web.socket.config.annotation.AbstractWebSocketMessageBrokerConfigurer;
-import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
-
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-
-/**
- * Allows configuring WebSocket Authorization.
- *
- * <p>For example:</p>
- *
- * <pre>
- * @Configuration
- * public class WebSocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer {
- *
- *   @Override
- *   protected void configure(MessageSecurityMetadataSourceRegistry messages) {
- *     messages
- *       .destinationMatchers("/user/queue/errors").permitAll()
- *       .destinationMatchers("/admin/**").hasRole("ADMIN")
- *       .anyMessage().authenticated();
- *   }
- * }
- * </pre>
- *
- *
- * @since 4.0
- * @author Rob Winch
- */
-@Order(Ordered.HIGHEST_PRECEDENCE + 100)
-public abstract class AbstractSecurityWebSocketMessageBrokerConfigurer extends AbstractWebSocketMessageBrokerConfigurer {
-
-    @Override
-    public void registerStompEndpoints(StompEndpointRegistry registry) {}
-
-    @Override
-    public void configureClientInboundChannel(ChannelRegistration registration) {
-        registration.setInterceptors(securityContextChannelInterceptor(),channelSecurity());
-    }
-
-    @Override
-    public void configureClientOutboundChannel(ChannelRegistration registration) {
-        registration.setInterceptors(securityContextChannelInterceptor(),channelSecurity());
-    }
-
-    @Bean
-    public ChannelSecurityInterceptor channelSecurity() {
-        ChannelSecurityInterceptor channelSecurityInterceptor = new ChannelSecurityInterceptor(metadataSource());
-        List<AccessDecisionVoter> voters = new ArrayList<AccessDecisionVoter>();
-        voters.add(new MessageExpressionVoter());
-        AffirmativeBased manager = new AffirmativeBased(voters);
-        channelSecurityInterceptor.setAccessDecisionManager(manager);
-        return channelSecurityInterceptor;
-    }
-
-    @Bean
-    public SecurityContextChannelInterceptor securityContextChannelInterceptor() {
-        return new SecurityContextChannelInterceptor();
-    }
-
-    @Bean
-    public MessageSecurityMetadataSource metadataSource() {
-        WebSocketMessageSecurityMetadataSourceRegistry registry = new WebSocketMessageSecurityMetadataSourceRegistry();
-        configure(registry);
-        return registry.createMetadataSource();
-    }
-
-    /**
-     *
-     * @param messages
-     */
-    protected abstract void configure(MessageSecurityMetadataSourceRegistry messages);
-
-    private class WebSocketMessageSecurityMetadataSourceRegistry extends MessageSecurityMetadataSourceRegistry {
-        @Override
-        public MessageSecurityMetadataSource createMetadataSource() {
-            return super.createMetadataSource();
-        }
-    }
-}

config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java

@@ -128,9 +128,6 @@ final class AuthenticationConfigBuilder {
     private final BeanReference portResolver;
     private final BeanMetadataElement csrfLogoutHandler;
 
-    private String loginProcessingUrl;
-    private String openidLoginProcessingUrl;
-
     public AuthenticationConfigBuilder(Element element, ParserContext pc, SessionCreationPolicy sessionPolicy,
             BeanReference requestCache, BeanReference authenticationManager, BeanReference sessionStrategy, BeanReference portMapper, BeanReference portResolver, BeanMetadataElement csrfLogoutHandler) {
         this.httpElt = element;
@@ -200,7 +197,6 @@ final class AuthenticationConfigBuilder {
             parser.parse(formLoginElt, pc);
             formFilter = parser.getFilterBean();
             formEntryPoint = parser.getEntryPointBean();
-            loginProcessingUrl = parser.getLoginProcessingUrl();
         }
 
         if (formFilter != null) {
@@ -225,7 +221,6 @@ final class AuthenticationConfigBuilder {
             parser.parse(openIDLoginElt, pc);
             openIDFilter = parser.getFilterBean();
             openIDEntryPoint = parser.getEntryPointBean();
-            openidLoginProcessingUrl = parser.getLoginProcessingUrl();
 
             List<Element> attrExElts = DomUtils.getChildElementsByTagName(openIDLoginElt, Elements.OPENID_ATTRIBUTE_EXCHANGE);
 
@@ -478,12 +473,10 @@ final class AuthenticationConfigBuilder {
 
             if (formFilterId != null) {
                 loginPageFilter.addConstructorArgReference(formFilterId);
-                loginPageFilter.addPropertyValue("authenticationUrl", loginProcessingUrl);
             }
 
             if (openIDFilterId != null) {
                 loginPageFilter.addConstructorArgReference(openIDFilterId);
-                loginPageFilter.addPropertyValue("openIDauthenticationUrl", openidLoginProcessingUrl);
             }
 
             loginPageGenerationFilter = loginPageFilter.getBeanDefinition();

config/src/main/java/org/springframework/security/config/http/CsrfBeanDefinitionParser.java

@@ -15,26 +15,17 @@
  */
 package org.springframework.security.config.http;
 
-import org.springframework.beans.BeanMetadataElement;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.parsing.BeanComponentDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.ManagedMap;
 import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.springframework.beans.factory.xml.ParserContext;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
-import org.springframework.security.web.access.AccessDeniedHandler;
-import org.springframework.security.web.access.DelegatingAccessDeniedHandler;
 import org.springframework.security.web.csrf.CsrfAuthenticationStrategy;
 import org.springframework.security.web.csrf.CsrfFilter;
 import org.springframework.security.web.csrf.CsrfLogoutHandler;
 import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
-import org.springframework.security.web.csrf.MissingCsrfTokenException;
 import org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor;
-import org.springframework.security.web.session.InvalidSessionAccessDeniedHandler;
-import org.springframework.security.web.session.InvalidSessionStrategy;
 import org.springframework.util.ClassUtils;
 import org.springframework.util.StringUtils;
 import org.w3c.dom.Element;
@@ -53,12 +44,12 @@ public class CsrfBeanDefinitionParser implements BeanDefinitionParser {
     private static final String ATT_REPOSITORY = "token-repository-ref";
 
     private String csrfRepositoryRef;
-    private BeanDefinition csrfFilter;
 
     public BeanDefinition parse(Element element, ParserContext pc) {
         boolean webmvcPresent = ClassUtils.isPresent(DISPATCHER_SERVLET_CLASS_NAME, getClass().getClassLoader());
         if(webmvcPresent) {
             RootBeanDefinition beanDefinition = new RootBeanDefinition(CsrfRequestDataValueProcessor.class);
+            beanDefinition.setFactoryMethodName("create");
             BeanComponentDefinition componentDefinition =
                     new BeanComponentDefinition(beanDefinition, REQUEST_DATA_VALUE_PROCESSOR);
             pc.registerBeanComponent(componentDefinition);
@@ -67,64 +58,21 @@ public class CsrfBeanDefinitionParser implements BeanDefinitionParser {
         csrfRepositoryRef = element.getAttribute(ATT_REPOSITORY);
         String matcherRef = element.getAttribute(ATT_MATCHER);
 
+        BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(CsrfFilter.class);
+
         if(!StringUtils.hasText(csrfRepositoryRef)) {
             RootBeanDefinition csrfTokenRepository = new RootBeanDefinition(HttpSessionCsrfTokenRepository.class);
             csrfRepositoryRef = pc.getReaderContext().generateBeanName(csrfTokenRepository);
             pc.registerBeanComponent(new BeanComponentDefinition(csrfTokenRepository, csrfRepositoryRef));
         }
 
-        BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(CsrfFilter.class);
         builder.addConstructorArgReference(csrfRepositoryRef);
 
         if(StringUtils.hasText(matcherRef)) {
             builder.addPropertyReference("requireCsrfProtectionMatcher", matcherRef);
         }
 
-        csrfFilter = builder.getBeanDefinition();
-        return csrfFilter;
-    }
-
-    /**
-     * Populate the AccessDeniedHandler on the {@link CsrfFilter}
-     *
-     * @param invalidSessionStrategy the {@link InvalidSessionStrategy} to use
-     * @param defaultDeniedHandler the {@link AccessDeniedHandler} to use
-     */
-    void initAccessDeniedHandler(BeanDefinition invalidSessionStrategy, BeanMetadataElement defaultDeniedHandler) {
-        BeanMetadataElement accessDeniedHandler = createAccessDeniedHandler(invalidSessionStrategy, defaultDeniedHandler);
-        csrfFilter.getPropertyValues().addPropertyValue("accessDeniedHandler", accessDeniedHandler);
-    }
-
-    /**
-     * Creates the {@link AccessDeniedHandler} from the result of
-     * {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} and
-     * {@link #getInvalidSessionStrategy(HttpSecurityBuilder)}. If
-     * {@link #getInvalidSessionStrategy(HttpSecurityBuilder)} is non-null, then
-     * a {@link DelegatingAccessDeniedHandler} is used in combination with
-     * {@link InvalidSessionAccessDeniedHandler} and the
-     * {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)}. Otherwise,
-     * only {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} is used.
-     *
-     * @param invalidSessionStrategy the {@link InvalidSessionStrategy} to use
-     * @param defaultDeniedHandler the {@link AccessDeniedHandler} to use
-     *
-     * @return the {@link BeanMetadataElement} that is the {@link AccessDeniedHandler} to populate on the {@link CsrfFilter}
-     */
-    private BeanMetadataElement createAccessDeniedHandler(BeanDefinition invalidSessionStrategy, BeanMetadataElement defaultDeniedHandler) {
-        if(invalidSessionStrategy == null) {
-            return defaultDeniedHandler;
-        }
-        ManagedMap<Class<? extends AccessDeniedException>,BeanDefinition> handlers =
-                new ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition>();
-        BeanDefinitionBuilder invalidSessionHandlerBldr = BeanDefinitionBuilder.rootBeanDefinition(InvalidSessionAccessDeniedHandler.class);
-        invalidSessionHandlerBldr.addConstructorArgValue(invalidSessionStrategy);
-        handlers.put(MissingCsrfTokenException.class, invalidSessionHandlerBldr.getBeanDefinition());
-
-        BeanDefinitionBuilder deniedBldr = BeanDefinitionBuilder.rootBeanDefinition(DelegatingAccessDeniedHandler.class);
-        deniedBldr.addConstructorArgValue(handlers);
-        deniedBldr.addConstructorArgValue(defaultDeniedHandler);
-
-        return deniedBldr.getBeanDefinition();
+        return builder.getBeanDefinition();
     }
 
     BeanDefinition getCsrfAuthenticationStrategy() {

config/src/main/java/org/springframework/security/config/http/FormLoginBeanDefinitionParser.java

@@ -66,7 +66,6 @@ public class FormLoginBeanDefinitionParser {
     private RootBeanDefinition filterBean;
     private RootBeanDefinition entryPointBean;
     private String loginPage;
-    private String loginProcessingUrl;
 
     FormLoginBeanDefinitionParser(String defaultLoginProcessingUrl, String filterClassName,
             BeanReference requestCache, BeanReference sessionStrategy, boolean allowSessionCreation, BeanReference portMapper, BeanReference portResolver) {
@@ -149,12 +148,7 @@ public class FormLoginBeanDefinitionParser {
             loginUrl = defaultLoginProcessingUrl;
         }
 
-        this.loginProcessingUrl = loginUrl;
-
-        BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.authentication.logout.LogoutFilter$FilterProcessUrlRequestMatcher");
-        matcherBuilder.addConstructorArgValue(loginUrl);
-
-        filterBuilder.addPropertyValue("requiresAuthenticationRequestMatcher", matcherBuilder.getBeanDefinition());
+        filterBuilder.addPropertyValue("filterProcessesUrl", loginUrl);
 
         if (StringUtils.hasText(successHandlerRef)) {
             filterBuilder.addPropertyReference("authenticationSuccessHandler", successHandlerRef);
@@ -207,8 +201,4 @@ public class FormLoginBeanDefinitionParser {
     String getLoginPage() {
         return loginPage;
     }
-
-    String getLoginProcessingUrl() {
-        return loginProcessingUrl;
-    }
 }

config/src/main/java/org/springframework/security/config/http/HeadersBeanDefinitionParser.java

@@ -208,7 +208,7 @@ public class HeadersBeanDefinitionParser implements BeanDefinitionParser {
                         }
                         String fromParameter = getAttribute(frameElt, ATT_FROM_PARAMETER, "from");
                         allowFromStrategy.addPropertyValue("allowFromParameterName", fromParameter);
-                        builder.addConstructorArgValue(allowFromStrategy.getBeanDefinition());
+                        builder.addConstructorArgValue(allowFromStrategy);
                     }
                 } else {
                     parserContext.getReaderContext().error("One of 'strategy' and 'strategy-ref' must be set.",

config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

@@ -130,10 +130,6 @@ class HttpConfigurationBuilder {
     private BeanMetadataElement csrfLogoutHandler;
     private BeanMetadataElement csrfAuthStrategy;
 
-    private CsrfBeanDefinitionParser csrfParser;
-
-    private BeanDefinition invalidSession;
-
     public HttpConfigurationBuilder(Element element, ParserContext pc,
             BeanReference portMapper, BeanReference portResolver, BeanReference authenticationManager) {
         this.httpElt = element;
@@ -204,8 +200,8 @@ class HttpConfigurationBuilder {
     }
 
     void setAccessDeniedHandler(BeanMetadataElement accessDeniedHandler) {
-        if(csrfParser != null ) {
-            csrfParser.initAccessDeniedHandler(this.invalidSession, accessDeniedHandler);
+        if(csrfFilter != null) {
+            csrfFilter.getPropertyValues().add("accessDeniedHandler", accessDeniedHandler);
         }
     }
 
@@ -385,10 +381,7 @@ class HttpConfigurationBuilder {
         }
 
         if (StringUtils.hasText(invalidSessionUrl)) {
-            BeanDefinitionBuilder invalidSessionBldr = BeanDefinitionBuilder.rootBeanDefinition(SimpleRedirectInvalidSessionStrategy.class);
-            invalidSessionBldr.addConstructorArgValue(invalidSessionUrl);
-            invalidSession = invalidSessionBldr.getBeanDefinition();
-            sessionMgmtFilter.addPropertyValue("invalidSessionStrategy", invalidSession);
+            sessionMgmtFilter.addPropertyValue("invalidSessionStrategy", new SimpleRedirectInvalidSessionStrategy(invalidSessionUrl));
         }
 
         sessionMgmtFilter.addConstructorArgReference(sessionAuthStratRef);
@@ -644,16 +637,14 @@ class HttpConfigurationBuilder {
 
     }
 
-    private CsrfBeanDefinitionParser createCsrfFilter() {
+    private void createCsrfFilter() {
         Element elmt = DomUtils.getChildElementByTagName(httpElt, Elements.CSRF);
         if (elmt != null) {
-            csrfParser = new CsrfBeanDefinitionParser();
-            csrfFilter = csrfParser.parse(elmt, pc);
+            CsrfBeanDefinitionParser csrfParser = new CsrfBeanDefinitionParser();
+            this.csrfFilter = csrfParser.parse(elmt, pc);
             this.csrfAuthStrategy = csrfParser.getCsrfAuthenticationStrategy();
             this.csrfLogoutHandler = csrfParser.getCsrfLogoutHandler();
-            return csrfParser;
         }
-        return null;
     }
 
     BeanMetadataElement getCsrfLogoutHandler() {

config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java

@@ -46,12 +46,10 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
 
     final String rememberMeServices;
     private ManagedList<BeanMetadataElement> logoutHandlers = new ManagedList<BeanMetadataElement>();
-    private boolean csrfEnabled;
 
     public LogoutBeanDefinitionParser(String rememberMeServices, BeanMetadataElement csrfLogoutHandler) {
         this.rememberMeServices = rememberMeServices;
-        this.csrfEnabled = csrfLogoutHandler != null;
-        if(this.csrfEnabled) {
+        if(csrfLogoutHandler != null) {
             logoutHandlers.add(csrfLogoutHandler);
         }
     }
@@ -80,9 +78,7 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
         if (!StringUtils.hasText(logoutUrl)) {
             logoutUrl = DEF_LOGOUT_URL;
         }
-
-
-        builder.addPropertyValue("logoutRequestMatcher", getLogoutRequestMatcher(logoutUrl));
+        builder.addPropertyValue("filterProcessesUrl", logoutUrl);
 
         if (StringUtils.hasText(successHandlerRef)) {
             if (StringUtils.hasText(logoutSuccessUrl)) {
@@ -118,19 +114,6 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
         return builder.getBeanDefinition();
     }
 
-    private BeanDefinition getLogoutRequestMatcher(String logoutUrl) {
-        if(this.csrfEnabled) {
-            BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
-            matcherBuilder.addConstructorArgValue(logoutUrl);
-            matcherBuilder.addConstructorArgValue("POST");
-            return matcherBuilder.getBeanDefinition();
-        } else {
-            BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter$FilterProcessUrlRequestMatcher");
-            matcherBuilder.addConstructorArgValue(logoutUrl);
-            return matcherBuilder.getBeanDefinition();
-        }
-    }
-
     ManagedList<BeanMetadataElement> getLogoutHandlers() {
         return logoutHandlers;
     }

config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java

@@ -132,12 +132,12 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser {
             }
 
             if (tokenValiditySet) {
-                boolean isTokenValidityNegative = tokenValiditySeconds.startsWith("-");
-                if (isTokenValidityNegative && isPersistent) {
+                int tokenValidity = Integer.parseInt(tokenValiditySeconds);
+                if (tokenValidity < 0 && isPersistent) {
                     pc.getReaderContext().error(ATT_TOKEN_VALIDITY + " cannot be negative if using" +
                             " a persistent remember-me token repository", source);
                 }
-                services.getPropertyValues().addPropertyValue("tokenValiditySeconds", tokenValiditySeconds);
+                services.getPropertyValues().addPropertyValue("tokenValiditySeconds", tokenValidity);
             }
 
             if (remembermeParameterSet) {

config/src/main/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParser.java

@@ -1,8 +1,5 @@
 package org.springframework.security.config.ldap;
 
-import java.io.IOException;
-import java.net.ServerSocket;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.config.BeanDefinition;
@@ -12,7 +9,6 @@ import org.springframework.beans.factory.xml.AbstractBeanDefinitionParser;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.config.BeanIds;
-import org.springframework.security.ldap.server.ApacheDSContainer;
 import org.springframework.util.StringUtils;
 import org.w3c.dom.Element;
 
@@ -44,8 +40,7 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 
     /** Defines the port the LDAP_PROVIDER server should run on */
     public static final String ATT_PORT = "port";
-    private static final int DEFAULT_PORT = 33389;
-    public static final String OPT_DEFAULT_PORT = String.valueOf(DEFAULT_PORT);
+    public static final String OPT_DEFAULT_PORT = "33389";
 
 
     public BeanDefinition parse(Element elt, ParserContext parserContext) {
@@ -106,10 +101,7 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
         String port = element.getAttribute(ATT_PORT);
 
         if (!StringUtils.hasText(port)) {
-            port = getDefaultPort();
-            if(logger.isDebugEnabled()) {
-                logger.debug("Using default port of " + port);
-            }
+            port = OPT_DEFAULT_PORT;
         }
 
         String url = "ldap://127.0.0.1:" + port + "/" + suffix;
@@ -142,26 +134,4 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 
         return (RootBeanDefinition) contextSource.getBeanDefinition();
     }
-
-    private String getDefaultPort() {
-        ServerSocket serverSocket = null;
-        try {
-            try {
-                serverSocket = new ServerSocket(DEFAULT_PORT);
-            } catch (IOException e) {
-                try {
-                    serverSocket = new ServerSocket(0);
-                } catch(IOException e2) {
-                    return String.valueOf(DEFAULT_PORT);
-                }
-            }
-            return String.valueOf(serverSocket.getLocalPort());
-        } finally {
-            if(serverSocket != null) {
-                try {
-                    serverSocket.close();
-                } catch (IOException e) {}
-            }
-        }
-    }
 }

config/src/main/java/org/springframework/security/config/method/GlobalMethodSecurityBeanDefinitionParser.java

@@ -452,9 +452,6 @@ public class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionP
         }
 
         public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {
-            if(!registry.containsBeanDefinition(beanName)) {
-                return;
-            }
             BeanDefinition beanDefinition = registry.getBeanDefinition(beanName);
             beanDefinition.setLazyInit(true);
         }

config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc

@@ -280,7 +280,7 @@ http-firewall =
     element http-firewall {ref}
 
 http =
-    ## Container element for HTTP security configuration. Multiple elements can now be defined, each with a specific pattern to which the enclosed security configuration applies. A pattern can also be configured to bypass Spring Security's filters completely by setting the "security" attribute to "none".
+    ## Container element for HTTP security configuration. Multiple elements can now be defined, each with a specific pattern to which the enclosed security configuration applies. A pattern can also be configured to bypass Spring Security's filters completely by setting the "secured" attribute to "false".
     element http {http.attlist, (intercept-url* & access-denied-handler? & form-login? & openid-login? & x509? & jee? & http-basic? & logout? & session-management & remember-me? & anonymous? & port-mappings & custom-filter* & request-cache? & expression-handler?) }
 http.attlist &=
     ## The request URL pattern which will be mapped to the filter chain created by this <http> element. If omitted, the filter chain will match all requests.

config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd

@@ -868,7 +868,7 @@
          <xs:documentation>Container element for HTTP security configuration. Multiple elements can now be defined,
                 each with a specific pattern to which the enclosed security configuration applies. A
                 pattern can also be configured to bypass Spring Security's filters completely by setting
-                the "security" attribute to "none".
+                the "secured" attribute to "false".
                 </xs:documentation>
       </xs:annotation>
       <xs:complexType>

config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc

@@ -280,7 +280,7 @@ http-firewall =
     element http-firewall {ref}
 
 http =
-    ## Container element for HTTP security configuration. Multiple elements can now be defined, each with a specific pattern to which the enclosed security configuration applies. A pattern can also be configured to bypass Spring Security's filters completely by setting the "security" attribute to "none".
+    ## Container element for HTTP security configuration. Multiple elements can now be defined, each with a specific pattern to which the enclosed security configuration applies. A pattern can also be configured to bypass Spring Security's filters completely by setting the "secured" attribute to "false".
     element http {http.attlist, (intercept-url* & access-denied-handler? & form-login? & openid-login? & x509? & jee? & http-basic? & logout? & session-management & remember-me? & anonymous? & port-mappings & custom-filter* & request-cache? & expression-handler? & headers? & csrf?) }
 http.attlist &=
     ## The request URL pattern which will be mapped to the filter chain created by this <http> element. If omitted, the filter chain will match all requests.
@@ -357,7 +357,7 @@ intercept-url.attlist &=
     attribute access {xsd:token}?
 intercept-url.attlist &=
     ## The HTTP Method for which the access configuration attributes should apply. If not specified, the attributes will apply to any method.
-    attribute method {"GET" | "DELETE" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "TRACE"}?
+    attribute method {"GET" | "DELETE" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "TRACE"}?
 
 intercept-url.attlist &=
     ## The filter list for the path. Currently can be set to "none" to remove a path from having any filters applied. The full filter stack (consisting of all filters created by the namespace configuration, and any added using 'custom-filter'), will be applied to any other paths.
@@ -572,7 +572,7 @@ remember-me.attlist &=
 
 remember-me.attlist &=
     ## The period (in seconds) for which the remember-me cookie should be valid.
-    attribute token-validity-seconds {xsd:string}?
+    attribute token-validity-seconds {xsd:integer}?
 
 remember-me.attlist &=
     ## Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful remember-me authentication.

config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd

@@ -868,7 +868,7 @@
          <xs:documentation>Container element for HTTP security configuration. Multiple elements can now be defined,
                 each with a specific pattern to which the enclosed security configuration applies. A
                 pattern can also be configured to bypass Spring Security's filters completely by setting
-                the "security" attribute to "none".
+                the "secured" attribute to "false".
                 </xs:documentation>
       </xs:annotation>
       <xs:complexType>
@@ -1248,7 +1248,6 @@
                <xs:enumeration value="OPTIONS"/>
                <xs:enumeration value="POST"/>
                <xs:enumeration value="PUT"/>
-               <xs:enumeration value="PATCH"/>
                <xs:enumeration value="TRACE"/>
             </xs:restriction>
          </xs:simpleType>
@@ -1796,7 +1795,7 @@
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
-      <xs:attribute name="token-validity-seconds" type="xs:string">
+      <xs:attribute name="token-validity-seconds" type="xs:integer">
          <xs:annotation>
             <xs:documentation>The period (in seconds) for which the remember-me cookie should be valid.
                 </xs:documentation>

config/src/test/groovy/org/springframework/security/config/annotation/BaseSpringSpec.groovy

@@ -123,8 +123,7 @@ abstract class BaseSpringSpec extends Specification {
     AuthenticationManager getAuthenticationManager() {
         try {
             authenticationManager().delegateBuilder.getObject()
-        } catch(NoSuchBeanDefinitionException e) {
-        } catch(MissingPropertyException e) {}
+        } catch(NoSuchBeanDefinitionException e) {}
         findFilter(FilterSecurityInterceptor).authenticationManager
     }
 

config/src/test/groovy/org/springframework/security/config/annotation/authentication/AuthenticationManagerBuilderTests.groovy

@@ -87,37 +87,4 @@ class AuthenticationManagerBuilderTests extends BaseSpringSpec {
                     .withUser("admin").password("password").roles("USER","ADMIN")
         }
     }
-
-    def "isConfigured with AuthenticationProvider"() {
-        setup:
-            ObjectPostProcessor opp = Mock()
-            AuthenticationProvider provider = Mock()
-            AuthenticationManagerBuilder auth = new AuthenticationManagerBuilder(opp)
-        when:
-            auth
-                .authenticationProvider(provider)
-        then:
-            auth.isConfigured()
-    }
-
-    def "isConfigured with parent"() {
-        setup:
-            ObjectPostProcessor opp = Mock()
-            AuthenticationManager parent = Mock()
-            AuthenticationManagerBuilder auth = new AuthenticationManagerBuilder(opp)
-        when:
-            auth
-                .parentAuthenticationManager(parent)
-        then:
-            auth.isConfigured()
-    }
-
-    def "isConfigured not configured"() {
-        setup:
-            ObjectPostProcessor opp = Mock()
-        when:
-            AuthenticationManagerBuilder auth = new AuthenticationManagerBuilder(opp)
-        then:
-            auth.isConfigured() == false
-    }
 }

config/src/test/groovy/org/springframework/security/config/annotation/authentication/NamespaceAuthenticationManagerTests.groovy

@@ -15,7 +15,6 @@
  */
 package org.springframework.security.config.annotation.authentication
 
-import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.security.authentication.AuthenticationManager
@@ -90,25 +89,4 @@ class NamespaceAuthenticationManagerTests extends BaseSpringSpec {
             return super.authenticationManagerBean();
         }
     }
-
-    def "SEC-2533: global authentication-manager@erase-credentials=false"() {
-        when:
-            loadConfig(GlobalEraseCredentialsFalseConfig)
-            Authentication auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password"))
-        then:
-            auth.credentials == "password"
-            auth.principal.password == "password"
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class GlobalEraseCredentialsFalseConfig extends WebSecurityConfigurerAdapter {
-        @Autowired
-        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .eraseCredentials(false)
-                .inMemoryAuthentication()
-                    .withUser("user").password("password").roles("USER")
-        }
-    }
 }

config/src/test/groovy/org/springframework/security/config/annotation/authentication/configuration/AuthenticationConfigurationTests.groovy

@@ -1,328 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.authentication.configuration;
-
-import org.springframework.aop.framework.ProxyFactoryBean
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.context.ApplicationContext
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.context.annotation.Import
-import org.springframework.core.Ordered
-import org.springframework.core.annotation.Order
-import org.springframework.security.access.annotation.Secured
-import org.springframework.security.authentication.AuthenticationManager
-import org.springframework.security.authentication.TestingAuthenticationToken
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
-import org.springframework.security.authentication.dao.DaoAuthenticationProvider
-import org.springframework.security.config.annotation.BaseSpringSpec
-import org.springframework.security.config.annotation.ObjectPostProcessor
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter
-import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
-import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity
-import org.springframework.security.core.AuthenticationException
-import org.springframework.security.core.authority.AuthorityUtils
-import org.springframework.security.core.context.SecurityContextHolder
-import org.springframework.security.core.userdetails.User
-import org.springframework.security.provisioning.InMemoryUserDetailsManager
-
-class AuthenticationConfigurationTests extends BaseSpringSpec {
-
-    def "Ordering Autowired on EnableGlobalMethodSecurity"() {
-        setup:
-            SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER"))
-        when:
-            loadConfig(GlobalMethodSecurityAutowiredConfigAndServicesConfig)
-        then:
-            context.getBean(Service).run()
-    }
-
-    @Configuration
-    @Import([GlobalMethodSecurityAutowiredConfig,ServicesConfig])
-    static class GlobalMethodSecurityAutowiredConfigAndServicesConfig {}
-
-    @Configuration
-    @EnableGlobalMethodSecurity(securedEnabled = true)
-    static class GlobalMethodSecurityAutowiredConfig {
-        @Autowired
-        public void configureGlobal(AuthenticationManagerBuilder auth) {
-            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
-        }
-    }
-
-    def "Ordering Autowired on EnableWebSecurity"() {
-        setup:
-            SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER"))
-        when:
-            loadConfig(GlobalMethodSecurityConfigAndServicesConfig)
-        then:
-            context.getBean(Service).run()
-    }
-
-    @Configuration
-    @Import([GlobalMethodSecurityConfig,WebSecurityConfig,ServicesConfig])
-    static class GlobalMethodSecurityConfigAndServicesConfig {}
-
-    @Configuration
-    @EnableGlobalMethodSecurity(securedEnabled = true)
-    static class GlobalMethodSecurityConfig {}
-
-    @Configuration
-    @EnableWebSecurity
-    static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
-        @Autowired
-        public void configureGlobal(AuthenticationManagerBuilder auth) {
-            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
-        }
-    }
-
-    //
-
-    def "Ordering Autowired on EnableWebMvcSecurity"() {
-        setup:
-            SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER"))
-        when:
-            loadConfig(GlobalMethodSecurityMvcSecurityAndServicesConfig)
-        then:
-            context.getBean(Service).run()
-    }
-
-    @Configuration
-    @Import([GlobalMethodSecurityConfig,WebMvcSecurityConfig,ServicesConfig])
-    static class GlobalMethodSecurityMvcSecurityAndServicesConfig {}
-
-    @Configuration
-    @EnableWebMvcSecurity
-    static class WebMvcSecurityConfig extends WebSecurityConfigurerAdapter {
-        @Autowired
-        public void configureGlobal(AuthenticationManagerBuilder auth) {
-            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
-        }
-    }
-
-    //
-
-    def "no authentication getAuthenticationManager falls back to null"() {
-        when:
-            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
-        then:
-            context.getBean(AuthenticationConfiguration).authenticationManager == null
-    }
-
-    def "QuiesentGlobalAuthenticationConfiguererAdapter falls back to null"() {
-        when:
-            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,QuiesentGlobalAuthenticationConfiguererAdapter)
-        then:
-            context.getBean(AuthenticationConfiguration).authenticationManager == null
-    }
-
-    @Configuration
-    static class QuiesentGlobalAuthenticationConfiguererAdapter extends GlobalAuthenticationConfigurerAdapter {}
-
-    //
-
-    def "GlobalAuthenticationConfiguererAdapterImpl configures authentication successfully"() {
-        setup:
-            def token = new UsernamePasswordAuthenticationToken("user", "password")
-        when:
-            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,GlobalAuthenticationConfiguererAdapterImpl)
-        then:
-            context.getBean(AuthenticationConfiguration).authenticationManager.authenticate(token)?.name == "user"
-    }
-
-    @Configuration
-    static class GlobalAuthenticationConfiguererAdapterImpl extends GlobalAuthenticationConfigurerAdapter {
-        public void init(AuthenticationManagerBuilder auth) throws Exception {
-            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
-        }
-    }
-
-    //
-
-    def "AuthenticationManagerBean configures authentication successfully"() {
-        setup:
-            def token = new UsernamePasswordAuthenticationToken("user", "password")
-            def auth = new UsernamePasswordAuthenticationToken("user", "password", AuthorityUtils.createAuthorityList("ROLE_USER"))
-            AuthenticationManagerBeanConfig.AM = Mock(AuthenticationManager)
-            1 * AuthenticationManagerBeanConfig.AM.authenticate(token) >> auth
-        when:
-            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,AuthenticationManagerBeanConfig)
-        then:
-            context.getBean(AuthenticationConfiguration).authenticationManager.authenticate(token).name == auth.name
-    }
-
-    @Configuration
-    static class AuthenticationManagerBeanConfig {
-        static AuthenticationManager AM
-        @Bean
-        public AuthenticationManager authenticationManager() {
-            AM
-        }
-    }
-
-    //
-
-    @Configuration
-    static class ServicesConfig {
-        @Bean
-        public Service service() {
-            return new ServiceImpl()
-        }
-    }
-
-    static interface Service {
-        public void run();
-    }
-
-    static class ServiceImpl implements Service {
-        @Secured("ROLE_USER")
-        public void run() {}
-    }
-
-    //
-
-    def "GlobalAuthenticationConfigurerAdapter are ordered"() {
-        setup:
-            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
-            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
-            config.setGlobalAuthenticationConfigurers([new LowestOrderGlobalAuthenticationConfigurerAdapter(), new HighestOrderGlobalAuthenticationConfigurerAdapter(), new DefaultOrderGlobalAuthenticationConfigurerAdapter()])
-        when:
-            config.getAuthenticationManager()
-        then:
-            DefaultOrderGlobalAuthenticationConfigurerAdapter.inits == [HighestOrderGlobalAuthenticationConfigurerAdapter,DefaultOrderGlobalAuthenticationConfigurerAdapter,LowestOrderGlobalAuthenticationConfigurerAdapter]
-            DefaultOrderGlobalAuthenticationConfigurerAdapter.configs == [HighestOrderGlobalAuthenticationConfigurerAdapter,DefaultOrderGlobalAuthenticationConfigurerAdapter,LowestOrderGlobalAuthenticationConfigurerAdapter]
-
-    }
-
-    static class DefaultOrderGlobalAuthenticationConfigurerAdapter extends GlobalAuthenticationConfigurerAdapter {
-        static List inits = []
-        static List configs = []
-
-        public void init(AuthenticationManagerBuilder auth) throws Exception {
-            inits.add(getClass())
-        }
-
-        public void configure(AuthenticationManagerBuilder auth) throws Exception {
-            configs.add(getClass())
-        }
-    }
-
-    @Order(Ordered.LOWEST_PRECEDENCE)
-    static class LowestOrderGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {}
-
-    @Order(Ordered.HIGHEST_PRECEDENCE)
-    static class HighestOrderGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {}
-
-    //
-
-    def "Spring Boot not triggered when already configured"() {
-        setup:
-            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
-            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
-            config.setGlobalAuthenticationConfigurers([new ConfiguresInMemoryConfigurerAdapter(), new BootGlobalAuthenticationConfigurerAdapter()])
-            AuthenticationManager authenticationManager = config.authenticationManager
-        when:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password"))
-        then:
-            noExceptionThrown()
-        when:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("boot","password"))
-        then:
-            thrown(AuthenticationException)
-    }
-
-
-    def "Spring Boot is triggered when not already configured"() {
-        setup:
-            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
-            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
-            config.setGlobalAuthenticationConfigurers([new BootGlobalAuthenticationConfigurerAdapter()])
-            AuthenticationManager authenticationManager = config.authenticationManager
-        when:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("boot","password"))
-        then:
-            noExceptionThrown()
-    }
-
-    static class ConfiguresInMemoryConfigurerAdapter extends GlobalAuthenticationConfigurerAdapter {
-
-        public void init(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .inMemoryAuthentication()
-                    .withUser("user").password("password").roles("USER")
-        }
-    }
-
-    @Order(Ordered.LOWEST_PRECEDENCE)
-    static class BootGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {
-        public void init(AuthenticationManagerBuilder auth) throws Exception {
-            auth.apply(new DefaultBootGlobalAuthenticationConfigurerAdapter())
-        }
-    }
-
-    static class DefaultBootGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {
-        @Override
-        public void configure(AuthenticationManagerBuilder auth) throws Exception {
-            if(auth.isConfigured()) {
-                return;
-            }
-
-            User user = new User("boot","password", AuthorityUtils.createAuthorityList("ROLE_USER"))
-
-            List<User> users = Arrays.asList(user);
-            InMemoryUserDetailsManager inMemory = new InMemoryUserDetailsManager(users);
-
-            DaoAuthenticationProvider provider = new DaoAuthenticationProvider()
-            provider.userDetailsService = inMemory
-
-            auth.authenticationProvider(provider)
-        }
-    }
-
-    def "SEC-2531: AuthenticationConfiguration#lazyBean should use BeanClassLoader on ProxyFactoryBean"() {
-        setup:
-            ObjectPostProcessor opp = Mock()
-            Sec2531Config. opp = opp
-            loadConfig(Sec2531Config)
-        when:
-            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
-            config.getAuthenticationManager()
-        then:
-            1 * opp.postProcess(_ as ProxyFactoryBean) >> { args ->
-                args[0]
-            }
-    }
-
-    @Configuration
-    @Import(AuthenticationConfiguration)
-    static class Sec2531Config {
-        static ObjectPostProcessor opp
-
-        @Bean
-        public ObjectPostProcessor objectPostProcessor() {
-            opp
-        }
-
-        @Bean
-        public AuthenticationManager manager() {
-            null
-        }
-    }
-}

config/src/test/groovy/org/springframework/security/config/annotation/issue50/ApplicationConfig.java

@@ -1,68 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.issue50;
-
-import javax.sql.DataSource;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
-import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder;
-import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType;
-import org.springframework.orm.jpa.JpaTransactionManager;
-import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;
-import org.springframework.orm.jpa.vendor.Database;
-import org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter;
-import org.springframework.security.config.annotation.issue50.domain.User;
-import org.springframework.transaction.PlatformTransactionManager;
-import org.springframework.transaction.annotation.EnableTransactionManagement;
-
-/**
- * @author Rob Winch
- *
- */
-@Configuration
-@EnableJpaRepositories("org.springframework.security.config.annotation.issue50.repo")
-@EnableTransactionManagement
-public class ApplicationConfig {
-    @Bean
-    public DataSource dataSource() {
-        EmbeddedDatabaseBuilder builder = new EmbeddedDatabaseBuilder();
-        return builder.setType(EmbeddedDatabaseType.HSQL).build();
-    }
-
-    @Bean
-    public LocalContainerEntityManagerFactoryBean entityManagerFactory() {
-        HibernateJpaVendorAdapter vendorAdapter = new HibernateJpaVendorAdapter();
-        vendorAdapter.setDatabase(Database.HSQL);
-        vendorAdapter.setGenerateDdl(true);
-        vendorAdapter.setShowSql(true);
-
-        LocalContainerEntityManagerFactoryBean factory = new LocalContainerEntityManagerFactoryBean();
-        factory.setJpaVendorAdapter(vendorAdapter);
-        factory.setPackagesToScan(User.class.getPackage().getName());
-        factory.setDataSource(dataSource());
-
-        return factory;
-    }
-
-    @Bean
-    public PlatformTransactionManager transactionManager() {
-        JpaTransactionManager txManager = new JpaTransactionManager();
-        txManager.setEntityManagerFactory(entityManagerFactory().getObject());
-        return txManager;
-    }
-}

config/src/test/groovy/org/springframework/security/config/annotation/issue50/Issue50Tests.groovy

@@ -1,100 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.issue50;
-
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.security.access.AccessDeniedException
-import org.springframework.security.authentication.AuthenticationManager
-import org.springframework.security.authentication.BadCredentialsException
-import org.springframework.security.authentication.TestingAuthenticationToken
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
-import org.springframework.security.config.annotation.issue50.domain.User
-import org.springframework.security.config.annotation.issue50.repo.UserRepository
-import org.springframework.security.core.Authentication
-import org.springframework.security.core.context.SecurityContextHolder
-import org.springframework.security.core.userdetails.UsernameNotFoundException
-import org.springframework.security.web.FilterChainProxy
-import org.springframework.test.context.ContextConfiguration
-import org.springframework.transaction.annotation.Transactional
-
-import spock.lang.Specification
-
-/**
- * @author Rob Winch
- *
- */
-@ContextConfiguration(classes=[ApplicationConfig,SecurityConfig])
-@Transactional
-class Issue50Tests extends Specification {
-    @Autowired
-    private FilterChainProxy springSecurityFilterChain
-    @Autowired
-    private AuthenticationManager authenticationManager
-    @Autowired
-    private UserRepository userRepo
-
-    def setup() {
-        SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_ADMIN")
-    }
-
-    def cleanup() {
-        SecurityContextHolder.clearContext()
-    }
-
-    // https://github.com/SpringSource/spring-security-javaconfig/issues/50
-    def "#50 - GlobalMethodSecurityConfiguration should load AuthenticationManager lazily"() {
-        when:
-        "Configuration Loads"
-        then: "GlobalMethodSecurityConfiguration loads AuthenticationManager lazily"
-        noExceptionThrown()
-    }
-
-    def "AuthenticationManager will not authenticate missing user"() {
-        when:
-        authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "password"))
-        then:
-        thrown(UsernameNotFoundException)
-    }
-
-    def "AuthenticationManager will not authenticate with invalid password"() {
-        when:
-        User user = new User(username:"test",password:"password")
-        userRepo.save(user)
-        authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , "invalid"))
-        then:
-        thrown(BadCredentialsException)
-    }
-
-    def "AuthenticationManager can be used to authenticate a user"() {
-        when:
-        User user = new User(username:"test",password:"password")
-        userRepo.save(user)
-        Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password))
-        then:
-        result.principal == user.username
-    }
-
-    def "Global Method Security is enabled and works"() {
-        setup:
-        SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_USER")
-        when:
-        User user = new User(username:"denied",password:"password")
-        userRepo.save(user)
-        Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password))
-        then:
-        thrown(AccessDeniedException)
-    }
-}

config/src/test/groovy/org/springframework/security/config/annotation/issue50/SecurityConfig.java

@@ -1,90 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.issue50;
-
-import org.spockframework.util.Assert;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.AuthenticationProvider;
-import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.issue50.domain.User;
-import org.springframework.security.config.annotation.issue50.repo.UserRepository;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.userdetails.UsernameNotFoundException;
-
-/**
- * @author Rob Winch
- *
- */
-@EnableWebSecurity
-@EnableGlobalMethodSecurity(prePostEnabled = true)
-@Configuration
-public class SecurityConfig extends WebSecurityConfigurerAdapter {
-    @Autowired
-    private UserRepository myUserRepository;
-
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-        auth
-            .authenticationProvider(authenticationProvider());
-    }
-
-    @Override
-    protected void configure(HttpSecurity http) throws Exception {
-        http
-            .authorizeRequests()
-                .antMatchers("/*").permitAll();
-    }
-
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean()
-            throws Exception {
-        return super.authenticationManagerBean();
-    }
-
-    @Bean
-    public AuthenticationProvider authenticationProvider() {
-        Assert.notNull(myUserRepository);
-        return new AuthenticationProvider() {
-            public boolean supports(Class<?> authentication) {
-                return true;
-            }
-            public Authentication authenticate(Authentication authentication)
-                    throws AuthenticationException {
-                Object principal = authentication.getPrincipal();
-                String username = String.valueOf(principal);
-                User user = myUserRepository.findByUsername(username);
-                if(user == null) {
-                    throw new UsernameNotFoundException("No user for principal "+principal);
-                }
-                if(!authentication.getCredentials().equals(user.getPassword())) {
-                    throw new BadCredentialsException("Invalid password");
-                }
-                return new TestingAuthenticationToken(principal, null, "ROLE_USER");
-            }
-        };
-    }
-}

config/src/test/groovy/org/springframework/security/config/annotation/issue50/domain/User.java

@@ -1,62 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.issue50.domain;
-
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-
-/**
- * @author Rob Winch
- *
- */
-@Entity
-public class User {
-
-    @Id
-    @GeneratedValue(strategy = GenerationType.AUTO)
-    private Long id;
-
-    private String username;
-
-    private String password;
-
-    public Long getId() {
-        return id;
-    }
-
-    public void setId(Long id) {
-        this.id = id;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getPassword() {
-        return password;
-    }
-
-    public void setPassword(String password) {
-        this.password = password;
-    }
-
-}

config/src/test/groovy/org/springframework/security/config/annotation/issue50/repo/UserRepository.java

@@ -1,30 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.issue50.repo;
-
-import org.springframework.data.repository.CrudRepository;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.security.config.annotation.issue50.domain.User;
-
-/**
- * @author Rob Winch
- *
- */
-public interface UserRepository extends CrudRepository<User, String> {
-
-    @PreAuthorize("hasRole('ROLE_ADMIN')")
-    User findByUsername(String username);
-}

config/src/test/groovy/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.groovy

@@ -19,10 +19,8 @@ import static org.fest.assertions.Assertions.assertThat
 import static org.junit.Assert.fail
 
 import org.aopalliance.intercept.MethodInterceptor
-import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.context.ApplicationContext
 import org.springframework.context.ApplicationListener
-import org.springframework.context.annotation.AnnotationConfigApplicationContext
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.security.access.AccessDeniedException
@@ -272,71 +270,4 @@ public class GlobalMethodSecurityConfigurationTests extends BaseSpringSpec {
             new MethodSecurityServiceImpl()
         }
     }
-
-    def "SEC-2425: EnableGlobalMethodSecurity works on superclass"() {
-        setup:
-            SecurityContextHolder.getContext().setAuthentication(
-                new TestingAuthenticationToken("user", "password","ROLE_USER"))
-            loadConfig(ParentConfig)
-            MethodSecurityService service = context.getBean(MethodSecurityService)
-        when:
-            service.preAuthorize()
-        then:
-            thrown(AccessDeniedException)
-    }
-
-    static class ChildConfig extends ParentConfig {}
-
-    @Configuration
-    @EnableGlobalMethodSecurity(prePostEnabled = true)
-    static class ParentConfig {
-
-        @Autowired
-        protected void configurGlobal(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .inMemoryAuthentication()
-        }
-
-        @Bean
-        public MethodSecurityService service() {
-            new MethodSecurityServiceImpl()
-        }
-    }
-
-    def "SEC-2479: Support AuthenticationManager in parent"() {
-        setup:
-            SecurityContextHolder.getContext().setAuthentication(
-                new TestingAuthenticationToken("user", "password","ROLE_USER"))
-            loadConfig(Sec2479ParentConfig)
-            def child = new AnnotationConfigApplicationContext()
-            child.register(Sec2479ChildConfig)
-            child.parent = context
-            child.refresh()
-            MethodSecurityService service = child.getBean(MethodSecurityService)
-        when:
-            service.preAuthorize()
-        then:
-            thrown(AccessDeniedException)
-        cleanup:
-            child?.close()
-    }
-
-    @Configuration
-    static class Sec2479ParentConfig {
-        static AuthenticationManager AM
-
-        @Bean
-        public AuthenticationManager am() {
-            AM
-        }
-    }
-
-    @Configuration
-    @EnableGlobalMethodSecurity(prePostEnabled = true)
-    static class Sec2479ChildConfig {
-        @Bean
-        public MethodSecurityService service() {
-            new MethodSecurityServiceImpl()
-        }
-    }
 }

config/src/test/groovy/org/springframework/security/config/annotation/method/configuration/NamespaceGlobalMethodSecurityTests.groovy

@@ -15,14 +15,11 @@
  */
 package org.springframework.security.config.annotation.method.configuration
 
-import org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor
-
 import static org.fest.assertions.Assertions.assertThat
 import static org.junit.Assert.fail
 
 import java.lang.reflect.Method
 
-import org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect
 import org.springframework.aop.aspectj.annotation.AnnotationAwareAspectJAutoProxyCreator
 import org.springframework.beans.factory.BeanCreationException
 import org.springframework.context.ConfigurableApplicationContext
@@ -191,8 +188,8 @@ public class NamespaceGlobalMethodSecurityTests extends BaseSpringSpec {
         when:
             context = new AnnotationConfigApplicationContext(AspectJModeConfig)
         then:
-            context.getBean(AnnotationSecurityAspect)
-            context.getBean(AspectJMethodSecurityInterceptor)
+            AnnotationAwareAspectJAutoProxyCreator autoProxyCreator = context.getBean(AnnotationAwareAspectJAutoProxyCreator)
+            autoProxyCreator.proxyTargetClass == true
     }
 
     @Configuration
@@ -204,8 +201,8 @@ public class NamespaceGlobalMethodSecurityTests extends BaseSpringSpec {
         when:
             context = new AnnotationConfigApplicationContext(BaseMethodConfig,AspectJModeExtendsGMSCConfig)
         then:
-            context.getBean(AnnotationSecurityAspect)
-            context.getBean(AspectJMethodSecurityInterceptor)
+            AnnotationAwareAspectJAutoProxyCreator autoProxyCreator = context.getBean(AnnotationAwareAspectJAutoProxyCreator)
+            autoProxyCreator.proxyTargetClass == false
     }
 
     @Configuration

config/src/test/groovy/org/springframework/security/config/annotation/web/WebSecurityConfigurerAdapterTests.groovy

@@ -27,9 +27,6 @@ import org.springframework.context.ApplicationContext
 import org.springframework.context.ApplicationListener
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.core.Ordered
-import org.springframework.core.annotation.AnnotationAwareOrderComparator
-import org.springframework.core.annotation.Order
 import org.springframework.security.authentication.AuthenticationManager
 import org.springframework.security.authentication.AuthenticationProvider
 import org.springframework.security.authentication.AuthenticationTrustResolver
@@ -286,18 +283,4 @@ class WebSecurityConfigurerAdapterTests extends BaseSpringSpec {
             return TR
         }
     }
-
-    def "WebSecurityConfigurerAdapter has Ordered between 0 and lowest priority"() {
-        when:
-            def lowestConfig = new LowestPriorityWebSecurityConfig()
-            def defaultConfig = new DefaultOrderWebSecurityConfig()
-            def compare = new AnnotationAwareOrderComparator()
-        then: "the default ordering is between 0 and lowest priority (Boot adapters)"
-            compare.compare(lowestConfig, defaultConfig) > 0
-    }
-
-    class DefaultOrderWebSecurityConfig extends WebSecurityConfigurerAdapter {}
-
-    @Order(Ordered.LOWEST_PRECEDENCE)
-    class LowestPriorityWebSecurityConfig extends WebSecurityConfigurerAdapter {}
 }

config/src/test/groovy/org/springframework/security/config/annotation/web/builders/DisableUseExpressionsConfig.java

@@ -1,34 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.builders;
-
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.web.configuration.BaseWebConfig;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer;
-
-@Configuration
-@EnableWebSecurity
-public class DisableUseExpressionsConfig extends BaseWebConfig {
-    protected void configure(HttpSecurity http) throws Exception {
-        // This config is also on UrlAuthorizationConfigurer javadoc
-        http
-            .apply(new UrlAuthorizationConfigurer<HttpSecurity>()).getRegistry()
-                .antMatchers("/users**","/sessions/**").hasRole("USER")
-                .antMatchers("/signup").hasRole("ANONYMOUS")
-                .anyRequest().hasRole("USER");
-    }
-}

config/src/test/groovy/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.groovy

@@ -501,4 +501,16 @@ public class NamespaceHttpTests extends BaseSpringSpec {
             findFilter(FilterSecurityInterceptor).securityMetadataSource.class == DefaultFilterInvocationSecurityMetadataSource
             findFilter(FilterSecurityInterceptor).accessDecisionManager.decisionVoters.collect { it.class } == [RoleVoter, AuthenticatedVoter]
     }
+
+    @Configuration
+    @EnableWebSecurity
+    static class DisableUseExpressionsConfig extends BaseWebConfig {
+        protected void configure(HttpSecurity http) throws Exception {
+            http
+                .apply(new UrlAuthorizationConfigurer()).getRegistry()
+                    .antMatchers("/users**","/sessions/**").hasRole("USER")
+                    .antMatchers("/signup").hasRole("ANONYMOUS")
+                    .anyRequest().hasRole("USER")
+        }
+    }
 }

config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/Sec2515Tests.groovy

@@ -1,117 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configuration;
-
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.beans.FatalBeanException;
-import org.springframework.context.annotation.AnnotationConfigApplicationContext
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.AuthenticationManager
-import org.springframework.security.authentication.TestingAuthenticationToken
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
-import org.springframework.security.config.annotation.BaseSpringSpec
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-
-public class Sec2515Tests extends BaseSpringSpec {
-
-    def "SEC-2515: Prevent StackOverflow with bean graph cycle"() {
-        when:
-           loadConfig(StackOverflowSecurityConfig)
-        then:
-            thrown(FatalBeanException)
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class StackOverflowSecurityConfig extends WebSecurityConfigurerAdapter {
-
-        @Override
-        @Bean
-        public AuthenticationManager authenticationManagerBean()
-                throws Exception {
-            return super.authenticationManagerBean();
-        }
-    }
-
-    def "Custom Name Prevent StackOverflow with bean graph cycle"() {
-        when:
-           loadConfig(StackOverflowSecurityConfig)
-        then:
-            thrown(FatalBeanException)
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class CustomBeanNameStackOverflowSecurityConfig extends WebSecurityConfigurerAdapter {
-
-        @Override
-        @Bean(name="custom")
-        public AuthenticationManager authenticationManagerBean()
-                throws Exception {
-            return super.authenticationManagerBean();
-        }
-    }
-
-    def "SEC-2549: Can load with child classloader"() {
-        setup:
-            CanLoadWithChildConfig.AM = Mock(AuthenticationManager)
-            context = new AnnotationConfigApplicationContext()
-            context.classLoader = new URLClassLoader(new URL[0], context.classLoader)
-            context.register(CanLoadWithChildConfig)
-            context.refresh()
-        when:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user", "password"))
-        then:
-            noExceptionThrown()
-            1 * CanLoadWithChildConfig.AM.authenticate(_) >> new TestingAuthenticationToken("user","password","ROLE_USER")
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class CanLoadWithChildConfig extends WebSecurityConfigurerAdapter {
-        static AuthenticationManager AM
-        @Bean
-        public AuthenticationManager am() {
-            AM
-        }
-    }
-
-    def "SEC-2515: @Bean still works when configure(AuthenticationManagerBuilder) used"() {
-        when:
-           loadConfig(SecurityConfig)
-        then:
-            noExceptionThrown();
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class SecurityConfig extends WebSecurityConfigurerAdapter {
-
-        @Override
-        @Bean
-        public AuthenticationManager authenticationManagerBean()
-                throws Exception {
-            return super.authenticationManagerBean();
-        }
-
-        @Override
-        protected void configure(AuthenticationManagerBuilder auth)
-                throws Exception {
-            auth.inMemoryAuthentication()
-        }
-    }
-}

config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.groovy

@@ -17,28 +17,31 @@ package org.springframework.security.config.annotation.web.configuration;
 
 import static org.junit.Assert.*
 
+import java.util.List;
+
 import org.springframework.beans.factory.BeanCreationException
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.context.annotation.AnnotationConfigApplicationContext
-import org.springframework.context.annotation.Bean
+import org.springframework.context.ApplicationListener;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration
 import org.springframework.core.annotation.Order
-import org.springframework.expression.ExpressionParser
-import org.springframework.mock.web.MockHttpServletRequest
-import org.springframework.security.access.expression.SecurityExpressionHandler
+import org.springframework.expression.ExpressionParser;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.access.expression.SecurityExpressionHandler;
 import org.springframework.security.authentication.AuthenticationManager
+import org.springframework.security.authentication.event.AuthenticationSuccessEvent;
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.builders.WebSecurity
 import org.springframework.security.web.FilterChainProxy
 import org.springframework.security.web.SecurityFilterChain
-import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator
-import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator
-import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler
-import org.springframework.security.web.access.expression.WebSecurityExpressionHandler
+import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator;
+import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
+import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;
+import org.springframework.security.web.access.expression.WebSecurityExpressionHandler;
+import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
 import org.springframework.security.web.util.matcher.AnyRequestMatcher
-import org.springframework.test.util.ReflectionTestUtils
+import org.springframework.test.util.ReflectionTestUtils;
 
 /**
  * @author Rob Winch
@@ -310,36 +313,4 @@ class WebSecurityConfigurationTests extends BaseSpringSpec {
             }
         }
     }
-
-    def "SEC-2461: Multiple WebSecurityConfiguration instances cause null springSecurityFilterChain"() {
-        setup:
-            def parent = loadConfig(ParentConfig)
-            def child = new AnnotationConfigApplicationContext()
-            child.register(ChildConfig)
-            child.parent = parent
-        when:
-            child.refresh()
-        then: "springSecurityFilterChain can be found in parent and child"
-            parent.getBean("springSecurityFilterChain")
-            child.getBean("springSecurityFilterChain")
-        and: "springSecurityFilterChain is defined in both parent and child (don't search parent)"
-            parent.containsBeanDefinition("springSecurityFilterChain")
-            child.containsBeanDefinition("springSecurityFilterChain")
-        cleanup:
-            child?.close()
-            // parent.close() is in superclass
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class ParentConfig extends WebSecurityConfigurerAdapter {
-        @Autowired
-        public void configureGlobal(AuthenticationManagerBuilder auth) {
-            auth.inMemoryAuthentication()
-        }
-    }
-
-    @EnableWebSecurity
-    @Configuration
-    static class ChildConfig extends WebSecurityConfigurerAdapter { }
 }

config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/sec2377/Sec2377Tests.groovy

@@ -1,38 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configuration.sec2377;
-
-import org.springframework.security.config.annotation.BaseSpringSpec
-import org.springframework.security.config.annotation.web.configuration.sec2377.a.*
-import org.springframework.security.config.annotation.web.configuration.sec2377.b.*
-import org.springframework.web.context.support.AnnotationConfigWebApplicationContext
-
-public class Sec2377Tests extends BaseSpringSpec {
-
-    def "SEC-2377: Error reporting with multiple EnableWebSecurity from other packages"() {
-        when:
-            AnnotationConfigWebApplicationContext parent = new AnnotationConfigWebApplicationContext()
-            parent.register(Sec2377AConfig)
-            parent.refresh()
-
-            AnnotationConfigWebApplicationContext child = new AnnotationConfigWebApplicationContext()
-            child.register(Sec2377BConfig)
-            child.parent = parent
-            child.refresh()
-        then:
-            noExceptionThrown();
-    }
-}