Release version 4.2.8.RELEASE

acl/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-acl</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-acl</name>
   <description>spring-security-acl</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

aspects/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-aspects</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-aspects</name>
   <description>spring-security-aspects</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,7 +45,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

build.gradle

@@ -11,7 +11,7 @@ buildscript {
 		classpath('me.champeau.gradle:gradle-javadoc-hotfix-plugin:0.1')
 		classpath('org.asciidoctor:asciidoctor-gradle-plugin:1.5.1')
 		classpath("io.spring.gradle:docbook-reference-plugin:0.3.1")
-		classpath("org.springframework.boot:spring-boot-gradle-plugin:1.5.17.RELEASE")
+		classpath("org.springframework.boot:spring-boot-gradle-plugin:1.5.2.RELEASE")
 	}
 }
 
@@ -30,7 +30,7 @@ allprojects {
 
 	ext.releaseBuild = version.endsWith('RELEASE')
 	ext.snapshotBuild = version.endsWith('SNAPSHOT')
-	ext.springVersion = '4.3.21.RELEASE'
+	ext.springVersion = '4.3.19.RELEASE'
 	ext.springLdapVersion = '2.3.2.RELEASE'
 
 	group = 'org.springframework.security'
@@ -61,7 +61,6 @@ sonarqube {
 // Set up different subproject lists for individual configuration
 ext.javaProjects = subprojects.findAll { project -> project.name != 'docs' && project.name != 'manual' && project.name != 'guides' && project.name != 'spring-security-bom' }
 ext.sampleProjects = subprojects.findAll { project -> project.name.startsWith('spring-security-samples') }
-ext.sampleBootProjects = subprojects.findAll { project -> project.name.startsWith('spring-security-samples-boot') }
 ext.itestProjects = subprojects.findAll { project -> project.name.startsWith('itest') }
 ext.coreModuleProjects = javaProjects - sampleProjects - itestProjects
 ext.aspectjProjects = [project(':spring-security-aspects'), project(':spring-security-samples-xml-aspectj'), project(':spring-security-samples-javaconfig-aspectj')]
@@ -120,7 +119,7 @@ configure(coreModuleProjects) {
 			imports {
 				mavenBom("io.spring.platform:platform-bom:${springIoVersion}") {
 					bomProperties([
-						'assertj.version': '2.6.0',
+						'assertj.version': '2.2.0',
 						'mockito.version': '1.10.19'
 					])
 				}

cas/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-cas</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-cas</name>
   <description>spring-security-cas</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -51,13 +51,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -89,7 +89,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.8.11.3</version>
+      <version>2.8.11.2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>

config/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-config</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-config</name>
   <description>spring-security-config</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -97,28 +97,28 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-ldap</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-messaging</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-openid</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
@@ -161,7 +161,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -347,7 +347,7 @@
     <dependency>
       <groupId>org.springframework.data</groupId>
       <artifactId>spring-data-jpa</artifactId>
-      <version>1.11.17.RELEASE</version>
+      <version>1.11.12.RELEASE</version>
       <scope>test</scope>
       <exclusions>
         <exclusion>
@@ -365,13 +365,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-aspects</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-cas</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>

config/src/main/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurer.java

@@ -23,7 +23,6 @@ import org.springframework.http.MediaType;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
-import org.springframework.security.web.savedrequest.NullRequestCache;
 import org.springframework.security.web.savedrequest.RequestCache;
 import org.springframework.security.web.savedrequest.RequestCacheAwareFilter;
 import org.springframework.security.web.util.matcher.AndRequestMatcher;
@@ -86,12 +85,6 @@ public final class RequestCacheConfigurer<H extends HttpSecurityBuilder<H>> exte
 		return this;
 	}
 
-	@Override
-	public H disable() {
-		getBuilder().setSharedObject(RequestCache.class, new NullRequestCache());
-		return super.disable();
-	}
-
 	@Override
 	public void init(H http) throws Exception {
 		http.setSharedObject(RequestCache.class, getRequestCache(http));

config/src/main/resources/org/springframework/security/config/spring-security-4.2.rnc

@@ -748,7 +748,7 @@ csrf-options.attlist &=
 	## The RequestMatcher instance to be used to determine if CSRF should be applied. Default is any HTTP method except "GET", "TRACE", "HEAD", "OPTIONS"
 	attribute request-matcher-ref { xsd:token }?
 csrf-options.attlist &=
-	## The CsrfTokenRepository to use. The default is HttpSessionCsrfTokenRepository wrapped by LazyCsrfTokenRepository.
+	## The CsrfTokenRepository to use. The default is HttpSessionCsrfTokenRepository
 	attribute token-repository-ref { xsd:token }?
 
 headers =

config/src/main/resources/org/springframework/security/config/spring-security-4.2.xsd

@@ -2337,8 +2337,7 @@
       </xs:attribute>
       <xs:attribute name="token-repository-ref" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The CsrfTokenRepository to use. The default is HttpSessionCsrfTokenRepository wrapped by
-                LazyCsrfTokenRepository.
+            <xs:documentation>The CsrfTokenRepository to use. The default is HttpSessionCsrfTokenRepository
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>

config/src/test/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurerDisabledTests.java

@@ -1,123 +0,0 @@
-/*
- * Copyright 2002-2018 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers;
-
-import javax.servlet.http.HttpSession;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.mock.web.MockFilterChain;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.mock.web.MockServletContext;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.core.userdetails.User;
-import org.springframework.security.core.userdetails.UserDetailsService;
-import org.springframework.security.provisioning.InMemoryUserDetailsManager;
-import org.springframework.security.web.FilterChainProxy;
-import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Tests for {@link RequestCacheConfigurer#disable()}
- *
- * @author Josh Cummings
- */
-public class RequestCacheConfigurerDisabledTests {
-	AnnotationConfigWebApplicationContext context;
-
-	MockHttpServletRequest request;
-	MockHttpServletResponse response;
-	MockFilterChain chain;
-
-	@Autowired
-	FilterChainProxy springSecurityFilterChain;
-
-	@Before
-	public void setup() {
-		this.request = new MockHttpServletRequest();
-		this.request.setMethod("GET");
-		this.response = new MockHttpServletResponse();
-		this.chain = new MockFilterChain();
-	}
-
-	@After
-	public void cleanup() {
-		if (this.context != null) {
-			this.context.close();
-		}
-	}
-
-	// gh-6102
-	@Test
-	public void getWhenRequestCacheIsDisabledThenExceptionTranslationFilterDoesNotStoreRequest() throws Exception {
-		loadConfig(RequestCacheDisabledConfig.class);
-
-		this.request.setServletPath("/path");
-		this.request.setRequestURI("/path");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-
-		HttpSession session = this.request.getSession();
-
-		setup();
-
-		this.request.setServletPath("/login");
-		this.request.setMethod("POST");
-		this.request.setParameter("username", "user");
-		this.request.setParameter("password", "password");
-		this.request.setSession(session);
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-
-		assertThat(this.response.getRedirectedUrl()).isEqualTo("/");
-	}
-
-	@EnableWebSecurity
-	static class RequestCacheDisabledConfig extends WebSecurityConfigurerAdapter {
-		@Override
-		protected void configure(HttpSecurity http) throws Exception {
-			super.configure(http);
-			http
-				.requestCache().disable()
-				.csrf().disable();
-		}
-
-		@Bean
-		public UserDetailsService userDetailsService() {
-			return new InMemoryUserDetailsManager(
-				User.withUsername("user")
-					.password("password")
-					.roles("USER")
-					.build());
-		}
-	}
-
-	public void loadConfig(Class<?>... configs) {
-		this.context = new AnnotationConfigWebApplicationContext();
-		this.context.register(configs);
-		this.context.setServletContext(new MockServletContext());
-		this.context.refresh();
-
-		this.context.getAutowireCapableBeanFactory().autowireBean(this);
-	}
-}

core/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-core</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-core</name>
   <description>spring-security-core</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -82,7 +82,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.8.11.3</version>
+      <version>2.8.11.2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>

core/src/main/java/org/springframework/security/access/annotation/Secured.java

@@ -55,5 +55,5 @@ public @interface Secured {
 	 *
 	 * @return String[] The secure method attributes
 	 */
-	public String[] value();
+	public String[]value();
 }

core/src/main/java/org/springframework/security/core/SpringSecurityCoreVersion.java

@@ -40,7 +40,7 @@ public class SpringSecurityCoreVersion {
 	 */
 	public static final long SERIAL_VERSION_UID = 420L;
 
-	static final String MIN_SPRING_VERSION = "4.3.21.RELEASE";
+	static final String MIN_SPRING_VERSION = "4.3.19.RELEASE";
 
 	static {
 		performVersionChecks();

crypto/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-crypto</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-crypto</name>
   <description>spring-security-crypto</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

data/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-data</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-data</name>
   <description>spring-security-data</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,13 +45,13 @@
     <dependency>
       <groupId>org.springframework.data</groupId>
       <artifactId>spring-data-commons</artifactId>
-      <version>1.13.17.RELEASE</version>
+      <version>1.13.14.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

gradle.properties

@@ -1 +1 @@
-version=4.2.10.RELEASE
+version=4.2.8.RELEASE

gradle/javaprojects.gradle

@@ -11,7 +11,7 @@ targetCompatibility = 1.6
 ext.apacheDsVersion = '1.5.5'
 ext.aspectjVersion = '1.8.13'
 ext.casClientVersion = '3.4.1'
-ext.cglibVersion = '3.2.9'
+ext.cglibVersion = '3.1'
 ext.commonsCodecVersion = '1.10'
 ext.commonsCollectionsVersion = '3.2.2'
 ext.commonsLoggingVersion = '1.2'
@@ -21,7 +21,7 @@ ext.groovyVersion = '2.4.4'
 ext.hsqlVersion = '2.3.6'
 ext.hibernateVersion = '5.0.12.Final'
 ext.hibernateValidatorVersion = '5.3.6.Final'
-ext.jacksonDatabindVersion = '2.8.11.3'
+ext.jacksonDatabindVersion = '2.8.11.2'
 ext.javaPersistenceVersion = '2.1.1'
 ext.jettyVersion = '6.1.26'
 ext.jstlVersion = '1.2.2'
@@ -32,11 +32,11 @@ ext.seleniumVersion = '2.44.0'
 ext.servletApiVersion = '3.1.0'
 ext.slf4jVersion = '1.7.25'
 ext.spockVersion = '0.7-groovy-2.0'
-ext.springDataCommonsVersion = '1.13.17.RELEASE'
-ext.springDataJpaVersion = '1.11.17.RELEASE'
-ext.springDataRedisVersion = '1.8.17.RELEASE'
-ext.springSessionVersion = '1.3.4.RELEASE'
-ext.springBootVersion = '1.5.16.RELEASE'
+ext.springDataCommonsVersion = '1.13.14.RELEASE'
+ext.springDataJpaVersion = '1.11.12.RELEASE'
+ext.springDataRedisVersion = '1.8.12.RELEASE'
+ext.springSessionVersion = '1.3.2.RELEASE'
+ext.springBootVersion = '1.5.15.RELEASE'
 ext.thymeleafVersion = '3.0.9.RELEASE'
 ext.jsonassertVersion = '1.4.0'
 ext.validationApiVersion = '1.1.0.Final'

gradle/maven-deployment.gradle

@@ -70,8 +70,8 @@ def customizePom(pom, gradleProject) {
 				email = 'rwinch@gopivotal.com'
 			}
 		}
-		// Exclude spring-framework-bom for sample Boot projects since spring-boot-starter-parent imports spring-framework-bom
-		if(!gradleProject.name.endsWith('-bom') && !sampleBootProjects.contains(gradleProject)) {
+
+		if(!gradleProject.name.endsWith('-bom')) {
 			dependencyManagement {
 				dependencies {
 					dependency {

itest/context/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>itest-context</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>itest-context</name>
   <description>itest-context</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -57,7 +57,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -132,13 +132,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>

itest/web/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>itest-web</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>itest-web</name>
   <description>itest-web</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -98,31 +98,31 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-ldap</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-test</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>

ldap/ldap.gradle

@@ -13,8 +13,7 @@ dependencies {
 			 "org.apache.directory.server:apacheds-protocol-ldap:$apacheDsVersion",
 			 "org.apache.directory.server:apacheds-server-jndi:$apacheDsVersion",
 			 'org.apache.directory.shared:shared-ldap:0.9.15',
-			 'ldapsdk:ldapsdk:4.1',
-			 'com.unboundid:unboundid-ldapsdk:3.2.1'
+			 'ldapsdk:ldapsdk:4.1'
 
 	compile ("org.springframework.ldap:spring-ldap-core:$springLdapVersion") {
 		exclude(group: 'commons-logging', module: 'commons-logging')
@@ -29,8 +28,7 @@ dependencies {
 }
 
 integrationTest {
-	include('**/ApacheDSServerIntegrationTests.class', '**/ApacheDSEmbeddedLdifTests.class',
-		'**/LdapUserDetailsManagerModifyPasswordTests.class')
+	include('**/ApacheDSServerIntegrationTests.class', '**/ApacheDSEmbeddedLdifTests.class')
 //	  exclude('**/OpenLDAPIntegrationTestSuite.class')
 	maxParallelForks = 1
 }

ldap/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-ldap</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-ldap</name>
   <description>spring-security-ldap</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -73,7 +73,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -102,13 +102,6 @@
       <artifactId>spring-tx</artifactId>
       <scope>compile</scope>
     </dependency>
-    <dependency>
-      <groupId>com.unboundid</groupId>
-      <artifactId>unboundid-ldapsdk</artifactId>
-      <version>3.2.1</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
     <dependency>
       <groupId>commons-logging</groupId>
       <artifactId>commons-logging</artifactId>

ldap/src/integration-test/java/org/springframework/security/ldap/server/UnboundIdContainerTests.java

@@ -1,78 +0,0 @@
-/*
- * Copyright 2002-2018 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.ldap.server;
-
-import java.io.IOException;
-import java.net.ServerSocket;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.junit.Test;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.junit.Assert.fail;
-
-/**
- * @author Eddú Meléndez
- */
-public class UnboundIdContainerTests {
-
-	@Test
-	public void startLdapServer() throws IOException {
-		UnboundIdContainer server = new UnboundIdContainer("dc=springframework,dc=org",
-				"classpath:test-server.ldif");
-		List<Integer> ports = getDefaultPorts(1);
-		server.setPort(ports.get(0));
-
-		try {
-			server.afterPropertiesSet();
-			fail("Expected a RuntimeException to be thrown.");
-		} catch (Exception ex) {
-			assertThat(ex).hasMessage("Server startup failed");
-		}
-	}
-
-	@Test
-	public void afterPropertiesSetWhenPortIsZeroThenRandomPortIsSelected() throws Exception {
-		UnboundIdContainer server = new UnboundIdContainer("dc=springframework,dc=org", null);
-		server.setPort(0);
-
-		try {
-			server.afterPropertiesSet();
-			assertThat(server.getPort()).isNotEqualTo(0);
-		} finally {
-			server.destroy();
-		}
-	}
-
-	private List<Integer> getDefaultPorts(int count) throws IOException {
-		List<ServerSocket> connections = new ArrayList<ServerSocket>();
-		List<Integer> availablePorts = new ArrayList<Integer>(count);
-		try {
-			for (int i = 0; i < count; i++) {
-				ServerSocket socket = new ServerSocket(0);
-				connections.add(socket);
-				availablePorts.add(socket.getLocalPort());
-			}
-			return availablePorts;
-		} finally {
-			for (ServerSocket conn : connections) {
-				conn.close();
-			}
-		}
-	}
-
-}

ldap/src/integration-test/java/org/springframework/security/ldap/userdetails/LdapUserDetailsManagerModifyPasswordTests.java

@@ -1,130 +0,0 @@
-/*
- * Copyright 2002-2018 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.ldap.userdetails;
-
-import javax.annotation.PreDestroy;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.ConfigurableApplicationContext;
-import org.springframework.context.annotation.AnnotationConfigApplicationContext;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.ldap.core.ContextSource;
-import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.ldap.DefaultLdapUsernameToDnMapper;
-import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
-import org.springframework.security.ldap.SpringSecurityLdapTemplate;
-import org.springframework.security.ldap.server.UnboundIdContainer;
-import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Tests for {@link LdapUserDetailsManager#changePassword}, specifically relating to the
- * use of the Modify Password Extended Operation.
- *
- * @author Josh Cummings
- */
-@RunWith(SpringJUnit4ClassRunner.class)
-public class LdapUserDetailsManagerModifyPasswordTests {
-
-	ConfigurableApplicationContext context;
-
-	LdapUserDetailsManager userDetailsManager;
-	ContextSource contextSource;
-
-	@Before
-	public void setup() {
-		this.context = new AnnotationConfigApplicationContext(ContainerConfiguration.class, LdapConfiguration.class);
-		this.contextSource = this.context.getBean(ContextSource.class);
-
-		this.userDetailsManager = new LdapUserDetailsManager(this.contextSource);
-		this.userDetailsManager.setUsePasswordModifyExtensionOperation(true);
-		this.userDetailsManager.setUsernameMapper(new DefaultLdapUsernameToDnMapper("ou=people", "uid"));
-	}
-
-	@After
-	public void teardown() {
-		this.context.close();
-	}
-
-	@Test(expected = BadCredentialsException.class)
-	public void changePasswordWhenOldPasswordIsIncorrectThenThrowsException() {
-		try {
-			TestingAuthenticationToken token = new TestingAuthenticationToken("bob", "bobpassword",
-				AuthorityUtils.createAuthorityList("ROLE_USER"));
-			SecurityContextHolder.getContext().setAuthentication(token);
-			this.userDetailsManager.changePassword("wrongoldpassword", "bobsnewpassword");
-		} finally {
-			SecurityContextHolder.clearContext();
-		}
-	}
-
-	@Test
-	public void changePasswordWhenOldPasswordIsCorrectThenPasses() {
-		try {
-			TestingAuthenticationToken token = new TestingAuthenticationToken("bob", "bobpassword",
-				AuthorityUtils.createAuthorityList("ROLE_USER"));
-			SecurityContextHolder.getContext().setAuthentication(token);
-
-			SpringSecurityLdapTemplate template = new SpringSecurityLdapTemplate(this.contextSource);
-
-			this.userDetailsManager.changePassword("bobspassword",
-				"bobsshinynewandformidablylongandnearlyimpossibletorememberthoughdemonstrablyhardtocrackduetoitshighlevelofentropypasswordofjustice");
-
-			assertThat(template.compare("uid=bob,ou=people", "userPassword",
-				"bobsshinynewandformidablylongandnearlyimpossibletorememberthoughdemonstrablyhardtocrackduetoitshighlevelofentropypasswordofjustice")).isTrue();
-		} finally {
-			SecurityContextHolder.clearContext();
-		}
-	}
-
-	@Configuration
-	static class LdapConfiguration {
-		@Autowired UnboundIdContainer container;
-
-		@Bean
-		ContextSource contextSource() throws Exception {
-			return new DefaultSpringSecurityContextSource("ldap://127.0.0.1:"
-					+ this.container.getPort() + "/dc=springframework,dc=org");
-		}
-	}
-
-	@Configuration
-	static class ContainerConfiguration {
-		UnboundIdContainer container = new UnboundIdContainer("dc=springframework,dc=org",
-				"classpath:test-server.ldif");
-
-		@Bean
-		UnboundIdContainer ldapContainer() {
-			this.container.setPort(0);
-			return this.container;
-		}
-
-		@PreDestroy
-		void shutdown() {
-			this.container.stop();
-		}
-	}
-}

ldap/src/main/java/org/springframework/security/ldap/server/UnboundIdContainer.java

@@ -1,150 +0,0 @@
-/*
- * Copyright 2002-2018 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.ldap.server;
-
-import java.io.IOException;
-import java.io.InputStream;
-
-import com.unboundid.ldap.listener.InMemoryDirectoryServer;
-import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
-import com.unboundid.ldap.listener.InMemoryListenerConfig;
-import com.unboundid.ldap.sdk.DN;
-import com.unboundid.ldap.sdk.Entry;
-import com.unboundid.ldap.sdk.LDAPException;
-import com.unboundid.ldif.LDIFReader;
-
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.DisposableBean;
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.context.Lifecycle;
-import org.springframework.core.io.Resource;
-import org.springframework.util.StringUtils;
-
-/**
- * @author Eddú Meléndez
- */
-public class UnboundIdContainer implements InitializingBean, DisposableBean, Lifecycle,
-		ApplicationContextAware {
-
-	private InMemoryDirectoryServer directoryServer;
-
-	private String defaultPartitionSuffix;
-
-	private int port = 53389;
-
-	private ApplicationContext context;
-
-	private boolean running;
-
-	private String ldif;
-
-	public UnboundIdContainer(String defaultPartitionSuffix, String ldif) {
-		this.defaultPartitionSuffix = defaultPartitionSuffix;
-		this.ldif = ldif;
-	}
-
-	public int getPort() {
-		return this.port;
-	}
-
-	public void setPort(int port) {
-		this.port = port;
-	}
-
-	@Override
-	public void destroy() throws Exception {
-		stop();
-	}
-
-	@Override
-	public void afterPropertiesSet() throws Exception {
-		start();
-	}
-
-	@Override
-	public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-		this.context = applicationContext;
-	}
-
-	@Override
-	public void start() {
-		if (isRunning()) {
-			return;
-		}
-
-		try {
-			InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(this.defaultPartitionSuffix);
-			config.addAdditionalBindCredentials("uid=admin,ou=system", "secret");
-
-			config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("LDAP", this.port));
-			config.setEnforceSingleStructuralObjectClass(false);
-			config.setEnforceAttributeSyntaxCompliance(true);
-
-			DN dn = new DN(this.defaultPartitionSuffix);
-			Entry entry = new Entry(dn);
-			entry.addAttribute("objectClass", "top", "domain", "extensibleObject");
-			entry.addAttribute("dc", dn.getRDN().getAttributeValues()[0]);
-
-			InMemoryDirectoryServer directoryServer = new InMemoryDirectoryServer(config);
-			directoryServer.add(entry);
-			importLdif(directoryServer);
-			directoryServer.startListening();
-			this.port = directoryServer.getListenPort();
-			this.directoryServer = directoryServer;
-			this.running = true;
-		} catch (LDAPException ex) {
-			throw new RuntimeException("Server startup failed", ex);
-		}
-
-	}
-
-	private void importLdif(InMemoryDirectoryServer directoryServer) {
-		if (StringUtils.hasText(this.ldif)) {
-			try {
-				Resource resource = this.context.getResource(this.ldif);
-				if (resource.exists()) {
-					InputStream inputStream = null;
-					try {
-						inputStream = resource.getInputStream();
-						directoryServer.importFromLDIF(false, new LDIFReader(inputStream));
-					} finally {
-						if (inputStream != null) {
-							try {
-								inputStream.close();
-							} catch (IOException ex) {
-								throw new IllegalStateException("Unable to load LDIF " + this.ldif, ex);
-							}
-						}
-					}
-				}
-			} catch (Exception ex) {
-				throw new IllegalStateException("Unable to load LDIF " + this.ldif, ex);
-			}
-		}
-	}
-
-	@Override
-	public void stop() {
-		this.directoryServer.shutDown(true);
-	}
-
-	@Override
-	public boolean isRunning() {
-		return this.running;
-	}
-}

ldap/src/main/java/org/springframework/security/ldap/userdetails/LdapUserDetailsManager.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2018 the original author or authors.
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,13 +15,12 @@
  */
 package org.springframework.security.ldap.userdetails;
 
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.ListIterator;
+
 import javax.naming.Context;
 import javax.naming.NameNotFoundException;
 import javax.naming.NamingEnumeration;
@@ -33,13 +32,10 @@ import javax.naming.directory.DirContext;
 import javax.naming.directory.ModificationItem;
 import javax.naming.directory.SearchControls;
 import javax.naming.directory.SearchResult;
-import javax.naming.ldap.ExtendedRequest;
-import javax.naming.ldap.ExtendedResponse;
 import javax.naming.ldap.LdapContext;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-
 import org.springframework.ldap.core.AttributesMapper;
 import org.springframework.ldap.core.AttributesMapperCallbackHandler;
 import org.springframework.ldap.core.ContextExecutor;
@@ -74,7 +70,6 @@ import org.springframework.util.Assert;
  * setup.
  *
  * @author Luke Taylor
- * @author Josh Cummings
  * @since 2.0
  */
 public class LdapUserDetailsManager implements UserDetailsManager {
@@ -128,8 +123,6 @@ public class LdapUserDetailsManager implements UserDetailsManager {
 
 	private String[] attributesToRetrieve;
 
-	private boolean usePasswordModifyExtensionOperation = false;
-
 	public LdapUserDetailsManager(ContextSource contextSource) {
 		template = new LdapTemplate(contextSource);
 	}
@@ -164,21 +157,8 @@ public class LdapUserDetailsManager implements UserDetailsManager {
 	/**
 	 * Changes the password for the current user. The username is obtained from the
 	 * security context.
-	 *
-	 * There are two supported strategies for modifying the user's password depending on
-	 * the capabilities of the corresponding LDAP server.
-	 *
 	 * <p>
-	 * Configured one way, this method will modify the user's password via the
-	 * <a target="_blank" href="https://tools.ietf.org/html/rfc3062">
-	 *     LDAP Password Modify Extended Operation
-	 * </a>.
-	 *
-	 * See {@link LdapUserDetailsManager#setUsePasswordModifyExtensionOperation(boolean)} for details.
-	 * </p>
-	 *
-	 * <p>
-	 * By default, though, if the old password is supplied, the update will be made by rebinding as the user,
+	 * If the old password is supplied, the update will be made by rebinding as the user,
 	 * thus modifying the password using the user's permissions. If
 	 * <code>oldPassword</code> is null, the update will be attempted using a standard
 	 * read/write context supplied by the context source.
@@ -198,13 +178,38 @@ public class LdapUserDetailsManager implements UserDetailsManager {
 
 		logger.debug("Changing password for user '" + username);
 
-		DistinguishedName userDn = usernameMapper.buildDn(username);
+		final DistinguishedName dn = usernameMapper.buildDn(username);
+		final ModificationItem[] passwordChange = new ModificationItem[] { new ModificationItem(
+				DirContext.REPLACE_ATTRIBUTE, new BasicAttribute(passwordAttributeName,
+						newPassword)) };
 
-		if (usePasswordModifyExtensionOperation) {
-			changePasswordUsingExtensionOperation(userDn, oldPassword, newPassword);
-		} else {
-			changePasswordUsingAttributeModification(userDn, oldPassword, newPassword);
+		if (oldPassword == null) {
+			template.modifyAttributes(dn, passwordChange);
+			return;
 		}
+
+		template.executeReadWrite(new ContextExecutor() {
+
+			public Object executeWithContext(DirContext dirCtx) throws NamingException {
+				LdapContext ctx = (LdapContext) dirCtx;
+				ctx.removeFromEnvironment("com.sun.jndi.ldap.connect.pool");
+				ctx.addToEnvironment(Context.SECURITY_PRINCIPAL,
+						LdapUtils.getFullDn(dn, ctx).toString());
+				ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, oldPassword);
+				// TODO: reconnect doesn't appear to actually change the credentials
+				try {
+					ctx.reconnect(null);
+				}
+				catch (javax.naming.AuthenticationException e) {
+					throw new BadCredentialsException(
+							"Authentication for password change failed.");
+				}
+
+				ctx.modifyAttributes(dn, passwordChange);
+
+				return null;
+			}
+		});
 	}
 
 	/**
@@ -409,181 +414,4 @@ public class LdapUserDetailsManager implements UserDetailsManager {
 	public void setRoleMapper(AttributesMapper roleMapper) {
 		this.roleMapper = roleMapper;
 	}
-
-	/**
-	 * Sets the method by which a user's password gets modified.
-	 *
-	 * If set to {@code true}, then {@link LdapUserDetailsManager#changePassword} will modify
-	 * the user's password by way of the
-	 * <a target="_blank" href="https://tools.ietf.org/html/rfc3062">Password Modify Extension Operation</a>.
-	 *
-	 * If set to {@code false}, then {@link LdapUserDetailsManager#changePassword} will modify
-	 * the user's password by directly modifying attributes on the corresponding entry.
-	 *
-	 * Before using this setting, ensure that the corresponding LDAP server supports this extended operation.
-	 *
-	 * By default, {@code usePasswordModifyExtensionOperation} is false.
-	 *
-	 * @param usePasswordModifyExtensionOperation
-	 * @since 4.2.9
-	 */
-	public void setUsePasswordModifyExtensionOperation(boolean usePasswordModifyExtensionOperation) {
-		this.usePasswordModifyExtensionOperation = usePasswordModifyExtensionOperation;
-	}
-
-	private void changePasswordUsingAttributeModification
-			(final DistinguishedName userDn, final String oldPassword, final String newPassword) {
-
-		final ModificationItem[] passwordChange = new ModificationItem[] { new ModificationItem(
-				DirContext.REPLACE_ATTRIBUTE, new BasicAttribute(passwordAttributeName,
-				newPassword)) };
-
-		if (oldPassword == null) {
-			template.modifyAttributes(userDn, passwordChange);
-			return;
-		}
-
-		template.executeReadWrite(new ContextExecutor<Object>() {
-			@Override
-			public Object executeWithContext(DirContext dirCtx) throws NamingException {
-				LdapContext ctx = (LdapContext) dirCtx;
-				ctx.removeFromEnvironment("com.sun.jndi.ldap.connect.pool");
-				ctx.addToEnvironment(Context.SECURITY_PRINCIPAL,
-					LdapUtils.getFullDn(userDn, ctx).toString());
-				ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, oldPassword);
-				// TODO: reconnect doesn't appear to actually change the credentials
-				try {
-					ctx.reconnect(null);
-				} catch (javax.naming.AuthenticationException e) {
-					throw new BadCredentialsException(
-						"Authentication for password change failed.");
-				}
-
-				ctx.modifyAttributes(userDn, passwordChange);
-
-				return null;
-
-			}
-		});
-
-	}
-
-	private void changePasswordUsingExtensionOperation
-			(final DistinguishedName userDn, final String oldPassword, final String newPassword) {
-
-		template.executeReadWrite(new ContextExecutor<Object>() {
-			@Override
-			public Object executeWithContext(DirContext dirCtx) throws NamingException {
-				LdapContext ctx = (LdapContext) dirCtx;
-
-				String userIdentity = LdapUtils.getFullDn(userDn, ctx).encode();
-				PasswordModifyRequest request =
-					new PasswordModifyRequest(userIdentity, oldPassword, newPassword);
-
-				try {
-					return ctx.extendedOperation(request);
-				} catch (javax.naming.AuthenticationException e) {
-					throw new BadCredentialsException(
-						"Authentication for password change failed.");
-				}
-			}
-		});
-	}
-
-	/**
-	 * An implementation of the
-	 * <a target="_blank" href="https://tools.ietf.org/html/rfc3062">
-	 *    LDAP Password Modify Extended Operation
-	 * </a>
-	 * client request.
-	 *
-	 * Can be directed at any LDAP server that supports the Password Modify Extended Operation.
-	 *
-	 * @author Josh Cummings
-	 * @since 4.2.9
-	 */
-	private static class PasswordModifyRequest implements ExtendedRequest {
-		private static final byte SEQUENCE_TYPE = 48;
-
-		private static final String PASSWORD_MODIFY_OID = "1.3.6.1.4.1.4203.1.11.1";
-		private static final byte USER_IDENTITY_OCTET_TYPE = -128;
-		private static final byte OLD_PASSWORD_OCTET_TYPE = -127;
-		private static final byte NEW_PASSWORD_OCTET_TYPE = -126;
-
-		private final ByteArrayOutputStream value = new ByteArrayOutputStream();
-
-		public PasswordModifyRequest(String userIdentity, String oldPassword, String newPassword) {
-			ByteArrayOutputStream elements = new ByteArrayOutputStream();
-
-			if (userIdentity != null) {
-				berEncode(USER_IDENTITY_OCTET_TYPE, userIdentity.getBytes(), elements);
-			}
-
-			if (oldPassword != null) {
-				berEncode(OLD_PASSWORD_OCTET_TYPE, oldPassword.getBytes(), elements);
-			}
-
-			if (newPassword != null) {
-				berEncode(NEW_PASSWORD_OCTET_TYPE, newPassword.getBytes(), elements);
-			}
-
-			berEncode(SEQUENCE_TYPE, elements.toByteArray(), this.value);
-		}
-
-		@Override
-		public String getID() {
-			return PASSWORD_MODIFY_OID;
-		}
-
-		@Override
-		public byte[] getEncodedValue() {
-			return this.value.toByteArray();
-		}
-
-		@Override
-		public ExtendedResponse createExtendedResponse(String id, byte[] berValue, int offset, int length) {
-			return null;
-		}
-
-		/**
-		 * Only minimal support for
-		 * <a target="_blank" href="https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf">
-		 *     BER encoding
-		 * </a>; just what is necessary for the Password Modify request.
-		 *
-		 */
-		private void berEncode(byte type, byte[] src, ByteArrayOutputStream dest) {
-			int length = src.length;
-
-			dest.write(type);
-
-			if (length < 128) {
-				dest.write(length);
-			} else if ((length & 0x000000FF) == length) {
-				dest.write((byte) 0x81);
-				dest.write((byte) (length & 0xFF));
-			} else if ((length & 0x0000FFFF) == length) {
-				dest.write((byte) 0x82);
-				dest.write((byte) ((length >> 8) & 0xFF));
-				dest.write((byte) (length & 0xFF));
-			} else if ((length & 0x00FFFFFF) == length) {
-				dest.write((byte) 0x83);
-				dest.write((byte) ((length >> 16) & 0xFF));
-				dest.write((byte) ((length >> 8) & 0xFF));
-				dest.write((byte) (length & 0xFF));
-			} else {
-				dest.write((byte) 0x84);
-				dest.write((byte) ((length >> 24) & 0xFF));
-				dest.write((byte) ((length >> 16) & 0xFF));
-				dest.write((byte) ((length >> 8) & 0xFF));
-				dest.write((byte) (length & 0xFF));
-			}
-
-			try {
-				dest.write(src);
-			} catch (IOException e) {
-				throw new IllegalArgumentException("Failed to BER encode provided value of type: " + type);
-			}
-		}
-	}
 }

messaging/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-messaging</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-messaging</name>
   <description>spring-security-messaging</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -102,7 +102,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>

openid/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-openid</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-openid</name>
   <description>spring-security-openid</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -63,13 +63,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

remoting/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-remoting</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-remoting</name>
   <description>spring-security-remoting</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

samples/boot/helloworld/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-boot-helloworld</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-samples-boot-helloworld</name>
   <description>spring-security-samples-boot-helloworld</description>
   <url>http://spring.io/spring-security</url>
@@ -30,6 +30,17 @@
     <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
     <url>https://github.com/spring-projects/spring-security</url>
   </scm>
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-framework-bom</artifactId>
+        <version>4.3.19.RELEASE</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
   <dependencies>
     <dependency>
       <groupId>org.springframework.boot</groupId>
@@ -44,13 +55,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -104,7 +115,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-test</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>

samples/boot/insecure/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-boot-insecure</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-samples-boot-insecure</name>
   <description>spring-security-samples-boot-insecure</description>
   <url>http://spring.io/spring-security</url>
@@ -30,6 +30,17 @@
     <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
     <url>https://github.com/spring-projects/spring-security</url>
   </scm>
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-framework-bom</artifactId>
+        <version>4.3.19.RELEASE</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
   <dependencies>
     <dependency>
       <groupId>org.springframework.boot</groupId>

samples/javaconfig/aspectj/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-aspectj</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-samples-javaconfig-aspectj</name>
   <description>spring-security-samples-javaconfig-aspectj</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,13 +45,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -71,7 +71,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-aspects</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/concurrency/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-concurrency</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-concurrency</name>
   <description>spring-security-samples-javaconfig-concurrency</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/data/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-data</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-samples-javaconfig-data</name>
   <description>spring-security-samples-javaconfig-data</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -75,19 +75,19 @@
     <dependency>
       <groupId>org.springframework.data</groupId>
       <artifactId>spring-data-jpa</artifactId>
-      <version>1.11.17.RELEASE</version>
+      <version>1.11.12.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-data</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

samples/javaconfig/form/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-form</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-form</name>
   <description>spring-security-samples-javaconfig-form</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/hellojs/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-hellojs</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-hellojs</name>
   <description>spring-security-samples-javaconfig-hellojs</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -49,7 +49,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.8.11.3</version>
+      <version>2.8.11.2</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -97,25 +97,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -150,7 +150,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/hellomvc/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-hellomvc</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-hellomvc</name>
   <description>spring-security-samples-javaconfig-hellomvc</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
@@ -180,7 +180,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-test</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>

samples/javaconfig/helloworld/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-helloworld</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-helloworld</name>
   <description>spring-security-samples-javaconfig-helloworld</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -67,13 +67,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

samples/javaconfig/inmemory/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-inmemory</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-inmemory</name>
   <description>spring-security-samples-javaconfig-inmemory</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
@@ -180,7 +180,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-test</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>

samples/javaconfig/jdbc/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-jdbc</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-jdbc</name>
   <description>spring-security-samples-javaconfig-jdbc</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/ldap/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-ldap</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-ldap</name>
   <description>spring-security-samples-javaconfig-ldap</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -127,31 +127,31 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-ldap</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -186,7 +186,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/messages/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-samples-javaconfig-messages</name>
   <description>spring-security-samples-javaconfig-messages</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -87,7 +87,7 @@
     <dependency>
       <groupId>org.springframework.data</groupId>
       <artifactId>spring-data-jpa</artifactId>
-      <version>1.11.17.RELEASE</version>
+      <version>1.11.12.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -99,13 +99,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

samples/javaconfig/openid/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-openid</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-openid</name>
   <description>spring-security-samples-javaconfig-openid</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,31 +91,31 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-openid</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -150,7 +150,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/preauth/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-preauth</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-preauth</name>
   <description>spring-security-samples-javaconfig-preauth</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/rememberme/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-rememberme</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-rememberme</name>
   <description>spring-security-samples-javaconfig-rememberme</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/javaconfig/x509/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-javaconfig-x509</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-javaconfig-x509</name>
   <description>spring-security-samples-javaconfig-x509</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,25 +91,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -144,7 +144,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/aspectj/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-aspectj</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-samples-xml-aspectj</name>
   <description>spring-security-samples-xml-aspectj</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,7 +45,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -65,13 +65,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-aspects</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/cas/cassample/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-cassample</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-cassample</name>
   <description>spring-security-samples-xml-cassample</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -55,13 +55,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-cas</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -98,13 +98,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/cas/casserver/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-casserver</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-casserver</name>
   <description>spring-security-samples-xml-casserver</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

samples/xml/contacts/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-contacts</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-contacts</name>
   <description>spring-security-samples-xml-contacts</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -49,13 +49,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-acl</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -145,19 +145,19 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-taglibs</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/dms/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-dms</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-samples-xml-dms</name>
   <description>spring-security-samples-xml-dms</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,13 +45,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-acl</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -92,7 +92,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/gae/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-gae</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-gae</name>
   <description>spring-security-samples-xml-gae</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -73,13 +73,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -147,13 +147,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-taglibs</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/helloworld/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-helloworld</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-helloworld</name>
   <description>spring-security-samples-xml-helloworld</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -67,13 +67,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

samples/xml/insecure/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-insecure</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-insecure</name>
   <description>spring-security-samples-xml-insecure</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

samples/xml/insecuremvc/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-insecuremvc</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-insecuremvc</name>
   <description>spring-security-samples-xml-insecuremvc</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -91,7 +91,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-samples-javaconfig-messages</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -126,7 +126,7 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.2.9</version>
+      <version>3.1</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/jaas/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-jaas</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-jaas</name>
   <description>spring-security-samples-xml-jaas</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -49,7 +49,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -107,19 +107,19 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-taglibs</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/ldap/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-ldap</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-ldap</name>
   <description>spring-security-samples-xml-ldap</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -61,7 +61,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-taglibs</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -128,19 +128,19 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-ldap</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/openid/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-openid</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-openid</name>
   <description>spring-security-samples-xml-openid</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -49,13 +49,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-openid</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -103,13 +103,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-taglibs</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/preauth/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-preauth</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-preauth</name>
   <description>spring-security-samples-xml-preauth</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -74,13 +74,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/servletapi/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-servletapi</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-servletapi</name>
   <description>spring-security-samples-xml-servletapi</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -55,13 +55,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -118,13 +118,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-taglibs</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

samples/xml/tutorial/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-samples-xml-tutorial</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <packaging>war</packaging>
   <name>spring-security-samples-xml-tutorial</name>
   <description>spring-security-samples-xml-tutorial</description>
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -55,7 +55,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -119,19 +119,19 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-taglibs</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>runtime</scope>
     </dependency>
     <dependency>

taglibs/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-taglibs</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-taglibs</name>
   <description>spring-security-taglibs</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,19 +45,19 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-acl</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

test/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-test</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-test</name>
   <description>spring-security-test</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,13 +45,13 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -80,7 +80,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-config</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>

web/pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-web</artifactId>
-  <version>4.2.10.RELEASE</version>
+  <version>4.2.8.RELEASE</version>
   <name>spring-security-web</name>
   <description>spring-security-web</description>
   <url>http://spring.io/spring-security</url>
@@ -35,7 +35,7 @@
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>4.3.21.RELEASE</version>
+        <version>4.3.19.RELEASE</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.2.10.RELEASE</version>
+      <version>4.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
@@ -88,7 +88,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.8.11.3</version>
+      <version>2.8.11.2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>

web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java

@@ -57,11 +57,8 @@ import org.springframework.security.web.authentication.SimpleUrlAuthenticationFa
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.security.web.util.UrlUtils;
-import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
-import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.GenericFilterBean;
-import org.springframework.web.util.UrlPathHelper;
 
 /**
  * Switch User processing filter responsible for user context switching.
@@ -121,8 +118,8 @@ public class SwitchUserFilter extends GenericFilterBean
 	private ApplicationEventPublisher eventPublisher;
 	private AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();
 	protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
-	private RequestMatcher exitUserMatcher = createMatcher("/logout/impersonate");
-	private RequestMatcher switchUserMatcher = createMatcher("/login/impersonate");
+	private String exitUserUrl = "/logout/impersonate";
+	private String switchUserUrl = "/login/impersonate";
 	private String targetUrl;
 	private String switchFailureUrl;
 	private String usernameParameter = SPRING_SECURITY_SWITCH_USERNAME_KEY;
@@ -389,10 +386,12 @@ public class SwitchUserFilter extends GenericFilterBean
 	 * @return <code>true</code> if the request requires a exit user, <code>false</code>
 	 * otherwise.
 	 *
-	 * @see SwitchUserFilter#setExitUserUrl(String)
+	 * @see SwitchUserFilter#exitUserUrl
 	 */
 	protected boolean requiresExitUser(HttpServletRequest request) {
-		return this.exitUserMatcher.matches(request);
+		String uri = stripUri(request);
+
+		return uri.endsWith(request.getContextPath() + this.exitUserUrl);
 	}
 
 	/**
@@ -403,10 +402,12 @@ public class SwitchUserFilter extends GenericFilterBean
 	 * @return <code>true</code> if the request requires a switch, <code>false</code>
 	 * otherwise.
 	 *
-	 * @see SwitchUserFilter#setSwitchUserUrl(String)
+	 * @see SwitchUserFilter#switchUserUrl
 	 */
 	protected boolean requiresSwitchUser(HttpServletRequest request) {
-		return this.switchUserMatcher.matches(request);
+		String uri = stripUri(request);
+
+		return uri.endsWith(request.getContextPath() + this.switchUserUrl);
 	}
 
 	public void setApplicationEventPublisher(ApplicationEventPublisher eventPublisher)
@@ -444,40 +445,18 @@ public class SwitchUserFilter extends GenericFilterBean
 	public void setExitUserUrl(String exitUserUrl) {
 		Assert.isTrue(UrlUtils.isValidRedirectUrl(exitUserUrl),
 				"exitUserUrl cannot be empty and must be a valid redirect URL");
-		this.exitUserMatcher = createMatcher(exitUserUrl);
+		this.exitUserUrl = exitUserUrl;
 	}
 
 	/**
-	 * Set the matcher to respond to exit user processing. This is a shortcut for
-	 * {@link #setExitUserMatcher(RequestMatcher)}
-	 *
-	 * @param exitUserMatcher The exit matcher to use
-	 */
-	public void setExitUserMatcher(RequestMatcher exitUserMatcher) {
-		Assert.notNull(exitUserMatcher, "exitUserMatcher cannot be null");
-		this.exitUserMatcher = exitUserMatcher;
-	}
-
-	/**
-	 * Set the URL to respond to switch user processing. This is a shortcut for
-	 * {@link #setSwitchUserMatcher(RequestMatcher)}
+	 * Set the URL to respond to switch user processing.
 	 *
 	 * @param switchUserUrl The switch user URL.
 	 */
 	public void setSwitchUserUrl(String switchUserUrl) {
 		Assert.isTrue(UrlUtils.isValidRedirectUrl(switchUserUrl),
 				"switchUserUrl cannot be empty and must be a valid redirect URL");
-		this.switchUserMatcher = createMatcher(switchUserUrl);
-	}
-
-	/**
-	 * Set the matcher to respond to switch user processing.
-	 *
-	 * @param switchUserMatcher The switch user matcher.
-	 */
-	public void setSwitchUserMatcher(RequestMatcher switchUserMatcher) {
-		Assert.notNull(switchUserMatcher, "switchUserMatcher cannot be null");
-		this.switchUserMatcher = switchUserMatcher;
+		this.switchUserUrl = switchUserUrl;
 	}
 
 	/**
@@ -562,7 +541,21 @@ public class SwitchUserFilter extends GenericFilterBean
 		this.switchAuthorityRole = switchAuthorityRole;
 	}
 
-	private static RequestMatcher createMatcher(String pattern) {
-		return new AntPathRequestMatcher(pattern, null, true, new UrlPathHelper());
+	/**
+	 * Strips any content after the ';' in the request URI
+	 *
+	 * @param request The http request
+	 *
+	 * @return The stripped uri
+	 */
+	private String stripUri(HttpServletRequest request) {
+		String uri = request.getRequestURI();
+		int idx = uri.indexOf(';');
+
+		if (idx > 0) {
+			uri = uri.substring(0, idx);
+		}
+
+		return uri;
 	}
 }

web/src/main/java/org/springframework/security/web/util/matcher/AntPathRequestMatcher.java

@@ -27,7 +27,6 @@ import org.springframework.http.HttpMethod;
 import org.springframework.util.AntPathMatcher;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
-import org.springframework.web.util.UrlPathHelper;
 
 /**
  * Matcher which compares a pre-defined ant-style pattern against the URL (
@@ -63,8 +62,6 @@ public final class AntPathRequestMatcher
 	private final HttpMethod httpMethod;
 	private final boolean caseSensitive;
 
-	private final UrlPathHelper urlPathHelper;
-
 	/**
 	 * Creates a matcher with the specific pattern which will match all HTTP methods in a
 	 * case insensitive manner.
@@ -98,21 +95,6 @@ public final class AntPathRequestMatcher
 	 */
 	public AntPathRequestMatcher(String pattern, String httpMethod,
 			boolean caseSensitive) {
-		this(pattern, httpMethod, caseSensitive, null);
-	}
-
-	/**
-	 * Creates a matcher with the supplied pattern which will match the specified Http
-	 * method
-	 *
-	 * @param pattern the ant pattern to use for matching
-	 * @param httpMethod the HTTP method. The {@code matches} method will return false if
-	 * the incoming request doesn't doesn't have the same method.
-	 * @param caseSensitive true if the matcher should consider case, else false
-	 * @param urlPathHelper if non-null, will be used for extracting the path from the HttpServletRequest
-	 */
-	public AntPathRequestMatcher(String pattern, String httpMethod,
-			boolean caseSensitive, UrlPathHelper urlPathHelper) {
 		Assert.hasText(pattern, "Pattern cannot be null or empty");
 		this.caseSensitive = caseSensitive;
 
@@ -138,7 +120,6 @@ public final class AntPathRequestMatcher
 		this.pattern = pattern;
 		this.httpMethod = StringUtils.hasText(httpMethod) ? HttpMethod.valueOf(httpMethod)
 				: null;
-		this.urlPathHelper = urlPathHelper;
 	}
 
 	/**
@@ -190,9 +171,6 @@ public final class AntPathRequestMatcher
 	}
 
 	private String getRequestPath(HttpServletRequest request) {
-		if (this.urlPathHelper != null) {
-			return this.urlPathHelper.getPathWithinApplication(request);
-		}
 		String url = request.getServletPath();
 
 		String pathInfo = request.getPathInfo();

web/src/test/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilterTests.java

@@ -40,7 +40,6 @@ import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.util.FieldUtils;
 import org.springframework.security.web.DefaultRedirectStrategy;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
-import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 
 import javax.servlet.FilterChain;
 import java.util.*;
@@ -113,29 +112,6 @@ public class SwitchUserFilterTests {
 		assertThat(filter.requiresExitUser(request)).isTrue();
 	}
 
-	@Test
-	// gh-4249
-	public void requiresExitUserWhenEndsWithThenDoesNotMatch() {
-		SwitchUserFilter filter = new SwitchUserFilter();
-		filter.setExitUserUrl("/j_spring_security_my_exit_user");
-
-		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.setRequestURI("/foo/bar/j_spring_security_my_exit_user");
-
-		assertThat(filter.requiresExitUser(request)).isFalse();
-	}
-
-	@Test
-	public void requiresExitUserWhenMatcherThenWorks() {
-		SwitchUserFilter filter = new SwitchUserFilter();
-		filter.setExitUserMatcher(AnyRequestMatcher.INSTANCE);
-
-		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.setRequestURI("/foo/bar/j_spring_security_my_exit_user");
-
-		assertThat(filter.requiresExitUser(request)).isTrue();
-	}
-
 	@Test
 	public void requiresSwitchMatchesCorrectly() {
 		SwitchUserFilter filter = new SwitchUserFilter();
@@ -147,29 +123,6 @@ public class SwitchUserFilterTests {
 		assertThat(filter.requiresSwitchUser(request)).isTrue();
 	}
 
-	@Test
-	// gh-4249
-	public void requiresSwitchUserWhenEndsWithThenDoesNotMatch() {
-		SwitchUserFilter filter = new SwitchUserFilter();
-		filter.setSwitchUserUrl("/j_spring_security_my_exit_user");
-
-		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.setRequestURI("/foo/bar/j_spring_security_my_exit_user");
-
-		assertThat(filter.requiresSwitchUser(request)).isFalse();
-	}
-
-	@Test
-	public void requiresSwitchUserWhenMatcherThenWorks() {
-		SwitchUserFilter filter = new SwitchUserFilter();
-		filter.setSwitchUserMatcher(AnyRequestMatcher.INSTANCE);
-
-		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.setRequestURI("/foo/bar/j_spring_security_my_exit_user");
-
-		assertThat(filter.requiresSwitchUser(request)).isTrue();
-	}
-
 	@Test(expected = UsernameNotFoundException.class)
 	public void attemptSwitchToUnknownUserFails() throws Exception {
 
@@ -265,7 +218,6 @@ public class SwitchUserFilterTests {
 	@Test
 	public void defaultProcessesFilterUrlMatchesUrlWithPathParameter() {
 		MockHttpServletRequest request = createMockSwitchRequest();
-		request.setContextPath("/webapp");
 		SwitchUserFilter filter = new SwitchUserFilter();
 		filter.setSwitchUserUrl("/login/impersonate");
 
@@ -399,7 +351,6 @@ public class SwitchUserFilterTests {
 		// http request
 		MockHttpServletRequest request = new MockHttpServletRequest();
 		request.setRequestURI("/webapp/login/impersonate");
-		request.setContextPath("/webapp");
 		request.addParameter(SwitchUserFilter.SPRING_SECURITY_SWITCH_USERNAME_KEY,
 				"jacklord");
 

web/src/test/java/org/springframework/security/web/util/matcher/AntPathRequestMatcherTests.java

@@ -24,7 +24,6 @@ import org.mockito.Mock;
 import org.mockito.runners.MockitoJUnitRunner;
 
 import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.web.util.UrlPathHelper;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.when;
@@ -39,14 +38,6 @@ public class AntPathRequestMatcherTests {
 	@Mock
 	private HttpServletRequest request;
 
-	@Test
-	public void matchesWhenUrlPathHelperThenMatchesOnRequestUri() {
-		AntPathRequestMatcher matcher = new AntPathRequestMatcher("/foo/bar", null, true, new UrlPathHelper());
-		MockHttpServletRequest request = new MockHttpServletRequest("GET", "/foo/bar");
-
-		assertThat(matcher.matches(request)).isTrue();
-	}
-
 	@Test
 	public void singleWildcardMatchesAnyPath() {
 		AntPathRequestMatcher matcher = new AntPathRequestMatcher("/**");