Release 5.8.1

Closes gh-12411

.github/workflows/continuous-integration-workflow.yml

@@ -31,15 +31,15 @@ jobs:
       runjobs: ${{ steps.continue.outputs.runjobs }}
       project_version: ${{ steps.continue.outputs.project_version }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - id: continue
         name: Determine if should continue
         run: |
           # Run jobs if in upstream repository
-          echo "::set-output name=runjobs::true"
+          echo "runjobs=true" >>$GITHUB_OUTPUT
           # Extract version from gradle.properties
           version=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
-          echo "::set-output name=project_version::$version"
+          echo "project_version=$version" >>$GITHUB_OUTPUT
   build_jdk_11:
     name: Build JDK 11
     needs: [prerequisites]
@@ -49,9 +49,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     if: needs.prerequisites.outputs.runjobs
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up JDK 11
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           java-version: '11'
           distribution: 'adopt'
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     if: needs.prerequisites.outputs.runjobs
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     if: needs.prerequisites.outputs.runjobs
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
@@ -113,7 +113,7 @@ jobs:
     runs-on: ubuntu-latest
     if: needs.prerequisites.outputs.runjobs
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
@@ -130,7 +130,7 @@ jobs:
     needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
@@ -154,7 +154,7 @@ jobs:
     needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
@@ -175,7 +175,7 @@ jobs:
     needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
@@ -205,7 +205,7 @@ jobs:
       TOKEN: ${{ github.token }}
       VERSION: ${{ needs.prerequisites.outputs.project_version }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
       - name: Set up gradle
@@ -286,7 +286,7 @@ jobs:
       TOKEN: ${{ github.token }}
       VERSION: ${{ needs.prerequisites.outputs.project_version }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:

.github/workflows/pr-build-workflow.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.repository == 'spring-projects/spring-security' }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:

.github/workflows/update-scheduled-release-version.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - id: checkout-source
         name: Checkout Source Code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
       - name: Set up gradle
@@ -38,7 +38,7 @@ jobs:
           export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
           export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
           ./gradlew gitHubCheckNextVersionDueToday
-          echo "::set-output name=is_due_today::$(cat build/github/milestones/is-due-today)"
+          echo "is_due_today=$(cat build/github/milestones/is-due-today)" >>$GITHUB_OUTPUT
       - id: check-open-issues
         name: Check for open issues
         if: steps.check-release-due.outputs.is_due_today == 'true'
@@ -47,7 +47,7 @@ jobs:
           export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
           export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
           ./gradlew gitHubCheckMilestoneHasNoOpenIssues
-          echo "::set-output name=is_open_issues::$(cat build/github/milestones/is-open-issues)"
+          echo "is_open_issues=$(cat build/github/milestones/is-open-issues)" >>$GITHUB_OUTPUT
       - id: validate-release-state
         name: Validate State of Release
         if: steps.check-release-due.outputs.is_due_today == 'true' && steps.check-open-issues.outputs.is_open_issues == 'true'

config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java

@@ -50,7 +50,8 @@ import org.springframework.security.web.csrf.CsrfToken;
  *
  * <h2>Shared Objects Created</h2>
  *
- * No shared objects are created. isLogoutRequest
+ * No shared objects are created.
+ *
  * <h2>Shared Objects Used</h2>
  *
  * The following shared objects are used:

config/src/main/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurer.java

@@ -49,10 +49,11 @@ import org.springframework.util.Assert;
  * </p>
  *
  * <pre>
- * protected void configure(HttpSecurity http) throws Exception {
- * 	http.apply(new UrlAuthorizationConfigurer&lt;HttpSecurity&gt;()).getRegistry()
- * 			.antMatchers(&quot;/users**&quot;, &quot;/sessions/**&quot;).hasRole(&quot;USER&quot;)
- * 			.antMatchers(&quot;/signup&quot;).hasRole(&quot;ANONYMOUS&quot;).anyRequest().hasRole(&quot;USER&quot;);
+ * &#64;Bean
+ * public SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context) throws Exception {
+ * 	http.apply(new UrlAuthorizationConfigurer&lt;HttpSecurity&gt;(context)).getRegistry()
+ * 			.requestMatchers(&quot;/users**&quot;, &quot;/sessions/**&quot;).hasRole(&quot;USER&quot;)
+ * 			.requestMatchers(&quot;/signup&quot;).hasRole(&quot;ANONYMOUS&quot;).anyRequest().hasRole(&quot;USER&quot;);
  * }
  * </pre>
  *

core/src/main/java/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java

@@ -40,8 +40,9 @@ import org.springframework.util.Assert;
 public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
 
 	/**
-	 * The plaintext password used to perform PasswordEncoder#matches(CharSequence,
-	 * String)} on when the user is not found to avoid SEC-2056.
+	 * The plaintext password used to perform
+	 * {@link PasswordEncoder#matches(CharSequence, String)} on when the user is not found
+	 * to avoid SEC-2056.
 	 */
 	private static final String USER_NOT_FOUND_PASSWORD = "userNotFoundPassword";
 

core/src/main/java/org/springframework/security/authorization/ExpressionAuthorizationDecision.java

@@ -22,7 +22,7 @@ import org.springframework.expression.Expression;
  * Represents an {@link AuthorizationDecision} based on a {@link Expression}
  *
  * @author Marcus Da Coregio
- * @since 5.6
+ * @since 5.8
  */
 public class ExpressionAuthorizationDecision extends AuthorizationDecision {
 

dependencies/spring-security-dependencies.gradle

@@ -8,7 +8,7 @@ javaPlatform {
 
 dependencies {
 	api platform("org.springframework:spring-framework-bom:$springFrameworkVersion")
-	api platform("io.projectreactor:reactor-bom:2020.0.25")
+	api platform("io.projectreactor:reactor-bom:2020.0.26")
 	api platform("io.rsocket:rsocket-bom:1.1.3")
 	api platform("org.junit:junit-bom:5.9.1")
 	api platform("org.mockito:mockito-bom:4.8.1")
@@ -25,7 +25,7 @@ dependencies {
 		api "com.squareup.okhttp3:okhttp:3.14.9"
 		api "com.unboundid:unboundid-ldapsdk:4.0.14"
 		api "commons-collections:commons-collections:3.2.2"
-		api "io.mockk:mockk:1.13.2"
+		api "io.mockk:mockk:1.13.3"
 		api "io.projectreactor.tools:blockhound:1.0.6.RELEASE"
 		api "jakarta.inject:jakarta.inject-api:1.0.5"
 		api "jakarta.annotation:jakarta.annotation-api:1.3.5"
@@ -44,14 +44,14 @@ dependencies {
 		api "org.apache.directory.server:apacheds-protocol-shared:1.5.5"
 		api "org.apache.directory.server:apacheds-server-jndi:1.5.5"
 		api "org.apache.directory.shared:shared-ldap:0.9.15"
-		api "org.apache.httpcomponents:httpclient:4.5.13"
+		api "org.apache.httpcomponents:httpclient:4.5.14"
 		api "org.aspectj:aspectjrt:$aspectjVersion"
 		api "org.aspectj:aspectjweaver:$aspectjVersion"
 		api "org.assertj:assertj-core:3.23.1"
 		api "org.bouncycastle:bcpkix-jdk15on:1.70"
 		api "org.bouncycastle:bcprov-jdk15on:1.70"
-		api "org.eclipse.jetty:jetty-server:9.4.49.v20220914"
-		api "org.eclipse.jetty:jetty-servlet:9.4.49.v20220914"
+		api "org.eclipse.jetty:jetty-server:9.4.50.v20221201"
+		api "org.eclipse.jetty:jetty-servlet:9.4.50.v20221201"
 		api "org.eclipse.persistence:javax.persistence:2.2.1"
 		api "org.hamcrest:hamcrest:2.2"
 		api "org.hibernate:hibernate-entitymanager:5.6.14.Final"

docs/antora-linked-worktree-patch.js

@@ -1,53 +0,0 @@
-'use strict'
-
-/* Copyright (c) 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *   https://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-const { promises: fsp } = require('fs')
-const ospath = require('path')
-
-/**
- * Rewrites local content sources to support the use of linked worktrees.
- *
- * @author Dan Allen <dan@opendevise.com>
- */
-module.exports.register = function () {
-  this.once('playbookBuilt', async ({ playbook }) => {
-    const expandPath = this.require('@antora/expand-path-helper')
-    for (const contentSource of playbook.content.sources) {
-      const { url, branches } = contentSource
-      if (url.charAt() !== '.') continue
-      const absdir = expandPath(url, { dot: playbook.dir })
-      const gitfile = ospath.join(absdir, '.git')
-      if (await fsp.stat(gitfile).then((stat) => !stat.isDirectory(), () => false)) {
-        const worktreeGitdir = await fsp.readFile(gitfile, 'utf8')
-          .then((contents) => contents.trimRight().substr(8))
-        const worktreeBranch = await fsp.readFile(ospath.join(worktreeGitdir, 'HEAD'), 'utf8')
-          .then((contents) => contents.trimRight().replace(/^ref: (?:refs\/heads\/)?/, ''))
-        const reldir = ospath.relative(
-          playbook.dir,
-          await fsp.readFile(ospath.join(worktreeGitdir, 'commondir'), 'utf8')
-            .then((contents) => {
-              const gitdir = ospath.join(worktreeGitdir, contents.trimRight())
-              return ospath.basename(gitdir) === '.git' ? ospath.dirname(gitdir) : gitdir
-            })
-        )
-        contentSource.url = reldir ? `.${ospath.sep}${reldir}` : '.'
-        if (!branches) continue
-        contentSource.branches = (branches.constructor === Array ? branches : [branches])
-          .map((pattern) => pattern.replaceAll('HEAD', worktreeBranch))
-      }
-    }
-  })
-}

docs/local-antora-playbook.yml

@@ -1,7 +1,6 @@
 # The purpose of this Antora playbook is to generate a preview of the docs in the current branch.
 antora:
   extensions:
-  - ./antora-linked-worktree-patch.js
   - '@antora/collector-extension'
 site:
   title: Spring Security

docs/modules/ROOT/pages/migration/index.adoc

@@ -126,9 +126,9 @@ fun passwordEncoder(): PasswordEncoder {
 ----
 ====
 
-==== Use `DelegatedPasswordEncoder`
+==== Use `DelegatingPasswordEncoder`
 
-Once you are not using the deprecated constructor, the next step is to prepare your code to upgrade to the latest standards by using `DelegatedPasswordEncoder`.
+Once you are not using the deprecated constructor, the next step is to prepare your code to upgrade to the latest standards by using `DelegatingPasswordEncoder`.
 The following code configures the delegating encoder to detect passwords that are using `current` and replace them with the latest:
 
 ====
@@ -140,8 +140,8 @@ PasswordEncoder passwordEncoder() {
     String prefix = "pbkdf2@5.8";
     PasswordEncoder current = // ... see previous step
     PasswordEncoder upgraded = Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_8();
-    DelegatedPasswordEncoder delegating = new DelegatedPasswordEncoder(prefix, Map.of(prefix, upgraded));
-    delegating.setDefaultPasswordEncoderFormatches(current);
+    DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder(prefix, Map.of(prefix, upgraded));
+    delegating.setDefaultPasswordEncoderForMatches(current);
     return delegating;
 }
 ----
@@ -154,8 +154,8 @@ fun passwordEncoder(): PasswordEncoder {
     String prefix = "pbkdf2@5.8"
     PasswordEncoder current = // ... see previous step
     PasswordEncoder upgraded = Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_8()
-    DelegatedPasswordEncoder delegating = new DelegatedPasswordEncoder(prefix, Map.of(prefix, upgraded))
-    delegating.setDefaultPasswordEncoderFormatches(current)
+    DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder(prefix, Map.of(prefix, upgraded))
+    delegating.setDefaultPasswordEncoderForMatches(current)
     return delegating
 }
 ----
@@ -211,9 +211,9 @@ fun passwordEncoder(): PasswordEncoder {
 ----
 ====
 
-==== Use `DelegatedPasswordEncoder`
+==== Use `DelegatingPasswordEncoder`
 
-Once you are not using the deprecated constructor, the next step is to prepare your code to upgrade to the latest standards by using `DelegatedPasswordEncoder`.
+Once you are not using the deprecated constructor, the next step is to prepare your code to upgrade to the latest standards by using `DelegatingPasswordEncoder`.
 The following code configures the delegating encoder to detect passwords that are using `current` and replace them with the latest:
 
 ====
@@ -225,8 +225,8 @@ PasswordEncoder passwordEncoder() {
     String prefix = "scrypt@5.8";
     PasswordEncoder current = // ... see previous step
     PasswordEncoder upgraded = SCryptPasswordEncoder.defaultsForSpringSecurity_v5_8();
-    DelegatedPasswordEncoder delegating = new DelegatedPasswordEncoder(prefix, Map.of(prefix, upgraded));
-    delegating.setDefaultPasswordEncoderFormatches(current);
+    DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder(prefix, Map.of(prefix, upgraded));
+    delegating.setDefaultPasswordEncoderForMatches(current);
     return delegating;
 }
 ----
@@ -239,8 +239,8 @@ fun passwordEncoder(): PasswordEncoder {
     String prefix = "scrypt@5.8"
     PasswordEncoder current = // ... see previous step
     PasswordEncoder upgraded = SCryptPasswordEncoder.defaultsForSpringSecurity_v5_8()
-    DelegatedPasswordEncoder delegating = new DelegatedPasswordEncoder(prefix, Map.of(prefix, upgraded))
-    delegating.setDefaultPasswordEncoderFormatches(current)
+    DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder(prefix, Map.of(prefix, upgraded))
+    delegating.setDefaultPasswordEncoderForMatches(current)
     return delegating
 }
 ----
@@ -296,9 +296,9 @@ fun passwordEncoder(): PasswordEncoder {
 ----
 ====
 
-==== Use `DelegatedPasswordEncoder`
+==== Use `DelegatingPasswordEncoder`
 
-Once you are not using the deprecated constructor, the next step is to prepare your code to upgrade to the latest standards by using `DelegatedPasswordEncoder`.
+Once you are not using the deprecated constructor, the next step is to prepare your code to upgrade to the latest standards by using `DelegatingPasswordEncoder`.
 The following code configures the delegating encoder to detect passwords that are using `current` and replace them with the latest:
 
 ====
@@ -310,8 +310,8 @@ PasswordEncoder passwordEncoder() {
 	String prefix = "argon@5.8";
 	PasswordEncoder current = // ... see previous step
     PasswordEncoder upgraded = Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8();
-	DelegatedPasswordEncoder delegating = new DelegatedPasswordEncoder(prefix, Map.of(prefix, upgraded));
-	delegating.setDefaultPasswordEncoderFormatches(current);
+	DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder(prefix, Map.of(prefix, upgraded));
+	delegating.setDefaultPasswordEncoderForMatches(current);
 	return delegating;
 }
 ----
@@ -324,8 +324,8 @@ fun passwordEncoder(): PasswordEncoder {
 	String prefix = "argon@5.8"
 	PasswordEncoder current = // ... see previous step
     PasswordEncoder upgraded = Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8()
-	DelegatedPasswordEncoder delegating = new DelegatedPasswordEncoder(prefix, Map.of(prefix, upgraded))
-	delegating.setDefaultPasswordEncoderFormatches(current)
+	DelegatingPasswordEncoder delegating = new DelegatingPasswordEncoder(prefix, Map.of(prefix, upgraded))
+	delegating.setDefaultPasswordEncoderForMatches(current)
 	return delegating
 }
 ----

docs/modules/ROOT/pages/migration/servlet/config.adoc

@@ -409,7 +409,9 @@ import static org.springframework.security.web.util.matcher.AntPathRequestMatche
 @Bean
 public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
     http
-        .securityMatcher(antMatcher("/api/**"), antMatcher("/app/**"))
+        .securityMatchers((matchers) -> matchers
+            .requestMatchers(antMatcher("/api/**"), antMatcher("/app/**"))
+        )
         .authorizeHttpRequests((authz) -> authz
             .requestMatchers(antMatcher("/api/admin/**")).hasRole("ADMIN")
             .anyRequest().authenticated()
@@ -871,6 +873,50 @@ open class SecurityConfiguration {
 ----
 ====
 
+== Add `@Configuration` to `@Enable*` annotations
+
+In 6.0, all Spring Security's `@Enable*` annotations had their `@Configuration` removed.
+While convenient, it was not consistent with the rest of the Spring projects and most notably Spring Framework's `@Enable*` annotations.
+Additionally, the introduction of support for `@Configuration(proxyBeanMethods=false)` in Spring Framework provides another reason to remove `@Configuration` meta-annotation from Spring Security's `@Enable*` annotations and allow users to opt into their preferred configuration mode.
+
+The following annotations had their `@Configuration` removed:
+
+- `@EnableGlobalAuthentication`
+- `@EnableGlobalMethodSecurity`
+- `@EnableMethodSecurity`
+- `@EnableReactiveMethodSecurity`
+- `@EnableWebSecurity`
+- `@EnableWebFluxSecurity`
+
+For example, if you are using `@EnableWebSecurity`, you will need to change:
+
+====
+.Java
+[source,java,role="primary"]
+----
+@EnableWebSecurity
+public class SecurityConfig {
+	// ...
+}
+----
+====
+
+to:
+
+====
+.Java
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+	// ...
+}
+----
+====
+
+And the same applies to every other annotation listed above.
+
 ==== Other Scenarios
 
 If you are using `AuthenticationManagerBuilder` for something more sophisticated, you can xref:servlet/authentication/architecture.adoc#servlet-authentication-authenticationmanager[publish your own `AuthenticationManager` `@Bean`] or wire an `AuthenticationManager` instance into the `HttpSecurity` DSL with {security-api-url}org/springframework/security/config/annotation/web/builders/HttpSecurity.html#authenticationManager(org.springframework.security.authentication.AuthenticationManager)[`HttpSecurity#authenticationManager`].

docs/modules/ROOT/pages/servlet/authorization/authorize-http-requests.adoc

@@ -48,12 +48,10 @@ image::{figures}/authorizationfilter.png[]
 
 * image:{icondir}/number_1.png[] First, the `AuthorizationFilter` obtains an  xref:servlet/authentication/architecture.adoc#servlet-authentication-authentication[Authentication] from the xref:servlet/authentication/architecture.adoc#servlet-authentication-securitycontextholder[SecurityContextHolder].
 It wraps this in an `Supplier` in order to delay lookup.
-* image:{icondir}/number_2.png[] Second, `AuthorizationFilter` creates a {security-api-url}org/springframework/security/web/FilterInvocation.html[`FilterInvocation`] from the `HttpServletRequest`, `HttpServletResponse`, and `FilterChain`.
-// FIXME: link to FilterInvocation
-* image:{icondir}/number_3.png[] Next, it passes the `Supplier<Authentication>` and `FilterInvocation` to the xref:servlet/architecture.adoc#authz-authorization-manager[`AuthorizationManager`].
-** image:{icondir}/number_4.png[] If authorization is denied, an `AccessDeniedException` is thrown.
+* image:{icondir}/number_2.png[] Second, it passes the `Supplier<Authentication>` and the `HttpServletRequest` to the xref:servlet/architecture.adoc#authz-authorization-manager[`AuthorizationManager`].
+** image:{icondir}/number_3.png[] If authorization is denied, an `AccessDeniedException` is thrown.
 In this case the xref:servlet/architecture.adoc#servlet-exceptiontranslationfilter[`ExceptionTranslationFilter`] handles the `AccessDeniedException`.
-** image:{icondir}/number_5.png[] If access is granted, `AuthorizationFilter` continues with the xref:servlet/architecture.adoc#servlet-filters-review[FilterChain] which allows the application to process normally.
+** image:{icondir}/number_4.png[] If access is granted, `AuthorizationFilter` continues with the xref:servlet/architecture.adoc#servlet-filters-review[FilterChain] which allows the application to process normally.
 
 We can configure Spring Security to have different rules by adding more rules in order of precedence.
 
@@ -70,7 +68,8 @@ SecurityFilterChain web(HttpSecurity http) throws Exception {
 			.requestMatchers("/resources/**", "/signup", "/about").permitAll()         // <2>
 			.requestMatchers("/admin/**").hasRole("ADMIN")                             // <3>
 			.requestMatchers("/db/**").access(new WebExpressionAuthorizationManager("hasRole('ADMIN') and hasRole('DBA')"))   // <4>
-			.anyRequest().denyAll()                                                // <5>
+			// .requestMatchers("/db/**").access(AuthorizationManagers.allOf(AuthorityAuthorizationManager.hasRole("ADMIN"), AuthorityAuthorizationManager.hasRole("DBA")))   // <5>
+			.anyRequest().denyAll()                                                // <6>
 		);
 
 	return http.build();
@@ -85,7 +84,8 @@ Specifically, any user can access a request if the URL starts with "/resources/"
 You will notice that since we are invoking the `hasRole` method we do not need to specify the "ROLE_" prefix.
 <4> Any URL that starts with "/db/" requires the user to have both "ROLE_ADMIN" and "ROLE_DBA".
 You will notice that since we are using the `hasRole` expression we do not need to specify the "ROLE_" prefix.
-<5> Any URL that has not already been matched on is denied access.
+<5> The same rule from 4, could be written by combining multiple `AuthorizationManager`.
+<6> Any URL that has not already been matched on is denied access.
 This is a good strategy if you do not want to accidentally forget to update your authorization rules.
 
 You can take a bean-based approach by constructing your own xref:servlet/authorization/architecture.adoc#authz-delegate-authorization-manager[`RequestMatcherDelegatingAuthorizationManager`] like so:
@@ -118,7 +118,7 @@ AuthorizationManager<RequestAuthorizationContext> requestMatcherAuthorizationMan
     RequestMatcher admin = mvcMatcherBuilder.pattern("/admin/**");
     RequestMatcher db = mvcMatcherBuilder.pattern("/db/**");
     RequestMatcher any = AnyRequestMatcher.INSTANCE;
-    AuthorizationManager<HttpRequestServlet> manager = RequestMatcherDelegatingAuthorizationManager.builder()
+    AuthorizationManager<HttpServletRequest> manager = RequestMatcherDelegatingAuthorizationManager.builder()
             .add(permitAll, (context) -> new AuthorizationDecision(true))
             .add(admin, AuthorityAuthorizationManager.hasRole("ADMIN"))
             .add(db, AuthorityAuthorizationManager.hasRole("DBA"))
@@ -163,7 +163,7 @@ Or you can provide it for all requests as seen below:
 SecurityFilterChain web(HttpSecurity http) throws Exception {
     http
         .authorizeHttpRequests((authorize) -> authorize
-            .anyRequest.access(new CustomAuthorizationManager());
+            .anyRequest().access(new CustomAuthorizationManager());
         )
         // ...
 

docs/modules/ROOT/pages/servlet/authorization/expression-based.adoc

@@ -145,7 +145,7 @@ You could refer to the method using:
 ----
 http
     .authorizeHttpRequests(authorize -> authorize
-        .requestMatchers("/user/**").access("@webSecurity.check(authentication,request)")
+        .requestMatchers("/user/**").access(new WebExpressionAuthorizationManager("@webSecurity.check(authentication,request)"))
         ...
     )
 ----

docs/modules/ROOT/pages/servlet/oauth2/resource-server/multitenancy.adoc

@@ -248,7 +248,7 @@ public class TenantJWSKeySelector
 	}
 
 	private JWSKeySelector<SecurityContext> fromTenant(String tenant) {
-		return Optional.ofNullable(this.tenantRepository.findById(tenant)) <3>
+		return Optional.ofNullable(this.tenants.findById(tenant)) <3>
 		        .map(t -> t.getAttrbute("jwks_uri"))
 				.map(this::fromUri)
 				.orElseThrow(() -> new IllegalArgumentException("unknown tenant"));

docs/spring-security-docs.gradle

@@ -6,7 +6,7 @@ apply plugin: 'io.spring.convention.docs'
 apply plugin: 'java'
 
 antora {
-	version = '~3.1'
+	version = '3.2.0-alpha.2'
 	playbook = file('local-antora-playbook.yml')
 	options = ['--clean', '--stacktrace']
 	environment = [
@@ -15,7 +15,7 @@ antora {
 		'ALGOLIA_INDEX_NAME': 'security-docs'
 	]
 	dependencies = [
-		'@antora/collector-extension': '1.0.0-alpha.2'
+		'@antora/collector-extension': '1.0.0-alpha.3'
 	]
 }
 

gradle.properties

@@ -3,8 +3,8 @@ springJavaformatVersion=0.0.35
 springBootVersion=2.4.2
 springFrameworkVersion=5.3.24
 openSamlVersion=3.4.6
-version=5.8.0
-kotlinVersion=1.7.21
+version=5.8.1
+kotlinVersion=1.7.22
 samplesBranch=5.8.x
 org.gradle.jvmargs=-Xmx3g -XX:MaxPermSize=2048m -XX:+HeapDumpOnOutOfMemoryError
 org.gradle.parallel=true

ldap/src/integration-test/java/org/springframework/security/ldap/userdetails/DefaultLdapAuthoritiesPopulatorGetGrantedAuthoritiesTests.java

@@ -0,0 +1,105 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.ldap.userdetails;
+
+import java.util.Set;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+
+import org.springframework.beans.factory.DisposableBean;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.ldap.core.ContextSource;
+import org.springframework.ldap.core.DirContextAdapter;
+import org.springframework.ldap.core.DistinguishedName;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
+import org.springframework.security.ldap.server.ApacheDSContainer;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit.jupiter.SpringExtension;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * @author Dayan Kodippily
+ */
+@ExtendWith(SpringExtension.class)
+@ContextConfiguration(
+		classes = DefaultLdapAuthoritiesPopulatorGetGrantedAuthoritiesTests.ApacheDsContainerWithUndefinedGroupRoleAttributeConfig.class)
+public class DefaultLdapAuthoritiesPopulatorGetGrantedAuthoritiesTests {
+
+	@Autowired
+	private DefaultSpringSecurityContextSource contextSource;
+
+	private DefaultLdapAuthoritiesPopulator populator;
+
+	@BeforeEach
+	public void setUp() {
+		this.populator = new DefaultLdapAuthoritiesPopulator(this.contextSource, "ou=groups");
+		this.populator.setIgnorePartialResultException(false);
+	}
+
+	@Test
+	public void groupSearchDoesNotAllowNullRoles() {
+		this.populator.setRolePrefix("ROLE_");
+		this.populator.setGroupRoleAttribute("ou");
+		this.populator.setSearchSubtree(true);
+		this.populator.setSearchSubtree(false);
+		this.populator.setConvertToUpperCase(true);
+		this.populator.setGroupSearchFilter("(member={0})");
+
+		DirContextAdapter ctx = new DirContextAdapter(
+				new DistinguishedName("uid=dayan,ou=people,dc=springframework,dc=org"));
+
+		Set<String> authorities = AuthorityUtils.authorityListToSet(this.populator.getGrantedAuthorities(ctx, "dayan"));
+
+		assertThat(authorities).as("Should have 1 role").hasSize(2);
+
+		assertThat(authorities.contains("ROLE_DEVELOPER")).isTrue();
+		assertThat(authorities.contains("ROLE_")).isTrue();
+	}
+
+	@Configuration
+	static class ApacheDsContainerWithUndefinedGroupRoleAttributeConfig implements DisposableBean {
+
+		private ApacheDSContainer container;
+
+		@Bean
+		ApacheDSContainer ldapContainer() throws Exception {
+			this.container = new ApacheDSContainer("dc=springframework,dc=org",
+					"classpath:test-server-with-undefined-group-role-attributes.ldif");
+			this.container.setPort(0);
+			return this.container;
+		}
+
+		@Bean
+		ContextSource contextSource(ApacheDSContainer ldapContainer) {
+			return new DefaultSpringSecurityContextSource(
+					"ldap://127.0.0.1:" + ldapContainer.getLocalPort() + "/dc=springframework,dc=org");
+		}
+
+		@Override
+		public void destroy() {
+			this.container.stop();
+		}
+
+	}
+
+}

ldap/src/integration-test/resources/test-server-with-undefined-group-role-attributes.ldif

@@ -0,0 +1,41 @@
+dn: ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: groups
+
+dn: ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: people
+
+dn: uid=dayan,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Dayan K
+sn: Dayan
+uid: dayan
+userPassword: dayanspassword
+
+
+
+dn: cn=managers,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: managers
+ou:
+member: uid=dayan,ou=people,dc=springframework,dc=org
+
+dn: cn=researchers,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: researchers
+member: uid=dayan,ou=people,dc=springframework,dc=org
+
+dn: cn=developers,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: developers
+ou: developer
+member: uid=dayan,ou=people,dc=springframework,dc=org

ldap/src/main/java/org/springframework/security/ldap/userdetails/DefaultLdapAuthoritiesPopulator.java

@@ -37,6 +37,7 @@ import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.ldap.SpringSecurityLdapTemplate;
 import org.springframework.util.Assert;
+import org.springframework.util.CollectionUtils;
 
 /**
  * The default strategy for obtaining user role information from the directory.
@@ -169,7 +170,14 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
 			logger.info("Will perform group search from the context source base since groupSearchBase is empty.");
 		}
 		this.authorityMapper = (record) -> {
-			String role = record.get(this.groupRoleAttribute).get(0);
+			List<String> roles = record.get(this.groupRoleAttribute);
+			if (CollectionUtils.isEmpty(roles)) {
+				return null;
+			}
+			String role = roles.get(0);
+			if (role == null) {
+				return null;
+			}
 			if (this.convertToUpperCase) {
 				role = role.toUpperCase();
 			}
@@ -225,7 +233,10 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
 				new String[] { this.groupRoleAttribute });
 		logger.debug(LogMessage.of(() -> "Found roles from search " + userRoles));
 		for (Map<String, List<String>> role : userRoles) {
-			authorities.add(this.authorityMapper.apply(role));
+			GrantedAuthority authority = this.authorityMapper.apply(role);
+			if (authority != null) {
+				authorities.add(authority);
+			}
 		}
 		return authorities;
 	}

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2AuthorizationRequestRedirectFilter.java

@@ -201,8 +201,8 @@ public class OAuth2AuthorizationRequestRedirectFilter extends OncePerRequestFilt
 					if (authorizationRequest == null) {
 						throw authzEx;
 					}
-					this.sendRedirectForAuthorization(request, response, authorizationRequest);
 					this.requestCache.saveRequest(request, response);
+					this.sendRedirectForAuthorization(request, response, authorizationRequest);
 				}
 				catch (Exception failed) {
 					this.unsuccessfulRedirectForAuthorization(request, response, failed);

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/OAuth2AuthorizationRequestRedirectFilterTests.java

@@ -52,6 +52,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.BDDMockito.given;
+import static org.mockito.BDDMockito.willAnswer;
 import static org.mockito.BDDMockito.willThrow;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
@@ -369,4 +370,22 @@ public class OAuth2AuthorizationRequestRedirectFilterTests {
 						+ "redirect_uri=http://localhost/login/oauth2/code/registration-id");
 	}
 
+	// gh-11602
+
+	@Test
+	public void doFilterWhenNotAuthorizationRequestAndClientAuthorizationRequiredExceptionThrownThenSaveRequestBeforeCommitted()
+			throws Exception {
+		String requestUri = "/path";
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
+		request.setServletPath(requestUri);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain filterChain = mock(FilterChain.class);
+		willAnswer((invocation) -> assertThat((invocation.<HttpServletResponse>getArgument(1)).isCommitted()).isFalse())
+				.given(this.requestCache).saveRequest(any(HttpServletRequest.class), any(HttpServletResponse.class));
+		willThrow(new ClientAuthorizationRequiredException(this.registration1.getRegistrationId())).given(filterChain)
+				.doFilter(any(ServletRequest.class), any(ServletResponse.class));
+		this.filter.doFilter(request, response, filterChain);
+		assertThat(response.isCommitted()).isTrue();
+	}
+
 }

web/src/main/java/org/springframework/security/web/context/SecurityContextHolderFilter.java

@@ -21,6 +21,8 @@ import java.util.function.Supplier;
 
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -28,7 +30,7 @@ import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.util.Assert;
-import org.springframework.web.filter.OncePerRequestFilter;
+import org.springframework.web.filter.GenericFilterBean;
 
 /**
  * A {@link javax.servlet.Filter} that uses the {@link SecurityContextRepository} to
@@ -40,17 +42,18 @@ import org.springframework.web.filter.OncePerRequestFilter;
  * mechanisms to choose individually if authentication should be persisted.
  *
  * @author Rob Winch
+ * @author Marcus da Coregio
  * @since 5.7
  */
-public class SecurityContextHolderFilter extends OncePerRequestFilter {
+public class SecurityContextHolderFilter extends GenericFilterBean {
+
+	private static final String FILTER_APPLIED = SecurityContextHolderFilter.class.getName() + ".APPLIED";
 
 	private final SecurityContextRepository securityContextRepository;
 
 	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
 			.getContextHolderStrategy();
 
-	private boolean shouldNotFilterErrorDispatch;
-
 	/**
 	 * Creates a new instance.
 	 * @param securityContextRepository the repository to use. Cannot be null.
@@ -61,23 +64,29 @@ public class SecurityContextHolderFilter extends OncePerRequestFilter {
 	}
 
 	@Override
-	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+			throws IOException, ServletException {
+		doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
+	}
+
+	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
 			throws ServletException, IOException {
+		if (request.getAttribute(FILTER_APPLIED) != null) {
+			chain.doFilter(request, response);
+			return;
+		}
+		request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
 		Supplier<SecurityContext> deferredContext = this.securityContextRepository.loadDeferredContext(request);
 		try {
 			this.securityContextHolderStrategy.setDeferredContext(deferredContext);
-			filterChain.doFilter(request, response);
+			chain.doFilter(request, response);
 		}
 		finally {
 			this.securityContextHolderStrategy.clearContext();
+			request.removeAttribute(FILTER_APPLIED);
 		}
 	}
 
-	@Override
-	protected boolean shouldNotFilterErrorDispatch() {
-		return this.shouldNotFilterErrorDispatch;
-	}
-
 	/**
 	 * Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
 	 * the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
@@ -89,13 +98,4 @@ public class SecurityContextHolderFilter extends OncePerRequestFilter {
 		this.securityContextHolderStrategy = securityContextHolderStrategy;
 	}
 
-	/**
-	 * Disables {@link SecurityContextHolderFilter} for error dispatch.
-	 * @param shouldNotFilterErrorDispatch if the Filter should be disabled for error
-	 * dispatch. Default is false.
-	 */
-	public void setShouldNotFilterErrorDispatch(boolean shouldNotFilterErrorDispatch) {
-		this.shouldNotFilterErrorDispatch = shouldNotFilterErrorDispatch;
-	}
-
 }

web/src/test/java/org/springframework/security/web/context/SecurityContextHolderFilterTests.java

@@ -18,6 +18,7 @@ package org.springframework.security.web.context;
 
 import java.util.function.Supplier;
 
+import javax.servlet.DispatcherType;
 import javax.servlet.FilterChain;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -26,11 +27,15 @@ import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Captor;
+import org.mockito.InOrder;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
+import org.springframework.mock.web.MockFilterChain;
 import org.springframework.security.authentication.TestAuthentication;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContext;
@@ -40,11 +45,17 @@ import org.springframework.security.core.context.SecurityContextImpl;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.inOrder;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 
 @ExtendWith(MockitoExtension.class)
 class SecurityContextHolderFilterTests {
 
+	private static final String FILTER_APPLIED = "org.springframework.security.web.context.SecurityContextHolderFilter.APPLIED";
+
 	@Mock
 	private SecurityContextRepository repository;
 
@@ -105,14 +116,38 @@ class SecurityContextHolderFilterTests {
 	}
 
 	@Test
-	void shouldNotFilterErrorDispatchWhenDefault() {
-		assertThat(this.filter.shouldNotFilterErrorDispatch()).isFalse();
+	void doFilterWhenFilterAppliedThenDoNothing() throws Exception {
+		given(this.request.getAttribute(FILTER_APPLIED)).willReturn(true);
+		this.filter.doFilter(this.request, this.response, new MockFilterChain());
+		verify(this.request, times(1)).getAttribute(FILTER_APPLIED);
+		verifyNoInteractions(this.repository, this.response);
 	}
 
 	@Test
-	void shouldNotFilterErrorDispatchWhenOverridden() {
-		this.filter.setShouldNotFilterErrorDispatch(true);
-		assertThat(this.filter.shouldNotFilterErrorDispatch()).isTrue();
+	void doFilterWhenNotAppliedThenSetsAndRemovesAttribute() throws Exception {
+		given(this.repository.loadDeferredContext(this.requestArg.capture())).willReturn(
+				new SupplierDeferredSecurityContext(SecurityContextHolder::createEmptyContext, this.strategy));
+
+		this.filter.doFilter(this.request, this.response, new MockFilterChain());
+
+		InOrder inOrder = inOrder(this.request, this.repository);
+		inOrder.verify(this.request).setAttribute(FILTER_APPLIED, true);
+		inOrder.verify(this.repository).loadDeferredContext(this.request);
+		inOrder.verify(this.request).removeAttribute(FILTER_APPLIED);
+	}
+
+	@ParameterizedTest
+	@EnumSource(DispatcherType.class)
+	void doFilterWhenAnyDispatcherTypeThenFilter(DispatcherType dispatcherType) throws Exception {
+		lenient().when(this.request.getDispatcherType()).thenReturn(dispatcherType);
+		Authentication authentication = TestAuthentication.authenticatedUser();
+		SecurityContext expectedContext = new SecurityContextImpl(authentication);
+		given(this.repository.loadDeferredContext(this.requestArg.capture()))
+				.willReturn(new SupplierDeferredSecurityContext(() -> expectedContext, this.strategy));
+		FilterChain filterChain = (request, response) -> assertThat(SecurityContextHolder.getContext())
+				.isEqualTo(expectedContext);
+
+		this.filter.doFilter(this.request, this.response, filterChain);
 	}
 
 }