rm .github/workflows for unsupported branch

.gitignore

@@ -28,5 +28,3 @@ s101plugin.state
 
 !.idea/checkstyle-idea.xml
 !.idea/externalDependencies.xml
-
-node_modules

README.adoc

@@ -57,7 +57,7 @@ See also the https://github.com/spring-projects/spring-framework/wiki/Gradle-bui
 
 == Getting Support
 Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
-https://spring.io/support[Commercial support] is available too.
+https://spring.io/services[Commercial support] is available too.
 
 == Contributing
 https://help.github.com/articles/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/main/CONTRIBUTING.adoc[contributor guidelines] for details.

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java

@@ -27,9 +27,7 @@ import org.springframework.security.acls.model.SidRetrievalStrategy;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.util.Assert;
 
 /**
@@ -48,9 +46,6 @@ import org.springframework.util.Assert;
  */
 public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 
-	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
-		.getContextHolderStrategy();
-
 	private final GrantedAuthority gaGeneralChanges;
 
 	private final GrantedAuthority gaModifyAuditing;
@@ -86,12 +81,12 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 
 	@Override
 	public void securityCheck(Acl acl, int changeType) {
-		SecurityContext context = this.securityContextHolderStrategy.getContext();
-		if ((context == null) || (context.getAuthentication() == null)
-				|| !context.getAuthentication().isAuthenticated()) {
+		if ((SecurityContextHolder.getContext() == null)
+				|| (SecurityContextHolder.getContext().getAuthentication() == null)
+				|| !SecurityContextHolder.getContext().getAuthentication().isAuthenticated()) {
 			throw new AccessDeniedException("Authenticated principal required to operate with ACLs");
 		}
-		Authentication authentication = context.getAuthentication();
+		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
 		// Check if authorized by virtue of ACL ownership
 		Sid currentUser = createCurrentUser(authentication);
 		if (currentUser.equals(acl.getOwner())
@@ -151,15 +146,4 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 		this.sidRetrievalStrategy = sidRetrievalStrategy;
 	}
 
-	/**
-	 * Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
-	 * the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
-	 *
-	 * @since 5.8
-	 */
-	public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
-		Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
-		this.securityContextHolderStrategy = securityContextHolderStrategy;
-	}
-
 }

acl/src/main/java/org/springframework/security/acls/domain/EhCacheBasedAclCache.java

@@ -110,9 +110,9 @@ public class EhCacheBasedAclCache implements AclCache {
 		if (this.aclAuthorizationStrategy == null) {
 			if (acl instanceof AclImpl) {
 				this.aclAuthorizationStrategy = (AclAuthorizationStrategy) FieldUtils
-					.getProtectedFieldValue("aclAuthorizationStrategy", acl);
+						.getProtectedFieldValue("aclAuthorizationStrategy", acl);
 				this.permissionGrantingStrategy = (PermissionGrantingStrategy) FieldUtils
-					.getProtectedFieldValue("permissionGrantingStrategy", acl);
+						.getProtectedFieldValue("permissionGrantingStrategy", acl);
 			}
 		}
 		if ((acl.getParentAcl() != null) && (acl.getParentAcl() instanceof MutableAcl)) {

acl/src/main/java/org/springframework/security/acls/domain/SidRetrievalStrategyImpl.java

@@ -54,7 +54,7 @@ public class SidRetrievalStrategyImpl implements SidRetrievalStrategy {
 	@Override
 	public List<Sid> getSids(Authentication authentication) {
 		Collection<? extends GrantedAuthority> authorities = this.roleHierarchy
-			.getReachableGrantedAuthorities(authentication.getAuthorities());
+				.getReachableGrantedAuthorities(authentication.getAuthorities());
 		List<Sid> sids = new ArrayList<>(authorities.size() + 1);
 		sids.add(new PrincipalSid(authentication));
 		for (GrantedAuthority authority : authorities) {

acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java

@@ -42,7 +42,7 @@ import org.springframework.security.acls.domain.AuditLogger;
 import org.springframework.security.acls.domain.DefaultPermissionFactory;
 import org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy;
 import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
+import org.springframework.security.acls.domain.ObjectIdentityImpl;
 import org.springframework.security.acls.domain.PermissionFactory;
 import org.springframework.security.acls.domain.PrincipalSid;
 import org.springframework.security.acls.model.AccessControlEntry;
@@ -51,7 +51,6 @@ import org.springframework.security.acls.model.AclCache;
 import org.springframework.security.acls.model.MutableAcl;
 import org.springframework.security.acls.model.NotFoundException;
 import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.security.acls.model.PermissionGrantingStrategy;
 import org.springframework.security.acls.model.Sid;
@@ -110,8 +109,6 @@ public class BasicLookupStrategy implements LookupStrategy {
 
 	private final AclAuthorizationStrategy aclAuthorizationStrategy;
 
-	private ObjectIdentityGenerator objectIdentityGenerator;
-
 	private PermissionFactory permissionFactory = new DefaultPermissionFactory();
 
 	private final AclCache aclCache;
@@ -165,7 +162,6 @@ public class BasicLookupStrategy implements LookupStrategy {
 		this.aclCache = aclCache;
 		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
 		this.grantingStrategy = grantingStrategy;
-		this.objectIdentityGenerator = new ObjectIdentityRetrievalStrategyImpl();
 		this.aclClassIdUtils = new AclClassIdUtils();
 		this.fieldAces.setAccessible(true);
 		this.fieldAcl.setAccessible(true);
@@ -492,11 +488,6 @@ public class BasicLookupStrategy implements LookupStrategy {
 		}
 	}
 
-	public final void setObjectIdentityGenerator(ObjectIdentityGenerator objectIdentityGenerator) {
-		Assert.notNull(objectIdentityGenerator, "objectIdentityGenerator cannot be null");
-		this.objectIdentityGenerator = objectIdentityGenerator;
-	}
-
 	public final void setConversionService(ConversionService conversionService) {
 		this.aclClassIdUtils = new AclClassIdUtils(conversionService);
 	}
@@ -578,8 +569,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 				// target id type, e.g. UUID.
 				Serializable identifier = (Serializable) rs.getObject("object_id_identity");
 				identifier = BasicLookupStrategy.this.aclClassIdUtils.identifierFrom(identifier, rs);
-				ObjectIdentity objectIdentity = BasicLookupStrategy.this.objectIdentityGenerator
-					.createObjectIdentity(identifier, rs.getString("class"));
+				ObjectIdentity objectIdentity = new ObjectIdentityImpl(rs.getString("class"), identifier);
 
 				Acl parentAcl = null;
 				long parentAclId = rs.getLong("parent_object");

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java

@@ -31,12 +31,11 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.core.convert.ConversionService;
 import org.springframework.jdbc.core.JdbcOperations;
 import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
+import org.springframework.security.acls.domain.ObjectIdentityImpl;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AclService;
 import org.springframework.security.acls.model.NotFoundException;
 import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
 import org.springframework.security.acls.model.Sid;
 import org.springframework.util.Assert;
 
@@ -82,8 +81,6 @@ public class JdbcAclService implements AclService {
 
 	private AclClassIdUtils aclClassIdUtils;
 
-	private ObjectIdentityGenerator objectIdentityGenerator;
-
 	public JdbcAclService(DataSource dataSource, LookupStrategy lookupStrategy) {
 		this(new JdbcTemplate(dataSource), lookupStrategy);
 	}
@@ -94,7 +91,6 @@ public class JdbcAclService implements AclService {
 		this.jdbcOperations = jdbcOperations;
 		this.lookupStrategy = lookupStrategy;
 		this.aclClassIdUtils = new AclClassIdUtils();
-		this.objectIdentityGenerator = new ObjectIdentityRetrievalStrategyImpl();
 	}
 
 	@Override
@@ -109,7 +105,7 @@ public class JdbcAclService implements AclService {
 		String javaType = rs.getString("class");
 		Serializable identifier = (Serializable) rs.getObject("obj_id");
 		identifier = this.aclClassIdUtils.identifierFrom(identifier, rs);
-		return this.objectIdentityGenerator.createObjectIdentity(identifier, javaType);
+		return new ObjectIdentityImpl(javaType, identifier);
 	}
 
 	@Override
@@ -169,11 +165,6 @@ public class JdbcAclService implements AclService {
 		this.aclClassIdUtils = new AclClassIdUtils(conversionService);
 	}
 
-	public void setObjectIdentityGenerator(ObjectIdentityGenerator objectIdentityGenerator) {
-		Assert.notNull(objectIdentityGenerator, "objectIdentityGenerator cannot be null");
-		this.objectIdentityGenerator = objectIdentityGenerator;
-	}
-
 	protected boolean isAclClassIdSupported() {
 		return this.aclClassIdSupported;
 	}

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -40,7 +40,6 @@ import org.springframework.security.acls.model.ObjectIdentity;
 import org.springframework.security.acls.model.Sid;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.transaction.support.TransactionSynchronizationManager;
 import org.springframework.util.Assert;
 
@@ -65,9 +64,6 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 
 	private static final String DEFAULT_INSERT_INTO_ACL_CLASS_WITH_ID = "insert into acl_class (class, class_id_type) values (?, ?)";
 
-	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
-		.getContextHolderStrategy();
-
 	private boolean foreignKeysInDatabase = true;
 
 	private final AclCache aclCache;
@@ -119,7 +115,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 
 		// Need to retrieve the current principal, in order to know who "owns" this ACL
 		// (can be changed later on)
-		Authentication auth = this.securityContextHolderStrategy.getContext().getAuthentication();
+		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 		PrincipalSid sid = new PrincipalSid(auth);
 
 		// Create the acl_object_identity row
@@ -477,15 +473,4 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 		}
 	}
 
-	/**
-	 * Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
-	 * the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
-	 *
-	 * @since 5.8
-	 */
-	public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
-		Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
-		this.securityContextHolderStrategy = securityContextHolderStrategy;
-	}
-
 }

acl/src/test/java/org/springframework/security/acls/AclFormattingUtilsTests.java

@@ -37,7 +37,7 @@ public class AclFormattingUtilsTests {
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.demergePatterns(null, "SOME STRING"));
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", null));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", "LONGER SOME STRING"));
+				.isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", "LONGER SOME STRING"));
 		assertThatNoException().isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", "SAME LENGTH"));
 	}
 
@@ -46,7 +46,7 @@ public class AclFormattingUtilsTests {
 		String original = "...........................A...R";
 		String removeBits = "...............................R";
 		assertThat(AclFormattingUtils.demergePatterns(original, removeBits))
-			.isEqualTo("...........................A....");
+				.isEqualTo("...........................A....");
 		assertThat(AclFormattingUtils.demergePatterns("ABCDEF", "......")).isEqualTo("ABCDEF");
 		assertThat(AclFormattingUtils.demergePatterns("ABCDEF", "GHIJKL")).isEqualTo("......");
 	}
@@ -56,7 +56,7 @@ public class AclFormattingUtilsTests {
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.mergePatterns(null, "SOME STRING"));
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", null));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", "LONGER SOME STRING"));
+				.isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", "LONGER SOME STRING"));
 		assertThatNoException().isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", "SAME LENGTH"));
 	}
 
@@ -73,9 +73,9 @@ public class AclFormattingUtilsTests {
 	public final void testBinaryPrints() {
 		assertThat(AclFormattingUtils.printBinary(15)).isEqualTo("............................****");
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_ON));
+				.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_ON));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_OFF));
+				.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_OFF));
 		assertThat(AclFormattingUtils.printBinary(15, 'x')).isEqualTo("............................xxxx");
 	}
 

acl/src/test/java/org/springframework/security/acls/AclPermissionCacheOptimizerTests.java

@@ -34,7 +34,7 @@ import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.verifyNoMoreInteractions;
+import static org.mockito.Mockito.verifyZeroInteractions;
 
 /**
  * @author Luke Taylor
@@ -68,7 +68,7 @@ public class AclPermissionCacheOptimizerTests {
 		pco.setObjectIdentityRetrievalStrategy(oids);
 		pco.setSidRetrievalStrategy(sids);
 		pco.cachePermissionsFor(mock(Authentication.class), Collections.emptyList());
-		verifyNoMoreInteractions(service, sids, oids);
+		verifyZeroInteractions(service, sids, oids);
 	}
 
 }

acl/src/test/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProviderTests.java

@@ -85,8 +85,7 @@ public class AclEntryAfterInvocationCollectionFilteringProviderTests {
 		AclEntryAfterInvocationCollectionFilteringProvider provider = new AclEntryAfterInvocationCollectionFilteringProvider(
 				service, Arrays.asList(mock(Permission.class)));
 		assertThat(provider.decide(mock(Authentication.class), new Object(),
-				SecurityConfig.createList("AFTER_ACL_COLLECTION_READ"), null))
-			.isNull();
+				SecurityConfig.createList("AFTER_ACL_COLLECTION_READ"), null)).isNull();
 		verify(service, never()).readAclById(any(ObjectIdentity.class), any(List.class));
 	}
 

acl/src/test/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProviderTests.java

@@ -54,7 +54,7 @@ public class AclEntryAfterInvocationProviderTests {
 	@Test
 	public void rejectsMissingPermissions() {
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new AclEntryAfterInvocationProvider(mock(AclService.class), null));
+				.isThrownBy(() -> new AclEntryAfterInvocationProvider(mock(AclService.class), null));
 		assertThatIllegalArgumentException().isThrownBy(
 				() -> new AclEntryAfterInvocationProvider(mock(AclService.class), Collections.<Permission>emptyList()));
 	}
@@ -112,12 +112,12 @@ public class AclEntryAfterInvocationProviderTests {
 		provider.setProcessDomainObjectClass(Object.class);
 		provider.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
 		assertThatExceptionOfType(AccessDeniedException.class)
-			.isThrownBy(() -> provider.decide(mock(Authentication.class), new Object(),
-					SecurityConfig.createList("UNSUPPORTED", "MY_ATTRIBUTE"), new Object()));
+				.isThrownBy(() -> provider.decide(mock(Authentication.class), new Object(),
+						SecurityConfig.createList("UNSUPPORTED", "MY_ATTRIBUTE"), new Object()));
 		// Second scenario with no acls found
 		assertThatExceptionOfType(AccessDeniedException.class)
-			.isThrownBy(() -> provider.decide(mock(Authentication.class), new Object(),
-					SecurityConfig.createList("UNSUPPORTED", "MY_ATTRIBUTE"), new Object()));
+				.isThrownBy(() -> provider.decide(mock(Authentication.class), new Object(),
+						SecurityConfig.createList("UNSUPPORTED", "MY_ATTRIBUTE"), new Object()));
 	}
 
 	@Test
@@ -126,8 +126,7 @@ public class AclEntryAfterInvocationProviderTests {
 		AclEntryAfterInvocationProvider provider = new AclEntryAfterInvocationProvider(service,
 				Arrays.asList(mock(Permission.class)));
 		assertThat(provider.decide(mock(Authentication.class), new Object(),
-				SecurityConfig.createList("AFTER_ACL_COLLECTION_READ"), null))
-			.isNull();
+				SecurityConfig.createList("AFTER_ACL_COLLECTION_READ"), null)).isNull();
 		verify(service, never()).readAclById(any(ObjectIdentity.class), any(List.class));
 	}
 

acl/src/test/java/org/springframework/security/acls/domain/AccessControlImplEntryTests.java

@@ -77,14 +77,14 @@ public class AccessControlImplEntryTests {
 		assertThat(ace).isNotNull();
 		assertThat(ace).isNotEqualTo(100L);
 		assertThat(ace).isEqualTo(ace);
-		assertThat(ace)
-			.isEqualTo(new AccessControlEntryImpl(1L, mockAcl, sid, BasePermission.ADMINISTRATION, true, true, true));
+		assertThat(ace).isEqualTo(
+				new AccessControlEntryImpl(1L, mockAcl, sid, BasePermission.ADMINISTRATION, true, true, true));
 		assertThat(ace).isNotEqualTo(
 				new AccessControlEntryImpl(2L, mockAcl, sid, BasePermission.ADMINISTRATION, true, true, true));
 		assertThat(ace).isNotEqualTo(new AccessControlEntryImpl(1L, mockAcl, new PrincipalSid("scott"),
 				BasePermission.ADMINISTRATION, true, true, true));
 		assertThat(ace)
-			.isNotEqualTo(new AccessControlEntryImpl(1L, mockAcl, sid, BasePermission.WRITE, true, true, true));
+				.isNotEqualTo(new AccessControlEntryImpl(1L, mockAcl, sid, BasePermission.WRITE, true, true, true));
 		assertThat(ace).isNotEqualTo(
 				new AccessControlEntryImpl(1L, mockAcl, sid, BasePermission.ADMINISTRATION, false, true, true));
 		assertThat(ace).isNotEqualTo(

acl/src/test/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImplTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,13 +29,9 @@ import org.springframework.security.acls.model.Acl;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
-import org.springframework.security.core.context.SecurityContextImpl;
 
 import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.verify;
 
 /**
  * @author Rob Winch
@@ -44,14 +40,9 @@ import static org.mockito.Mockito.verify;
 @ExtendWith(MockitoExtension.class)
 public class AclAuthorizationStrategyImplTests {
 
-	SecurityContext context;
-
 	@Mock
 	Acl acl;
 
-	@Mock
-	SecurityContextHolderStrategy securityContextHolderStrategy;
-
 	GrantedAuthority authority;
 
 	AclAuthorizationStrategyImpl strategy;
@@ -62,8 +53,7 @@ public class AclAuthorizationStrategyImplTests {
 		TestingAuthenticationToken authentication = new TestingAuthenticationToken("foo", "bar",
 				Arrays.asList(this.authority));
 		authentication.setAuthenticated(true);
-		this.context = new SecurityContextImpl(authentication);
-		SecurityContextHolder.setContext(this.context);
+		SecurityContextHolder.getContext().setAuthentication(authentication);
 	}
 
 	@AfterEach
@@ -86,16 +76,6 @@ public class AclAuthorizationStrategyImplTests {
 		this.strategy.securityCheck(this.acl, AclAuthorizationStrategy.CHANGE_GENERAL);
 	}
 
-	@Test
-	public void securityCheckWhenCustomSecurityContextHolderStrategyThenUses() {
-		given(this.securityContextHolderStrategy.getContext()).willReturn(this.context);
-		given(this.acl.getOwner()).willReturn(new GrantedAuthoritySid("ROLE_AUTH"));
-		this.strategy = new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_SYSTEM_ADMIN"));
-		this.strategy.setSecurityContextHolderStrategy(this.securityContextHolderStrategy);
-		this.strategy.securityCheck(this.acl, AclAuthorizationStrategy.CHANGE_GENERAL);
-		verify(this.securityContextHolderStrategy).getContext();
-	}
-
 	@SuppressWarnings("serial")
 	class CustomAuthority implements GrantedAuthority {
 

acl/src/test/java/org/springframework/security/acls/domain/AclImplTests.java

@@ -103,7 +103,7 @@ public class AclImplTests {
 		assertThatIllegalArgumentException().isThrownBy(
 				() -> new AclImpl(null, 1, this.authzStrategy, this.pgs, null, null, true, new PrincipalSid("joe")));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new AclImpl(null, 1, this.authzStrategy, this.mockAuditLogger));
+				.isThrownBy(() -> new AclImpl(null, 1, this.authzStrategy, this.mockAuditLogger));
 	}
 
 	@Test
@@ -111,7 +111,7 @@ public class AclImplTests {
 		assertThatIllegalArgumentException().isThrownBy(() -> new AclImpl(this.objectIdentity, null, this.authzStrategy,
 				this.pgs, null, null, true, new PrincipalSid("joe")));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new AclImpl(this.objectIdentity, null, this.authzStrategy, this.mockAuditLogger));
+				.isThrownBy(() -> new AclImpl(this.objectIdentity, null, this.authzStrategy, this.mockAuditLogger));
 	}
 
 	@Test
@@ -120,7 +120,7 @@ public class AclImplTests {
 				new DefaultPermissionGrantingStrategy(this.mockAuditLogger), null, null, true,
 				new PrincipalSid("joe")));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new AclImpl(this.objectIdentity, 1, null, this.mockAuditLogger));
+				.isThrownBy(() -> new AclImpl(this.objectIdentity, 1, null, this.mockAuditLogger));
 	}
 
 	@Test
@@ -128,7 +128,7 @@ public class AclImplTests {
 		MutableAcl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, null, true,
 				new PrincipalSid("joe"));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> acl.insertAce(0, null, new GrantedAuthoritySid("ROLE_IGNORED"), true));
+				.isThrownBy(() -> acl.insertAce(0, null, new GrantedAuthoritySid("ROLE_IGNORED"), true));
 		assertThatIllegalArgumentException().isThrownBy(() -> acl.insertAce(0, BasePermission.READ, null, true));
 	}
 
@@ -175,7 +175,7 @@ public class AclImplTests {
 		acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST1"), true);
 		service.updateAcl(acl);
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> acl.insertAce(55, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true));
+				.isThrownBy(() -> acl.insertAce(55, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true));
 	}
 
 	@Test
@@ -223,7 +223,7 @@ public class AclImplTests {
 				new PrincipalSid("joe"));
 		Sid ben = new PrincipalSid("ben");
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> acl.isGranted(new ArrayList<>(0), Arrays.asList(ben), false));
+				.isThrownBy(() -> acl.isGranted(new ArrayList<>(0), Arrays.asList(ben), false));
 		assertThatIllegalArgumentException().isThrownBy(() -> acl.isGranted(READ, new ArrayList<>(0), false));
 	}
 
@@ -246,14 +246,12 @@ public class AclImplTests {
 		List<Sid> sids = Arrays.asList(new PrincipalSid("ben"), new GrantedAuthoritySid("ROLE_GUEST"));
 		assertThat(rootAcl.isGranted(permissions, sids, false)).isFalse();
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> rootAcl.isGranted(permissions, SCOTT, false));
+				.isThrownBy(() -> rootAcl.isGranted(permissions, SCOTT, false));
 		assertThat(rootAcl.isGranted(WRITE, SCOTT, false)).isTrue();
 		assertThat(rootAcl.isGranted(WRITE,
-				Arrays.asList(new PrincipalSid("rod"), new GrantedAuthoritySid("WRITE_ACCESS_ROLE")), false))
-			.isFalse();
+				Arrays.asList(new PrincipalSid("rod"), new GrantedAuthoritySid("WRITE_ACCESS_ROLE")), false)).isFalse();
 		assertThat(rootAcl.isGranted(WRITE,
-				Arrays.asList(new GrantedAuthoritySid("WRITE_ACCESS_ROLE"), new PrincipalSid("rod")), false))
-			.isTrue();
+				Arrays.asList(new GrantedAuthoritySid("WRITE_ACCESS_ROLE"), new PrincipalSid("rod")), false)).isTrue();
 		// Change the type of the Sid and check the granting process
 		assertThatExceptionOfType(NotFoundException.class).isThrownBy(() -> rootAcl.isGranted(WRITE,
 				Arrays.asList(new GrantedAuthoritySid("rod"), new PrincipalSid("WRITE_ACCESS_ROLE")), false));
@@ -294,7 +292,7 @@ public class AclImplTests {
 		// Check granting process for parent1
 		assertThat(parentAcl1.isGranted(READ, SCOTT, false)).isTrue();
 		assertThat(parentAcl1.isGranted(READ, Arrays.asList((Sid) new GrantedAuthoritySid("ROLE_USER_READ")), false))
-			.isTrue();
+				.isTrue();
 		assertThat(parentAcl1.isGranted(WRITE, BEN, false)).isTrue();
 		assertThat(parentAcl1.isGranted(DELETE, BEN, false)).isFalse();
 		assertThat(parentAcl1.isGranted(DELETE, SCOTT, false)).isFalse();
@@ -305,13 +303,13 @@ public class AclImplTests {
 		// Check granting process for child1
 		assertThat(childAcl1.isGranted(CREATE, SCOTT, false)).isTrue();
 		assertThat(childAcl1.isGranted(READ, Arrays.asList((Sid) new GrantedAuthoritySid("ROLE_USER_READ")), false))
-			.isTrue();
+				.isTrue();
 		assertThat(childAcl1.isGranted(DELETE, BEN, false)).isFalse();
 		// Check granting process for child2 (doesn't inherit the permissions from its
 		// parent)
 		assertThatExceptionOfType(NotFoundException.class).isThrownBy(() -> childAcl2.isGranted(CREATE, SCOTT, false));
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> childAcl2.isGranted(CREATE, Arrays.asList((Sid) new PrincipalSid("joe")), false));
+				.isThrownBy(() -> childAcl2.isGranted(CREATE, Arrays.asList((Sid) new PrincipalSid("joe")), false));
 	}
 
 	@Test
@@ -398,20 +396,20 @@ public class AclImplTests {
 				new PrincipalSid("joe"));
 		assertThat(acl.isSidLoaded(loadedSids)).isTrue();
 		assertThat(acl.isSidLoaded(Arrays.asList(new GrantedAuthoritySid("ROLE_IGNORED"), new PrincipalSid("ben"))))
-			.isTrue();
+				.isTrue();
 		assertThat(acl.isSidLoaded(Arrays.asList((Sid) new GrantedAuthoritySid("ROLE_IGNORED")))).isTrue();
 		assertThat(acl.isSidLoaded(BEN)).isTrue();
 		assertThat(acl.isSidLoaded(null)).isTrue();
 		assertThat(acl.isSidLoaded(new ArrayList<>(0))).isTrue();
 		assertThat(acl.isSidLoaded(
 				Arrays.asList(new GrantedAuthoritySid("ROLE_IGNORED"), new GrantedAuthoritySid("ROLE_IGNORED"))))
-			.isTrue();
+						.isTrue();
 		assertThat(acl.isSidLoaded(
 				Arrays.asList(new GrantedAuthoritySid("ROLE_GENERAL"), new GrantedAuthoritySid("ROLE_IGNORED"))))
-			.isFalse();
+						.isFalse();
 		assertThat(acl.isSidLoaded(
 				Arrays.asList(new GrantedAuthoritySid("ROLE_IGNORED"), new GrantedAuthoritySid("ROLE_GENERAL"))))
-			.isFalse();
+						.isFalse();
 	}
 
 	@Test
@@ -419,7 +417,7 @@ public class AclImplTests {
 		AclImpl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, this.pgs, null, null, true,
 				new PrincipalSid("joe"));
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> acl.insertAce(-1, mock(Permission.class), mock(Sid.class), true));
+				.isThrownBy(() -> acl.insertAce(-1, mock(Permission.class), mock(Sid.class), true));
 	}
 
 	@Test
@@ -437,7 +435,7 @@ public class AclImplTests {
 		acl.insertAce(0, mock(Permission.class), mock(Sid.class), true);
 		// Size is now 1
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> acl.insertAce(2, mock(Permission.class), mock(Sid.class), true));
+				.isThrownBy(() -> acl.insertAce(2, mock(Permission.class), mock(Sid.class), true));
 	}
 
 	// SEC-1151
@@ -468,7 +466,7 @@ public class AclImplTests {
 		AclImpl acl = new AclImpl(this.objectIdentity, 1, this.authzStrategy, maskPgs, null, null, true,
 				new PrincipalSid("joe"));
 		Permission permission = this.permissionFactory
-			.buildFromMask(BasePermission.READ.getMask() | BasePermission.WRITE.getMask());
+				.buildFromMask(BasePermission.READ.getMask() | BasePermission.WRITE.getMask());
 		Sid sid = new PrincipalSid("ben");
 		acl.insertAce(0, permission, sid, true);
 		service.updateAcl(acl);

acl/src/test/java/org/springframework/security/acls/domain/AclImplementationSecurityCheckTests.java

@@ -73,12 +73,12 @@ public class AclImplementationSecurityCheckTests {
 				new SimpleGrantedAuthority("ROLE_THREE"));
 		Acl acl2 = new AclImpl(identity, 1L, aclAuthorizationStrategy2, new ConsoleAuditLogger());
 		// Check access in case the principal has no authorization rights
-		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_GENERAL));
-		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_AUDITING));
-		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_OWNERSHIP));
+		assertThatExceptionOfType(NotFoundException.class).isThrownBy(
+				() -> aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_GENERAL));
+		assertThatExceptionOfType(NotFoundException.class).isThrownBy(
+				() -> aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_AUDITING));
+		assertThatExceptionOfType(NotFoundException.class).isThrownBy(
+				() -> aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_OWNERSHIP));
 	}
 
 	@Test
@@ -181,11 +181,11 @@ public class AclImplementationSecurityCheckTests {
 				new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()), null, null, false,
 				new PrincipalSid(auth));
 		assertThatNoException()
-			.isThrownBy(() -> aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_GENERAL));
-		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_AUDITING));
-		assertThatNoException()
-			.isThrownBy(() -> aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_OWNERSHIP));
+				.isThrownBy(() -> aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_GENERAL));
+		assertThatExceptionOfType(NotFoundException.class).isThrownBy(
+				() -> aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_AUDITING));
+		assertThatNoException().isThrownBy(
+				() -> aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_OWNERSHIP));
 	}
 
 }

acl/src/test/java/org/springframework/security/acls/domain/ObjectIdentityImplTests.java

@@ -60,7 +60,7 @@ public class ObjectIdentityImplTests {
 	public void testGetIdMethodConstraints() {
 		// Check the getId() method is present
 		assertThatExceptionOfType(IdentityUnavailableException.class)
-			.isThrownBy(() -> new ObjectIdentityImpl("A_STRING_OBJECT"));
+				.isThrownBy(() -> new ObjectIdentityImpl("A_STRING_OBJECT"));
 		// getId() should return a non-null value
 		MockIdDomainObject mockId = new MockIdDomainObject();
 		assertThatIllegalArgumentException().isThrownBy(() -> new ObjectIdentityImpl(mockId));

acl/src/test/java/org/springframework/security/acls/domain/PermissionTests.java

@@ -47,12 +47,10 @@ public class PermissionTests {
 	public void expectedIntegerValues() {
 		assertThat(BasePermission.READ.getMask()).isEqualTo(1);
 		assertThat(BasePermission.ADMINISTRATION.getMask()).isEqualTo(16);
-		assertThat(new CumulativePermission().set(BasePermission.READ)
-			.set(BasePermission.WRITE)
-			.set(BasePermission.CREATE)
-			.getMask()).isEqualTo(7);
+		assertThat(new CumulativePermission().set(BasePermission.READ).set(BasePermission.WRITE)
+				.set(BasePermission.CREATE).getMask()).isEqualTo(7);
 		assertThat(new CumulativePermission().set(BasePermission.READ).set(BasePermission.ADMINISTRATION).getMask())
-			.isEqualTo(17);
+				.isEqualTo(17);
 	}
 
 	@Test
@@ -66,23 +64,20 @@ public class PermissionTests {
 		this.permissionFactory.registerPublicPermissions(SpecialPermission.class);
 		assertThat(BasePermission.READ.toString()).isEqualTo("BasePermission[...............................R=1]");
 		assertThat(BasePermission.ADMINISTRATION.toString())
-			.isEqualTo("BasePermission[...........................A....=16]");
+				.isEqualTo("BasePermission[...........................A....=16]");
 		assertThat(new CumulativePermission().set(BasePermission.READ).toString())
-			.isEqualTo("CumulativePermission[...............................R=1]");
+				.isEqualTo("CumulativePermission[...............................R=1]");
 		assertThat(
 				new CumulativePermission().set(SpecialPermission.ENTER).set(BasePermission.ADMINISTRATION).toString())
-			.isEqualTo("CumulativePermission[..........................EA....=48]");
+						.isEqualTo("CumulativePermission[..........................EA....=48]");
 		assertThat(new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ).toString())
-			.isEqualTo("CumulativePermission[...........................A...R=17]");
-		assertThat(new CumulativePermission().set(BasePermission.ADMINISTRATION)
-			.set(BasePermission.READ)
-			.clear(BasePermission.ADMINISTRATION)
-			.toString()).isEqualTo("CumulativePermission[...............................R=1]");
-		assertThat(new CumulativePermission().set(BasePermission.ADMINISTRATION)
-			.set(BasePermission.READ)
-			.clear(BasePermission.ADMINISTRATION)
-			.clear(BasePermission.READ)
-			.toString()).isEqualTo("CumulativePermission[................................=0]");
+				.isEqualTo("CumulativePermission[...........................A...R=17]");
+		assertThat(new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ)
+				.clear(BasePermission.ADMINISTRATION).toString())
+						.isEqualTo("CumulativePermission[...............................R=1]");
+		assertThat(new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ)
+				.clear(BasePermission.ADMINISTRATION).clear(BasePermission.READ).toString())
+						.isEqualTo("CumulativePermission[................................=0]");
 	}
 
 }

acl/src/test/java/org/springframework/security/acls/jdbc/AbstractBasicLookupStrategyTests.java

@@ -147,7 +147,7 @@ public abstract class AbstractBasicLookupStrategyTests {
 		// Deliberately use an integer for the child, to reproduce bug report in SEC-819
 		ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, 102);
 		Map<ObjectIdentity, Acl> map = this.strategy
-			.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
+				.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
 		checkEntries(topParentOid, middleParentOid, childOid, map);
 	}
 
@@ -161,7 +161,7 @@ public abstract class AbstractBasicLookupStrategyTests {
 		// Let's empty the database to force acls retrieval from cache
 		emptyDatabase();
 		Map<ObjectIdentity, Acl> map = this.strategy
-			.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
+				.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
 		checkEntries(topParentOid, middleParentOid, childOid, map);
 	}
 
@@ -174,7 +174,7 @@ public abstract class AbstractBasicLookupStrategyTests {
 		// acls
 		this.strategy.setBatchSize(1);
 		Map<ObjectIdentity, Acl> map = this.strategy
-			.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
+				.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
 		checkEntries(topParentOid, middleParentOid, childOid, map);
 	}
 
@@ -301,7 +301,7 @@ public abstract class AbstractBasicLookupStrategyTests {
 		getJdbcTemplate().execute(query);
 		ObjectIdentity oid = new ObjectIdentityImpl(TARGET_CLASS, 104L);
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> this.strategy.readAclsById(Arrays.asList(oid), Arrays.asList(BEN_SID)));
+				.isThrownBy(() -> this.strategy.readAclsById(Arrays.asList(oid), Arrays.asList(BEN_SID)));
 	}
 
 	@Test
@@ -318,13 +318,4 @@ public abstract class AbstractBasicLookupStrategyTests {
 		assertThat(((GrantedAuthoritySid) result).getGrantedAuthority()).isEqualTo("sid");
 	}
 
-	@Test
-	public void setObjectIdentityGeneratorWhenNullThenThrowsIllegalArgumentException() {
-		// @formatter:off
-		assertThatIllegalArgumentException()
-				.isThrownBy(() -> this.strategy.setObjectIdentityGenerator(null))
-				.withMessage("objectIdentityGenerator cannot be null");
-		// @formatter:on
-	}
-
 }

acl/src/test/java/org/springframework/security/acls/jdbc/BasicLookupStrategyWithAclClassTypeTests.java

@@ -116,7 +116,7 @@ public class BasicLookupStrategyWithAclClassTypeTests extends AbstractBasicLooku
 	public void testReadObjectIdentityUsingNonUuidInDatabase() {
 		ObjectIdentity oid = new ObjectIdentityImpl(TARGET_CLASS_WITH_UUID, OBJECT_IDENTITY_LONG_AS_UUID);
 		assertThatExceptionOfType(ConversionFailedException.class)
-			.isThrownBy(() -> this.uuidEnabledStrategy.readAclsById(Arrays.asList(oid), Arrays.asList(BEN_SID)));
+				.isThrownBy(() -> this.uuidEnabledStrategy.readAclsById(Arrays.asList(oid), Arrays.asList(BEN_SID)));
 	}
 
 }

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcAclServiceTests.java

@@ -45,7 +45,6 @@ import org.springframework.security.acls.model.Sid;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyList;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -101,7 +100,7 @@ public class JdbcAclServiceTests {
 		ObjectIdentity objectIdentity = new ObjectIdentityImpl(Object.class, 1);
 		List<Sid> sids = Arrays.<Sid>asList(new PrincipalSid("user"));
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> this.aclService.readAclById(objectIdentity, sids));
+				.isThrownBy(() -> this.aclService.readAclById(objectIdentity, sids));
 	}
 
 	@Test
@@ -168,27 +167,7 @@ public class JdbcAclServiceTests {
 		assertThat(objectIdentities.size()).isEqualTo(1);
 		assertThat(objectIdentities.get(0).getType()).isEqualTo("costcenter");
 		assertThat(objectIdentities.get(0).getIdentifier())
-			.isEqualTo(UUID.fromString("25d93b3f-c3aa-4814-9d5e-c7c96ced7762"));
-	}
-
-	@Test
-	public void setObjectIdentityGeneratorWhenNullThenThrowsIllegalArgumentException() {
-		assertThatIllegalArgumentException()
-			.isThrownBy(() -> this.aclServiceIntegration.setObjectIdentityGenerator(null))
-			.withMessage("objectIdentityGenerator cannot be null");
-	}
-
-	@Test
-	public void findChildrenWhenObjectIdentityGeneratorSetThenUsed() {
-		this.aclServiceIntegration
-			.setObjectIdentityGenerator((id, type) -> new ObjectIdentityImpl(type, "prefix:" + id));
-
-		ObjectIdentity objectIdentity = new ObjectIdentityImpl("location", "US");
-		this.aclServiceIntegration.setAclClassIdSupported(true);
-		List<ObjectIdentity> objectIdentities = this.aclServiceIntegration.findChildren(objectIdentity);
-		assertThat(objectIdentities.size()).isEqualTo(1);
-		assertThat(objectIdentities.get(0).getType()).isEqualTo("location");
-		assertThat(objectIdentities.get(0).getIdentifier()).isEqualTo("prefix:US-PAL");
+				.isEqualTo(UUID.fromString("25d93b3f-c3aa-4814-9d5e-c7c96ced7762"));
 	}
 
 	class MockLongIdDomainObject {

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcMutableAclServiceTests.java

@@ -48,10 +48,7 @@ import org.springframework.security.acls.model.Sid;
 import org.springframework.security.acls.sid.CustomSid;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
-import org.springframework.security.core.context.SecurityContextImpl;
 import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
 import org.springframework.test.context.transaction.AfterTransaction;
@@ -62,9 +59,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
-import static org.mockito.Mockito.verify;
 
 /**
  * Integration tests the ACL system using an in-memory database.
@@ -168,7 +163,7 @@ public class JdbcMutableAclServiceTests {
 		this.jdbcMutableAclService.updateAcl(child);
 		// Let's check if we can read them back correctly
 		Map<ObjectIdentity, Acl> map = this.jdbcMutableAclService
-			.readAclsById(Arrays.asList(getTopParentOid(), getMiddleParentOid(), getChildOid()));
+				.readAclsById(Arrays.asList(getTopParentOid(), getMiddleParentOid(), getChildOid()));
 		assertThat(map).hasSize(3);
 		// Get the retrieved versions
 		MutableAcl retrievedTopParent = (MutableAcl) map.get(getTopParentOid());
@@ -196,7 +191,7 @@ public class JdbcMutableAclServiceTests {
 		assertThat(retrievedMiddleParent.isGranted(delete, pSid, false)).isTrue();
 		assertThat(retrievedChild.isGranted(delete, pSid, false)).isFalse();
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> retrievedChild.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), pSid, false));
+				.isThrownBy(() -> retrievedChild.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), pSid, false));
 		// Now check the inherited rights (when not explicitly overridden) also look OK
 		assertThat(retrievedChild.isGranted(read, pSid, false)).isTrue();
 		assertThat(retrievedChild.isGranted(write, pSid, false)).isFalse();
@@ -209,9 +204,9 @@ public class JdbcMutableAclServiceTests {
 		// Check the child permissions no longer inherit
 		assertThat(nonInheritingChild.isGranted(delete, pSid, true)).isFalse();
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> nonInheritingChild.isGranted(read, pSid, true));
+				.isThrownBy(() -> nonInheritingChild.isGranted(read, pSid, true));
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> nonInheritingChild.isGranted(write, pSid, true));
+				.isThrownBy(() -> nonInheritingChild.isGranted(write, pSid, true));
 		// Let's add an identical permission to the child, but it'll appear AFTER the
 		// current permission, so has no impact
 		nonInheritingChild.insertAce(1, BasePermission.DELETE, new PrincipalSid(this.auth), true);
@@ -266,9 +261,9 @@ public class JdbcMutableAclServiceTests {
 		// Delete the mid-parent and test if the child was deleted, as well
 		this.jdbcMutableAclService.deleteAcl(getMiddleParentOid(), true);
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> this.jdbcMutableAclService.readAclById(getMiddleParentOid()));
+				.isThrownBy(() -> this.jdbcMutableAclService.readAclById(getMiddleParentOid()));
 		assertThatExceptionOfType(NotFoundException.class)
-			.isThrownBy(() -> this.jdbcMutableAclService.readAclById(getChildOid()));
+				.isThrownBy(() -> this.jdbcMutableAclService.readAclById(getChildOid()));
 		Acl acl = this.jdbcMutableAclService.readAclById(getTopParentOid());
 		assertThat(acl).isNotNull();
 		assertThat(getTopParentOid()).isEqualTo(acl.getObjectIdentity());
@@ -277,11 +272,11 @@ public class JdbcMutableAclServiceTests {
 	@Test
 	public void constructorRejectsNullParameters() {
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new JdbcMutableAclService(null, this.lookupStrategy, this.aclCache));
+				.isThrownBy(() -> new JdbcMutableAclService(null, this.lookupStrategy, this.aclCache));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new JdbcMutableAclService(this.dataSource, null, this.aclCache));
+				.isThrownBy(() -> new JdbcMutableAclService(this.dataSource, null, this.aclCache));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new JdbcMutableAclService(this.dataSource, this.lookupStrategy, null));
+				.isThrownBy(() -> new JdbcMutableAclService(this.dataSource, this.lookupStrategy, null));
 	}
 
 	@Test
@@ -297,7 +292,7 @@ public class JdbcMutableAclServiceTests {
 		this.jdbcMutableAclService.createAcl(duplicateOid);
 		// Try to add the same object second time
 		assertThatExceptionOfType(AlreadyExistsException.class)
-			.isThrownBy(() -> this.jdbcMutableAclService.createAcl(duplicateOid));
+				.isThrownBy(() -> this.jdbcMutableAclService.createAcl(duplicateOid));
 	}
 
 	@Test
@@ -320,7 +315,7 @@ public class JdbcMutableAclServiceTests {
 		try {
 			// checking in the class, not database
 			assertThatExceptionOfType(ChildrenExistException.class)
-				.isThrownBy(() -> this.jdbcMutableAclService.deleteAcl(getTopParentOid(), false));
+					.isThrownBy(() -> this.jdbcMutableAclService.deleteAcl(getTopParentOid(), false));
 		}
 		finally {
 			// restore to the default
@@ -355,19 +350,6 @@ public class JdbcMutableAclServiceTests {
 		assertThat(this.jdbcMutableAclService.readAclById(new ObjectIdentityImpl(TARGET_CLASS, 101L))).isNotNull();
 	}
 
-	@Test
-	@Transactional
-	public void createAclWhenCustomSecurityContextHolderStrategyThenUses() {
-		SecurityContextHolderStrategy securityContextHolderStrategy = mock(SecurityContextHolderStrategy.class);
-		SecurityContext context = new SecurityContextImpl(this.auth);
-		given(securityContextHolderStrategy.getContext()).willReturn(context);
-		JdbcMutableAclService service = new JdbcMutableAclService(this.dataSource, this.lookupStrategy, this.aclCache);
-		service.setSecurityContextHolderStrategy(securityContextHolderStrategy);
-		ObjectIdentity oid = new ObjectIdentityImpl(TARGET_CLASS, 101);
-		service.createAcl(oid);
-		verify(securityContextHolderStrategy).getContext();
-	}
-
 	/**
 	 * SEC-655
 	 */
@@ -392,7 +374,7 @@ public class JdbcMutableAclServiceTests {
 		child = (MutableAcl) this.jdbcMutableAclService.readAclById(childOid);
 		parent = (MutableAcl) child.getParentAcl();
 		assertThat(parent.getEntries()).hasSize(2)
-			.withFailMessage("Fails because child has a stale reference to its parent");
+				.withFailMessage("Fails because child has a stale reference to its parent");
 		assertThat(parent.getEntries().get(0).getPermission().getMask()).isEqualTo(1);
 		assertThat(parent.getEntries().get(0).getSid()).isEqualTo(new PrincipalSid("ben"));
 		assertThat(parent.getEntries().get(1).getPermission().getMask()).isEqualTo(1);

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcMutableAclServiceTestsWithAclClassId.java

@@ -79,7 +79,7 @@ public class JdbcMutableAclServiceTestsWithAclClassId extends JdbcMutableAclServ
 		ObjectIdentity oid = new ObjectIdentityImpl(TARGET_CLASS_WITH_UUID, id);
 		getJdbcMutableAclService().createAcl(oid);
 		assertThat(getJdbcMutableAclService().readAclById(new ObjectIdentityImpl(TARGET_CLASS_WITH_UUID, id)))
-			.isNotNull();
+				.isNotNull();
 	}
 
 }

acl/src/test/java/org/springframework/security/acls/sid/SidTests.java

@@ -46,9 +46,9 @@ public class SidTests {
 		// Check one Authentication-argument constructor
 		assertThatIllegalArgumentException().isThrownBy(() -> new PrincipalSid((Authentication) null));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new PrincipalSid(new TestingAuthenticationToken(null, "password")));
+				.isThrownBy(() -> new PrincipalSid(new TestingAuthenticationToken(null, "password")));
 		assertThatNoException()
-			.isThrownBy(() -> new PrincipalSid(new TestingAuthenticationToken("johndoe", "password")));
+				.isThrownBy(() -> new PrincipalSid(new TestingAuthenticationToken("johndoe", "password")));
 	}
 
 	@Test
@@ -60,7 +60,7 @@ public class SidTests {
 		// Check one GrantedAuthority-argument constructor
 		assertThatIllegalArgumentException().isThrownBy(() -> new GrantedAuthoritySid((GrantedAuthority) null));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> new GrantedAuthoritySid(new SimpleGrantedAuthority(null)));
+				.isThrownBy(() -> new GrantedAuthoritySid(new SimpleGrantedAuthority(null)));
 		assertThatNoException().isThrownBy(() -> new GrantedAuthoritySid(new SimpleGrantedAuthority("ROLE_TEST")));
 	}
 
@@ -100,7 +100,7 @@ public class SidTests {
 		assertThat(principalSid.hashCode()).isEqualTo(new PrincipalSid("johndoe").hashCode());
 		assertThat(principalSid.hashCode()).isNotEqualTo(new PrincipalSid("scott").hashCode());
 		assertThat(principalSid.hashCode())
-			.isNotEqualTo(new PrincipalSid(new TestingAuthenticationToken("scott", "password")).hashCode());
+				.isNotEqualTo(new PrincipalSid(new TestingAuthenticationToken("scott", "password")).hashCode());
 	}
 
 	@Test
@@ -111,7 +111,7 @@ public class SidTests {
 		assertThat(gaSid.hashCode()).isEqualTo(new GrantedAuthoritySid("ROLE_TEST").hashCode());
 		assertThat(gaSid.hashCode()).isNotEqualTo(new GrantedAuthoritySid("ROLE_TEST_2").hashCode());
 		assertThat(gaSid.hashCode())
-			.isNotEqualTo(new GrantedAuthoritySid(new SimpleGrantedAuthority("ROLE_TEST_2")).hashCode());
+				.isNotEqualTo(new GrantedAuthoritySid(new SimpleGrantedAuthority("ROLE_TEST_2")).hashCode());
 	}
 
 	@Test

aspects/spring-security-aspects.gradle

@@ -27,3 +27,7 @@ sourceSets.test.aspectj.srcDir "src/test/java"
 sourceSets.test.java.srcDirs = files()
 
 compileAspectj.ajcOptions.outxmlfile = "META-INF/aop.xml"
+
+aspectj {
+	version = aspectjVersion
+}

aspects/src/main/java/org/springframework/security/access/intercept/aspectj/aspect/AnnotationSecurityAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,9 +37,7 @@ import org.springframework.security.access.prepost.PreFilter;
  * @author Mike Wiesner
  * @author Luke Taylor
  * @since 3.1
- * @deprecated Use aspects in {@link org.springframework.security.authorization.method.aspectj} instead
  */
-@Deprecated
 public aspect AnnotationSecurityAspect implements InitializingBean {
 
 		/**

aspects/src/main/java/org/springframework/security/authorization/method/aspectj/AbstractMethodInterceptorAspect.aj

@@ -1,61 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.access.prepost.PostAuthorize;
-
-/**
- * Abstract AspectJ aspect for adapting a {@link MethodInvocation}
- *
- * @author Josh Cummings
- * @since 5.8
- */
-abstract aspect AbstractMethodInterceptorAspect {
-
-	protected abstract pointcut executionOfAnnotatedMethod();
-
-	private MethodInterceptor securityInterceptor;
-
-	Object around(): executionOfAnnotatedMethod() {
-		if (this.securityInterceptor == null) {
-			return proceed();
-		}
-		MethodInvocation invocation = new JoinPointMethodInvocation(thisJoinPoint, () -> proceed());
-		try {
-			return this.securityInterceptor.invoke(invocation);
-		} catch (Throwable t) {
-			throwUnchecked(t);
-			throw new IllegalStateException("Code unexpectedly reached", t);
-		}
-	}
-
-	public void setSecurityInterceptor(MethodInterceptor securityInterceptor) {
-		this.securityInterceptor = securityInterceptor;
-	}
-
-	private static void throwUnchecked(Throwable ex) {
-		AbstractMethodInterceptorAspect.<RuntimeException>throwAny(ex);
-	}
-
-	@SuppressWarnings("unchecked")
-	private static <E extends Throwable> void throwAny(Throwable ex) throws E {
-		throw (E) ex;
-	}
-}

aspects/src/main/java/org/springframework/security/authorization/method/aspectj/JoinPointMethodInvocation.aj

@@ -1,98 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.authorization.method.aspectj;
-
-import java.lang.reflect.AccessibleObject;
-import java.lang.reflect.Method;
-import java.util.function.Supplier;
-
-import org.aopalliance.intercept.MethodInvocation;
-import org.aspectj.lang.JoinPoint;
-import org.aspectj.lang.reflect.CodeSignature;
-
-import org.springframework.util.Assert;
-
-class JoinPointMethodInvocation implements MethodInvocation {
-
-	private final JoinPoint jp;
-
-	private final Method method;
-
-	private final Object target;
-
-	private final Supplier<Object> proceed;
-
-	JoinPointMethodInvocation(JoinPoint jp, Supplier<Object> proceed) {
-		this.jp = jp;
-		if (jp.getTarget() != null) {
-			this.target = jp.getTarget();
-		}
-		else {
-			// SEC-1295: target may be null if an ITD is in use
-			this.target = jp.getSignature().getDeclaringType();
-		}
-		String targetMethodName = jp.getStaticPart().getSignature().getName();
-		Class<?>[] types = ((CodeSignature) jp.getStaticPart().getSignature()).getParameterTypes();
-		Class<?> declaringType = jp.getStaticPart().getSignature().getDeclaringType();
-		this.method = findMethod(targetMethodName, declaringType, types);
-		Assert.notNull(this.method, () -> "Could not obtain target method from JoinPoint: '" + jp + "'");
-		this.proceed = proceed;
-	}
-
-	private Method findMethod(String name, Class<?> declaringType, Class<?>[] params) {
-		Method method = null;
-		try {
-			method = declaringType.getMethod(name, params);
-		}
-		catch (NoSuchMethodException ignored) {
-		}
-		if (method == null) {
-			try {
-				method = declaringType.getDeclaredMethod(name, params);
-			}
-			catch (NoSuchMethodException ignored) {
-			}
-		}
-		return method;
-	}
-
-	@Override
-	public Method getMethod() {
-		return this.method;
-	}
-
-	@Override
-	public Object[] getArguments() {
-		return this.jp.getArgs();
-	}
-
-	@Override
-	public AccessibleObject getStaticPart() {
-		return this.method;
-	}
-
-	@Override
-	public Object getThis() {
-		return this.target;
-	}
-
-	@Override
-	public Object proceed() throws Throwable {
-		return this.proceed.get();
-	}
-
-}

aspects/src/main/java/org/springframework/security/authorization/method/aspectj/PostAuthorizeAspect.aj

@@ -1,44 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.access.prepost.PostAuthorize;
-
-/**
- * Concrete AspectJ aspect using Spring Security @PostAuthorize annotation.
- *
- * <p>
- * When using this aspect, you <i>must</i> annotate the implementation class
- * (and/or methods within that class), <i>not</i> the interface (if any) that
- * the class implements. AspectJ follows Java's rule that annotations on
- * interfaces are <i>not</i> inherited. This will vary from Spring AOP.
- *
- * @author Mike Wiesner
- * @author Luke Taylor
- * @author Josh Cummings
- * @since 5.8
- */
-public aspect PostAuthorizeAspect extends AbstractMethodInterceptorAspect {
-
-	/**
-	 * Matches the execution of any method with a PostAuthorize annotation.
-	 */
-	protected pointcut executionOfAnnotatedMethod() : execution(* *(..)) && @annotation(PostAuthorize);
-}

aspects/src/main/java/org/springframework/security/authorization/method/aspectj/PostFilterAspect.aj

@@ -1,45 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.access.prepost.PostFilter;
-
-/**
- * Concrete AspectJ aspect using Spring Security @PostFilter annotation.
- *
- * <p>
- * When using this aspect, you <i>must</i> annotate the implementation class
- * (and/or methods within that class), <i>not</i> the interface (if any) that
- * the class implements. AspectJ follows Java's rule that annotations on
- * interfaces are <i>not</i> inherited. This will vary from Spring AOP.
- *
- * @author Mike Wiesner
- * @author Luke Taylor
- * @author Josh Cummings
- * @since 5.8
- */
-public aspect PostFilterAspect extends AbstractMethodInterceptorAspect {
-
-	/**
-	 * Matches the execution of any method with a PostFilter annotation.
-	 */
-	protected pointcut executionOfAnnotatedMethod() : execution(* *(..)) && @annotation(PostFilter);
-
-}

aspects/src/main/java/org/springframework/security/authorization/method/aspectj/PreAuthorizeAspect.aj

@@ -1,44 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.access.prepost.PreAuthorize;
-
-/**
- * Concrete AspectJ aspect using Spring Security @PreAuthorize annotation.
- *
- * <p>
- * When using this aspect, you <i>must</i> annotate the implementation class
- * (and/or methods within that class), <i>not</i> the interface (if any) that
- * the class implements. AspectJ follows Java's rule that annotations on
- * interfaces are <i>not</i> inherited. This will vary from Spring AOP.
- *
- * @author Mike Wiesner
- * @author Luke Taylor
- * @author Josh Cummings
- * @since 5.8
- */
-public aspect PreAuthorizeAspect extends AbstractMethodInterceptorAspect {
-
-	/**
-	 * Matches the execution of any method with a PreAuthorize annotation.
-	 */
-	protected pointcut executionOfAnnotatedMethod() : execution(* *(..)) && @annotation(PreAuthorize);
-}

aspects/src/main/java/org/springframework/security/authorization/method/aspectj/PreFilterAspect.aj

@@ -1,45 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.access.prepost.PreFilter;
-
-/**
- * Concrete AspectJ aspect using Spring Security @PreFilter annotation.
- *
- * <p>
- * When using this aspect, you <i>must</i> annotate the implementation class
- * (and/or methods within that class), <i>not</i> the interface (if any) that
- * the class implements. AspectJ follows Java's rule that annotations on
- * interfaces are <i>not</i> inherited. This will vary from Spring AOP.
- *
- * @author Mike Wiesner
- * @author Luke Taylor
- * @author Josh Cummings
- * @since 5.8
- */
-public aspect PreFilterAspect extends AbstractMethodInterceptorAspect {
-
-	/**
-	 * Matches the execution of any method with a PreFilter annotation.
-	 */
-	protected pointcut executionOfAnnotatedMethod() : execution(* *(..)) && @annotation(PreFilter);
-
-}

aspects/src/main/java/org/springframework/security/authorization/method/aspectj/SecuredAspect.aj

@@ -1,56 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.access.annotation.Secured;
-
-/**
- * Concrete AspectJ aspect using Spring Security @Secured annotation.
- *
- * <p>
- * When using this aspect, you <i>must</i> annotate the implementation class
- * (and/or methods within that class), <i>not</i> the interface (if any) that
- * the class implements. AspectJ follows Java's rule that annotations on
- * interfaces are <i>not</i> inherited. This will vary from Spring AOP.
- *
- * @author Mike Wiesner
- * @author Luke Taylor
- * @author Josh Cummings
- * @since 5.8
- */
-public aspect SecuredAspect extends AbstractMethodInterceptorAspect {
-
-	/**
-	 * Matches the execution of any public method in a type with the Secured
-	 * annotation, or any subtype of a type with the Secured annotation.
-	 */
-	private pointcut executionOfAnyPublicMethodInAtSecuredType() :
-			execution(public * ((@Secured *)+).*(..)) && @this(Secured);
-
-	/**
-	 * Matches the execution of any method with the Secured annotation.
-	 */
-	private pointcut executionOfSecuredMethod() :
-			execution(* *(..)) && @annotation(Secured);
-
-	protected pointcut executionOfAnnotatedMethod() :
-			executionOfAnyPublicMethodInAtSecuredType() ||
-			executionOfSecuredMethod();
-}

aspects/src/test/java/org/springframework/security/access/intercept/aspectj/aspect/AnnotationSecurityAspectTests.java

@@ -101,7 +101,7 @@ public class AnnotationSecurityAspectTests {
 	@Test
 	public void securedClassMethodDeniesUnauthenticatedAccess() {
 		assertThatExceptionOfType(AuthenticationCredentialsNotFoundException.class)
-			.isThrownBy(() -> this.secured.securedClassMethod());
+				.isThrownBy(() -> this.secured.securedClassMethod());
 	}
 
 	@Test

aspects/src/test/java/org/springframework/security/authorization/method/aspectj/PostAuthorizeAspectTests.java

@@ -1,160 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.MockitoAnnotations;
-
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.prepost.PostAuthorize;
-import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.authorization.method.AuthorizationManagerAfterMethodInterceptor;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-
-/**
- * @author Luke Taylor
- * @since 3.0.3
- */
-public class PostAuthorizeAspectTests {
-
-	private TestingAuthenticationToken anne = new TestingAuthenticationToken("anne", "", "ROLE_A");
-
-	private MethodInterceptor interceptor;
-
-	private SecuredImpl secured = new SecuredImpl();
-
-	private SecuredImplSubclass securedSub = new SecuredImplSubclass();
-
-	private PrePostSecured prePostSecured = new PrePostSecured();
-
-	@BeforeEach
-	public final void setUp() {
-		MockitoAnnotations.initMocks(this);
-		this.interceptor = AuthorizationManagerAfterMethodInterceptor.postAuthorize();
-		PostAuthorizeAspect secAspect = PostAuthorizeAspect.aspectOf();
-		secAspect.setSecurityInterceptor(this.interceptor);
-	}
-
-	@AfterEach
-	public void clearContext() {
-		SecurityContextHolder.clearContext();
-	}
-
-	@Test
-	public void securedInterfaceMethodAllowsAllAccess() {
-		this.secured.securedMethod();
-	}
-
-	@Test
-	public void securedClassMethodDeniesUnauthenticatedAccess() {
-		assertThatExceptionOfType(AuthenticationCredentialsNotFoundException.class)
-			.isThrownBy(() -> this.secured.securedClassMethod());
-	}
-
-	@Test
-	public void securedClassMethodAllowsAccessToRoleA() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		this.secured.securedClassMethod();
-	}
-
-	@Test
-	public void internalPrivateCallIsIntercepted() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.secured.publicCallsPrivate());
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.securedSub.publicCallsPrivate());
-	}
-
-	@Test
-	public void protectedMethodIsIntercepted() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.secured.protectedMethod());
-	}
-
-	@Test
-	public void overriddenProtectedMethodIsNotIntercepted() {
-		// AspectJ doesn't inherit annotations
-		this.securedSub.protectedMethod();
-	}
-
-	// SEC-1262
-	@Test
-	public void denyAllPreAuthorizeDeniesAccess() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.prePostSecured::denyAllMethod);
-	}
-
-	interface SecuredInterface {
-
-		@PostAuthorize("hasRole('X')")
-		void securedMethod();
-
-	}
-
-	static class SecuredImpl implements SecuredInterface {
-
-		// Not really secured because AspectJ doesn't inherit annotations from interfaces
-		@Override
-		public void securedMethod() {
-		}
-
-		@PostAuthorize("hasRole('A')")
-		void securedClassMethod() {
-		}
-
-		@PostAuthorize("hasRole('X')")
-		private void privateMethod() {
-		}
-
-		@PostAuthorize("hasRole('X')")
-		protected void protectedMethod() {
-		}
-
-		@PostAuthorize("hasRole('X')")
-		void publicCallsPrivate() {
-			privateMethod();
-		}
-
-	}
-
-	static class SecuredImplSubclass extends SecuredImpl {
-
-		@Override
-		protected void protectedMethod() {
-		}
-
-		@Override
-		public void publicCallsPrivate() {
-			super.publicCallsPrivate();
-		}
-
-	}
-
-	static class PrePostSecured {
-
-		@PostAuthorize("denyAll")
-		void denyAllMethod() {
-		}
-
-	}
-
-}

aspects/src/test/java/org/springframework/security/authorization/method/aspectj/PostFilterAspectTests.java

@@ -1,66 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.authorization.method.aspectj;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.MockitoAnnotations;
-
-import org.springframework.security.access.prepost.PostFilter;
-import org.springframework.security.authorization.method.PostFilterAuthorizationMethodInterceptor;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * @author Luke Taylor
- * @since 3.0.3
- */
-public class PostFilterAspectTests {
-
-	private MethodInterceptor interceptor;
-
-	private PrePostSecured prePostSecured = new PrePostSecured();
-
-	@BeforeEach
-	public final void setUp() {
-		MockitoAnnotations.initMocks(this);
-		this.interceptor = new PostFilterAuthorizationMethodInterceptor();
-		PostFilterAspect secAspect = PostFilterAspect.aspectOf();
-		secAspect.setSecurityInterceptor(this.interceptor);
-	}
-
-	@Test
-	public void preFilterMethodWhenListThenFilters() {
-		List<String> objects = new ArrayList<>(Arrays.asList("apple", "banana", "aubergine", "orange"));
-		assertThat(this.prePostSecured.postFilterMethod(objects)).containsExactly("apple", "aubergine");
-	}
-
-	static class PrePostSecured {
-
-		@PostFilter("filterObject.startsWith('a')")
-		List<String> postFilterMethod(List<String> objects) {
-			return objects;
-		}
-
-	}
-
-}

aspects/src/test/java/org/springframework/security/authorization/method/aspectj/PreAuthorizeAspectTests.java

@@ -1,160 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.MockitoAnnotations;
-
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-
-/**
- * @author Luke Taylor
- * @since 3.0.3
- */
-public class PreAuthorizeAspectTests {
-
-	private TestingAuthenticationToken anne = new TestingAuthenticationToken("anne", "", "ROLE_A");
-
-	private MethodInterceptor interceptor;
-
-	private SecuredImpl secured = new SecuredImpl();
-
-	private SecuredImplSubclass securedSub = new SecuredImplSubclass();
-
-	private PrePostSecured prePostSecured = new PrePostSecured();
-
-	@BeforeEach
-	public final void setUp() {
-		MockitoAnnotations.initMocks(this);
-		this.interceptor = AuthorizationManagerBeforeMethodInterceptor.preAuthorize();
-		PreAuthorizeAspect secAspect = PreAuthorizeAspect.aspectOf();
-		secAspect.setSecurityInterceptor(this.interceptor);
-	}
-
-	@AfterEach
-	public void clearContext() {
-		SecurityContextHolder.clearContext();
-	}
-
-	@Test
-	public void securedInterfaceMethodAllowsAllAccess() {
-		this.secured.securedMethod();
-	}
-
-	@Test
-	public void securedClassMethodDeniesUnauthenticatedAccess() {
-		assertThatExceptionOfType(AuthenticationCredentialsNotFoundException.class)
-			.isThrownBy(() -> this.secured.securedClassMethod());
-	}
-
-	@Test
-	public void securedClassMethodAllowsAccessToRoleA() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		this.secured.securedClassMethod();
-	}
-
-	@Test
-	public void internalPrivateCallIsIntercepted() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.secured.publicCallsPrivate());
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.securedSub.publicCallsPrivate());
-	}
-
-	@Test
-	public void protectedMethodIsIntercepted() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.secured.protectedMethod());
-	}
-
-	@Test
-	public void overriddenProtectedMethodIsNotIntercepted() {
-		// AspectJ doesn't inherit annotations
-		this.securedSub.protectedMethod();
-	}
-
-	// SEC-1262
-	@Test
-	public void denyAllPreAuthorizeDeniesAccess() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.prePostSecured::denyAllMethod);
-	}
-
-	interface SecuredInterface {
-
-		@PreAuthorize("hasRole('X')")
-		void securedMethod();
-
-	}
-
-	static class SecuredImpl implements SecuredInterface {
-
-		// Not really secured because AspectJ doesn't inherit annotations from interfaces
-		@Override
-		public void securedMethod() {
-		}
-
-		@PreAuthorize("hasRole('A')")
-		void securedClassMethod() {
-		}
-
-		@PreAuthorize("hasRole('X')")
-		private void privateMethod() {
-		}
-
-		@PreAuthorize("hasRole('X')")
-		protected void protectedMethod() {
-		}
-
-		@PreAuthorize("hasRole('X')")
-		void publicCallsPrivate() {
-			privateMethod();
-		}
-
-	}
-
-	static class SecuredImplSubclass extends SecuredImpl {
-
-		@Override
-		protected void protectedMethod() {
-		}
-
-		@Override
-		public void publicCallsPrivate() {
-			super.publicCallsPrivate();
-		}
-
-	}
-
-	static class PrePostSecured {
-
-		@PreAuthorize("denyAll")
-		void denyAllMethod() {
-		}
-
-	}
-
-}

aspects/src/test/java/org/springframework/security/authorization/method/aspectj/PreFilterAspectTests.java

@@ -1,66 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.authorization.method.aspectj;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.MockitoAnnotations;
-
-import org.springframework.security.access.prepost.PreFilter;
-import org.springframework.security.authorization.method.PreFilterAuthorizationMethodInterceptor;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * @author Luke Taylor
- * @since 3.0.3
- */
-public class PreFilterAspectTests {
-
-	private MethodInterceptor interceptor;
-
-	private PrePostSecured prePostSecured = new PrePostSecured();
-
-	@BeforeEach
-	public final void setUp() {
-		MockitoAnnotations.initMocks(this);
-		this.interceptor = new PreFilterAuthorizationMethodInterceptor();
-		PreFilterAspect secAspect = PreFilterAspect.aspectOf();
-		secAspect.setSecurityInterceptor(this.interceptor);
-	}
-
-	@Test
-	public void preFilterMethodWhenListThenFilters() {
-		List<String> objects = new ArrayList<>(Arrays.asList("apple", "banana", "aubergine", "orange"));
-		assertThat(this.prePostSecured.preFilterMethod(objects)).containsExactly("apple", "aubergine");
-	}
-
-	static class PrePostSecured {
-
-		@PreFilter("filterObject.startsWith('a')")
-		List<String> preFilterMethod(List<String> objects) {
-			return objects;
-		}
-
-	}
-
-}

aspects/src/test/java/org/springframework/security/authorization/method/aspectj/SecuredAspectTests.java

@@ -1,143 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.authorization.method.aspectj;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.MockitoAnnotations;
-
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.annotation.Secured;
-import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-
-/**
- * @author Luke Taylor
- * @since 3.0.3
- */
-public class SecuredAspectTests {
-
-	private TestingAuthenticationToken anne = new TestingAuthenticationToken("anne", "", "ROLE_A");
-
-	private MethodInterceptor interceptor;
-
-	private SecuredImpl secured = new SecuredImpl();
-
-	private SecuredImplSubclass securedSub = new SecuredImplSubclass();
-
-	@BeforeEach
-	public final void setUp() {
-		MockitoAnnotations.initMocks(this);
-		this.interceptor = AuthorizationManagerBeforeMethodInterceptor.secured();
-		SecuredAspect secAspect = SecuredAspect.aspectOf();
-		secAspect.setSecurityInterceptor(this.interceptor);
-	}
-
-	@AfterEach
-	public void clearContext() {
-		SecurityContextHolder.clearContext();
-	}
-
-	@Test
-	public void securedInterfaceMethodAllowsAllAccess() {
-		this.secured.securedMethod();
-	}
-
-	@Test
-	public void securedClassMethodDeniesUnauthenticatedAccess() {
-		assertThatExceptionOfType(AuthenticationCredentialsNotFoundException.class)
-			.isThrownBy(() -> this.secured.securedClassMethod());
-	}
-
-	@Test
-	public void securedClassMethodAllowsAccessToRoleA() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		this.secured.securedClassMethod();
-	}
-
-	@Test
-	public void internalPrivateCallIsIntercepted() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.secured.publicCallsPrivate());
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.securedSub.publicCallsPrivate());
-	}
-
-	@Test
-	public void protectedMethodIsIntercepted() {
-		SecurityContextHolder.getContext().setAuthentication(this.anne);
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> this.secured.protectedMethod());
-	}
-
-	@Test
-	public void overriddenProtectedMethodIsNotIntercepted() {
-		// AspectJ doesn't inherit annotations
-		this.securedSub.protectedMethod();
-	}
-
-	interface SecuredInterface {
-
-		@Secured("ROLE_X")
-		void securedMethod();
-
-	}
-
-	static class SecuredImpl implements SecuredInterface {
-
-		// Not really secured because AspectJ doesn't inherit annotations from interfaces
-		@Override
-		public void securedMethod() {
-		}
-
-		@Secured("ROLE_A")
-		void securedClassMethod() {
-		}
-
-		@Secured("ROLE_X")
-		private void privateMethod() {
-		}
-
-		@Secured("ROLE_X")
-		protected void protectedMethod() {
-		}
-
-		@Secured("ROLE_X")
-		void publicCallsPrivate() {
-			privateMethod();
-		}
-
-	}
-
-	static class SecuredImplSubclass extends SecuredImpl {
-
-		@Override
-		protected void protectedMethod() {
-		}
-
-		@Override
-		public void publicCallsPrivate() {
-			super.publicCallsPrivate();
-		}
-
-	}
-
-}

build.gradle

@@ -1,16 +1,15 @@
 import io.spring.gradle.IncludeRepoTask
-import trang.RncToXsd
 
 buildscript {
 	dependencies {
-		classpath libs.io.spring.javaformat.spring.javaformat.gradle.plugin
-		classpath libs.io.spring.nohttp.nohttp.gradle
-		classpath libs.io.freefair.gradle.aspectj.plugin
-		classpath libs.org.jetbrains.kotlin.kotlin.gradle.plugin
-		classpath libs.com.netflix.nebula.nebula.project.plugin
+		classpath "io.spring.javaformat:spring-javaformat-gradle-plugin:$springJavaformatVersion"
+		classpath 'io.spring.nohttp:nohttp-gradle:0.0.11'
+		classpath "io.freefair.gradle:aspectj-plugin:6.2.0"
+		classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinVersion"
+		classpath "com.netflix.nebula:nebula-project-plugin:8.2.0"
 	}
 	repositories {
-		gradlePluginPortal()
+		maven { url 'https://plugins.gradle.org/m2/' }
 	}
 }
 
@@ -19,13 +18,12 @@ apply plugin: 'locks'
 apply plugin: 's101'
 apply plugin: 'io.spring.convention.root'
 apply plugin: 'org.jetbrains.kotlin.jvm'
+apply plugin: 'org.springframework.security.update-dependencies'
 apply plugin: 'org.springframework.security.update-version'
 apply plugin: 'org.springframework.security.sagan'
 apply plugin: 'org.springframework.github.milestone'
 apply plugin: 'org.springframework.github.changelog'
 apply plugin: 'org.springframework.github.release'
-apply plugin: 'org.springframework.security.versions.verify-dependencies-versions'
-apply plugin: 'org.springframework.security.check-expected-branch-version'
 
 group = 'org.springframework.security'
 description = 'Spring Security'
@@ -87,6 +85,71 @@ tasks.named("dispatchGitHubWorkflow") {
 	}
 }
 
+tasks.named("updateDependencies") {
+	// we aren't Gradle 7 compatible yet
+	checkForGradleUpdate = false
+}
+
+updateDependenciesSettings {
+	gitHub {
+		organization = "spring-projects"
+		repository = "spring-security"
+	}
+	addFiles({
+		return [
+				project.file("buildSrc/src/main/groovy/io/spring/gradle/convention/CheckstylePlugin.groovy")
+		]
+	})
+	dependencyExcludes {
+		majorVersionBump()
+		minorVersionBump()
+		alphaBetaVersions()
+		releaseCandidatesVersions()
+		milestoneVersions()
+		snapshotVersions()
+		addRule { components ->
+			components.withModule("commons-codec:commons-codec") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("commons-codec updates break saml tests");
+				}
+			}
+			components.withModule("org.python:jython") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("jython updates break integration tests");
+				}
+			}
+			components.withModule("com.nimbusds:nimbus-jose-jwt") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("nimbus-jose-jwt gets updated when oauth2-oidc-sdk is updated to ensure consistency");
+				}
+			}
+			components.all { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				// Do not compare version due to multiple versions existing
+				// will cause opensaml 3.x to be updated to 4.x
+				if (candidate.getGroup().equals("org.opensaml")) {
+					selection.reject("org.opensaml maintains two different versions, so it must be updated manually");
+				}
+			}
+			components.withModule("io.spring.javaformat:spring-javaformat-gradle-plugin") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("spring-javaformat-gradle-plugin updates break checkstyle");
+				}
+			}
+			components.withModule("io.spring.javaformat:spring-javaformat-checkstyle") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("spring-javaformat-checkstyle updates break checkstyle");
+				}
+			}
+		}
+	}
+}
+
 subprojects {
 	plugins.withType(JavaPlugin) {
 		project.sourceCompatibility='1.8'
@@ -94,6 +157,7 @@ subprojects {
 	tasks.withType(JavaCompile) {
 		options.encoding = "UTF-8"
 		options.compilerArgs.add("-parameters")
+		options.release = 8
 	}
 }
 
@@ -106,7 +170,7 @@ allprojects {
 		pluginManager.withPlugin("io.spring.convention.checkstyle", { plugin ->
 			configure(plugin) {
 				dependencies {
-					checkstyle libs.io.spring.javaformat.spring.javaformat.checkstyle
+					checkstyle "io.spring.javaformat:spring-javaformat-checkstyle:$springJavaformatVersion"
 				}
 				checkstyle {
 					toolVersion = '8.34'
@@ -122,24 +186,18 @@ allprojects {
 			}
 		}
 	}
-
-	tasks.withType(JavaCompile).configureEach {
-		javaCompiler = javaToolchains.compilerFor {
-			languageVersion = JavaLanguageVersion.of(8)
-		}
-	}
 }
 
-develocity {
+if (hasProperty('buildScan')) {
 	buildScan {
-		termsOfUseUrl = 'https://gradle.com/help/legal-terms-of-use'
-		termsOfUseAgree = 'yes'
+		termsOfServiceUrl = 'https://gradle.com/terms-of-service'
+		termsOfServiceAgree = 'yes'
 	}
 }
 
 nohttp {
 	source.exclude "buildSrc/build/**"
-	source.builtBy(project(':spring-security-config').tasks.withType(RncToXsd))
+
 }
 
 tasks.register('cloneSamples', IncludeRepoTask) {
@@ -149,6 +207,5 @@ tasks.register('cloneSamples', IncludeRepoTask) {
 }
 
 s101 {
-	repository = 'https://structure101.com/binaries/latest'
 	configurationDirectory = project.file("etc/s101")
 }

buildSrc/build.gradle

@@ -2,6 +2,7 @@ plugins {
 	id "java-gradle-plugin"
 	id "java"
 	id "groovy"
+	id 'com.apollographql.apollo' version '2.4.5'
 }
 
 sourceCompatibility = 1.8
@@ -40,6 +41,10 @@ gradlePlugin {
 			id = "io.spring.convention.management-configuration"
 			implementationClass = "io.spring.gradle.convention.ManagementConfigurationPlugin"
 		}
+		updateDependencies {
+			id = "org.springframework.security.update-dependencies"
+			implementationClass = "org.springframework.security.convention.versions.UpdateDependenciesPlugin"
+		}
 		updateProjectVersion {
 			id = "org.springframework.security.update-version"
 			implementationClass = "org.springframework.security.convention.versions.UpdateProjectVersionPlugin"
@@ -64,14 +69,6 @@ gradlePlugin {
 			id = "s101"
 			implementationClass = "s101.S101Plugin"
 		}
-		verifyDependenciesVersions {
-			id = "org.springframework.security.versions.verify-dependencies-versions"
-			implementationClass = "org.springframework.security.convention.versions.VerifyDependenciesVersionsPlugin"
-		}
-		checkExpectedBranchVersion {
-			id = "org.springframework.security.check-expected-branch-version"
-			implementationClass = "org.springframework.security.CheckExpectedBranchVersionPlugin"
-		}
 	}
 }
 
@@ -82,37 +79,34 @@ configurations {
 }
 
 dependencies {
-	implementation platform(libs.io.projectreactor.reactor.bom)
-
-	implementation libs.com.google.code.gson.gson
-	implementation libs.com.thaiopensource.trag
-	implementation libs.net.sourceforge.saxon.saxon
-	implementation libs.org.yaml.snakeyaml
+	implementation 'com.google.code.gson:gson:2.8.6'
+	implementation 'com.thaiopensource:trang:20091111'
+	implementation 'net.sourceforge.saxon:saxon:9.1.0.8'
+	implementation 'org.yaml:snakeyaml:1.30'
 	implementation localGroovy()
 
-	implementation libs.io.github.gradle.nexus.publish.plugin
-	implementation 'io.projectreactor:reactor-core'
-	implementation libs.org.gretty.gretty
-	implementation libs.com.github.ben.manes.gradle.versions.plugin
-	implementation libs.com.github.spullara.mustache.java.compiler
-	implementation libs.io.spring.javaformat.spring.javaformat.gradle.plugin
-	implementation libs.io.spring.nohttp.nohttp.gradle
-	implementation libs.net.sourceforge.htmlunit
-	implementation libs.org.hidetake.gradle.ssh.plugin
-	implementation libs.org.jfrog.buildinfo.build.info.extractor.gradle
-	implementation libs.org.sonarsource.scanner.gradle.sonarqube.gradle.plugin
-	implementation libs.com.squareup.okhttp3.okhttp
+	implementation 'io.github.gradle-nexus:publish-plugin:1.1.0'
+	implementation 'io.projectreactor:reactor-core:3.4.31'
+	implementation 'org.gretty:gretty:3.0.9'
+	implementation 'com.apollographql.apollo:apollo-runtime:2.4.5'
+	implementation 'com.github.ben-manes:gradle-versions-plugin:0.38.0'
+	implementation 'com.github.spullara.mustache.java:compiler:0.9.4'
+	implementation 'io.spring.javaformat:spring-javaformat-gradle-plugin:0.0.15'
+	implementation 'io.spring.nohttp:nohttp-gradle:0.0.11'
+	implementation 'net.sourceforge.htmlunit:htmlunit:2.37.0'
+	implementation 'org.hidetake:gradle-ssh-plugin:2.10.1'
+	implementation 'org.jfrog.buildinfo:build-info-extractor-gradle:4.29.0'
+	implementation 'org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.7.1'
 
-	testImplementation platform(libs.org.junit.junit.bom)
-	testImplementation platform(libs.org.mockito.mockito.bom)
+	testImplementation platform('org.junit:junit-bom:5.8.2')
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testImplementation "org.junit.jupiter:junit-jupiter-params"
 	testImplementation "org.junit.jupiter:junit-jupiter-engine"
-	testImplementation libs.org.apache.commons.commons.io
-	testImplementation libs.org.assertj.assertj.core
-	testImplementation 'org.mockito:mockito-core'
-	testImplementation 'org.mockito:mockito-junit-jupiter'
-	testImplementation libs.com.squareup.okhttp3.mockwebserver
+	testImplementation 'org.apache.commons:commons-io:1.3.2'
+	testImplementation 'org.assertj:assertj-core:3.13.2'
+	testImplementation 'org.mockito:mockito-core:3.12.4'
+	testImplementation 'org.mockito:mockito-junit-jupiter:3.12.4'
+	testImplementation "com.squareup.okhttp3:mockwebserver:3.14.9"
 }
 
 

buildSrc/settings.gradle

@@ -1,7 +0,0 @@
-dependencyResolutionManagement {
-	versionCatalogs {
-		libs {
-			from(files("../gradle/libs.versions.toml"))
-		}
-	}
-}

buildSrc/src/main/groovy/io/spring/gradle/convention/IntegrationTestPlugin.groovy

@@ -59,22 +59,14 @@ public class IntegrationTestPlugin implements Plugin<Project> {
 			integrationTestRuntime {
 				extendsFrom integrationTestCompile, testRuntime, testRuntimeOnly
 			}
-			integrationTestCompileClasspath {
-				extendsFrom integrationTestCompile
-				canBeResolved = true
-			}
-			integrationTestRuntimeClasspath {
-				extendsFrom integrationTestRuntime
-				canBeResolved = true
-			}
 		}
 
 		project.sourceSets {
 			integrationTest {
 				java.srcDir project.file('src/integration-test/java')
 				resources.srcDir project.file('src/integration-test/resources')
-				compileClasspath = project.sourceSets.main.output + project.sourceSets.test.output + project.configurations.integrationTestCompileClasspath
-				runtimeClasspath = output + compileClasspath + project.configurations.integrationTestRuntimeClasspath
+				compileClasspath = project.sourceSets.main.output + project.sourceSets.test.output + project.configurations.integrationTestCompile
+				runtimeClasspath = output + compileClasspath + project.configurations.integrationTestRuntime
 			}
 		}
 
@@ -93,7 +85,7 @@ public class IntegrationTestPlugin implements Plugin<Project> {
 			project.idea {
 				module {
 					testSourceDirs += project.file('src/integration-test/java')
-					scopes.TEST.plus += [ project.configurations.integrationTestCompileClasspath ]
+					scopes.TEST.plus += [ project.configurations.integrationTestCompile ]
 				}
 			}
 		}
@@ -123,7 +115,7 @@ public class IntegrationTestPlugin implements Plugin<Project> {
 
 		project.plugins.withType(EclipsePlugin) {
 			project.eclipse.classpath {
-				plusConfigurations += [ project.configurations.integrationTestCompileClasspath ]
+				plusConfigurations += [ project.configurations.integrationTestCompile ]
 			}
 		}
 	}

buildSrc/src/main/groovy/io/spring/gradle/convention/RepositoryConventionPlugin.groovy

@@ -34,14 +34,6 @@ class RepositoryConventionPlugin implements Plugin<Project> {
 			if (forceMavenRepositories?.contains('local')) {
 				mavenLocal()
 			}
-			maven {
-				name = 'shibboleth'
-				url = 'https://build.shibboleth.net/nexus/content/repositories/releases/'
-				content {
-					includeGroupByRegex('org\\.opensaml.*')
-					includeGroupByRegex('net\\.shibboleth.*')
-				}
-			}
 			mavenCentral()
 			if (isSnapshot) {
 				maven {
@@ -75,11 +67,12 @@ class RepositoryConventionPlugin implements Plugin<Project> {
 						password project.artifactoryPassword
 					}
 				}
-				content {
-					excludeGroup('net.minidev')
-				}
 				url = 'https://repo.spring.io/release/'
 			}
+			maven {
+				name = 'shibboleth'
+				url = 'https://build.shibboleth.net/nexus/content/repositories/releases/'
+			}
 		}
 	}
 

buildSrc/src/main/groovy/io/spring/gradle/convention/SchemaDeployPlugin.groovy

@@ -62,33 +62,6 @@ public class SchemaDeployPlugin implements Plugin<Project> {
 						execute "rm -f $tempPath*.zip"
 						execute "rm -rf $extractPath*"
 						execute "mv $tempPath/* $extractPath"
-
-						/*
-						 * Copy spring-security-oauth schemas so that legacy projects using the "http" scheme can
-						 * resolve the following schema locations:
-						 *
-						 * - http://www.springframework.org/schema/security/spring-security-oauth-1.0.xsd
-						 * - http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
-						 * - http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
-						 *
-						 * Note: The directory:
-						 *   https://www.springframework.org/schema/security/
-						 *
-						 * is a symbolic link pointing to:
-						 *   https://docs.spring.io/autorepo/schema/spring-security/current/security/
-						 *
-						 * which in turn points to the latest:
-						 *   https://docs.spring.io/autorepo/schema/spring-security/$version/security/
-						 *
-						 * with the help of the autoln command which is run regularly via a cron job.
-						 *
-						 * See https://github.com/spring-io/autoln for more info.
-						 */
-						if (name == "spring-security") {
-							def springSecurityOauthPath = "/var/www/domains/spring.io/docs/htdocs/autorepo/schema/spring-security-oauth/current/security"
-							execute "cp $springSecurityOauthPath/* ${extractPath}security"
-						}
-
 						execute "chmod -R g+w $extractPath"
 					}
 				}

buildSrc/src/main/groovy/io/spring/gradle/convention/SchemaZipPlugin.groovy

@@ -1,10 +1,9 @@
 package io.spring.gradle.convention
 
-import org.gradle.api.Plugin
-import org.gradle.api.Project
 import org.gradle.api.plugins.JavaPlugin
 import org.gradle.api.tasks.bundling.Zip
-import org.springframework.gradle.xsd.CreateVersionlessXsdTask
+import org.gradle.api.Plugin
+import org.gradle.api.Project
 
 public class SchemaZipPlugin implements Plugin<Project> {
 
@@ -16,10 +15,7 @@ public class SchemaZipPlugin implements Plugin<Project> {
 		schemaZip.archiveClassifier = 'schema'
 		schemaZip.description = "Builds -${schemaZip.archiveClassifier} archive containing all " +
 			"XSDs for deployment at static.springframework.org/schema."
-		def versionlessXsd = project.tasks.create("versionlessXsd", CreateVersionlessXsdTask) {
-			description = "Generates spring-security.xsd"
-			versionlessXsdFile = project.layout.buildDirectory.file("versionlessXsd/spring-security.xsd")
-		}
+
 		project.rootProject.subprojects.each { module ->
 
 			module.getPlugins().withType(JavaPlugin.class).all {
@@ -40,14 +36,8 @@ public class SchemaZipPlugin implements Plugin<Project> {
 						duplicatesStrategy 'exclude'
 						from xsdFile.path
 					}
-					versionlessXsd.getInputFiles().from(xsdFile.path)
 				}
 			}
 		}
-
-        schemaZip.into("security") {
-            from(versionlessXsd.getOutputs())
-        }
-
 	}
 }

buildSrc/src/main/java/org/springframework/gradle/github/user/GitHubUserApi.java

@@ -1,82 +0,0 @@
-/*
- * Copyright 2020-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.gradle.github.user;
-
-import java.io.IOException;
-
-import com.google.gson.Gson;
-import okhttp3.Interceptor;
-import okhttp3.OkHttpClient;
-import okhttp3.Request;
-import okhttp3.Response;
-
-/**
- * @author Steve Riesenberg
- */
-public class GitHubUserApi {
-	private String baseUrl = "https://api.github.com";
-
-	private final OkHttpClient httpClient;
-	private Gson gson = new Gson();
-
-	public GitHubUserApi(String gitHubAccessToken) {
-		this.httpClient = new OkHttpClient.Builder()
-				.addInterceptor(new AuthorizationInterceptor(gitHubAccessToken))
-				.build();
-	}
-
-	public void setBaseUrl(String baseUrl) {
-		this.baseUrl = baseUrl;
-	}
-
-	/**
-	 * Retrieve a GitHub user by the personal access token.
-	 *
-	 * @return The GitHub user
-	 */
-	public User getUser() {
-		String url = this.baseUrl + "/user";
-		Request request = new Request.Builder().url(url).get().build();
-		try (Response response = this.httpClient.newCall(request).execute()) {
-			if (!response.isSuccessful()) {
-				throw new RuntimeException(
-						String.format("Unable to retrieve GitHub user." +
-								" Please check the personal access token and try again." +
-								" Got response %s", response));
-			}
-			return this.gson.fromJson(response.body().charStream(), User.class);
-		} catch (IOException ex) {
-			throw new RuntimeException("Unable to retrieve GitHub user.", ex);
-		}
-	}
-
-	private static class AuthorizationInterceptor implements Interceptor {
-		private final String token;
-
-		public AuthorizationInterceptor(String token) {
-			this.token = token;
-		}
-
-		@Override
-		public Response intercept(Chain chain) throws IOException {
-			Request request = chain.request().newBuilder()
-					.addHeader("Authorization", "Bearer " + this.token)
-					.build();
-
-			return chain.proceed(request);
-		}
-	}
-}

buildSrc/src/main/java/org/springframework/gradle/github/user/User.java

@@ -1,53 +0,0 @@
-package org.springframework.gradle.github.user;
-
-/**
- * @author Steve Riesenberg
- */
-public class User {
-	private Long id;
-	private String login;
-	private String name;
-	private String url;
-
-	public Long getId() {
-		return this.id;
-	}
-
-	public void setId(Long id) {
-		this.id = id;
-	}
-
-	public String getLogin() {
-		return this.login;
-	}
-
-	public void setLogin(String login) {
-		this.login = login;
-	}
-
-	public String getName() {
-		return this.name;
-	}
-
-	public void setName(String name) {
-		this.name = name;
-	}
-
-	public String getUrl() {
-		return this.url;
-	}
-
-	public void setUrl(String url) {
-		this.url = url;
-	}
-
-	@Override
-	public String toString() {
-		return "User{" +
-				"id=" + id +
-				", login='" + login + '\'' +
-				", name='" + name + '\'' +
-				", url='" + url + '\'' +
-				'}';
-	}
-}

buildSrc/src/main/java/org/springframework/gradle/sagan/SaganApi.java

@@ -26,14 +26,14 @@ import java.util.Base64;
  * Implements necessary calls to the Sagan API See https://spring.io/restdocs/index.html
  */
 public class SaganApi {
-	private String baseUrl = "https://api.spring.io";
+	private String baseUrl = "https://spring.io/api";
 
 	private OkHttpClient client;
 	private Gson gson = new Gson();
 
-	public SaganApi(String username, String gitHubToken) {
+	public SaganApi(String gitHubToken) {
 		this.client = new OkHttpClient.Builder()
-				.addInterceptor(new BasicInterceptor(username, gitHubToken))
+				.addInterceptor(new BasicInterceptor("not-used", gitHubToken))
 				.build();
 	}
 

buildSrc/src/main/java/org/springframework/gradle/sagan/SaganCreateReleaseTask.java

@@ -16,21 +16,12 @@
 
 package org.springframework.gradle.sagan;
 
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
 import org.gradle.api.DefaultTask;
 import org.gradle.api.tasks.Input;
 import org.gradle.api.tasks.TaskAction;
 
-import org.springframework.gradle.github.user.GitHubUserApi;
-import org.springframework.gradle.github.user.User;
-import org.springframework.util.Assert;
-
 public class SaganCreateReleaseTask extends DefaultTask {
 
-	private static final Pattern VERSION_PATTERN = Pattern.compile("^([0-9]+)\\.([0-9]+)\\.([0-9]+)(-.+)?$");
-
 	@Input
 	private String gitHubAccessToken;
 	@Input
@@ -44,25 +35,11 @@ public class SaganCreateReleaseTask extends DefaultTask {
 
 	@TaskAction
 	public void saganCreateRelease() {
-		GitHubUserApi github = new GitHubUserApi(this.gitHubAccessToken);
-		User user = github.getUser();
-
-		// Antora reference docs URLs for snapshots do not contain -SNAPSHOT
-		String referenceDocUrl = this.referenceDocUrl;
-		if (this.version.endsWith("-SNAPSHOT")) {
-			Matcher versionMatcher = VERSION_PATTERN.matcher(this.version);
-			Assert.isTrue(versionMatcher.matches(), "Version " + this.version + " does not match expected pattern");
-			String majorVersion = versionMatcher.group(1);
-			String minorVersion = versionMatcher.group(2);
-			String majorMinorVersion = String.format("%s.%s-SNAPSHOT", majorVersion, minorVersion);
-			referenceDocUrl = this.referenceDocUrl.replace("{version}", majorMinorVersion);
-		}
-
-		SaganApi sagan = new SaganApi(user.getLogin(), this.gitHubAccessToken);
+		SaganApi sagan = new SaganApi(this.gitHubAccessToken);
 		Release release = new Release();
 		release.setVersion(this.version);
 		release.setApiDocUrl(this.apiDocUrl);
-		release.setReferenceDocUrl(referenceDocUrl);
+		release.setReferenceDocUrl(this.referenceDocUrl);
 		sagan.createReleaseForProject(release, this.projectName);
 	}
 

buildSrc/src/main/java/org/springframework/gradle/sagan/SaganDeleteReleaseTask.java

@@ -20,9 +20,6 @@ import org.gradle.api.DefaultTask;
 import org.gradle.api.tasks.Input;
 import org.gradle.api.tasks.TaskAction;
 
-import org.springframework.gradle.github.user.GitHubUserApi;
-import org.springframework.gradle.github.user.User;
-
 public class SaganDeleteReleaseTask extends DefaultTask {
 
 	@Input
@@ -34,10 +31,7 @@ public class SaganDeleteReleaseTask extends DefaultTask {
 
 	@TaskAction
 	public void saganCreateRelease() {
-		GitHubUserApi github = new GitHubUserApi(this.gitHubAccessToken);
-		User user = github.getUser();
-
-		SaganApi sagan = new SaganApi(user.getLogin(), this.gitHubAccessToken);
+		SaganApi sagan = new SaganApi(this.gitHubAccessToken);
 		sagan.deleteReleaseForProject(this.version, this.projectName);
 	}
 

buildSrc/src/main/java/org/springframework/gradle/xsd/CreateVersionlessXsdTask.java

@@ -1,147 +0,0 @@
-/*
- * Copyright 2019-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.gradle.xsd;
-
-import org.gradle.api.DefaultTask;
-import org.gradle.api.file.ConfigurableFileCollection;
-import org.gradle.api.file.RegularFileProperty;
-import org.gradle.api.tasks.*;
-import org.gradle.work.DisableCachingByDefault;
-
-import java.io.File;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-/**
- * Creates the spring-security.xsd automatically
- *
- * @author Rob Winch
- */
-@DisableCachingByDefault(because = "not worth it")
-public abstract class CreateVersionlessXsdTask extends DefaultTask {
-
-	@InputFiles
-	public abstract ConfigurableFileCollection getInputFiles();
-
-	@OutputFile
-	abstract RegularFileProperty getVersionlessXsdFile();
-
-	@TaskAction
-	void createVersionlessXsd() throws IOException {
-		XsdFileMajorMinorVersion largest = null;
-		ConfigurableFileCollection inputFiles = getInputFiles();
-		if (inputFiles.isEmpty()) {
-			throw new IllegalStateException("No Inputs configured");
-		}
-		for (File file : inputFiles) {
-			XsdFileMajorMinorVersion current = XsdFileMajorMinorVersion.create(file);
-			if (current == null) {
-				continue;
-			}
-			if (largest == null) {
-				largest = current;
-			}
-			else if (current.getVersion().isGreaterThan(largest.getVersion())) {
-				largest = current;
-			}
-		}
-		if (largest == null) {
-			throw new IllegalStateException("Could not create versionless xsd file because no files matching spring-security-<digit>.xsd were found in " + inputFiles.getFiles());
-		}
-		Path to = getVersionlessXsdFile().getAsFile().get().toPath();
-		Path from = largest.getFile().toPath();
-		Files.copy(from, to, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.COPY_ATTRIBUTES);
-	}
-
-	static class XsdFileMajorMinorVersion {
-		private final File file;
-
-		private final MajorMinorVersion version;
-
-		private XsdFileMajorMinorVersion(File file, MajorMinorVersion version) {
-			this.file = file;
-			this.version = version;
-		}
-
-		private static final Pattern FILE_MAJOR_MINOR_VERSION_PATTERN = Pattern.compile("^spring-security-(\\d+)\\.(\\d+)\\.xsd$");
-
-		/**
-		 * If matches xsd with major minor version (e.g. spring-security-5.1.xsd returns it, otherwise null
-		 * @param file
-		 * @return
-		 */
-		static XsdFileMajorMinorVersion create(File file) {
-			String fileName = file.getName();
-			Matcher matcher = FILE_MAJOR_MINOR_VERSION_PATTERN.matcher(fileName);
-			if (!matcher.find()) {
-				return null;
-			}
-			int major = Integer.parseInt(matcher.group(1));
-			int minor = Integer.parseInt(matcher.group(2));
-			MajorMinorVersion version = new MajorMinorVersion(major, minor);
-			return new XsdFileMajorMinorVersion(file, version);
-		}
-
-		public File getFile() {
-			return file;
-		}
-
-		public MajorMinorVersion getVersion() {
-			return version;
-		}
-	}
-
-	static class MajorMinorVersion {
-		private final int major;
-
-		private final int minor;
-
-		MajorMinorVersion(int major, int minor) {
-			this.major = major;
-			this.minor = minor;
-		}
-
-		public int getMajor() {
-			return major;
-		}
-
-		public int getMinor() {
-			return minor;
-		}
-
-		public boolean isGreaterThan(MajorMinorVersion version) {
-			if (getMajor() > version.getMajor()) {
-				return true;
-			}
-			if (getMajor() < version.getMajor()) {
-				return false;
-			}
-			if (getMinor() > version.getMinor()) {
-				return true;
-			}
-			if (getMinor() < version.getMinor()) {
-				return false;
-			}
-			// they are equal
-			return false;
-		}
-	}
-}

buildSrc/src/main/java/org/springframework/security/CheckExpectedBranchVersionPlugin.java

@@ -1,85 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-
-import org.gradle.api.DefaultTask;
-import org.gradle.api.Plugin;
-import org.gradle.api.Project;
-import org.gradle.api.plugins.JavaBasePlugin;
-import org.gradle.api.tasks.TaskAction;
-import org.gradle.api.tasks.TaskProvider;
-
-/**
- * @author Marcus da Coregio
- */
-public class CheckExpectedBranchVersionPlugin implements Plugin<Project> {
-
-	@Override
-	public void apply(Project project) {
-		TaskProvider<CheckExpectedBranchVersionTask> checkExpectedBranchVersionTask = project.getTasks().register("checkExpectedBranchVersion", CheckExpectedBranchVersionTask.class, (task) -> {
-			task.setGroup("Build");
-			task.setDescription("Check if the project version matches the branch version");
-		});
-		project.getTasks().named(JavaBasePlugin.CHECK_TASK_NAME, checkTask -> checkTask.dependsOn(checkExpectedBranchVersionTask));
-	}
-
-	public static class CheckExpectedBranchVersionTask extends DefaultTask {
-
-		@TaskAction
-		public void run() throws IOException {
-			Project project = getProject();
-			if (project.hasProperty("skipCheckExpectedBranchVersion")) {
-				return;
-			}
-			String version = (String) project.getVersion();
-			String branchVersion = getBranchVersion(project);
-			if (!branchVersion.matches("^[0-9]+\\.[0-9]+\\.x$")) {
-				System.out.println("Branch version '" + branchVersion + "' does not match *.x, ignoring");
-				return;
-			}
-			if (!versionsMatch(version, branchVersion)) {
-				throw new IllegalStateException(String.format("Project version [%s] does not match branch version [%s]. " +
-						"Please verify that the branch contains the right version.", version, branchVersion));
-			}
-		}
-
-		private static String getBranchVersion(Project project) throws IOException {
-			try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-				project.exec((exec) -> {
-					exec.commandLine("git", "symbolic-ref", "--short", "HEAD");
-					exec.setErrorOutput(System.err);
-					exec.setStandardOutput(baos);
-				});
-				return baos.toString().trim();
-			}
-		}
-
-		private boolean versionsMatch(String projectVersion, String branchVersion) {
-			String[] projectVersionParts = projectVersion.split("\\.");
-			String[] branchVersionParts = branchVersion.split("\\.");
-			if (projectVersionParts.length < 2 || branchVersionParts.length < 2) {
-				return false;
-			}
-			return projectVersionParts[0].equals(branchVersionParts[0]) && projectVersionParts[1].equals(branchVersionParts[1]);
-		}
-
-	}
-
-}

buildSrc/src/main/java/org/springframework/security/convention/versions/CommandLineUtils.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.PrintStream;
+import java.util.Arrays;
+import java.util.Scanner;
+
+class CommandLineUtils {
+	static void runCommand(File dir, String... args) {
+		try {
+			Process process = new ProcessBuilder()
+					.directory(dir)
+					.command(args)
+					.start();
+			writeLinesTo(process.getInputStream(), System.out);
+			writeLinesTo(process.getErrorStream(), System.out);
+			if (process.waitFor() != 0) {
+				new RuntimeException("Failed to run " + Arrays.toString(args));
+			}
+		} catch (IOException | InterruptedException e) {
+			throw new RuntimeException("Failed to run " + Arrays.toString(args), e);
+		}
+	}
+
+	private static void writeLinesTo(InputStream input, PrintStream out) {
+		Scanner scanner = new Scanner(input);
+		while(scanner.hasNextLine()) {
+			out.println(scanner.nextLine());
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/GitHubApi.java

@@ -0,0 +1,179 @@
+package org.springframework.security.convention.versions;
+
+import com.apollographql.apollo.ApolloCall;
+import com.apollographql.apollo.ApolloClient;
+import com.apollographql.apollo.api.Input;
+import com.apollographql.apollo.api.Response;
+import com.apollographql.apollo.exception.ApolloException;
+import okhttp3.Interceptor;
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import org.jetbrains.annotations.NotNull;
+import reactor.core.publisher.Mono;
+import reactor.util.retry.Retry;
+import reactor.util.retry.RetrySpec;
+
+import java.io.IOException;
+import java.time.Duration;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+public class GitHubApi {
+
+	private final ApolloClient apolloClient;
+
+	public GitHubApi(String githubToken) {
+		if (githubToken == null) {
+			throw new IllegalArgumentException("githubToken is required. You can set it using -PgitHubAccessToken=");
+		}
+		OkHttpClient.Builder clientBuilder = new OkHttpClient.Builder();
+		clientBuilder.addInterceptor(new AuthorizationInterceptor(githubToken));
+		this.apolloClient = ApolloClient.builder()
+				.serverUrl("https://api.github.com/graphql")
+				.okHttpClient(clientBuilder.build())
+				.build();
+	}
+
+	public Mono<FindCreateIssueResult> findCreateIssueInput(String owner, String name, String milestone) {
+		String label = "\"type: dependency-upgrade\"";
+		FindCreateIssueInputQuery findCreateIssueInputQuery = new FindCreateIssueInputQuery(owner, name, Input.optional(label), Input.optional(milestone));
+		return Mono.create( sink -> this.apolloClient.query(findCreateIssueInputQuery)
+				.enqueue(new ApolloCall.Callback<FindCreateIssueInputQuery.Data>() {
+					@Override
+					public void onResponse(@NotNull Response<FindCreateIssueInputQuery.Data> response) {
+						if (response.hasErrors()) {
+							sink.error(new RuntimeException(response.getErrors().stream().map(e -> e.getMessage()).collect(Collectors.joining(" "))));
+						} else {
+							FindCreateIssueInputQuery.Data data = response.getData();
+							FindCreateIssueInputQuery.Repository repository = data.repository();
+							List<String> labels = repository.labels().nodes().stream().map(FindCreateIssueInputQuery.Node::id).collect(Collectors.toList());
+							if (labels.isEmpty()) {
+								sink.error(new IllegalArgumentException("Could not find label for " + label));
+								return;
+							}
+							Optional<String> firstMilestoneId = repository.milestones().nodes().stream().map(FindCreateIssueInputQuery.Node1::id).findFirst();
+							if (!firstMilestoneId.isPresent()) {
+								sink.error(new IllegalArgumentException("Could not find OPEN milestone id for " + milestone));
+								return;
+							}
+							String milestoneId = firstMilestoneId.get();
+							String repositoryId = repository.id();
+							String assigneeId = data.viewer().id();
+							sink.success(new FindCreateIssueResult(repositoryId, labels, milestoneId, assigneeId));
+						}
+					}
+					@Override
+					public void onFailure(@NotNull ApolloException e) {
+						sink.error(e);
+					}
+				}));
+	}
+
+	public static class FindCreateIssueResult {
+		private final String repositoryId;
+		private final List<String> labelIds;
+		private final String milestoneId;
+		private final String assigneeId;
+
+		public FindCreateIssueResult(String repositoryId, List<String> labelIds, String milestoneId, String assigneeId) {
+			this.repositoryId = repositoryId;
+			this.labelIds = labelIds;
+			this.milestoneId = milestoneId;
+			this.assigneeId = assigneeId;
+		}
+
+		public String getRepositoryId() {
+			return repositoryId;
+		}
+
+		public List<String> getLabelIds() {
+			return labelIds;
+		}
+
+		public String getMilestoneId() {
+			return milestoneId;
+		}
+
+		public String getAssigneeId() {
+			return assigneeId;
+		}
+	}
+
+	public Mono<RateLimitQuery.RateLimit> findRateLimit() {
+		return Mono.create( sink -> this.apolloClient.query(new RateLimitQuery())
+			.enqueue(new ApolloCall.Callback<RateLimitQuery.Data>() {
+				@Override
+				public void onResponse(@NotNull Response<RateLimitQuery.Data> response) {
+					if (response.hasErrors()) {
+						sink.error(new RuntimeException(response.getErrors().stream().map(e -> e.getMessage()).collect(Collectors.joining(" "))));
+					} else {
+						sink.success(response.getData().rateLimit());
+					}
+				}
+				@Override
+				public void onFailure(@NotNull ApolloException e) {
+					sink.error(e);
+				}
+			}));
+	}
+
+	public Mono<Integer> createIssue(String repositoryId, String title, List<String> labelIds, String milestoneId, String assigneeId) {
+		CreateIssueInputMutation createIssue = new CreateIssueInputMutation.Builder()
+				.repositoryId(repositoryId)
+				.title(title)
+				.labelIds(labelIds)
+				.milestoneId(milestoneId)
+				.assigneeId(assigneeId)
+				.build();
+		return Mono.create( sink -> this.apolloClient.mutate(createIssue)
+				.enqueue(new ApolloCall.Callback<CreateIssueInputMutation.Data>() {
+					@Override
+					public void onResponse(@NotNull Response<CreateIssueInputMutation.Data> response) {
+						if (response.hasErrors()) {
+							String message = response.getErrors().stream().map(e -> e.getMessage() + " " + e.getCustomAttributes() + " " + e.getLocations()).collect(Collectors.joining(" "));
+							if (message.contains("was submitted too quickly")) {
+								sink.error(new SubmittedTooQuick(message));
+							} else {
+								sink.error(new RuntimeException(message));
+							}
+						} else {
+							sink.success(response.getData().createIssue().issue().number());
+						}
+					}
+					@Override
+					public void onFailure(@NotNull ApolloException e) {
+						sink.error(e);
+					}
+				}))
+				.retryWhen(
+					RetrySpec.fixedDelay(3, Duration.ofMinutes(1))
+						.filter(SubmittedTooQuick.class::isInstance)
+						.doBeforeRetry(r -> System.out.println("Pausing for 1 minute and then retrying due to receiving \"submitted too quickly\" error from GitHub API"))
+				)
+				.cast(Integer.class);
+	}
+
+	public static class SubmittedTooQuick extends RuntimeException {
+		public SubmittedTooQuick(String message) {
+			super(message);
+		}
+	}
+
+	private static class AuthorizationInterceptor implements Interceptor {
+
+		private final String token;
+
+		public AuthorizationInterceptor(String token) {
+			this.token = token;
+		}
+
+		@Override
+		public okhttp3.Response intercept(Chain chain) throws IOException {
+			Request request = chain.request().newBuilder()
+					.addHeader("Authorization", "Bearer " + this.token).build();
+			return chain.proceed(request);
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/TransitiveDependencyLookupUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2019-2020 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

buildSrc/src/main/java/org/springframework/security/convention/versions/UpdateDependenciesExtension.java

@@ -0,0 +1,198 @@
+package org.springframework.security.convention.versions;
+
+import com.github.benmanes.gradle.versions.updates.resolutionstrategy.ComponentSelectionRulesWithCurrent;
+import com.github.benmanes.gradle.versions.updates.resolutionstrategy.ComponentSelectionWithCurrent;
+import com.github.benmanes.gradle.versions.updates.resolutionstrategy.ResolutionStrategyWithCurrent;
+import org.gradle.api.Action;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Supplier;
+import java.util.regex.Pattern;
+
+public class UpdateDependenciesExtension {
+	private Supplier<List<File>> files;
+
+	private UpdateMode updateMode = UpdateMode.COMMIT;
+
+	private DependencyExcludes dependencyExcludes = new DependencyExcludes();
+
+	private GitHub gitHub = new GitHub();
+
+	public UpdateDependenciesExtension(Supplier<List<File>> files) {
+		this.files = files;
+	}
+
+	public void setUpdateMode(UpdateMode updateMode) {
+		this.updateMode = updateMode;
+	}
+
+	public UpdateMode getUpdateMode() {
+		return updateMode;
+	}
+
+	GitHub getGitHub() {
+		return this.gitHub;
+	}
+
+	DependencyExcludes getExcludes() {
+		return dependencyExcludes;
+	}
+
+	Supplier<List<File>> getFiles() {
+		return files;
+	}
+
+	public void setFiles(Supplier<List<File>> files) {
+		this.files = files;
+	}
+
+	public void addFiles(Supplier<List<File>> files) {
+		Supplier<List<File>> original = this.files;
+		setFiles(() -> {
+			List<File> result = new ArrayList<>(original.get());
+			result.addAll(files.get());
+			return result;
+		});
+	}
+
+	public void dependencyExcludes(Action<DependencyExcludes> excludes) {
+		excludes.execute(this.dependencyExcludes);
+	}
+
+	public void gitHub(Action<GitHub> gitHub) {
+		gitHub.execute(this.gitHub);
+	}
+
+	public enum UpdateMode {
+		COMMIT,
+		GITHUB_ISSUE
+	}
+
+	public class GitHub {
+		private String organization;
+
+		private String repository;
+
+		private String accessToken;
+
+		private String milestone;
+
+		public String getOrganization() {
+			return organization;
+		}
+
+		public void setOrganization(String organization) {
+			this.organization = organization;
+		}
+
+		public String getRepository() {
+			return repository;
+		}
+
+		public void setRepository(String repository) {
+			this.repository = repository;
+		}
+
+		public String getAccessToken() {
+			return accessToken;
+		}
+
+		public void setAccessToken(String accessToken) {
+			this.accessToken = accessToken;
+		}
+
+		public String getMilestone() {
+			return milestone;
+		}
+
+		public void setMilestone(String milestone) {
+			this.milestone = milestone;
+		}
+	}
+
+	/**
+	 * Consider creating some Predicates instead since they are composible
+	 */
+	public class DependencyExcludes {
+		private List<Action<ComponentSelectionWithCurrent>> actions = new ArrayList<>();
+		private List<Action<ComponentSelectionRulesWithCurrent>> components = new ArrayList<>();
+
+		List<Action<ComponentSelectionWithCurrent>> getActions() {
+			return actions;
+		}
+
+		public List<Action<ComponentSelectionRulesWithCurrent>> getComponents() {
+			return components;
+		}
+
+		public DependencyExcludes alphaBetaVersions() {
+			this.actions.add(excludeVersionWithRegex("(?i).*?(alpha|beta).*", "an alpha or beta version"));
+			return this;
+		}
+
+		public DependencyExcludes majorVersionBump() {
+			this.actions.add((selection) -> {
+				String currentVersion = selection.getCurrentVersion();
+				int separator = currentVersion.indexOf(".");
+				String major = separator > 0 ? currentVersion.substring(0, separator) : currentVersion;
+				String candidateVersion = selection.getCandidate().getVersion();
+				Pattern calVerPattern = Pattern.compile("\\d\\d\\d\\d.*");
+				boolean isCalVer = calVerPattern.matcher(candidateVersion).matches();
+				if (!isCalVer && !candidateVersion.startsWith(major)) {
+					selection.reject("Cannot upgrade to new Major Version");
+				}
+			});
+			return this;
+		}
+
+		public DependencyExcludes minorVersionBump() {
+			this.actions.add(createExcludeMinorVersionBump());
+			return this;
+		}
+
+		public Action<ComponentSelectionWithCurrent> createExcludeMinorVersionBump() {
+			return (selection) -> {
+				String currentVersion = selection.getCurrentVersion();
+				int majorSeparator = currentVersion.indexOf(".");
+				int separator = currentVersion.indexOf(".", majorSeparator + 1);
+				String majorMinor = separator > 0 ? currentVersion.substring(0, separator) : currentVersion;
+				String candidateVersion = selection.getCandidate().getVersion();
+				if (!candidateVersion.startsWith(majorMinor)) {
+					selection.reject("Cannot upgrade to new Minor Version");
+				}
+			};
+		}
+
+		public DependencyExcludes releaseCandidatesVersions() {
+			this.actions.add(excludeVersionWithRegex("(?i).*?rc.*", "a release candidate version"));
+			return this;
+		}
+
+		public DependencyExcludes milestoneVersions() {
+			this.actions.add(excludeVersionWithRegex("(?i).*?m\\d+.*", "a milestone version"));
+			return this;
+		}
+
+		public DependencyExcludes snapshotVersions() {
+			this.actions.add(excludeVersionWithRegex(".*?-SNAPSHOT.*", "a SNAPSHOT version"));
+			return this;
+		}
+
+		public DependencyExcludes addRule(Action<ComponentSelectionRulesWithCurrent> rule) {
+			this.components.add(rule);
+			return this;
+		}
+
+		private Action<ComponentSelectionWithCurrent> excludeVersionWithRegex(String regex, String reason) {
+			Pattern pattern = Pattern.compile(regex);
+			return (selection) -> {
+				String candidateVersion = selection.getCandidate().getVersion();
+				if (pattern.matcher(candidateVersion).matches()) {
+					selection.reject(candidateVersion + " is not allowed because it is " + reason);
+				}
+			};
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/UpdateDependenciesPlugin.java

@@ -0,0 +1,244 @@
+/*
+ * Copyright 2019-2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import com.github.benmanes.gradle.versions.reporter.result.Dependency;
+import com.github.benmanes.gradle.versions.reporter.result.DependencyOutdated;
+import com.github.benmanes.gradle.versions.reporter.result.Result;
+import com.github.benmanes.gradle.versions.reporter.result.VersionAvailable;
+import com.github.benmanes.gradle.versions.updates.DependencyUpdatesTask;
+import com.github.benmanes.gradle.versions.updates.gradle.GradleUpdateResult;
+import com.github.benmanes.gradle.versions.updates.resolutionstrategy.ComponentSelectionRulesWithCurrent;
+import com.github.benmanes.gradle.versions.updates.resolutionstrategy.ComponentSelectionWithCurrent;
+import com.github.benmanes.gradle.versions.updates.resolutionstrategy.ResolutionStrategyWithCurrent;
+import groovy.lang.Closure;
+import org.gradle.api.Action;
+import org.gradle.api.Plugin;
+import org.gradle.api.Project;
+import org.gradle.api.artifacts.component.ModuleComponentIdentifier;
+import reactor.core.publisher.Mono;
+
+import java.io.File;
+import java.time.Duration;
+import java.util.*;
+import java.util.function.Supplier;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static org.springframework.security.convention.versions.TransitiveDependencyLookupUtils.NIMBUS_JOSE_JWT_NAME;
+import static org.springframework.security.convention.versions.TransitiveDependencyLookupUtils.OIDC_SDK_NAME;
+
+public class UpdateDependenciesPlugin implements Plugin<Project> {
+	private GitHubApi gitHubApi;
+
+	@Override
+	public void apply(Project project) {
+		UpdateDependenciesExtension updateDependenciesSettings = project.getExtensions().create("updateDependenciesSettings", UpdateDependenciesExtension.class, defaultFiles(project));
+		if (project.hasProperty("updateMode")) {
+			String updateMode = String.valueOf(project.findProperty("updateMode"));
+			updateDependenciesSettings.setUpdateMode(UpdateDependenciesExtension.UpdateMode.valueOf(updateMode));
+		}
+		if (project.hasProperty("nextVersion")) {
+			String nextVersion = String.valueOf(project.findProperty("nextVersion"));
+			updateDependenciesSettings.getGitHub().setMilestone(nextVersion);
+		}
+		if (project.hasProperty("gitHubAccessToken")) {
+			String gitHubAccessToken = String.valueOf(project.findProperty("gitHubAccessToken"));
+			updateDependenciesSettings.getGitHub().setAccessToken(gitHubAccessToken);
+		}
+		project.getTasks().register("updateDependencies", DependencyUpdatesTask.class, new Action<DependencyUpdatesTask>() {
+			@Override
+			public void execute(DependencyUpdatesTask updateDependencies) {
+				updateDependencies.setDescription("Update the dependencies");
+				updateDependencies.setCheckConstraints(true);
+				updateDependencies.setOutputFormatter(new Closure<Void>(null) {
+					@Override
+					public Void call(Object argument) {
+						Result result = (Result) argument;
+						if (gitHubApi == null && updateDependenciesSettings.getUpdateMode() != UpdateDependenciesExtension.UpdateMode.COMMIT) {
+							gitHubApi = new GitHubApi(updateDependenciesSettings.getGitHub().getAccessToken());
+						}
+						updateDependencies(result, project, updateDependenciesSettings);
+						updateGradleVersion(result, project, updateDependenciesSettings);
+						return null;
+					}
+				});
+				updateDependencies.resolutionStrategy(new Action<ResolutionStrategyWithCurrent>() {
+					@Override
+					public void execute(ResolutionStrategyWithCurrent resolution) {
+						resolution.componentSelection(new Action<ComponentSelectionRulesWithCurrent>() {
+							@Override
+							public void execute(ComponentSelectionRulesWithCurrent components) {
+								updateDependenciesSettings.getExcludes().getActions().forEach((action) -> {
+									components.all(action);
+								});
+								updateDependenciesSettings.getExcludes().getComponents().forEach((action) -> {
+									action.execute(components);
+								});
+								components.all((selection) -> {
+									ModuleComponentIdentifier candidate = selection.getCandidate();
+									if (candidate.getGroup().startsWith("org.apache.directory.") && !candidate.getVersion().equals(selection.getCurrentVersion())) {
+										selection.reject("org.apache.directory.* has breaking changes in newer versions");
+									}
+								});
+								String jaxbBetaRegex = ".*?b\\d+.*";
+								components.withModule("javax.xml.bind:jaxb-api", excludeWithRegex(jaxbBetaRegex, "Reject jaxb-api beta versions"));
+								components.withModule("com.sun.xml.bind:jaxb-impl", excludeWithRegex(jaxbBetaRegex, "Reject jaxb-api beta versions"));
+								components.withModule("commons-collections:commons-collections", excludeWithRegex("^\\d{3,}.*", "Reject commons-collections date based releases"));
+							}
+						});
+					}
+				});
+			}
+		});
+	}
+
+	private void updateDependencies(Result result, Project project, UpdateDependenciesExtension updateDependenciesSettings) {
+		SortedSet<DependencyOutdated> dependencies = result.getOutdated().getDependencies();
+		if (dependencies.isEmpty()) {
+			return;
+		}
+		Map<String, List<DependencyOutdated>> groups = new LinkedHashMap<>();
+		dependencies.forEach(outdated -> {
+			groups.computeIfAbsent(outdated.getGroup(), (key) -> new ArrayList<>()).add(outdated);
+		});
+		List<DependencyOutdated> nimbusds = groups.getOrDefault("com.nimbusds", new ArrayList<>());
+		DependencyOutdated oidcSdc = nimbusds.stream().filter(d -> d.getName().equals(OIDC_SDK_NAME)).findFirst().orElseGet(() -> null);
+		if(oidcSdc != null) {
+			String oidcVersion = updatedVersion(oidcSdc);
+			String jwtVersion = TransitiveDependencyLookupUtils.lookupJwtVersion(oidcVersion);
+
+			Dependency nimbusJoseJwtDependency = result.getCurrent().getDependencies().stream().filter(d -> d.getName().equals(NIMBUS_JOSE_JWT_NAME)).findFirst().get();
+			DependencyOutdated outdatedJwt = new DependencyOutdated();
+			outdatedJwt.setVersion(nimbusJoseJwtDependency.getVersion());
+			outdatedJwt.setGroup(oidcSdc.getGroup());
+			outdatedJwt.setName(NIMBUS_JOSE_JWT_NAME);
+			VersionAvailable available = new VersionAvailable();
+			available.setRelease(jwtVersion);
+			outdatedJwt.setAvailable(available);
+			nimbusds.add(outdatedJwt);
+		}
+		File gradlePropertiesFile = project.getRootProject().file(Project.GRADLE_PROPERTIES);
+		Mono<GitHubApi.FindCreateIssueResult> createIssueResult = createIssueResultMono(updateDependenciesSettings);
+		List<File> filesWithDependencies = updateDependenciesSettings.getFiles().get();
+		groups.forEach((group, outdated) -> {
+			outdated.forEach((dependency) -> {
+				String ga = dependency.getGroup() + ":" + dependency.getName() + ":";
+				String originalDependency = ga + dependency.getVersion();
+				String replacementDependency = ga + updatedVersion(dependency);
+				System.out.println("Update " + originalDependency + " to " + replacementDependency);
+				filesWithDependencies.forEach((fileWithDependency) -> {
+					updateDependencyInlineVersion(fileWithDependency, dependency);
+					updateDependencyWithVersionVariable(fileWithDependency, gradlePropertiesFile, dependency);
+				});
+			});
+
+			// commit
+			DependencyOutdated firstDependency = outdated.get(0);
+			String updatedVersion = updatedVersion(firstDependency);
+			String title = outdated.size() == 1 ? "Update " + firstDependency.getName() + " to " + updatedVersion : "Update " + firstDependency.getGroup() + " to " + updatedVersion;
+			afterGroup(updateDependenciesSettings, project.getRootDir(), title, createIssueResult);
+		});
+	}
+
+	private void afterGroup(UpdateDependenciesExtension updateDependenciesExtension, File rootDir, String title, Mono<GitHubApi.FindCreateIssueResult> createIssueResultMono) {
+
+		String commitMessage = title;
+		if (updateDependenciesExtension.getUpdateMode() == UpdateDependenciesExtension.UpdateMode.GITHUB_ISSUE) {
+			GitHubApi.FindCreateIssueResult createIssueResult = createIssueResultMono.block();
+			Integer issueNumber = gitHubApi.createIssue(createIssueResult.getRepositoryId(), title, createIssueResult.getLabelIds(), createIssueResult.getMilestoneId(), createIssueResult.getAssigneeId()).delayElement(Duration.ofSeconds(1)).block();
+			commitMessage += "\n\nCloses gh-" + issueNumber;
+		}
+		CommandLineUtils.runCommand(rootDir, "git", "commit", "-am", commitMessage);
+	}
+
+	private Mono<GitHubApi.FindCreateIssueResult> createIssueResultMono(UpdateDependenciesExtension updateDependenciesExtension) {
+		return Mono.defer(() -> {
+			UpdateDependenciesExtension.GitHub gitHub = updateDependenciesExtension.getGitHub();
+			return gitHubApi.findCreateIssueInput(gitHub.getOrganization(), gitHub.getRepository(), gitHub.getMilestone()).cache();
+		});
+	}
+
+	private void updateGradleVersion(Result result, Project project, UpdateDependenciesExtension updateDependenciesSettings) {
+		if (!result.getGradle().isEnabled()) {
+			return;
+		}
+		GradleUpdateResult current = result.getGradle().getCurrent();
+		GradleUpdateResult running = result.getGradle().getRunning();
+		if (current.compareTo(running) > 0) {
+			String title = "Update Gradle to " + current.getVersion();
+			System.out.println(title);
+			CommandLineUtils.runCommand(project.getRootDir(), "./gradlew", "wrapper", "--gradle-version", current.getVersion(), "--no-daemon");
+			afterGroup(updateDependenciesSettings, project.getRootDir(), title, createIssueResultMono(updateDependenciesSettings));
+		}
+	}
+
+	private static Supplier<List<File>> defaultFiles(Project project) {
+		return () -> {
+			List<File> result = new ArrayList<>();
+			result.add(project.getBuildFile());
+			project.getChildProjects().values().forEach((childProject) ->
+					result.add(childProject.getBuildFile())
+			);
+			result.add(project.getRootProject().file("buildSrc/build.gradle"));
+			return result;
+		};
+	}
+
+	static Action<ComponentSelectionWithCurrent> excludeWithRegex(String regex, String reason) {
+		Pattern pattern = Pattern.compile(regex);
+		return (selection) -> {
+			String candidateVersion = selection.getCandidate().getVersion();
+			if (pattern.matcher(candidateVersion).matches()) {
+				selection.reject(candidateVersion + " is not allowed because it is " + reason);
+			}
+		};
+	}
+
+	static void updateDependencyInlineVersion(File buildFile, DependencyOutdated dependency){
+		String ga = dependency.getGroup() + ":" + dependency.getName() + ":";
+		String originalDependency = ga + dependency.getVersion();
+		String replacementDependency = ga + updatedVersion(dependency);
+		FileUtils.replaceFileText(buildFile, buildFileText -> buildFileText.replace(originalDependency, replacementDependency));
+	}
+
+	static void updateDependencyWithVersionVariable(File scanFile, File gradlePropertiesFile, DependencyOutdated dependency) {
+		if (!gradlePropertiesFile.exists()) {
+			return;
+		}
+		FileUtils.replaceFileText(gradlePropertiesFile, (gradlePropertiesText) -> {
+			String ga = dependency.getGroup() + ":" + dependency.getName() + ":";
+			Pattern pattern = Pattern.compile("\"" + ga + "\\$\\{?([^'\"]+?)\\}?\"");
+			String buildFileText = FileUtils.readString(scanFile);
+			Matcher matcher = pattern.matcher(buildFileText);
+			while (matcher.find()) {
+				String versionVariable = matcher.group(1);
+				gradlePropertiesText = gradlePropertiesText.replace(versionVariable + "=" + dependency.getVersion(), versionVariable + "=" + updatedVersion(dependency));
+			}
+			return gradlePropertiesText;
+		});
+	}
+
+	private static String updatedVersion(DependencyOutdated dependency) {
+		VersionAvailable available = dependency.getAvailable();
+		String release = available.getRelease();
+		if (release != null) {
+			return release;
+		}
+		return available.getMilestone();
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/VerifyDependenciesVersionsPlugin.java

@@ -1,70 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.convention.versions;
-
-import org.gradle.api.DefaultTask;
-import org.gradle.api.Plugin;
-import org.gradle.api.Project;
-import org.gradle.api.artifacts.MinimalExternalModuleDependency;
-import org.gradle.api.artifacts.VersionCatalog;
-import org.gradle.api.artifacts.VersionCatalogsExtension;
-import org.gradle.api.plugins.JavaBasePlugin;
-import org.gradle.api.tasks.TaskAction;
-import org.gradle.api.tasks.TaskProvider;
-
-public class VerifyDependenciesVersionsPlugin implements Plugin<Project> {
-
-	@Override
-	public void apply(Project project) {
-		TaskProvider<VerifyDependenciesVersionsTask> verifyDependenciesVersionsTaskProvider = project.getTasks().register("verifyDependenciesVersions", VerifyDependenciesVersionsTask.class, (task) -> {
-			task.setGroup("Verification");
-			task.setDescription("Verify that specific dependencies are using the same version");
-			VersionCatalog versionCatalog = project.getExtensions().getByType(VersionCatalogsExtension.class).named("libs");
-			MinimalExternalModuleDependency oauth2OidcSdk = versionCatalog.findLibrary("com-nimbusds-oauth2-oidc-sdk").get().get();
-			MinimalExternalModuleDependency nimbusJoseJwt = versionCatalog.findLibrary("com-nimbusds-nimbus-jose-jwt").get().get();
-			task.setOauth2OidcSdkVersion(oauth2OidcSdk.getVersionConstraint().getDisplayName());
-			task.setExpectedNimbusJoseJwtVersion(nimbusJoseJwt.getVersionConstraint().getDisplayName());
-		});
-		project.getTasks().named(JavaBasePlugin.CHECK_TASK_NAME, checkTask -> checkTask.dependsOn(verifyDependenciesVersionsTaskProvider));
-	}
-
-	public static class VerifyDependenciesVersionsTask extends DefaultTask {
-
-		private String oauth2OidcSdkVersion;
-
-		private String expectedNimbusJoseJwtVersion;
-
-		public void setOauth2OidcSdkVersion(String oauth2OidcSdkVersion) {
-			this.oauth2OidcSdkVersion = oauth2OidcSdkVersion;
-		}
-
-		public void setExpectedNimbusJoseJwtVersion(String expectedNimbusJoseJwtVersion) {
-			this.expectedNimbusJoseJwtVersion = expectedNimbusJoseJwtVersion;
-		}
-
-		@TaskAction
-		public void verify() {
-			String transitiveNimbusJoseJwtVersion = TransitiveDependencyLookupUtils.lookupJwtVersion(this.oauth2OidcSdkVersion);
-			if (!transitiveNimbusJoseJwtVersion.equals(this.expectedNimbusJoseJwtVersion)) {
-				String message = String.format("Found transitive nimbus-jose-jwt:%s in oauth2-oidc-sdk:%s, but the project contains a different version of nimbus-jose-jwt [%s]. Please align the versions.", transitiveNimbusJoseJwtVersion, this.oauth2OidcSdkVersion, this.expectedNimbusJoseJwtVersion);
-				throw new IllegalStateException(message);
-			}
-		}
-
-	}
-
-}

buildSrc/src/main/java/s101/S101Configurer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
 package s101;
 
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -33,11 +34,18 @@ import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Properties;
 import java.util.Set;
+import java.util.jar.JarEntry;
+import java.util.jar.JarInputStream;
+import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
+import com.gargoylesoftware.htmlunit.WebClient;
+import com.gargoylesoftware.htmlunit.html.HtmlAnchor;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
 import com.github.mustachejava.DefaultMustacheFactory;
 import com.github.mustachejava.Mustache;
 import com.github.mustachejava.MustacheFactory;
@@ -63,10 +71,6 @@ public class S101Configurer {
 
 	private final Path licenseDirectory;
 
-	private final String repository;
-
-	private final String version;
-
 	private final Project project;
 	private final Logger logger;
 
@@ -86,9 +90,6 @@ public class S101Configurer {
 			throw new UncheckedIOException(ex);
 		}
 		this.licenseDirectory = new File(System.getProperty("user.home") + "/.Structure101/java").toPath();
-		S101PluginExtension extension = project.getExtensions().getByType(S101PluginExtension.class);
-		this.repository = extension.getRepository().get();
-		this.version = extension.getVersion().get();
 	}
 
 	public void license(String licenseId) {
@@ -128,7 +129,25 @@ public class S101Configurer {
 
 	public void configure(File installationDirectory, File configurationDirectory) {
 		deleteDirectory(configurationDirectory);
-		configureProject(this.version, configurationDirectory);
+		String version = computeVersionFromInstallation(installationDirectory);
+		configureProject(version, configurationDirectory);
+	}
+
+	private String computeVersionFromInstallation(File installationDirectory) {
+		File buildJar = new File(installationDirectory, "structure101-java-build.jar");
+		try (JarInputStream input = new JarInputStream(new FileInputStream(buildJar))) {
+			JarEntry entry;
+			while ((entry = input.getNextJarEntry()) != null) {
+				if (entry.getName().contains("structure101-build.properties")) {
+					Properties properties = new Properties();
+					properties.load(input);
+					return properties.getProperty("s101-build");
+				}
+			}
+		} catch (Exception ex) {
+			throw new RuntimeException(ex);
+		}
+		throw new IllegalStateException("Unable to determine Structure101 version");
 	}
 
 	private boolean deleteDirectory(File directoryToBeDeleted) {
@@ -142,8 +161,20 @@ public class S101Configurer {
 	}
 
 	private String installBuildTool(File installationDirectory, File configurationDirectory) {
-		copyZipToFilesystem(this.repository, installationDirectory, "structure101-build-java-all-" + this.version);
-		return this.version;
+		String source = "https://structure101.com/binaries/v6";
+		try (final WebClient webClient = new WebClient()) {
+			HtmlPage page = webClient.getPage(source);
+			for (HtmlAnchor anchor : page.getAnchors()) {
+				Matcher matcher = Pattern.compile("(structure101-build-java-all-)(.*).zip").matcher(anchor.getHrefAttribute());
+				if (matcher.find()) {
+					copyZipToFilesystem(source, installationDirectory, matcher.group(1) + matcher.group(2));
+					return matcher.group(2);
+				}
+			}
+			return null;
+		} catch (Exception ex) {
+			throw new RuntimeException(ex);
+		}
 	}
 
 	private void copyZipToFilesystem(String source, File destination, String name) {

buildSrc/src/main/java/s101/S101Plugin.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

buildSrc/src/main/java/s101/S101PluginExtension.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,12 +17,7 @@
 package s101;
 
 import java.io.File;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
-import com.gargoylesoftware.htmlunit.WebClient;
-import com.gargoylesoftware.htmlunit.html.HtmlAnchor;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
 import org.gradle.api.Project;
 import org.gradle.api.provider.Property;
 import org.gradle.api.tasks.Input;
@@ -30,11 +25,6 @@ import org.gradle.api.tasks.InputDirectory;
 
 public class S101PluginExtension {
 	private final Property<String> licenseId;
-
-	private final Property<String> repository;
-
-	private final Property<String> version;
-
 	private final Property<File> installationDirectory;
 	private final Property<File> configurationDirectory;
 	private final Property<String> label;
@@ -75,24 +65,6 @@ public class S101PluginExtension {
 		this.label.set(label);
 	}
 
-	@Input
-	public Property<String> getRepository() {
-		return repository;
-	}
-
-	public void setRepository(String repository) {
-		this.repository.set(repository);
-	}
-
-	@Input
-	public Property<String> getVersion() {
-		return this.version;
-	}
-
-	public void setVersion(String version) {
-		this.version.set(version);
-	}
-
 	public S101PluginExtension(Project project) {
 		this.licenseId = project.getObjects().property(String.class);
 		if (project.hasProperty("s101.licenseId")) {
@@ -106,31 +78,5 @@ public class S101PluginExtension {
 		if (project.hasProperty("s101.label")) {
 			setLabel((String) project.findProperty("s101.label"));
 		}
-		this.repository = project.getObjects().property(String.class);
-		if (project.hasProperty("s101.repository")) {
-			setRepository((String) project.findProperty("s101.repository"));
-		} else {
-			setRepository("https://structure101.com/binaries/v6");
-		}
-		this.version = project.getObjects().property(String.class);
-		if (project.hasProperty("s101.version")) {
-			setVersion((String) project.findProperty("s101.version"));
-		} else {
-			try (final WebClient webClient = new WebClient()) {
-				HtmlPage page = webClient.getPage(getRepository().get());
-				Matcher matcher = null;
-				for (HtmlAnchor anchor : page.getAnchors()) {
-					Matcher candidate = Pattern.compile("(structure101-build-java-all-)(.*).zip").matcher(anchor.getHrefAttribute());
-					if (candidate.find()) {
-						matcher = candidate;
-					}
-				}
-				if (matcher != null) {
-					setVersion(matcher.group(2));
-				}
-			} catch (Exception ex) {
-				throw new RuntimeException(ex);
-			}
-		}
 	}
 }

buildSrc/src/test/java/io/spring/gradle/convention/RepositoryConventionPluginTests.java

@@ -125,27 +125,27 @@ public class RepositoryConventionPluginTests {
 
 	private void assertSnapshotRepository(RepositoryHandler repositories) {
 		assertThat(repositories).extracting(ArtifactRepository::getName).hasSize(5);
-		assertThat(((MavenArtifactRepository) repositories.get(1)).getUrl().toString())
+		assertThat(((MavenArtifactRepository) repositories.get(0)).getUrl().toString())
 				.isEqualTo("https://repo.maven.apache.org/maven2/");
-		assertThat(((MavenArtifactRepository) repositories.get(2)).getUrl().toString())
+		assertThat(((MavenArtifactRepository) repositories.get(1)).getUrl().toString())
 				.isEqualTo("https://repo.spring.io/snapshot/");
-		assertThat(((MavenArtifactRepository) repositories.get(3)).getUrl().toString())
+		assertThat(((MavenArtifactRepository) repositories.get(2)).getUrl().toString())
 				.isEqualTo("https://repo.spring.io/milestone/");
 	}
 
 	private void assertMilestoneRepository(RepositoryHandler repositories) {
 		assertThat(repositories).extracting(ArtifactRepository::getName).hasSize(4);
-		assertThat(((MavenArtifactRepository) repositories.get(1)).getUrl().toString())
+		assertThat(((MavenArtifactRepository) repositories.get(0)).getUrl().toString())
 				.isEqualTo("https://repo.maven.apache.org/maven2/");
-		assertThat(((MavenArtifactRepository) repositories.get(2)).getUrl().toString())
+		assertThat(((MavenArtifactRepository) repositories.get(1)).getUrl().toString())
 				.isEqualTo("https://repo.spring.io/milestone/");
 	}
 
 	private void assertReleaseRepository(RepositoryHandler repositories) {
 		assertThat(repositories).extracting(ArtifactRepository::getName).hasSize(3);
-		assertThat(((MavenArtifactRepository) repositories.get(1)).getUrl().toString())
+		assertThat(((MavenArtifactRepository) repositories.get(0)).getUrl().toString())
 				.isEqualTo("https://repo.maven.apache.org/maven2/");
-		assertThat(((MavenArtifactRepository) repositories.get(2)).getUrl().toString())
+		assertThat(((MavenArtifactRepository) repositories.get(1)).getUrl().toString())
 				.isEqualTo("https://repo.spring.io/release/");
 	}
 

buildSrc/src/test/java/io/spring/gradle/convention/sagan/SaganApiTests.java

@@ -42,7 +42,7 @@ public class SaganApiTests {
 	public void setup() throws Exception {
 		this.server = new MockWebServer();
 		this.server.start();
-		this.sagan = new SaganApi("user", "mock-oauth-token");
+		this.sagan = new SaganApi("mock-oauth-token");
 		this.baseUrl = this.server.url("/api").toString();
 		this.sagan.setBaseUrl(this.baseUrl);
 	}
@@ -63,7 +63,7 @@ public class SaganApiTests {
 		RecordedRequest request = this.server.takeRequest(1, TimeUnit.SECONDS);
 		assertThat(request.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/projects/spring-security/releases");
 		assertThat(request.getMethod()).isEqualToIgnoringCase("post");
-		assertThat(request.getHeaders().get("Authorization")).isEqualTo("Basic dXNlcjptb2NrLW9hdXRoLXRva2Vu");
+		assertThat(request.getHeaders().get("Authorization")).isEqualTo("Basic bm90LXVzZWQ6bW9jay1vYXV0aC10b2tlbg==");
 		assertThat(request.getBody().readString(Charset.defaultCharset())).isEqualToIgnoringWhitespace("{\n" +
 				"   \"version\":\"5.6.0-SNAPSHOT\",\n" +
 				"   \"current\":false,\n" +
@@ -79,7 +79,7 @@ public class SaganApiTests {
 		RecordedRequest request = this.server.takeRequest(1, TimeUnit.SECONDS);
 		assertThat(request.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/projects/spring-security/releases/5.6.0-SNAPSHOT");
 		assertThat(request.getMethod()).isEqualToIgnoringCase("delete");
-		assertThat(request.getHeaders().get("Authorization")).isEqualTo("Basic dXNlcjptb2NrLW9hdXRoLXRva2Vu");
+		assertThat(request.getHeaders().get("Authorization")).isEqualTo("Basic bm90LXVzZWQ6bW9jay1vYXV0aC10b2tlbg==");
 		assertThat(request.getBody().readString(Charset.defaultCharset())).isEmpty();
 	}
 }

buildSrc/src/test/java/org/springframework/gradle/github/user/GitHubUserApiTests.java

@@ -1,106 +0,0 @@
-/*
- * Copyright 2020-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.gradle.github.user;
-
-import okhttp3.mockwebserver.MockResponse;
-import okhttp3.mockwebserver.MockWebServer;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-
-/**
- * @author Steve Riesenberg
- */
-public class GitHubUserApiTests {
-	private GitHubUserApi gitHubUserApi;
-
-	private MockWebServer server;
-
-	private String baseUrl;
-
-	@BeforeEach
-	public void setup() throws Exception {
-		this.server = new MockWebServer();
-		this.server.start();
-		this.baseUrl = this.server.url("/api").toString();
-		this.gitHubUserApi = new GitHubUserApi("mock-oauth-token");
-		this.gitHubUserApi.setBaseUrl(this.baseUrl);
-	}
-
-	@AfterEach
-	public void cleanup() throws Exception {
-		this.server.shutdown();
-	}
-
-	@Test
-	public void getUserWhenValidParametersThenSuccess() {
-		// @formatter:off
-		String responseJson = "{\n" +
-				"    \"avatar_url\": \"https://avatars.githubusercontent.com/u/583231?v=4\",\n" +
-				"    \"bio\": null,\n" +
-				"    \"blog\": \"https://github.blog\",\n" +
-				"    \"company\": \"@github\",\n" +
-				"    \"created_at\": \"2011-01-25T18:44:36Z\",\n" +
-				"    \"email\": null,\n" +
-				"    \"events_url\": \"https://api.github.com/users/octocat/events{/privacy}\",\n" +
-				"    \"followers\": 8481,\n" +
-				"    \"followers_url\": \"https://api.github.com/users/octocat/followers\",\n" +
-				"    \"following\": 9,\n" +
-				"    \"following_url\": \"https://api.github.com/users/octocat/following{/other_user}\",\n" +
-				"    \"gists_url\": \"https://api.github.com/users/octocat/gists{/gist_id}\",\n" +
-				"    \"gravatar_id\": \"\",\n" +
-				"    \"hireable\": null,\n" +
-				"    \"html_url\": \"https://github.com/octocat\",\n" +
-				"    \"id\": 583231,\n" +
-				"    \"location\": \"San Francisco\",\n" +
-				"    \"login\": \"octocat\",\n" +
-				"    \"name\": \"The Octocat\",\n" +
-				"    \"node_id\": \"MDQ6VXNlcjU4MzIzMQ==\",\n" +
-				"    \"organizations_url\": \"https://api.github.com/users/octocat/orgs\",\n" +
-				"    \"public_gists\": 8,\n" +
-				"    \"public_repos\": 8,\n" +
-				"    \"received_events_url\": \"https://api.github.com/users/octocat/received_events\",\n" +
-				"    \"repos_url\": \"https://api.github.com/users/octocat/repos\",\n" +
-				"    \"site_admin\": false,\n" +
-				"    \"starred_url\": \"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\n" +
-				"    \"subscriptions_url\": \"https://api.github.com/users/octocat/subscriptions\",\n" +
-				"    \"twitter_username\": null,\n" +
-				"    \"type\": \"User\",\n" +
-				"    \"updated_at\": \"2023-02-25T12:14:58Z\",\n" +
-				"    \"url\": \"https://api.github.com/users/octocat\"\n" +
-				"}";
-		// @formatter:on
-		this.server.enqueue(new MockResponse().setBody(responseJson));
-
-		User user = this.gitHubUserApi.getUser();
-		assertThat(user.getId()).isEqualTo(583231);
-		assertThat(user.getLogin()).isEqualTo("octocat");
-		assertThat(user.getName()).isEqualTo("The Octocat");
-		assertThat(user.getUrl()).isEqualTo("https://api.github.com/users/octocat");
-	}
-
-	@Test
-	public void getUserWhenErrorResponseThenException() {
-		this.server.enqueue(new MockResponse().setResponseCode(400));
-		// @formatter:off
-		assertThatExceptionOfType(RuntimeException.class)
-				.isThrownBy(() -> this.gitHubUserApi.getUser());
-		// @formatter:on
-	}
-}

buildSrc/src/test/java/org/springframework/gradle/xsd/CreateVersionlessXsdTaskTests.java

@@ -1,94 +0,0 @@
-/*
- * Copyright 2019-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.gradle.xsd;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.gradle.xsd.CreateVersionlessXsdTask.MajorMinorVersion;
-import org.springframework.gradle.xsd.CreateVersionlessXsdTask.XsdFileMajorMinorVersion;
-
-import java.io.File;
-
-import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
-
-/**
- * @author Rob Winch
- */
-class CreateVersionlessXsdTaskTests {
-
-	@Test
-	void xsdCreateWhenValid() {
-		File file = new File("spring-security-2.0.xsd");
-		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
-		assertThat(xsdFile).isNotNull();
-		assertThat(xsdFile.getFile()).isEqualTo(file);
-		assertThat(xsdFile.getVersion().getMajor()).isEqualTo(2);
-		assertThat(xsdFile.getVersion().getMinor()).isEqualTo(0);
-	}
-
-	@Test
-	void xsdCreateWhenPatchReleaseThenNull() {
-		File file = new File("spring-security-2.0.1.xsd");
-		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
-		assertThat(xsdFile).isNull();
-	}
-
-	@Test
-	void xsdCreateWhenNotXsdFileThenNull() {
-		File file = new File("spring-security-2.0.txt");
-		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
-		assertThat(xsdFile).isNull();
-	}
-
-	@Test
-	void xsdCreateWhenNotStartWithSpringSecurityThenNull() {
-		File file = new File("spring-securityNO-2.0.xsd");
-		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
-		assertThat(xsdFile).isNull();
-	}
-
-	@Test
-	void isGreaterWhenMajorLarger() {
-		MajorMinorVersion larger = new MajorMinorVersion(2,0);
-		MajorMinorVersion smaller = new MajorMinorVersion(1,0);
-		assertThat(larger.isGreaterThan(smaller)).isTrue();
-		assertThat(smaller.isGreaterThan(larger)).isFalse();
-	}
-
-	@Test
-	void isGreaterWhenMinorLarger() {
-		MajorMinorVersion larger = new MajorMinorVersion(1,1);
-		MajorMinorVersion smaller = new MajorMinorVersion(1,0);
-		assertThat(larger.isGreaterThan(smaller)).isTrue();
-		assertThat(smaller.isGreaterThan(larger)).isFalse();
-	}
-
-	@Test
-	void isGreaterWhenMajorAndMinorLarger() {
-		MajorMinorVersion larger = new MajorMinorVersion(2,1);
-		MajorMinorVersion smaller = new MajorMinorVersion(1,0);
-		assertThat(larger.isGreaterThan(smaller)).isTrue();
-		assertThat(smaller.isGreaterThan(larger)).isFalse();
-	}
-
-	@Test
-	void isGreaterWhenSame() {
-		MajorMinorVersion first = new MajorMinorVersion(1,0);
-		MajorMinorVersion second = new MajorMinorVersion(1,0);
-		assertThat(first.isGreaterThan(second)).isFalse();
-		assertThat(second.isGreaterThan(first)).isFalse();
-	}
-}

buildSrc/src/test/java/org/springframework/security/convention/versions/DependencyExcludesTests.java

@@ -0,0 +1,86 @@
+/*
+ * Copyright 2019-2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import com.github.benmanes.gradle.versions.updates.resolutionstrategy.ComponentSelectionWithCurrent;
+import org.gradle.api.Action;
+import org.gradle.api.artifacts.ComponentSelection;
+import org.gradle.api.artifacts.component.ModuleComponentIdentifier;
+import org.junit.jupiter.api.Test;
+
+import java.util.Collections;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.*;
+
+public class DependencyExcludesTests {
+
+	@Test
+	public void createExcludeMinorVersionBumpWhenMajorVersionBumpThenReject() {
+		ComponentSelection componentSelection = executeCreateExcludeMinorVersionBump("1.0.0", "2.0.0");
+		verify(componentSelection).reject(any());
+	}
+
+	@Test
+	public void createExcludeMinorVersionBumpWhenMajorCalVersionBumpThenReject() {
+		ComponentSelection componentSelection = executeCreateExcludeMinorVersionBump("2000.0.0", "2001.0.0");
+		verify(componentSelection).reject(any());
+	}
+
+	@Test
+	public void createExcludeMinorVersionBumpWhenMinorVersionBumpThenReject() {
+		ComponentSelection componentSelection = executeCreateExcludeMinorVersionBump("1.0.0", "1.1.0");
+		verify(componentSelection).reject(any());
+	}
+
+	@Test
+	public void createExcludeMinorVersionBumpWhenMinorCalVersionBumpThenReject() {
+		ComponentSelection componentSelection = executeCreateExcludeMinorVersionBump("2000.0.0", "2000.1.0");
+		verify(componentSelection).reject(any());
+	}
+
+	@Test
+	public void createExcludeMinorVersionBumpWhenMinorAndPatchVersionBumpThenReject() {
+		ComponentSelection componentSelection = executeCreateExcludeMinorVersionBump("1.0.0", "1.1.1");
+		verify(componentSelection).reject(any());
+	}
+
+	@Test
+	public void createExcludeMinorVersionBumpWhenPatchVersionBumpThenDoesNotReject() {
+		ComponentSelection componentSelection = executeCreateExcludeMinorVersionBump("1.0.0", "1.0.1");
+		verify(componentSelection, times(0)).reject(any());
+	}
+
+	private ComponentSelection executeCreateExcludeMinorVersionBump(String currentVersion, String candidateVersion) {
+		ComponentSelection componentSelection = mock(ComponentSelection.class);
+		UpdateDependenciesExtension.DependencyExcludes excludes = new UpdateDependenciesExtension(() -> Collections.emptyList()).new DependencyExcludes();
+		Action<ComponentSelectionWithCurrent> excludeMinorVersionBump = excludes.createExcludeMinorVersionBump();
+		ComponentSelectionWithCurrent selection = currentVersionAndCandidateVersion(componentSelection, currentVersion, candidateVersion);
+		excludeMinorVersionBump.execute(selection);
+		return componentSelection;
+	}
+
+	private ComponentSelectionWithCurrent currentVersionAndCandidateVersion(ComponentSelection componentSelection, String currentVersion, String candidateVersion) {
+		ModuleComponentIdentifier candidate = mock(ModuleComponentIdentifier.class);
+		given(componentSelection.getCandidate()).willReturn(candidate);
+		ComponentSelectionWithCurrent selection = new ComponentSelectionWithCurrent(currentVersion, componentSelection);
+		given(candidate.getVersion()).willReturn(candidateVersion);
+		given(componentSelection.getCandidate()).willReturn(candidate);
+		return selection;
+	}
+}

buildSrc/src/test/java/org/springframework/security/convention/versions/TransitiveDependencyLookupUtilsTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2019-2020 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,18 +14,18 @@
  * limitations under the License.
  */
 
-package org.springframework.security.web.server.firewall;
+package org.springframework.security.convention.versions;
 
-/**
- * Thrown when a {@link org.springframework.web.server.ServerWebExchange} is rejected.
- *
- * @author Rob Winch
- * @since 5.7.13
- */
-public class ServerExchangeRejectedException extends RuntimeException {
 
-	public ServerExchangeRejectedException(String message) {
-		super(message);
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class TransitiveDependencyLookupUtilsTest {
+
+	@Test
+	public void lookupJwtVersionWhen93Then961() {
+		String s = TransitiveDependencyLookupUtils.lookupJwtVersion("9.3");
+		assertThat(s).isEqualTo("9.6.1");
 	}
-
 }

cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationProvider.java

@@ -98,7 +98,7 @@ public class CasAuthenticationProvider implements AuthenticationProvider, Initia
 		if (authentication instanceof UsernamePasswordAuthenticationToken
 				&& (!CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER.equals(authentication.getPrincipal().toString())
 						&& !CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER
-							.equals(authentication.getPrincipal().toString()))) {
+								.equals(authentication.getPrincipal().toString()))) {
 			// UsernamePasswordAuthenticationToken not CAS related
 			return null;
 		}

cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java

@@ -18,7 +18,6 @@ package org.springframework.security.cas.userdetails;
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Locale;
 
 import org.jasig.cas.client.validation.Assertion;
 
@@ -74,8 +73,7 @@ public final class GrantedAuthorityFromAssertionAttributesUserDetailsService
 	}
 
 	private SimpleGrantedAuthority createSimpleGrantedAuthority(Object o) {
-		return new SimpleGrantedAuthority(
-				this.convertToUpperCase ? o.toString().toUpperCase(Locale.ROOT) : o.toString());
+		return new SimpleGrantedAuthority(this.convertToUpperCase ? o.toString().toUpperCase() : o.toString());
 	}
 
 	/**

cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java

@@ -42,8 +42,6 @@ import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
-import org.springframework.security.web.context.NullSecurityContextRepository;
-import org.springframework.security.web.context.SecurityContextRepository;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
@@ -207,8 +205,6 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 
 	private AuthenticationFailureHandler proxyFailureHandler = new SimpleUrlAuthenticationFailureHandler();
 
-	private SecurityContextRepository securityContextRepository = new NullSecurityContextRepository();
-
 	public CasAuthenticationFilter() {
 		super("/login/cas");
 		setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler());
@@ -227,7 +223,6 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 		SecurityContext context = SecurityContextHolder.createEmptyContext();
 		context.setAuthentication(authResult);
 		SecurityContextHolder.setContext(context);
-		this.securityContextRepository.saveContext(context, request, response);
 		if (this.eventPublisher != null) {
 			this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
 		}
@@ -251,8 +246,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 			this.logger.debug("Failed to obtain an artifact (cas ticket)");
 			password = "";
 		}
-		UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username,
-				password);
+		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
 		authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
 		return this.getAuthenticationManager().authenticate(authRequest);
 	}
@@ -280,18 +274,6 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 		return result;
 	}
 
-	/**
-	 * Sets the {@link SecurityContextRepository} to save the {@link SecurityContext} on
-	 * authentication success. The default action is not to save the
-	 * {@link SecurityContext}.
-	 * @param securityContextRepository the {@link SecurityContextRepository} to use.
-	 * Cannot be null.
-	 */
-	public void setSecurityContextRepository(SecurityContextRepository securityContextRepository) {
-		Assert.notNull(securityContextRepository, "securityContextRepository cannot be null");
-		this.securityContextRepository = securityContextRepository;
-	}
-
 	/**
 	 * Sets the {@link AuthenticationFailureHandler} for proxy requests.
 	 * @param proxyFailureHandler

cas/src/test/java/org/springframework/security/cas/authentication/CasAuthenticationProviderTests.java

@@ -87,8 +87,8 @@ public class CasAuthenticationProviderTests {
 		cap.setServiceProperties(makeServiceProperties());
 		cap.setTicketValidator(new MockTicketValidator(true));
 		cap.afterPropertiesSet();
-		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
-			.unauthenticated(CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER, "ST-123");
+		UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
+				CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER, "ST-123");
 		token.setDetails("details");
 		Authentication result = cap.authenticate(token);
 		// Confirm ST-123 was NOT added to the cache
@@ -120,8 +120,8 @@ public class CasAuthenticationProviderTests {
 		cap.setTicketValidator(new MockTicketValidator(true));
 		cap.setServiceProperties(makeServiceProperties());
 		cap.afterPropertiesSet();
-		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
-			.unauthenticated(CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, "ST-456");
+		UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
+				CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, "ST-456");
 		token.setDetails("details");
 		Authentication result = cap.authenticate(token);
 		// Confirm ST-456 was added to the cache
@@ -157,8 +157,8 @@ public class CasAuthenticationProviderTests {
 		cap.setServiceProperties(serviceProperties);
 		cap.afterPropertiesSet();
 		String ticket = "ST-456";
-		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
-			.unauthenticated(CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, ticket);
+		UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
+				CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, ticket);
 		Authentication result = cap.authenticate(token);
 	}
 
@@ -178,8 +178,8 @@ public class CasAuthenticationProviderTests {
 		cap.setServiceProperties(serviceProperties);
 		cap.afterPropertiesSet();
 		String ticket = "ST-456";
-		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
-			.unauthenticated(CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, ticket);
+		UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
+				CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, ticket);
 		Authentication result = cap.authenticate(token);
 		verify(validator).validate(ticket, serviceProperties.getService());
 		serviceProperties.setAuthenticateAllArtifacts(true);
@@ -211,8 +211,8 @@ public class CasAuthenticationProviderTests {
 		cap.setTicketValidator(new MockTicketValidator(true));
 		cap.setServiceProperties(makeServiceProperties());
 		cap.afterPropertiesSet();
-		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
-			.unauthenticated(CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER, "");
+		UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
+				CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER, "");
 		assertThatExceptionOfType(BadCredentialsException.class).isThrownBy(() -> cap.authenticate(token));
 	}
 
@@ -314,8 +314,8 @@ public class CasAuthenticationProviderTests {
 		cap.setTicketValidator(new MockTicketValidator(true));
 		cap.setServiceProperties(makeServiceProperties());
 		cap.afterPropertiesSet();
-		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
-			.authenticated("some_normal_user", "password", AuthorityUtils.createAuthorityList("ROLE_A"));
+		UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("some_normal_user",
+				"password", AuthorityUtils.createAuthorityList("ROLE_A"));
 		assertThat(cap.authenticate(token)).isNull();
 	}
 

cas/src/test/java/org/springframework/security/cas/authentication/CasAuthenticationTokenTests.java

@@ -103,7 +103,7 @@ public class CasAuthenticationTokenTests {
 	@Test
 	public void testNoArgConstructorDoesntExist() {
 		assertThatExceptionOfType(NoSuchMethodException.class)
-			.isThrownBy(() -> CasAuthenticationToken.class.getDeclaredConstructor((Class[]) null));
+				.isThrownBy(() -> CasAuthenticationToken.class.getDeclaredConstructor((Class[]) null));
 	}
 
 	@Test
@@ -121,8 +121,8 @@ public class CasAuthenticationTokenTests {
 		final Assertion assertion = new AssertionImpl("test");
 		CasAuthenticationToken token1 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
 				makeUserDetails(), assertion);
-		UsernamePasswordAuthenticationToken token2 = UsernamePasswordAuthenticationToken.authenticated("Test",
-				"Password", this.ROLES);
+		UsernamePasswordAuthenticationToken token2 = new UsernamePasswordAuthenticationToken("Test", "Password",
+				this.ROLES);
 		assertThat(!token1.equals(token2)).isTrue();
 	}
 

cas/src/test/java/org/springframework/security/cas/jackson2/CasAuthenticationTokenMixinTests.java

@@ -132,7 +132,7 @@ public class CasAuthenticationTokenMixinTests {
 		assertThat(token.getAssertion()).isNotNull().isInstanceOf(AssertionImpl.class);
 		assertThat(token.getKeyHash()).isEqualTo(KEY.hashCode());
 		assertThat(token.getUserDetails().getAuthorities()).extracting(GrantedAuthority::getAuthority)
-			.containsOnly("ROLE_USER");
+				.containsOnly("ROLE_USER");
 		assertThat(token.getAssertion().getAuthenticationDate()).isEqualTo(START_DATE);
 		assertThat(token.getAssertion().getValidFromDate()).isEqualTo(START_DATE);
 		assertThat(token.getAssertion().getValidUntilDate()).isEqualTo(END_DATE);
@@ -143,7 +143,7 @@ public class CasAuthenticationTokenMixinTests {
 	private CasAuthenticationToken createCasAuthenticationToken() {
 		User principal = new User("admin", "1234", Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER")));
 		Collection<? extends GrantedAuthority> authorities = Collections
-			.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
+				.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
 		Assertion assertion = new AssertionImpl(new AttributePrincipalImpl("assertName"), START_DATE, END_DATE,
 				START_DATE, Collections.<String, Object>emptyMap());
 		return new CasAuthenticationToken(KEY, principal, principal.getPassword(), authorities,

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationEntryPointTests.java

@@ -39,7 +39,7 @@ public class CasAuthenticationEntryPointTests {
 		CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
 		ep.setServiceProperties(new ServiceProperties());
 		assertThatIllegalArgumentException().isThrownBy(ep::afterPropertiesSet)
-			.withMessage("loginUrl must be specified");
+				.withMessage("loginUrl must be specified");
 	}
 
 	@Test
@@ -47,7 +47,7 @@ public class CasAuthenticationEntryPointTests {
 		CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
 		ep.setLoginUrl("https://cas/login");
 		assertThatIllegalArgumentException().isThrownBy(ep::afterPropertiesSet)
-			.withMessage("serviceProperties must be specified");
+				.withMessage("serviceProperties must be specified");
 	}
 
 	@Test
@@ -74,7 +74,7 @@ public class CasAuthenticationEntryPointTests {
 		ep.commence(request, response, null);
 		assertThat(
 				"https://cas/login?service=" + URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8"))
-			.isEqualTo(response.getRedirectedUrl());
+						.isEqualTo(response.getRedirectedUrl());
 	}
 
 	@Test
@@ -92,7 +92,7 @@ public class CasAuthenticationEntryPointTests {
 		ep.commence(request, response, null);
 		assertThat("https://cas/login?service="
 				+ URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8") + "&renew=true")
-			.isEqualTo(response.getRedirectedUrl());
+						.isEqualTo(response.getRedirectedUrl());
 	}
 
 }

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java

@@ -21,7 +21,6 @@ import javax.servlet.FilterChain;
 import org.jasig.cas.client.proxy.ProxyGrantingTicketStorage;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
-import org.mockito.ArgumentCaptor;
 
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -33,19 +32,17 @@ import org.springframework.security.cas.ServiceProperties;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
-import org.springframework.security.web.context.SecurityContextRepository;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
+import static org.mockito.Mockito.verifyZeroInteractions;
 
 /**
  * Tests {@link CasAuthenticationFilter}.
@@ -132,14 +129,13 @@ public class CasAuthenticationFilterTests {
 		assertThat(filter.requiresAuthentication(request, response)).isFalse();
 		request.setParameter(properties.getArtifactParameter(), "value");
 		assertThat(filter.requiresAuthentication(request, response)).isTrue();
-		SecurityContextHolder.getContext()
-			.setAuthentication(new AnonymousAuthenticationToken("key", "principal",
-					AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
+		SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("key", "principal",
+				AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
 		assertThat(filter.requiresAuthentication(request, response)).isTrue();
 		SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("un", "principal"));
 		assertThat(filter.requiresAuthentication(request, response)).isTrue();
 		SecurityContextHolder.getContext()
-			.setAuthentication(new TestingAuthenticationToken("un", "principal", "ROLE_ANONYMOUS"));
+				.setAuthentication(new TestingAuthenticationToken("un", "principal", "ROLE_ANONYMOUS"));
 		assertThat(filter.requiresAuthentication(request, response)).isFalse();
 	}
 
@@ -175,9 +171,9 @@ public class CasAuthenticationFilterTests {
 		filter.afterPropertiesSet();
 		filter.doFilter(request, response, chain);
 		assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull()
-			.withFailMessage("Authentication should not be null");
+				.withFailMessage("Authentication should not be null");
 		verify(chain).doFilter(request, response);
-		verifyNoMoreInteractions(successHandler);
+		verifyZeroInteractions(successHandler);
 		// validate for when the filterProcessUrl matches
 		filter.setFilterProcessesUrl(request.getServletPath());
 		SecurityContextHolder.clearContext();
@@ -186,38 +182,6 @@ public class CasAuthenticationFilterTests {
 		verify(successHandler).onAuthenticationSuccess(request, response, authentication);
 	}
 
-	@Test
-	public void testSecurityContextHolder() throws Exception {
-		SecurityContextRepository securityContextRepository = mock(SecurityContextRepository.class);
-		AuthenticationManager manager = mock(AuthenticationManager.class);
-		Authentication authentication = new TestingAuthenticationToken("un", "pwd", "ROLE_USER");
-		given(manager.authenticate(any(Authentication.class))).willReturn(authentication);
-		ServiceProperties serviceProperties = new ServiceProperties();
-		serviceProperties.setAuthenticateAllArtifacts(true);
-		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.setParameter("ticket", "ST-1-123");
-		request.setServletPath("/authenticate");
-		MockHttpServletResponse response = new MockHttpServletResponse();
-		FilterChain chain = mock(FilterChain.class);
-		CasAuthenticationFilter filter = new CasAuthenticationFilter();
-		filter.setServiceProperties(serviceProperties);
-		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
-		filter.setAuthenticationManager(manager);
-		filter.setSecurityContextRepository(securityContextRepository);
-		filter.afterPropertiesSet();
-		filter.doFilter(request, response, chain);
-		assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull()
-			.withFailMessage("Authentication should not be null");
-		verify(chain).doFilter(request, response);
-		// validate for when the filterProcessUrl matches
-		filter.setFilterProcessesUrl(request.getServletPath());
-		SecurityContextHolder.clearContext();
-		filter.doFilter(request, response, chain);
-		ArgumentCaptor<SecurityContext> contextArg = ArgumentCaptor.forClass(SecurityContext.class);
-		verify(securityContextRepository).saveContext(contextArg.capture(), eq(request), eq(response));
-		assertThat(contextArg.getValue().getAuthentication().getPrincipal()).isEqualTo(authentication.getName());
-	}
-
 	// SEC-1592
 	@Test
 	public void testChainNotInvokedForProxyReceptor() throws Exception {
@@ -229,7 +193,7 @@ public class CasAuthenticationFilterTests {
 		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
 		filter.setProxyReceptorUrl(request.getServletPath());
 		filter.doFilter(request, response, chain);
-		verifyNoMoreInteractions(chain);
+		verifyZeroInteractions(chain);
 	}
 
 }

cas/src/test/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetailsTests.java

@@ -54,7 +54,7 @@ public class DefaultServiceAuthenticationDetailsTests {
 		this.request.setServerPort(8443);
 		this.request.setRequestURI("/cas-sample/secure/");
 		this.artifactPattern = DefaultServiceAuthenticationDetails
-			.createArtifactPattern(ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
+				.createArtifactPattern(ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
 	}
 
 	@AfterEach

config/spring-security-config.gradle

@@ -1,11 +1,13 @@
 import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
-import org.springframework.gradle.xsd.CreateVersionlessXsdTask
-import trang.RncToXsd
 
 apply plugin: 'io.spring.convention.spring-module'
 apply plugin: 'trang'
 apply plugin: 'kotlin'
 
+repositories {
+	maven { url "https://build.shibboleth.net/nexus/content/repositories/releases/" }
+}
+
 dependencies {
 	management platform(project(":spring-security-dependencies"))
 	// NB: Don't add other compile time dependencies to the config module as this breaks tooling
@@ -74,7 +76,6 @@ dependencies {
 	testImplementation "org.apache.directory.server:apacheds-protocol-ldap"
 	testImplementation "org.apache.directory.server:apacheds-server-jndi"
 	testImplementation 'org.apache.directory.shared:shared-ldap'
-	testImplementation "com.unboundid:unboundid-ldapsdk"
 	testImplementation 'org.eclipse.persistence:javax.persistence'
 	testImplementation('org.hibernate:hibernate-entitymanager') {
 		exclude group: 'javax.activation', module: 'javax.activation-api'
@@ -111,35 +112,13 @@ dependencies {
 	testRuntimeOnly 'org.hsqldb:hsqldb'
 }
 
-def rncToXsd = tasks.named('rncToXsd', RncToXsd)
-rncToXsd.configure {
+
+rncToXsd {
 	rncDir = file('src/main/resources/org/springframework/security/config/')
 	xsdDir = rncDir
 	xslFile = new File(rncDir, 'spring-security.xsl')
 }
 
-def versionlessXsd = tasks.register("versionlessXsd", CreateVersionlessXsdTask) {
-	inputFiles.from(rncToXsd.map { task -> project.fileTree(task.xsdDir) })
-	versionlessXsdFile = project.layout.buildDirectory.file("versionlessXsd/spring-security.xsd")
-}
-
-tasks.named('processResources', ProcessResources).configure {
-	from(versionlessXsd) {
-		into 'org/springframework/security/config/'
-	}
-	from(rncToXsd) {
-		duplicatesStrategy DuplicatesStrategy.EXCLUDE
-		into 'org/springframework/security/config/'
-	}
-}
-
-tasks.named('sourcesJar', Jar).configure {
-	from(rncToXsd) {
-		duplicatesStrategy DuplicatesStrategy.EXCLUDE
-		into 'org/springframework/security/config/'
-	}
-}
-
 tasks.withType(KotlinCompile).configureEach {
 	kotlinOptions {
 		languageVersion = "1.3"
@@ -149,36 +128,4 @@ tasks.withType(KotlinCompile).configureEach {
 	}
 }
 
-compileTestJava {
-	exclude "org/springframework/security/config/annotation/web/configurers/saml2/**", "org/springframework/security/config/http/Saml2*"
-}
-
-task compileSaml2TestJava(type: JavaCompile) {
-	javaCompiler = javaToolchains.compilerFor {
-		languageVersion = JavaLanguageVersion.of(11)
-	}
-	source = sourceSets.test.java.srcDirs
-	include "org/springframework/security/config/annotation/web/configurers/saml2/**", "org/springframework/security/config/http/Saml2*"
-	classpath = sourceSets.test.compileClasspath
-	destinationDirectory = new File("${buildDir}/classes/java/test")
-	options.sourcepath = sourceSets.test.java.getSourceDirectories()
-}
-
-task saml2Tests(type: Test) {
-	javaLauncher = javaToolchains.launcherFor {
-		languageVersion = JavaLanguageVersion.of(11)
-	}
-	filter {
-		includeTestsMatching "org.springframework.security.config.annotation.web.configurers.saml2.*"
-	}
-	useJUnitPlatform()
-	dependsOn compileSaml2TestJava
-}
-
-test {
-	shouldRunAfter saml2Tests
-}
-
-tasks.named('check') {
-	dependsOn saml2Tests
-}
+build.dependsOn rncToXsd

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderBuilderSecurityBuilderTests.java

@@ -74,8 +74,8 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 		assertThat(authoritiesPopulator).hasFieldOrPropertyWithValue("groupRoleAttribute", "cn");
 		assertThat(authoritiesPopulator).hasFieldOrPropertyWithValue("groupSearchBase", "");
 		assertThat(authoritiesPopulator).hasFieldOrPropertyWithValue("groupSearchFilter", "(uniqueMember={0})");
-		assertThat(authoritiesPopulator).extracting("searchControls")
-			.hasFieldOrPropertyWithValue("searchScope", SearchControls.ONELEVEL_SCOPE);
+		assertThat(authoritiesPopulator).extracting("searchControls").hasFieldOrPropertyWithValue("searchScope",
+				SearchControls.ONELEVEL_SCOPE);
 		assertThat(ReflectionTestUtils.getField(getAuthoritiesMapper(provider), "prefix")).isEqualTo("ROLE_");
 	}
 
@@ -85,7 +85,7 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 		LdapAuthenticationProvider provider = ldapProvider();
 
 		assertThat(ReflectionTestUtils.getField(getAuthoritiesPopulator(provider), "groupRoleAttribute"))
-			.isEqualTo("group");
+				.isEqualTo("group");
 	}
 
 	@Test
@@ -94,7 +94,7 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 		LdapAuthenticationProvider provider = ldapProvider();
 
 		assertThat(ReflectionTestUtils.getField(getAuthoritiesPopulator(provider), "groupSearchFilter"))
-			.isEqualTo("ou=groupName");
+				.isEqualTo("ou=groupName");
 	}
 
 	@Test
@@ -103,8 +103,7 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 		LdapAuthenticationProvider provider = ldapProvider();
 
 		assertThat(ReflectionTestUtils.getField(getAuthoritiesPopulator(provider), "searchControls"))
-			.extracting("searchScope")
-			.isEqualTo(SearchControls.SUBTREE_SCOPE);
+				.extracting("searchScope").isEqualTo(SearchControls.SUBTREE_SCOPE);
 	}
 
 	@Test
@@ -120,8 +119,8 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 		this.spring.register(BindAuthenticationConfig.class).autowire();
 
 		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob")
-				.withAuthorities(Collections.singleton(new SimpleGrantedAuthority("ROLE_DEVELOPERS"))));
+				.andExpect(authenticated().withUsername("bob")
+						.withAuthorities(Collections.singleton(new SimpleGrantedAuthority("ROLE_DEVELOPERS"))));
 	}
 
 	// SEC-2472
@@ -130,14 +129,13 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 		this.spring.register(PasswordEncoderConfig.class).autowire();
 
 		this.mockMvc.perform(formLogin().user("bcrypt").password("password"))
-			.andExpect(authenticated().withUsername("bcrypt")
-				.withAuthorities(Collections.singleton(new SimpleGrantedAuthority("ROLE_DEVELOPERS"))));
+				.andExpect(authenticated().withUsername("bcrypt")
+						.withAuthorities(Collections.singleton(new SimpleGrantedAuthority("ROLE_DEVELOPERS"))));
 	}
 
 	private LdapAuthenticationProvider ldapProvider() {
 		return ((List<LdapAuthenticationProvider>) ReflectionTestUtils.getField(this.authenticationManager,
-				"providers"))
-			.get(0);
+				"providers")).get(0);
 	}
 
 	private LdapAuthoritiesPopulator getAuthoritiesPopulator(LdapAuthenticationProvider provider) {

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderConfigurerTests.java

@@ -51,7 +51,7 @@ public class LdapAuthenticationProviderConfigurerTests {
 		this.spring.register(MultiLdapAuthenticationProvidersConfig.class).autowire();
 
 		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob"));
+				.andExpect(authenticated().withUsername("bob"));
 	}
 
 	@Test

config/src/integration-test/java/org/springframework/security/config/annotation/rsocket/JwtITests.java

@@ -122,7 +122,7 @@ public class JwtITests {
 	@Test
 	public void routeWhenAuthenticationBearerThenAuthorized() {
 		MimeType authenticationMimeType = MimeTypeUtils
-			.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_AUTHENTICATION.getString());
+				.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_AUTHENTICATION.getString());
 		BearerTokenMetadata credentials = new BearerTokenMetadata("token");
 		given(this.decoder.decode(any())).willReturn(Mono.just(jwt()));
 		// @formatter:off
@@ -137,11 +137,8 @@ public class JwtITests {
 	}
 
 	private Jwt jwt() {
-		return TestJwts.jwt()
-			.claim(IdTokenClaimNames.ISS, "https://issuer.example.com")
-			.claim(IdTokenClaimNames.SUB, "rob")
-			.claim(IdTokenClaimNames.AUD, Arrays.asList("client-id"))
-			.build();
+		return TestJwts.jwt().claim(IdTokenClaimNames.ISS, "https://issuer.example.com")
+				.claim(IdTokenClaimNames.SUB, "rob").claim(IdTokenClaimNames.AUD, Arrays.asList("client-id")).build();
 	}
 
 	private RSocketRequester.Builder requester() {
@@ -172,7 +169,7 @@ public class JwtITests {
 		@Bean
 		PayloadSocketAcceptorInterceptor rsocketInterceptor(RSocketSecurity rsocket) {
 			rsocket.authorizePayload((authorize) -> authorize.anyRequest().authenticated().anyExchange().permitAll())
-				.jwt(Customizer.withDefaults());
+					.jwt(Customizer.withDefaults());
 			return rsocket.build();
 		}
 

config/src/integration-test/java/org/springframework/security/config/annotation/rsocket/RSocketMessageHandlerITests.java

@@ -195,7 +195,7 @@ public class RSocketMessageHandlerITests {
 		String data = "a";
 		assertThatExceptionOfType(ApplicationErrorException.class).isThrownBy(
 				() -> this.requester.route("secure.hello").data(data).retrieveFlux(String.class).collectList().block())
-			.withMessageContaining("Access Denied");
+				.withMessageContaining("Access Denied");
 		assertThat(this.controller.payloads).isEmpty();
 	}
 

config/src/integration-test/java/org/springframework/security/config/annotation/rsocket/SimpleAuthenticationITests.java

@@ -117,7 +117,7 @@ public class SimpleAuthenticationITests {
 	@Test
 	public void retrieveMonoWhenAuthorizedThenGranted() {
 		MimeType authenticationMimeType = MimeTypeUtils
-			.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_AUTHENTICATION.getString());
+				.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_AUTHENTICATION.getString());
 		UsernamePasswordMetadata credentials = new UsernamePasswordMetadata("rob", "password");
 		// @formatter:off
 		this.requester = RSocketRequester.builder()
@@ -161,7 +161,7 @@ public class SimpleAuthenticationITests {
 		@Bean
 		PayloadSocketAcceptorInterceptor rsocketInterceptor(RSocketSecurity rsocket) {
 			rsocket.authorizePayload((authorize) -> authorize.anyRequest().authenticated().anyExchange().permitAll())
-				.simpleAuthentication(Customizer.withDefaults());
+					.simpleAuthentication(Customizer.withDefaults());
 			return rsocket.build();
 		}
 

config/src/integration-test/java/org/springframework/security/config/ldap/EmbeddedLdapServerContextSourceFactoryBeanITests.java

@@ -1,185 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.ldap;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-
-import org.springframework.beans.factory.UnsatisfiedDependencyException;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.ldap.core.support.LdapContextSource;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.test.SpringTestContext;
-import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.crypto.password.NoOpPasswordEncoder;
-import org.springframework.test.web.servlet.MockMvc;
-
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin;
-import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
-
-@ExtendWith(SpringTestContextExtension.class)
-public class EmbeddedLdapServerContextSourceFactoryBeanITests {
-
-	public final SpringTestContext spring = new SpringTestContext(this);
-
-	@Autowired
-	private MockMvc mockMvc;
-
-	@Test
-	public void contextSourceFactoryBeanWhenEmbeddedServerThenAuthenticates() throws Exception {
-		this.spring.register(FromEmbeddedLdapServerConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob"));
-	}
-
-	@Test
-	public void contextSourceFactoryBeanWhenPortZeroThenAuthenticates() throws Exception {
-		this.spring.register(PortZeroConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob"));
-	}
-
-	@Test
-	public void contextSourceFactoryBeanWhenCustomLdifAndRootThenAuthenticates() throws Exception {
-		this.spring.register(CustomLdifAndRootConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("pg").password("password")).andExpect(authenticated().withUsername("pg"));
-	}
-
-	@Test
-	public void contextSourceFactoryBeanWhenCustomManagerDnThenAuthenticates() throws Exception {
-		this.spring.register(CustomManagerDnConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob"));
-	}
-
-	@Test
-	public void contextSourceFactoryBeanWhenManagerDnAndNoPasswordThenException() {
-		assertThatExceptionOfType(UnsatisfiedDependencyException.class)
-			.isThrownBy(() -> this.spring.register(CustomManagerDnNoPasswordConfig.class).autowire())
-			.withRootCauseInstanceOf(IllegalStateException.class)
-			.withMessageContaining("managerPassword is required if managerDn is supplied");
-	}
-
-	@EnableWebSecurity
-	static class FromEmbeddedLdapServerConfig {
-
-		@Bean
-		EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean() {
-			return EmbeddedLdapServerContextSourceFactoryBean.fromEmbeddedLdapServer();
-		}
-
-		@Bean
-		AuthenticationManager authenticationManager(LdapContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class PortZeroConfig {
-
-		@Bean
-		EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean() {
-			EmbeddedLdapServerContextSourceFactoryBean factoryBean = EmbeddedLdapServerContextSourceFactoryBean
-				.fromEmbeddedLdapServer();
-			factoryBean.setPort(0);
-			return factoryBean;
-		}
-
-		@Bean
-		AuthenticationManager authenticationManager(LdapContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomLdifAndRootConfig {
-
-		@Bean
-		EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean() {
-			EmbeddedLdapServerContextSourceFactoryBean factoryBean = EmbeddedLdapServerContextSourceFactoryBean
-				.fromEmbeddedLdapServer();
-			factoryBean.setLdif("classpath*:test-server2.xldif");
-			factoryBean.setRoot("dc=monkeymachine,dc=co,dc=uk");
-			return factoryBean;
-		}
-
-		@Bean
-		AuthenticationManager authenticationManager(LdapContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=gorillas");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomManagerDnConfig {
-
-		@Bean
-		EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean() {
-			EmbeddedLdapServerContextSourceFactoryBean factoryBean = EmbeddedLdapServerContextSourceFactoryBean
-				.fromEmbeddedLdapServer();
-			factoryBean.setManagerDn("uid=admin,ou=system");
-			factoryBean.setManagerPassword("secret");
-			return factoryBean;
-		}
-
-		@Bean
-		AuthenticationManager authenticationManager(LdapContextSource contextSource) {
-			LdapPasswordComparisonAuthenticationManagerFactory factory = new LdapPasswordComparisonAuthenticationManagerFactory(
-					contextSource, NoOpPasswordEncoder.getInstance());
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomManagerDnNoPasswordConfig {
-
-		@Bean
-		EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean() {
-			EmbeddedLdapServerContextSourceFactoryBean factoryBean = EmbeddedLdapServerContextSourceFactoryBean
-				.fromEmbeddedLdapServer();
-			factoryBean.setManagerDn("uid=admin,ou=system");
-			return factoryBean;
-		}
-
-		@Bean
-		AuthenticationManager authenticationManager(LdapContextSource contextSource) {
-			LdapPasswordComparisonAuthenticationManagerFactory factory = new LdapPasswordComparisonAuthenticationManagerFactory(
-					contextSource, NoOpPasswordEncoder.getInstance());
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-}

config/src/integration-test/java/org/springframework/security/config/ldap/LdapBindAuthenticationManagerFactoryITests.java

@@ -1,243 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.ldap;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-
-import org.springframework.beans.factory.DisposableBean;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.ldap.core.DirContextAdapter;
-import org.springframework.ldap.core.DirContextOperations;
-import org.springframework.ldap.core.support.BaseLdapPathContextSource;
-import org.springframework.ldap.core.support.LdapContextSource;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.test.SpringTestContext;
-import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
-import org.springframework.security.core.userdetails.User;
-import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
-import org.springframework.security.ldap.server.ApacheDSContainer;
-import org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator;
-import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
-import org.springframework.security.ldap.userdetails.UserDetailsContextMapper;
-import org.springframework.test.web.servlet.MockMvc;
-
-import static org.mockito.Mockito.mock;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin;
-import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
-
-@ExtendWith(SpringTestContextExtension.class)
-public class LdapBindAuthenticationManagerFactoryITests {
-
-	public final SpringTestContext spring = new SpringTestContext(this);
-
-	@Autowired
-	private MockMvc mockMvc;
-
-	@Test
-	public void authenticationManagerFactoryWhenFromContextSourceThenAuthenticates() throws Exception {
-		this.spring.register(FromContextSourceConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob"));
-	}
-
-	@Test
-	public void ldapAuthenticationProviderCustomLdapAuthoritiesPopulator() throws Exception {
-		CustomAuthoritiesPopulatorConfig.LAP = new DefaultLdapAuthoritiesPopulator(mock(LdapContextSource.class),
-				null) {
-			@Override
-			protected Set<GrantedAuthority> getAdditionalRoles(DirContextOperations user, String username) {
-				return new HashSet<>(AuthorityUtils.createAuthorityList("ROLE_EXTRA"));
-			}
-		};
-
-		this.spring.register(CustomAuthoritiesPopulatorConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(
-					authenticated().withAuthorities(Collections.singleton(new SimpleGrantedAuthority("ROLE_EXTRA"))));
-	}
-
-	@Test
-	public void authenticationManagerFactoryWhenCustomAuthoritiesMapperThenUsed() throws Exception {
-		CustomAuthoritiesMapperConfig.AUTHORITIES_MAPPER = ((authorities) -> AuthorityUtils
-			.createAuthorityList("ROLE_CUSTOM"));
-
-		this.spring.register(CustomAuthoritiesMapperConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(
-					authenticated().withAuthorities(Collections.singleton(new SimpleGrantedAuthority("ROLE_CUSTOM"))));
-	}
-
-	@Test
-	public void authenticationManagerFactoryWhenCustomUserDetailsContextMapperThenUsed() throws Exception {
-		CustomUserDetailsContextMapperConfig.CONTEXT_MAPPER = new UserDetailsContextMapper() {
-			@Override
-			public UserDetails mapUserFromContext(DirContextOperations ctx, String username,
-					Collection<? extends GrantedAuthority> authorities) {
-				return User.withUsername("other").password("password").roles("USER").build();
-			}
-
-			@Override
-			public void mapUserToContext(UserDetails user, DirContextAdapter ctx) {
-			}
-		};
-
-		this.spring.register(CustomUserDetailsContextMapperConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("other"));
-	}
-
-	@Test
-	public void authenticationManagerFactoryWhenCustomUserDnPatternsThenUsed() throws Exception {
-		this.spring.register(CustomUserDnPatternsConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob"));
-	}
-
-	@Test
-	public void authenticationManagerFactoryWhenCustomUserSearchThenUsed() throws Exception {
-		this.spring.register(CustomUserSearchConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bobspassword"))
-			.andExpect(authenticated().withUsername("bob"));
-	}
-
-	@EnableWebSecurity
-	static class FromContextSourceConfig extends BaseLdapServerConfig {
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomAuthoritiesMapperConfig extends BaseLdapServerConfig {
-
-		static GrantedAuthoritiesMapper AUTHORITIES_MAPPER;
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=people");
-			factory.setAuthoritiesMapper(AUTHORITIES_MAPPER);
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomAuthoritiesPopulatorConfig extends BaseLdapServerConfig {
-
-		static LdapAuthoritiesPopulator LAP;
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=people");
-			factory.setLdapAuthoritiesPopulator(LAP);
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomUserDetailsContextMapperConfig extends BaseLdapServerConfig {
-
-		static UserDetailsContextMapper CONTEXT_MAPPER;
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=people");
-			factory.setUserDetailsContextMapper(CONTEXT_MAPPER);
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomUserDnPatternsConfig extends BaseLdapServerConfig {
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomUserSearchConfig extends BaseLdapServerConfig {
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
-			factory.setUserSearchFilter("uid={0}");
-			factory.setUserSearchBase("ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	abstract static class BaseLdapServerConfig implements DisposableBean {
-
-		private ApacheDSContainer container;
-
-		@Bean
-		ApacheDSContainer ldapServer() throws Exception {
-			this.container = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/test-server.ldif");
-			this.container.setPort(0);
-			return this.container;
-		}
-
-		@Bean
-		BaseLdapPathContextSource contextSource(ApacheDSContainer container) {
-			int port = container.getLocalPort();
-			return new DefaultSpringSecurityContextSource("ldap://localhost:" + port + "/dc=springframework,dc=org");
-		}
-
-		@Override
-		public void destroy() {
-			this.container.stop();
-		}
-
-	}
-
-}

config/src/integration-test/java/org/springframework/security/config/ldap/LdapPasswordComparisonAuthenticationManagerFactoryITests.java

@@ -1,114 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.ldap;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-
-import org.springframework.beans.factory.DisposableBean;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.ldap.core.support.BaseLdapPathContextSource;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.test.SpringTestContext;
-import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.NoOpPasswordEncoder;
-import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
-import org.springframework.security.ldap.server.ApacheDSContainer;
-import org.springframework.test.web.servlet.MockMvc;
-
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin;
-import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
-
-@ExtendWith(SpringTestContextExtension.class)
-public class LdapPasswordComparisonAuthenticationManagerFactoryITests {
-
-	public final SpringTestContext spring = new SpringTestContext(this);
-
-	@Autowired
-	private MockMvc mockMvc;
-
-	@Test
-	public void authenticationManagerFactoryWhenCustomPasswordEncoderThenUsed() throws Exception {
-		this.spring.register(CustomPasswordEncoderConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bcrypt").password("password"))
-			.andExpect(authenticated().withUsername("bcrypt"));
-	}
-
-	@Test
-	public void authenticationManagerFactoryWhenCustomPasswordAttributeThenUsed() throws Exception {
-		this.spring.register(CustomPasswordAttributeConfig.class).autowire();
-
-		this.mockMvc.perform(formLogin().user("bob").password("bob")).andExpect(authenticated().withUsername("bob"));
-	}
-
-	@EnableWebSecurity
-	static class CustomPasswordEncoderConfig extends BaseLdapServerConfig {
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapPasswordComparisonAuthenticationManagerFactory factory = new LdapPasswordComparisonAuthenticationManagerFactory(
-					contextSource, new BCryptPasswordEncoder());
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	static class CustomPasswordAttributeConfig extends BaseLdapServerConfig {
-
-		@Bean
-		AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
-			LdapPasswordComparisonAuthenticationManagerFactory factory = new LdapPasswordComparisonAuthenticationManagerFactory(
-					contextSource, NoOpPasswordEncoder.getInstance());
-			factory.setPasswordAttribute("uid");
-			factory.setUserDnPatterns("uid={0},ou=people");
-			return factory.createAuthenticationManager();
-		}
-
-	}
-
-	@EnableWebSecurity
-	abstract static class BaseLdapServerConfig implements DisposableBean {
-
-		private ApacheDSContainer container;
-
-		@Bean
-		ApacheDSContainer ldapServer() throws Exception {
-			this.container = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/test-server.ldif");
-			this.container.setPort(0);
-			return this.container;
-		}
-
-		@Bean
-		BaseLdapPathContextSource contextSource(ApacheDSContainer container) {
-			int port = container.getLocalPort();
-			return new DefaultSpringSecurityContextSource("ldap://localhost:" + port + "/dc=springframework,dc=org");
-		}
-
-		@Override
-		public void destroy() {
-			this.container.stop();
-		}
-
-	}
-
-}

config/src/integration-test/java/org/springframework/security/config/ldap/LdapProviderBeanDefinitionParserTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2020 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -56,7 +56,7 @@ public class LdapProviderBeanDefinitionParserTests {
 		AuthenticationManager authenticationManager = this.appCtx.getBean(BeanIds.AUTHENTICATION_MANAGER,
 				AuthenticationManager.class);
 		Authentication auth = authenticationManager
-			.authenticate(UsernamePasswordAuthenticationToken.unauthenticated("ben", "benspassword"));
+				.authenticate(new UsernamePasswordAuthenticationToken("ben", "benspassword"));
 		UserDetails ben = (UserDetails) auth.getPrincipal();
 		assertThat(ben.getAuthorities()).hasSize(3);
 	}
@@ -71,7 +71,7 @@ public class LdapProviderBeanDefinitionParserTests {
 		ProviderManager providerManager = this.appCtx.getBean(BeanIds.AUTHENTICATION_MANAGER, ProviderManager.class);
 		assertThat(providerManager.getProviders()).hasSize(2);
 		assertThat(providerManager.getProviders()).extracting("authoritiesPopulator.groupSearchFilter")
-			.containsExactly("member={0}", "uniqueMember={0}");
+				.containsExactly("member={0}", "uniqueMember={0}");
 	}
 
 	@Test
@@ -89,7 +89,7 @@ public class LdapProviderBeanDefinitionParserTests {
 		AuthenticationManager authenticationManager = this.appCtx.getBean(BeanIds.AUTHENTICATION_MANAGER,
 				AuthenticationManager.class);
 		Authentication auth = authenticationManager
-			.authenticate(UsernamePasswordAuthenticationToken.unauthenticated("ben", "benspassword"));
+				.authenticate(new UsernamePasswordAuthenticationToken("ben", "benspassword"));
 
 		assertThat(auth).isNotNull();
 	}
@@ -104,8 +104,7 @@ public class LdapProviderBeanDefinitionParserTests {
 
 		AuthenticationManager authenticationManager = this.appCtx.getBean(BeanIds.AUTHENTICATION_MANAGER,
 				AuthenticationManager.class);
-		Authentication auth = authenticationManager
-			.authenticate(UsernamePasswordAuthenticationToken.unauthenticated("ben", "ben"));
+		Authentication auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("ben", "ben"));
 
 		assertThat(auth).isNotNull();
 	}
@@ -122,7 +121,7 @@ public class LdapProviderBeanDefinitionParserTests {
 		AuthenticationManager authenticationManager = this.appCtx.getBean(BeanIds.AUTHENTICATION_MANAGER,
 				AuthenticationManager.class);
 		Authentication auth = authenticationManager
-			.authenticate(UsernamePasswordAuthenticationToken.unauthenticated("bcrypt", "password"));
+				.authenticate(new UsernamePasswordAuthenticationToken("bcrypt", "password"));
 
 		assertThat(auth).isNotNull();
 	}
@@ -137,8 +136,8 @@ public class LdapProviderBeanDefinitionParserTests {
 
 		ProviderManager providerManager = this.appCtx.getBean(BeanIds.AUTHENTICATION_MANAGER, ProviderManager.class);
 		assertThat(providerManager.getProviders()).hasSize(1);
-		assertThat(providerManager.getProviders()).extracting("userDetailsContextMapper")
-			.allSatisfy((contextMapper) -> assertThat(contextMapper).isInstanceOf(InetOrgPersonContextMapper.class));
+		assertThat(providerManager.getProviders()).extracting("userDetailsContextMapper").allSatisfy(
+				(contextMapper) -> assertThat(contextMapper).isInstanceOf(InetOrgPersonContextMapper.class));
 	}
 
 	@Test
@@ -155,10 +154,10 @@ public class LdapProviderBeanDefinitionParserTests {
 
 		AuthenticationProvider authenticationProvider = providerManager.getProviders().get(0);
 		assertThat(authenticationProvider).extracting("authenticator.userDnFormat")
-			.satisfies((messageFormats) -> assertThat(messageFormats)
-				.isEqualTo(new MessageFormat[] { new MessageFormat("uid={0},ou=people") }));
+				.satisfies((messageFormats) -> assertThat(messageFormats)
+						.isEqualTo(new MessageFormat[] { new MessageFormat("uid={0},ou=people") }));
 		assertThat(authenticationProvider).extracting("authoritiesPopulator.groupSearchFilter")
-			.satisfies((searchFilter) -> assertThat(searchFilter).isEqualTo("member={0}"));
+				.satisfies((searchFilter) -> assertThat(searchFilter).isEqualTo("member={0}"));
 	}
 
 }

config/src/integration-test/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParserTests.java

@@ -52,7 +52,7 @@ public class LdapServerBeanDefinitionParserTests {
 		this.appCtx = new InMemoryXmlApplicationContext("<ldap-server ldif='classpath:test-server.ldif' port='0'/>");
 
 		DefaultSpringSecurityContextSource contextSource = (DefaultSpringSecurityContextSource) this.appCtx
-			.getBean(BeanIds.CONTEXT_SOURCE);
+				.getBean(BeanIds.CONTEXT_SOURCE);
 
 		// Check data is loaded
 		LdapTemplate template = new LdapTemplate(contextSource);
@@ -71,7 +71,7 @@ public class LdapServerBeanDefinitionParserTests {
 		this.appCtx.getBean(BeanIds.CONTEXT_SOURCE);
 
 		DefaultSpringSecurityContextSource contextSource = (DefaultSpringSecurityContextSource) this.appCtx
-			.getBean("blah");
+				.getBean("blah");
 
 		// Check data is loaded as before
 		LdapTemplate template = new LdapTemplate(contextSource);
@@ -83,7 +83,7 @@ public class LdapServerBeanDefinitionParserTests {
 		this.appCtx = new InMemoryXmlApplicationContext(
 				"<ldap-server ldif='classpath*:test-server2.xldif' root='dc=monkeymachine,dc=co,dc=uk' port='0'/>");
 		DefaultSpringSecurityContextSource contextSource = (DefaultSpringSecurityContextSource) this.appCtx
-			.getBean(BeanIds.CONTEXT_SOURCE);
+				.getBean(BeanIds.CONTEXT_SOURCE);
 
 		LdapTemplate template = new LdapTemplate(contextSource);
 		template.lookup("uid=pg,ou=gorillas");

config/src/integration-test/java/org/springframework/security/config/ldap/LdapUserServiceBeanDefinitionParserTests.java

@@ -58,17 +58,17 @@ public class LdapUserServiceBeanDefinitionParserTests {
 	@Test
 	public void beanClassNamesAreCorrect() {
 		assertThat(FilterBasedLdapUserSearch.class.getName())
-			.isEqualTo(LdapUserServiceBeanDefinitionParser.LDAP_SEARCH_CLASS);
+				.isEqualTo(LdapUserServiceBeanDefinitionParser.LDAP_SEARCH_CLASS);
 		assertThat(PersonContextMapper.class.getName())
-			.isEqualTo(LdapUserServiceBeanDefinitionParser.PERSON_MAPPER_CLASS);
+				.isEqualTo(LdapUserServiceBeanDefinitionParser.PERSON_MAPPER_CLASS);
 		assertThat(InetOrgPersonContextMapper.class.getName())
-			.isEqualTo(LdapUserServiceBeanDefinitionParser.INET_ORG_PERSON_MAPPER_CLASS);
+				.isEqualTo(LdapUserServiceBeanDefinitionParser.INET_ORG_PERSON_MAPPER_CLASS);
 		assertThat(LdapUserDetailsMapper.class.getName())
-			.isEqualTo(LdapUserServiceBeanDefinitionParser.LDAP_USER_MAPPER_CLASS);
+				.isEqualTo(LdapUserServiceBeanDefinitionParser.LDAP_USER_MAPPER_CLASS);
 		assertThat(DefaultLdapAuthoritiesPopulator.class.getName())
-			.isEqualTo(LdapUserServiceBeanDefinitionParser.LDAP_AUTHORITIES_POPULATOR_CLASS);
+				.isEqualTo(LdapUserServiceBeanDefinitionParser.LDAP_AUTHORITIES_POPULATOR_CLASS);
 		assertThat(new LdapUserServiceBeanDefinitionParser().getBeanClassName(mock(Element.class)))
-			.isEqualTo(LdapUserDetailsService.class.getName());
+				.isEqualTo(LdapUserDetailsService.class.getName());
 	}
 
 	@Test

config/src/main/java/org/springframework/security/config/Elements.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -138,10 +138,4 @@ public abstract class Elements {
 
 	public static final String PASSWORD_MANAGEMENT = "password-management";
 
-	public static final String RELYING_PARTY_REGISTRATIONS = "relying-party-registrations";
-
-	public static final String SAML2_LOGIN = "saml2-login";
-
-	public static final String SAML2_LOGOUT = "saml2-logout";
-
 }

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2009-2022 the original author or authors.
+ * Copyright 2009-2020 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,7 +47,6 @@ import org.springframework.security.config.method.InterceptMethodsBeanDefinition
 import org.springframework.security.config.method.MethodSecurityBeanDefinitionParser;
 import org.springframework.security.config.method.MethodSecurityMetadataSourceBeanDefinitionParser;
 import org.springframework.security.config.oauth2.client.ClientRegistrationsBeanDefinitionParser;
-import org.springframework.security.config.saml2.RelyingPartyRegistrationsBeanDefinitionParser;
 import org.springframework.security.config.websocket.WebSocketMessageBrokerSecurityBeanDefinitionParser;
 import org.springframework.security.core.SpringSecurityCoreVersion;
 import org.springframework.util.ClassUtils;
@@ -85,19 +84,17 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 		String version = pkg.getImplementationVersion();
 		this.logger.info("Spring Security 'config' module version is " + version);
 		if (version.compareTo(coreVersion) != 0) {
-			this.logger
-				.error("You are running with different versions of the Spring Security 'core' and 'config' modules");
+			this.logger.error(
+					"You are running with different versions of the Spring Security 'core' and 'config' modules");
 		}
 	}
 
 	@Override
 	public BeanDefinition parse(Element element, ParserContext pc) {
 		if (!namespaceMatchesVersion(element)) {
-			pc.getReaderContext()
-				.fatal("You cannot use a spring-security-2.0.xsd or spring-security-3.0.xsd or "
-						+ "spring-security-3.1.xsd schema or spring-security-3.2.xsd schema or spring-security-4.0.xsd schema "
-						+ "with Spring Security 5.8. Please update your schema declarations to the 5.8 schema.",
-						element);
+			pc.getReaderContext().fatal("You cannot use a spring-security-2.0.xsd or spring-security-3.0.xsd or "
+					+ "spring-security-3.1.xsd schema or spring-security-3.2.xsd schema or spring-security-4.0.xsd schema "
+					+ "with Spring Security 5.6. Please update your schema declarations to the 5.6 schema.", element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
 		BeanDefinitionParser parser = this.parsers.get(name);
@@ -142,9 +139,8 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 	}
 
 	private void reportUnsupportedNodeType(String name, ParserContext pc, Node node) {
-		pc.getReaderContext()
-			.fatal("Security namespace does not support decoration of "
-					+ ((node instanceof Element) ? "element" : "attribute") + " [" + name + "]", node);
+		pc.getReaderContext().fatal("Security namespace does not support decoration of "
+				+ ((node instanceof Element) ? "element" : "attribute") + " [" + name + "]", node);
 	}
 
 	private void reportMissingWebClasses(String nodeName, ParserContext pc, Node node) {
@@ -195,7 +191,6 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 		this.parsers.put(Elements.FILTER_CHAIN, new FilterChainBeanDefinitionParser());
 		this.filterChainMapBDD = new FilterChainMapBeanDefinitionDecorator();
 		this.parsers.put(Elements.CLIENT_REGISTRATIONS, new ClientRegistrationsBeanDefinitionParser());
-		this.parsers.put(Elements.RELYING_PARTY_REGISTRATIONS, new RelyingPartyRegistrationsBeanDefinitionParser());
 	}
 
 	private void loadWebSocketParsers() {
@@ -221,7 +216,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 
 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-5\\.8.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-5\\.6.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}

config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java

@@ -176,7 +176,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	private <C extends SecurityConfigurer<O, B>> void add(C configurer) {
 		Assert.notNull(configurer, "configurer cannot be null");
 		Class<? extends SecurityConfigurer<O, B>> clazz = (Class<? extends SecurityConfigurer<O, B>>) configurer
-			.getClass();
+				.getClass();
 		synchronized (this.configurers) {
 			if (this.buildState.isConfigured()) {
 				throw new IllegalStateException("Cannot apply " + configurer + " to already built object");
@@ -221,7 +221,6 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		if (configs == null) {
 			return new ArrayList<>();
 		}
-		removeFromConfigurersAddedInInitializing(clazz);
 		return new ArrayList<>(configs);
 	}
 
@@ -254,16 +253,11 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		if (configs == null) {
 			return null;
 		}
-		removeFromConfigurersAddedInInitializing(clazz);
 		Assert.state(configs.size() == 1,
 				() -> "Only one configurer expected for type " + clazz + ", but got " + configs);
 		return (C) configs.get(0);
 	}
 
-	private <C extends SecurityConfigurer<O, B>> void removeFromConfigurersAddedInInitializing(Class<C> clazz) {
-		this.configurersAddedInInitializing.removeIf(clazz::isInstance);
-	}
-
 	/**
 	 * Specifies the {@link ObjectPostProcessor} to use.
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} to use. Cannot be null

config/src/main/java/org/springframework/security/config/annotation/authentication/builders/AuthenticationManagerBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -149,7 +149,7 @@ public class AuthenticationManagerBuilder
 	 * {@link #getDefaultUserDetailsService()} method. Note that additional
 	 * {@link UserDetailsService}'s may override this {@link UserDetailsService} as the
 	 * default. See the <a href=
-	 * "https://docs.spring.io/spring-security/reference/servlet/appendix/database-schema.html"
+	 * "https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#user-schema"
 	 * >User Schema</a> section of the reference for the default schema.
 	 * </p>
 	 * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/AuthenticationConfiguration.java

@@ -184,9 +184,8 @@ public class AuthenticationConfiguration {
 			return Collections.emptyList();
 		}
 		for (String beanName : beanNamesForType) {
-			if (((ConfigurableApplicationContext) this.applicationContext).getBeanFactory()
-				.getBeanDefinition(beanName)
-				.isPrimary()) {
+			if (((ConfigurableApplicationContext) this.applicationContext).getBeanFactory().getBeanDefinition(beanName)
+					.isPrimary()) {
 				list.add(beanName);
 			}
 		}
@@ -219,7 +218,7 @@ public class AuthenticationConfiguration {
 		@Override
 		public void init(AuthenticationManagerBuilder auth) {
 			Map<String, Object> beansWithAnnotation = this.context
-				.getBeansWithAnnotation(EnableGlobalAuthentication.class);
+					.getBeansWithAnnotation(EnableGlobalAuthentication.class);
 			if (logger.isTraceEnabled()) {
 				logger.trace(LogMessage.format("Eagerly initializing %s", beansWithAnnotation));
 			}

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/EnableGlobalAuthentication.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -39,19 +39,10 @@ import org.springframework.security.config.annotation.web.servlet.configuration.
  * @EnableGlobalAuthentication
  * public class MyGlobalAuthenticationConfiguration {
  *
- * 	@Bean
- * 	public UserDetailsService userDetailsService() {
- * 		UserDetails user = User.withDefaultPasswordEncoder()
- * 			.username("user")
- * 			.password("password")
- * 			.roles("USER")
- * 			.build();
- * 		UserDetails admin = User.withDefaultPasswordEncoder()
- * 			.username("admin")
- * 			.password("password")
- * 			.roles("ADMIN", "USER")
- * 			.build();
- * 		return new InMemoryUserDetailsManager(user, admin);
+ * 	@Autowired
+ * 	public void configureGlobal(AuthenticationManagerBuilder auth) {
+ * 		auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
+ * 				.and().withUser("admin").password("password").roles("USER", "ADMIN");
  * 	}
  * }
  * </pre>
@@ -63,24 +54,15 @@ import org.springframework.security.config.annotation.web.servlet.configuration.
  * <pre class="code">
  * &#064;Configuration
  * &#064;EnableWebSecurity
- * public class MyWebSecurityConfiguration {
+ * public class MyWebSecurityConfiguration extends WebSecurityConfigurerAdapter {
  *
- * 	&#064;Bean
- * 	public UserDetailsService userDetailsService() {
- * 		UserDetails user = User.withDefaultPasswordEncoder()
- * 			.username(&quot;user&quot;)
- * 			.password(&quot;password&quot;)
- * 			.roles(&quot;USER&quot;)
- * 			.build();
- * 		UserDetails admin = User.withDefaultPasswordEncoder()
- * 			.username(&quot;admin&quot;)
- * 			.password(&quot;password&quot;)
- * 			.roles(&quot;ADMIN&quot;, &quot;USER&quot;)
- * 			.build();
- * 		return new InMemoryUserDetailsManager(user, admin);
+ * 	&#064;Autowired
+ * 	public void configureGlobal(AuthenticationManagerBuilder auth) {
+ * 		auth.inMemoryAuthentication().withUser(&quot;user&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;)
+ * 				.and().withUser(&quot;admin&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;, &quot;ADMIN&quot;);
  * 	}
  *
- * 	// Possibly more bean methods ...
+ * 	// Possibly overridden methods ...
  * }
  * </pre>
  *
@@ -98,6 +80,7 @@ import org.springframework.security.config.annotation.web.servlet.configuration.
  * @see EnableWebMvcSecurity
  * @see EnableWebSecurity
  * @see EnableGlobalMethodSecurity
+ *
  * @author Rob Winch
  *
  */

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeAuthenticationProviderBeanManagerConfigurer.java

@@ -67,7 +67,7 @@ class InitializeAuthenticationProviderBeanManagerConfigurer extends GlobalAuthen
 		 */
 		private <T> T getBeanOrNull(Class<T> type) {
 			String[] beanNames = InitializeAuthenticationProviderBeanManagerConfigurer.this.context
-				.getBeanNamesForType(type);
+					.getBeanNamesForType(type);
 			if (beanNames.length != 1) {
 				return null;
 			}

config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java

@@ -387,7 +387,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	 */
 	public PasswordCompareConfigurer passwordCompare() {
 		return new PasswordCompareConfigurer().passwordAttribute("password")
-			.passwordEncoder(NoOpPasswordEncoder.getInstance());
+				.passwordEncoder(NoOpPasswordEncoder.getInstance());
 	}
 
 	/**

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableGlobalMethodSecurity.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,9 +43,7 @@ import org.springframework.security.config.annotation.authentication.configurati
  *
  * @author Rob Winch
  * @since 3.2
- * @deprecated Use {@link EnableMethodSecurity} instead
  */
-@Deprecated
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.TYPE)
 @Documented

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableMethodSecurity.java

@@ -33,7 +33,6 @@ import org.springframework.security.access.prepost.PreFilter;
 
 /**
  * Enables Spring Security Method Security.
- *
  * @author Evgeniy Cheban
  * @author Josh Cummings
  * @since 5.6

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableReactiveMethodSecurity.java

@@ -26,9 +26,9 @@ import org.springframework.context.annotation.AdviceMode;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.core.Ordered;
-import org.springframework.security.authorization.ReactiveAuthorizationManager;
 
 /**
+ *
  * @author Rob Winch
  * @since 5.0
  */
@@ -69,11 +69,4 @@ public @interface EnableReactiveMethodSecurity {
 	 */
 	int order() default Ordered.LOWEST_PRECEDENCE;
 
-	/**
-	 * Indicate whether {@link ReactiveAuthorizationManager} based Method Security to be
-	 * used.
-	 * @since 5.8
-	 */
-	boolean useAuthorizationManager() default false;
-
 }