Release 5.8.2

.github/ISSUE_TEMPLATE/bug.md

@@ -7,10 +7,6 @@ assignees: ''
 
 ---
 
-<!--
-Do NOT report Security Vulnerabilities here. Please use https://github.com/spring-projects/spring-security/security/policy
--->
-
 **Describe the bug**
 A clear and concise description of what the bug is.
 

.github/workflows/continuous-integration-workflow.yml

@@ -40,8 +40,8 @@ jobs:
           # Extract version from gradle.properties
           version=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
           echo "project_version=$version" >>$GITHUB_OUTPUT
-  build_jdk_17:
-    name: Build JDK 17
+  build_jdk_11:
+    name: Build JDK 11
     needs: [prerequisites]
     strategy:
       matrix:
@@ -50,11 +50,11 @@ jobs:
     if: needs.prerequisites.outputs.runjobs
     steps:
       - uses: actions/checkout@v3
-      - name: Set up JDK 17
+      - name: Set up JDK 11
         uses: actions/setup-java@v3
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
           cache: 'gradle'
       - name: Set up Gradle
         uses: gradle/gradle-build-action@v2
@@ -76,8 +76,8 @@ jobs:
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Snapshot Tests
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -94,8 +94,8 @@ jobs:
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Check samples project
         env:
           LOCAL_REPOSITORY_PATH: ${{ github.workspace }}/build/publications/repos
@@ -118,8 +118,8 @@ jobs:
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Check for package tangles
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -128,15 +128,15 @@ jobs:
           ./gradlew check s101 -Ps101.licenseId="$STRUCTURE101_LICENSEID" --stacktrace
   deploy_artifacts:
     name: Deploy Artifacts
-    needs: [build_jdk_17, snapshot_tests, check_samples, check_tangles]
+    needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Deploy artifacts
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -152,15 +152,15 @@ jobs:
           ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
   deploy_docs:
     name: Deploy Docs
-    needs: [build_jdk_17, snapshot_tests, check_samples, check_tangles]
+    needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Deploy Docs
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -173,15 +173,15 @@ jobs:
           DOCS_HOST: ${{ secrets.DOCS_HOST }}
   deploy_schema:
     name: Deploy Schema
-    needs: [build_jdk_17, snapshot_tests, check_samples, check_tangles]
+    needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Deploy Schema
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -212,8 +212,8 @@ jobs:
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Wait for Artifactory Artifacts
         if: ${{ contains(needs.prerequisites.outputs.project_version, '-RC') || contains(needs.prerequisites.outputs.project_version, '-M') }}
         run: |
@@ -291,8 +291,8 @@ jobs:
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Schedule next release (if not already scheduled)
         run: ./gradlew scheduleNextRelease -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
   notify_result:

.github/workflows/pr-build-workflow.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - name: Build with Gradle
         run: ./gradlew clean build --continue --scan

.github/workflows/rebuild-search-index.yml

@@ -1,20 +0,0 @@
-name: Rebuild Search Index
-on:
-  schedule:
-  - cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch:
-permissions: read-all
-jobs:
-  build:
-    if: github.repository_owner == 'spring-projects'
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-      with:
-        ref: docs-build
-        fetch-depth: 1
-    - name: Dispatch
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run rebuild-search-index.yml -r $(git rev-parse --abbrev-ref HEAD)

.github/workflows/release-scheduler.yml

@@ -1,24 +0,0 @@
-name: Release Scheduler
-on:
-  schedule:
-  - cron: '15 15 * * MON' # Every Monday at 3:15pm UTC
-  workflow_dispatch:
-permissions: read-all
-jobs:
-  dispatch_scheduled_releases:
-    name: Dispatch scheduled releases
-    if: github.repository_owner == 'spring-projects'
-    strategy:
-      matrix:
-        # List of active maintenance branches.
-        branch: [ main, 6.0.x, 5.8.x, 5.7.x, 5.6.x ]
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 1
-    - name: Dispatch
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run update-scheduled-release-version.yml -r ${{ matrix.branch }}

.github/workflows/update-scheduled-release-version.yml

@@ -29,8 +29,8 @@ jobs:
       - name: Set up gradle
         uses: spring-io/spring-gradle-build-action@v1
         with:
-          java-version: '17'
-          distribution: 'temurin'
+          java-version: '11'
+          distribution: 'adopt'
       - id: check-release-due
         name: Check Release Due
         run: |

.sdkmanrc

@@ -3,4 +3,4 @@
 # See https://sdkman.io/usage#config
 # A summary is to add the following to ~/.sdkman/etc/config
 # sdkman_auto_env=true
-java=17.0.3-tem
+java=11.0.14-tem

README.adoc

@@ -6,8 +6,8 @@ image:https://img.shields.io/badge/Revved%20up%20by-Gradle%20Enterprise-06A0CE?l
 
 = Spring Security
 
-Spring Security provides security services for the https://docs.spring.io[Spring IO Platform]. Spring Security 6.0 requires Spring 6.0 as
-a minimum and also requires Java 17.
+Spring Security provides security services for the https://docs.spring.io[Spring IO Platform]. Spring Security 5.0 requires Spring 5.0 as
+a minimum and also requires Java 8.
 
 For a detailed list of features and access to the latest release, please visit https://spring.io/projects[Spring projects].
 
@@ -30,9 +30,9 @@ In the instructions below, https://vimeo.com/34436402[`./gradlew`] is invoked fr
 a cross-platform, self-contained bootstrap mechanism for the build.
 
 === Prerequisites
-https://docs.github.com/en/get-started/quickstart/set-up-git[Git] and the https://www.oracle.com/java/technologies/downloads/#java17[JDK17 build].
+https://help.github.com/set-up-git-redirect[Git] and the https://www.oracle.com/technetwork/java/javase/downloads[JDK11 build].
 
-Be sure that your `JAVA_HOME` environment variable points to the `jdk-17` folder extracted from the JDK download.
+Be sure that your `JAVA_HOME` environment variable points to the `jdk-11` folder extracted from the JDK download.
 
 === Check out sources
 [indent=0]
@@ -40,38 +40,27 @@ Be sure that your `JAVA_HOME` environment variable points to the `jdk-17` folder
 git clone git@github.com:spring-projects/spring-security.git
 ----
 
-=== Install all `spring-*.jar` into your local Maven repository.
-
+=== Install all spring-\* jars into your local Maven cache
 [indent=0]
 ----
 ./gradlew publishToMavenLocal
 ----
 
-=== Compile and test; build all JARs, distribution zips, and docs
-
+=== Compile and test; build all jars, distribution zips, and docs
 [indent=0]
 ----
 ./gradlew build
 ----
 
-The reference docs are not currently included in the distribution zip.
-You can build the reference docs for this branch by running the following command:
-
-----
-./gradlew :spring-security-docs:antora
-----
-
-That command publishes the docs site to the `_docs/build/site_` directory.
-The https://github.com/spring-projects/spring-security/tree/docs-build[playbook branch] describes how to build the reference docs in detail.
-
 Discover more commands with `./gradlew tasks`.
+See also the https://github.com/spring-projects/spring-framework/wiki/Gradle-build-and-release-FAQ[Gradle build and release FAQ].
 
 == Getting Support
 Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
 https://spring.io/services[Commercial support] is available too.
 
 == Contributing
-https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/main/CONTRIBUTING.adoc[contributor guidelines] for details.
+https://help.github.com/articles/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/main/CONTRIBUTING.adoc[contributor guidelines] for details.
 
 == License
 Spring Security is Open Source software released under the

RELEASE.adoc

@@ -1,89 +1,4 @@
-= Release Process
-
-The release process for Spring Security is partially automated. The following table outlines which steps are automated and which are manual. Follow the links to read about each step.
-
-[cols="1,1"]
-|===
-| Step | Status
-
-| <<update-dependencies>>
-| :x: manual
-
-| <<check-all-issues-are-closed>>
-| :white_check_mark: automated (scheduled release will abort if any issues are open)
-
-| <<update-release-version>>
-| :white_check_mark: automated
-
-| <<update-antora-version>>
-| :white_check_mark: automated
-
-| <<build-locally>>
-| :x: manual (when updating dependencies)
-
-| <<push-release-commit>>
-| :white_check_mark: automated
-
-| <<announce-release-on-slack>>
-| :white_check_mark: automated
-
-| <<tag-release>>
-| :white_check_mark: automated
-
-| <<update-to-next-development-version>>
-| :white_check_mark: automated
-
-| <<update-version-on-project-page>>
-| :x: manual
-
-| <<update-release-notes-on-github>>
-| :white_check_mark: automated
-
-| <<close-create-milestone,Close milestone>>
-| :x: manual (move issues to new milestone before release)
-
-| <<close-create-milestone,Create milestone>>
-| :white_check_mark: automated (if not already created)
-
-| <<announce-release-on-other-channels>>
-| :x: manual
-|===
-
-*When should I update dependencies manually?* Dependencies should be updated at the latest the end of the week prior to the release. This is usually the Friday following the 2nd Monday of the month (counting from the first week with a Monday). When in doubt, check the https://github.com/spring-projects/spring-security/milestones[milestones] page for release due dates.
-
-*When do scheduled releases occur?* Automated releases are scheduled to occur at *3:15 PM UTC* on the *3rd Monday of the month* (counting from the first week with a Monday).
-
-[NOTE]
-The scheduled release process currently runs every Monday but only releases when a release is due. See the performed checks below for more information.
-
-The automated release process occurs on the following branches:
-
-* `main`
-* `5.8.x`
-* `5.7.x`
-* `5.6.x`
-
-For each of the above branches, the automated process performs the following checks before proceeding with the release:
-
-1. _Check if the milestone is due today._ This check compares the current (SNAPSHOT) version of the branch with available milestones and chooses the first match (sorted alphabetically). If the due date on the matched milestone is *not* today, the process stops.
-2. _Check if all issues are closed._ This check uses the milestone from the previous step and looks for open issues. If any open issues are found, the process stops.
-
-[IMPORTANT]
-You should ensure all issues are closed or moved to another milestone prior to a scheduled release.
-
-If the above checks pass, the version number is updated (in `gradle.properties` and `antora.yml`) and a commit is pushed to trigger the CI process.
-
-*How do I trigger a release manually?* You can trigger a release manually in two ways:
-
-1. Trigger a release for a particular branch via https://github.com/spring-projects/spring-security/actions/workflows/update-scheduled-release-version.yml[`update-scheduled-release-version.yml`] on the desired branch. The above checks are performed for that branch, and the release will proceed if all checks pass. _This is the recommended way to trigger a release that did not pass the above checks during a regularly scheduled release._
-2. Trigger releases for all branches via https://github.com/spring-projects/spring-security/actions/workflows/release-scheduler.yml[`release-scheduler.yml`] on the `main` branch. The above checks are performed for each branch, and only releases that pass all checks will proceed.
-
-*When should additional manual steps be performed?* All other automated steps listed above occur during the normal CI process. Additional manual steps can be performed at any time once the builds pass and releases are finished.
-
-*What if something goes wrong?* If the normal CI process fails, you can retry by re-running the failed jobs with the "Re-run failed jobs" option in GitHub Actions. If changes are required, you should revert the "Release x.y.z" commit, delete the tag, and proceed manually.
-
-[#update-dependencies]
-== Update dependencies
+= Update Dependencies
 
 Ensure you have no changes in your local repository.
 Change to a new branch.
@@ -144,8 +59,7 @@ $ ./gradlew updateDependencies -PupdateMode=GITHUB_ISSUE -PgitHubAccessToken=<gi
 
 Apply any fixes from your previous branch that were necessary.
 
-[#check-all-issues-are-closed]
-== Check all issues are closed
+= Check All Issues are Closed
 
 The following command will check if there are any open issues for the ticket.
 Before running the command, replace the following values:
@@ -160,13 +74,11 @@ $ ./gradlew gitHubCheckMilestoneHasNoOpenIssues -PgitHubAccessToken=<github-pers
 
 Alternatively, you can manually check using https://github.com/spring-projects/spring-security/milestones
 
-[#update-release-version]
-== Update release version
+= Update Release Version
 
 Update the version number in `gradle.properties` for the release, for example `5.5.0-M1`, `5.5.0-RC1`, `5.5.0`
 
-[#update-antora-version]
-== Update antora version
+= Update Antora Version
 
 You will need to update the antora.yml version.
 If you are unsure of what the values should be, the following task will instruct you what the expected values are:
@@ -176,8 +88,7 @@ If you are unsure of what the values should be, the following task will instruct
 ./gradlew :spring-security-docs:antoraCheckVersion
 ----
 
-[#build-locally]
-== Build locally
+= Build Locally
 
 Run the build using
 
@@ -186,8 +97,7 @@ Run the build using
 $ ./gradlew check
 ----
 
-[#push-release-commit]
-== Push release commit
+= Push the Release Commit
 
 Push the commit and GitHub actions will build and deploy the artifacts
 If you are pushing to Maven Central, then you can get notified when it’s uploaded by running the following:
@@ -197,8 +107,7 @@ If you are pushing to Maven Central, then you can get notified when it’s uploa
 $ ./scripts/release/wait-for-done.sh 5.5.0
 ----
 
-[#announce-release-on-slack]
-== Announce release on Slack
+= Announce the release on Slack
 
 * Announce via Slack on
 https://pivotal.slack.com/messages/spring-release[#spring-release],
@@ -209,8 +118,7 @@ Something like:
 spring-security-announcing 5.5.0 is available.
 ....
 
-[#tag-release]
-== Tag release
+= Tag the release
 
 * Tag the release and then push the tag
 
@@ -219,13 +127,11 @@ git tag 5.4.0-RC1
 git push origin 5.4.0-RC1
 ....
 
-[#update-to-next-development-version]
-== Update to next development version
+== 7. Update to Next Development Version
 
 * Update `gradle.properties` version to next `+SNAPSHOT+` version, update antora.yml, and then push
 
-[#update-version-on-project-page]
-== Update version on project page
+== 8. Update version on project page
 
 The following command will update https://spring.io/projects/spring-security#learn with the new release version using the following parameters
 
@@ -238,8 +144,9 @@ The following command will update https://spring.io/projects/spring-security#lea
 $ ./gradlew saganCreateRelease saganDeleteRelease -PgitHubAccessToken=<github-personal-access-token> -PnextVersion=<next-version> -PpreviousVersion=<previous-version>
 ----
 
-[#update-release-notes-on-github]
-== Update release notes on GitHub
+
+
+== 9. Update Release Notes on GitHub
 
 Generate the Release Notes replacing:
 
@@ -260,8 +167,7 @@ cat build/changelog/release-notes.md | xclip -selection clipboard
 https://github.com/spring-projects/spring-security/releases[release on
 GitHub], associate it with the tag, and paste the generated notes
 
-[#close-create-milestone]
-== Close / Create milestone
+== 10. Close / Create Milestone
 
 * In
 https://github.com/spring-projects/spring-security/milestones[GitHub
@@ -270,8 +176,7 @@ Milestones], create a new milestone for the next release version
 the new milestone
 * Close the milestone for the release.
 
-[#announce-release-on-other-channels]
-== Announce release on other channels
+== 11. Announce the release on other channels
 
 * Create a https://spring.io/admin/blog[Blog]
 * Tweet from [@SpringSecurity](https://twitter.com/springsecurity)

acl/spring-security-acl.gradle

@@ -9,6 +9,8 @@ dependencies {
 	api 'org.springframework:spring-jdbc'
 	api 'org.springframework:spring-tx'
 
+	optional 'net.sf.ehcache:ehcache'
+
 	testImplementation "org.assertj:assertj-core"
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testImplementation "org.junit.jupiter:junit-jupiter-params"

acl/src/main/java/org/springframework/security/acls/domain/EhCacheBasedAclCache.java

@@ -0,0 +1,141 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.domain;
+
+import java.io.Serializable;
+
+import net.sf.ehcache.CacheException;
+import net.sf.ehcache.Ehcache;
+import net.sf.ehcache.Element;
+
+import org.springframework.security.acls.model.AclCache;
+import org.springframework.security.acls.model.MutableAcl;
+import org.springframework.security.acls.model.ObjectIdentity;
+import org.springframework.security.acls.model.PermissionGrantingStrategy;
+import org.springframework.security.util.FieldUtils;
+import org.springframework.util.Assert;
+
+/**
+ * Simple implementation of {@link AclCache} that delegates to EH-CACHE.
+ * <p>
+ * Designed to handle the transient fields in {@link AclImpl}. Note that this
+ * implementation assumes all {@link AclImpl} instances share the same
+ * {@link PermissionGrantingStrategy} and {@link AclAuthorizationStrategy} instances.
+ *
+ * @author Ben Alex
+ * @deprecated since 5.6. In favor of JCache based implementations
+ */
+@Deprecated
+public class EhCacheBasedAclCache implements AclCache {
+
+	private final Ehcache cache;
+
+	private PermissionGrantingStrategy permissionGrantingStrategy;
+
+	private AclAuthorizationStrategy aclAuthorizationStrategy;
+
+	public EhCacheBasedAclCache(Ehcache cache, PermissionGrantingStrategy permissionGrantingStrategy,
+			AclAuthorizationStrategy aclAuthorizationStrategy) {
+		Assert.notNull(cache, "Cache required");
+		Assert.notNull(permissionGrantingStrategy, "PermissionGrantingStrategy required");
+		Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
+		this.cache = cache;
+		this.permissionGrantingStrategy = permissionGrantingStrategy;
+		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
+	}
+
+	@Override
+	public void evictFromCache(Serializable pk) {
+		Assert.notNull(pk, "Primary key (identifier) required");
+		MutableAcl acl = getFromCache(pk);
+		if (acl != null) {
+			this.cache.remove(acl.getId());
+			this.cache.remove(acl.getObjectIdentity());
+		}
+	}
+
+	@Override
+	public void evictFromCache(ObjectIdentity objectIdentity) {
+		Assert.notNull(objectIdentity, "ObjectIdentity required");
+		MutableAcl acl = getFromCache(objectIdentity);
+		if (acl != null) {
+			this.cache.remove(acl.getId());
+			this.cache.remove(acl.getObjectIdentity());
+		}
+	}
+
+	@Override
+	public MutableAcl getFromCache(ObjectIdentity objectIdentity) {
+		Assert.notNull(objectIdentity, "ObjectIdentity required");
+		try {
+			Element element = this.cache.get(objectIdentity);
+			return (element != null) ? initializeTransientFields((MutableAcl) element.getValue()) : null;
+		}
+		catch (CacheException ex) {
+			return null;
+		}
+	}
+
+	@Override
+	public MutableAcl getFromCache(Serializable pk) {
+		Assert.notNull(pk, "Primary key (identifier) required");
+		try {
+			Element element = this.cache.get(pk);
+			return (element != null) ? initializeTransientFields((MutableAcl) element.getValue()) : null;
+		}
+		catch (CacheException ex) {
+			return null;
+		}
+	}
+
+	@Override
+	public void putInCache(MutableAcl acl) {
+		Assert.notNull(acl, "Acl required");
+		Assert.notNull(acl.getObjectIdentity(), "ObjectIdentity required");
+		Assert.notNull(acl.getId(), "ID required");
+		if (this.aclAuthorizationStrategy == null) {
+			if (acl instanceof AclImpl) {
+				this.aclAuthorizationStrategy = (AclAuthorizationStrategy) FieldUtils
+						.getProtectedFieldValue("aclAuthorizationStrategy", acl);
+				this.permissionGrantingStrategy = (PermissionGrantingStrategy) FieldUtils
+						.getProtectedFieldValue("permissionGrantingStrategy", acl);
+			}
+		}
+		if ((acl.getParentAcl() != null) && (acl.getParentAcl() instanceof MutableAcl)) {
+			putInCache((MutableAcl) acl.getParentAcl());
+		}
+		this.cache.put(new Element(acl.getObjectIdentity(), acl));
+		this.cache.put(new Element(acl.getId(), acl));
+	}
+
+	private MutableAcl initializeTransientFields(MutableAcl value) {
+		if (value instanceof AclImpl) {
+			FieldUtils.setProtectedFieldValue("aclAuthorizationStrategy", value, this.aclAuthorizationStrategy);
+			FieldUtils.setProtectedFieldValue("permissionGrantingStrategy", value, this.permissionGrantingStrategy);
+		}
+		if (value.getParentAcl() != null) {
+			initializeTransientFields((MutableAcl) value.getParentAcl());
+		}
+		return value;
+	}
+
+	@Override
+	public void clearCache() {
+		this.cache.removeAll();
+	}
+
+}

acl/src/test/java/org/springframework/security/acls/jdbc/AbstractBasicLookupStrategyTests.java

@@ -16,7 +16,6 @@
 
 package org.springframework.security.acls.jdbc;
 
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
@@ -24,15 +23,15 @@ import java.util.UUID;
 
 import javax.sql.DataSource;
 
+import net.sf.ehcache.Cache;
+import net.sf.ehcache.CacheManager;
+import net.sf.ehcache.Ehcache;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
-import org.springframework.cache.Cache;
-import org.springframework.cache.CacheManager;
-import org.springframework.cache.concurrent.ConcurrentMapCache;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.security.acls.TargetObject;
 import org.springframework.security.acls.TargetObjectWithUUID;
@@ -42,10 +41,10 @@ import org.springframework.security.acls.domain.BasePermission;
 import org.springframework.security.acls.domain.ConsoleAuditLogger;
 import org.springframework.security.acls.domain.DefaultPermissionFactory;
 import org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy;
+import org.springframework.security.acls.domain.EhCacheBasedAclCache;
 import org.springframework.security.acls.domain.GrantedAuthoritySid;
 import org.springframework.security.acls.domain.ObjectIdentityImpl;
 import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.domain.SpringCacheBasedAclCache;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AuditableAccessControlEntry;
 import org.springframework.security.acls.model.MutableAcl;
@@ -56,8 +55,6 @@ import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
 
 /**
  * Tests {@link BasicLookupStrategy}
@@ -78,7 +75,7 @@ public abstract class AbstractBasicLookupStrategyTests {
 
 	private BasicLookupStrategy strategy;
 
-	private static CacheManagerMock cacheManager;
+	private static CacheManager cacheManager;
 
 	public abstract JdbcTemplate getJdbcTemplate();
 
@@ -86,13 +83,14 @@ public abstract class AbstractBasicLookupStrategyTests {
 
 	@BeforeAll
 	public static void initCacheManaer() {
-		cacheManager = new CacheManagerMock();
-		cacheManager.addCache("basiclookuptestcache");
+		cacheManager = CacheManager.create();
+		cacheManager.addCache(new Cache("basiclookuptestcache", 500, false, false, 30, 30));
 	}
 
 	@AfterAll
 	public static void shutdownCacheManager() {
-		cacheManager.clear();
+		cacheManager.removalAll();
+		cacheManager.shutdown();
 	}
 
 	@BeforeEach
@@ -120,17 +118,11 @@ public abstract class AbstractBasicLookupStrategyTests {
 		return new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_ADMINISTRATOR"));
 	}
 
-	protected SpringCacheBasedAclCache aclCache() {
-		return new SpringCacheBasedAclCache(getCache(), new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()),
+	protected EhCacheBasedAclCache aclCache() {
+		return new EhCacheBasedAclCache(getCache(), new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()),
 				new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_USER")));
 	}
 
-	protected Cache getCache() {
-		Cache cache = cacheManager.getCacheManager().getCache("basiclookuptestcache");
-		cache.clear();
-		return cache;
-	}
-
 	@AfterEach
 	public void emptyDatabase() {
 		String query = "DELETE FROM acl_entry;" + "DELETE FROM acl_object_identity WHERE ID = 9;"
@@ -142,6 +134,12 @@ public abstract class AbstractBasicLookupStrategyTests {
 		getJdbcTemplate().execute(query);
 	}
 
+	protected Ehcache getCache() {
+		Ehcache cache = cacheManager.getCache("basiclookuptestcache");
+		cache.removeAll();
+		return cache;
+	}
+
 	@Test
 	public void testAclsRetrievalWithDefaultBatchSize() throws Exception {
 		ObjectIdentity topParentOid = new ObjectIdentityImpl(TARGET_CLASS, 100L);
@@ -329,32 +327,4 @@ public abstract class AbstractBasicLookupStrategyTests {
 		// @formatter:on
 	}
 
-	private static final class CacheManagerMock {
-
-		private final List<String> cacheNames;
-
-		private final CacheManager cacheManager;
-
-		private CacheManagerMock() {
-			this.cacheNames = new ArrayList<>();
-			this.cacheManager = mock(CacheManager.class);
-			given(this.cacheManager.getCacheNames()).willReturn(this.cacheNames);
-		}
-
-		private CacheManager getCacheManager() {
-			return this.cacheManager;
-		}
-
-		private void addCache(String name) {
-			this.cacheNames.add(name);
-			Cache cache = new ConcurrentMapCache(name);
-			given(this.cacheManager.getCache(name)).willReturn(cache);
-		}
-
-		private void clear() {
-			this.cacheNames.clear();
-		}
-
-	}
-
 }

acl/src/test/java/org/springframework/security/acls/jdbc/EhCacheBasedAclCacheTests.java

@@ -0,0 +1,223 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.jdbc;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.util.List;
+
+import net.sf.ehcache.Ehcache;
+import net.sf.ehcache.Element;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import org.springframework.security.acls.domain.AclAuthorizationStrategy;
+import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
+import org.springframework.security.acls.domain.AclImpl;
+import org.springframework.security.acls.domain.ConsoleAuditLogger;
+import org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy;
+import org.springframework.security.acls.domain.EhCacheBasedAclCache;
+import org.springframework.security.acls.domain.ObjectIdentityImpl;
+import org.springframework.security.acls.model.MutableAcl;
+import org.springframework.security.acls.model.ObjectIdentity;
+import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.util.FieldUtils;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+
+/**
+ * Tests {@link EhCacheBasedAclCache}
+ *
+ * @author Andrei Stefan
+ */
+@ExtendWith(MockitoExtension.class)
+public class EhCacheBasedAclCacheTests {
+
+	private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";
+
+	@Mock
+	private Ehcache cache;
+
+	@Captor
+	private ArgumentCaptor<Element> element;
+
+	private EhCacheBasedAclCache myCache;
+
+	private MutableAcl acl;
+
+	@BeforeEach
+	public void setup() {
+		this.myCache = new EhCacheBasedAclCache(this.cache,
+				new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()),
+				new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_USER")));
+		ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, 100L);
+		AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
+				new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
+				new SimpleGrantedAuthority("ROLE_GENERAL"));
+		this.acl = new AclImpl(identity, 1L, aclAuthorizationStrategy, new ConsoleAuditLogger());
+	}
+
+	@AfterEach
+	public void cleanup() {
+		SecurityContextHolder.clearContext();
+	}
+
+	@Test
+	public void constructorRejectsNullParameters() {
+		assertThatIllegalArgumentException().isThrownBy(
+				() -> new EhCacheBasedAclCache(null, new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()),
+						new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_USER"))));
+	}
+
+	@Test
+	public void methodsRejectNullParameters() {
+		assertThatIllegalArgumentException().isThrownBy(() -> this.myCache.evictFromCache((Serializable) null));
+		assertThatIllegalArgumentException().isThrownBy(() -> this.myCache.evictFromCache((ObjectIdentity) null));
+		assertThatIllegalArgumentException().isThrownBy(() -> this.myCache.getFromCache((Serializable) null));
+		assertThatIllegalArgumentException().isThrownBy(() -> this.myCache.getFromCache((ObjectIdentity) null));
+		assertThatIllegalArgumentException().isThrownBy(() -> this.myCache.putInCache(null));
+	}
+
+	// SEC-527
+	@Test
+	public void testDiskSerializationOfMutableAclObjectInstance() throws Exception {
+		// Serialization test
+		File file = File.createTempFile("SEC_TEST", ".object");
+		FileOutputStream fos = new FileOutputStream(file);
+		ObjectOutputStream oos = new ObjectOutputStream(fos);
+		oos.writeObject(this.acl);
+		oos.close();
+		FileInputStream fis = new FileInputStream(file);
+		ObjectInputStream ois = new ObjectInputStream(fis);
+		MutableAcl retrieved = (MutableAcl) ois.readObject();
+		ois.close();
+		assertThat(retrieved).isEqualTo(this.acl);
+		Object retrieved1 = FieldUtils.getProtectedFieldValue("aclAuthorizationStrategy", retrieved);
+		assertThat(retrieved1).isNull();
+		Object retrieved2 = FieldUtils.getProtectedFieldValue("permissionGrantingStrategy", retrieved);
+		assertThat(retrieved2).isNull();
+	}
+
+	@Test
+	public void clearCache() {
+		this.myCache.clearCache();
+		verify(this.cache).removeAll();
+	}
+
+	@Test
+	public void putInCache() {
+		this.myCache.putInCache(this.acl);
+		verify(this.cache, times(2)).put(this.element.capture());
+		assertThat(this.element.getValue().getKey()).isEqualTo(this.acl.getId());
+		assertThat(this.element.getValue().getObjectValue()).isEqualTo(this.acl);
+		assertThat(this.element.getAllValues().get(0).getKey()).isEqualTo(this.acl.getObjectIdentity());
+		assertThat(this.element.getAllValues().get(0).getObjectValue()).isEqualTo(this.acl);
+	}
+
+	@Test
+	public void putInCacheAclWithParent() {
+		Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_GENERAL");
+		auth.setAuthenticated(true);
+		SecurityContextHolder.getContext().setAuthentication(auth);
+		ObjectIdentity identityParent = new ObjectIdentityImpl(TARGET_CLASS, 2L);
+		AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
+				new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
+				new SimpleGrantedAuthority("ROLE_GENERAL"));
+		MutableAcl parentAcl = new AclImpl(identityParent, 2L, aclAuthorizationStrategy, new ConsoleAuditLogger());
+		this.acl.setParent(parentAcl);
+		this.myCache.putInCache(this.acl);
+		verify(this.cache, times(4)).put(this.element.capture());
+		List<Element> allValues = this.element.getAllValues();
+		assertThat(allValues.get(0).getKey()).isEqualTo(parentAcl.getObjectIdentity());
+		assertThat(allValues.get(0).getObjectValue()).isEqualTo(parentAcl);
+		assertThat(allValues.get(1).getKey()).isEqualTo(parentAcl.getId());
+		assertThat(allValues.get(1).getObjectValue()).isEqualTo(parentAcl);
+		assertThat(allValues.get(2).getKey()).isEqualTo(this.acl.getObjectIdentity());
+		assertThat(allValues.get(2).getObjectValue()).isEqualTo(this.acl);
+		assertThat(allValues.get(3).getKey()).isEqualTo(this.acl.getId());
+		assertThat(allValues.get(3).getObjectValue()).isEqualTo(this.acl);
+	}
+
+	@Test
+	public void getFromCacheSerializable() {
+		given(this.cache.get(this.acl.getId())).willReturn(new Element(this.acl.getId(), this.acl));
+		assertThat(this.myCache.getFromCache(this.acl.getId())).isEqualTo(this.acl);
+	}
+
+	@Test
+	public void getFromCacheSerializablePopulatesTransient() {
+		given(this.cache.get(this.acl.getId())).willReturn(new Element(this.acl.getId(), this.acl));
+		this.myCache.putInCache(this.acl);
+		ReflectionTestUtils.setField(this.acl, "permissionGrantingStrategy", null);
+		ReflectionTestUtils.setField(this.acl, "aclAuthorizationStrategy", null);
+		MutableAcl fromCache = this.myCache.getFromCache(this.acl.getId());
+		assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
+		assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
+	}
+
+	@Test
+	public void getFromCacheObjectIdentity() {
+		given(this.cache.get(this.acl.getId())).willReturn(new Element(this.acl.getId(), this.acl));
+		assertThat(this.myCache.getFromCache(this.acl.getId())).isEqualTo(this.acl);
+	}
+
+	@Test
+	public void getFromCacheObjectIdentityPopulatesTransient() {
+		given(this.cache.get(this.acl.getObjectIdentity())).willReturn(new Element(this.acl.getId(), this.acl));
+		this.myCache.putInCache(this.acl);
+		ReflectionTestUtils.setField(this.acl, "permissionGrantingStrategy", null);
+		ReflectionTestUtils.setField(this.acl, "aclAuthorizationStrategy", null);
+		MutableAcl fromCache = this.myCache.getFromCache(this.acl.getObjectIdentity());
+		assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
+		assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
+	}
+
+	@Test
+	public void evictCacheSerializable() {
+		given(this.cache.get(this.acl.getObjectIdentity())).willReturn(new Element(this.acl.getId(), this.acl));
+		this.myCache.evictFromCache(this.acl.getObjectIdentity());
+		verify(this.cache).remove(this.acl.getId());
+		verify(this.cache).remove(this.acl.getObjectIdentity());
+	}
+
+	@Test
+	public void evictCacheObjectIdentity() {
+		given(this.cache.get(this.acl.getId())).willReturn(new Element(this.acl.getId(), this.acl));
+		this.myCache.evictFromCache(this.acl.getId());
+		verify(this.cache).remove(this.acl.getId());
+		verify(this.cache).remove(this.acl.getObjectIdentity());
+	}
+
+}

acl/src/test/resources/jdbcMutableAclServiceTests-context.xml

@@ -13,10 +13,16 @@
 		<property name="dataSource" ref="dataSource"/>
 	</bean>
 
-	<bean id="aclCache" class="org.springframework.security.acls.domain.SpringCacheBasedAclCache">
+	<bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache">
 		<constructor-arg>
-		   <bean class="org.springframework.cache.concurrent.ConcurrentMapCacheFactoryBean">
-			  <property name="name" value="aclCache"/>
+		   <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
+			  <property name="cacheManager">
+					<bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean">
+						<!-- This context is used in two tests so accept existing cache manager as the context will be reused -->
+						<property name="acceptExisting" value="true"/>
+					</bean>
+			  </property>
+			  <property name="cacheName" value="aclCache"/>
 		   </bean>
 		</constructor-arg>
 		<constructor-arg>

aspects/spring-security-aspects.gradle

@@ -1,15 +1,6 @@
 apply plugin: 'io.spring.convention.spring-module'
 apply plugin: 'io.freefair.aspectj'
 
-compileAspectj {
-	sourceCompatibility "17"
-	targetCompatibility "17"
-}
-compileTestAspectj {
-	sourceCompatibility "17"
-	targetCompatibility "17"
-}
-
 dependencies {
 	management platform(project(":spring-security-dependencies"))
 	api "org.aspectj:aspectjrt"

build.gradle

@@ -4,13 +4,12 @@ buildscript {
 	dependencies {
 		classpath "io.spring.javaformat:spring-javaformat-gradle-plugin:$springJavaformatVersion"
 		classpath 'io.spring.nohttp:nohttp-gradle:0.0.11'
-		classpath "io.freefair.gradle:aspectj-plugin:6.6-rc1"
+		classpath "io.freefair.gradle:aspectj-plugin:6.5.1"
 		classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinVersion"
 		classpath "com.netflix.nebula:nebula-project-plugin:8.2.0"
 	}
 	repositories {
-		maven { url 'https://repo.spring.io/plugins-snapshot' }
-		maven { url 'https://plugins.gradle.org/m2/' }
+		gradlePluginPortal()
 	}
 }
 
@@ -104,6 +103,7 @@ updateDependenciesSettings {
 	dependencyExcludes {
 		majorVersionBump()
 		minorVersionBump()
+		releaseCandidatesVersions()
 		alphaBetaVersions()
 		snapshotVersions()
 		addRule { components ->
@@ -119,13 +119,27 @@ updateDependenciesSettings {
 					selection.reject("nimbus-jose-jwt gets updated when oauth2-oidc-sdk is updated to ensure consistency");
 				}
 			}
+			components.withModule("io.mockk:mockk") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("mockk updates break tests");
+				}
+			}
+			components.all { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				// Do not compare version due to multiple versions existing
+				// will cause opensaml 3.x to be updated to 4.x
+				if (candidate.getGroup().equals("org.opensaml")) {
+					selection.reject("org.opensaml maintains two different versions, so it must be updated manually");
+				}
+			}
 		}
 	}
 }
 
 subprojects {
 	plugins.withType(JavaPlugin) {
-		project.sourceCompatibility=JavaVersion.VERSION_17
+		project.sourceCompatibility='1.8'
 	}
 	tasks.withType(JavaCompile) {
 		options.encoding = "UTF-8"
@@ -161,7 +175,7 @@ allprojects {
 
 	tasks.withType(JavaCompile).configureEach {
 		javaCompiler = javaToolchains.compilerFor {
-			languageVersion = JavaLanguageVersion.of(17)
+			languageVersion = JavaLanguageVersion.of(8)
 		}
 	}
 }

buildSrc/build.gradle

@@ -5,7 +5,7 @@ plugins {
 	id 'com.apollographql.apollo' version '2.4.5'
 }
 
-sourceCompatibility = JavaVersion.VERSION_17
+sourceCompatibility = 1.8
 
 repositories {
 	gradlePluginPortal()
@@ -87,7 +87,7 @@ dependencies {
 	implementation localGroovy()
 
 	implementation 'io.github.gradle-nexus:publish-plugin:1.1.0'
-	implementation 'io.projectreactor:reactor-core:3.5.3'
+	implementation 'io.projectreactor:reactor-core:3.5.0-M1'
 	implementation 'org.gretty:gretty:3.0.9'
 	implementation 'com.apollographql.apollo:apollo-runtime:2.4.5'
 	implementation 'com.github.ben-manes:gradle-versions-plugin:0.38.0'

buildSrc/src/main/groovy/io/spring/gradle/convention/JacocoPlugin.groovy

@@ -34,7 +34,7 @@ class JacocoPlugin implements Plugin<Project> {
 			project.tasks.check.dependsOn project.tasks.jacocoTestReport
 
 			project.jacoco {
-				toolVersion = '0.8.7'
+				toolVersion = '0.8.2'
 			}
 		}
 	}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestoneApi.java

@@ -17,14 +17,10 @@
 package org.springframework.gradle.github.milestones;
 
 import java.io.IOException;
-import java.time.Instant;
 import java.time.LocalDate;
 import java.time.LocalDateTime;
-import java.time.ZoneId;
-import java.time.ZoneOffset;
 import java.util.List;
 import java.util.Optional;
-import java.util.TimeZone;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestoneHasNoOpenIssuesTask.java

@@ -70,7 +70,7 @@ public abstract class GitHubMilestoneHasNoOpenIssuesTask extends DefaultTask {
 		long milestoneNumber = this.milestones.findMilestoneNumberByTitle(this.repository, this.milestoneTitle);
 		boolean isOpenIssues = this.milestones.isOpenIssuesForMilestoneNumber(this.repository, milestoneNumber);
 		Path isOpenIssuesPath = getIsOpenIssuesFile().getAsFile().get().toPath();
-		Files.writeString(isOpenIssuesPath, String.valueOf(isOpenIssues));
+		Files.write(isOpenIssuesPath, String.valueOf(isOpenIssues).getBytes());
 		if (isOpenIssues) {
 			System.out.println("The repository " + this.repository + " has open issues for milestone with the title " + this.milestoneTitle + " and number " + milestoneNumber);
 		}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestonePlugin.java

@@ -16,13 +16,10 @@
 
 package org.springframework.gradle.github.milestones;
 
-import org.gradle.api.Action;
 import org.gradle.api.Plugin;
 import org.gradle.api.Project;
 import org.gradle.api.tasks.TaskProvider;
 
-import org.springframework.gradle.github.RepositoryRef;
-
 public class GitHubMilestonePlugin implements Plugin<Project> {
 	@Override
 	public void apply(Project project) {

buildSrc/src/main/java/org/springframework/gradle/github/milestones/Milestone.java

@@ -19,7 +19,6 @@ package org.springframework.gradle.github.milestones;
 import com.google.gson.annotations.SerializedName;
 
 import java.time.LocalDateTime;
-import java.util.Date;
 
 /**
  * @author Steve Riesenberg

buildSrc/src/test/java/io/spring/gradle/convention/JavadocApiPluginITest.java

@@ -5,7 +5,6 @@ import org.apache.commons.io.FileUtils;
 import org.gradle.testkit.runner.BuildResult;
 import org.gradle.testkit.runner.TaskOutcome;
 import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -29,7 +28,7 @@ public class JavadocApiPluginITest {
 				.build();
 		assertThat(result.task(":api").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
         File allClasses = new File(testKit.getRootDir(), "build/api/allclasses-noframe.html");
-		File index = new File(testKit.getRootDir(), "build/api/allclasses-index.html");
+		File index = new File(testKit.getRootDir(), "build/api/allclasses.html");
 		File listing = allClasses.exists() ? allClasses : index;
 		String listingText = FileUtils.readFileToString(listing);
 		assertThat(listingText).contains("sample/Api.html");

buildSrc/src/test/java/org/springframework/gradle/github/milestones/GitHubMilestoneApiTests.java

@@ -3,7 +3,6 @@ package org.springframework.gradle.github.milestones;
 import java.nio.charset.Charset;
 import java.time.Instant;
 import java.time.LocalDate;
-import java.time.LocalDateTime;
 import java.time.LocalTime;
 import java.time.ZoneId;
 import java.util.concurrent.TimeUnit;

buildSrc/src/test/resources/samples/integrationtest/withpropdeps/build.gradle

@@ -9,6 +9,6 @@ repositories {
 }
 
 dependencies {
-	optional 'jakarta.servlet:jakarta.servlet-api:5.0.0'
+	optional 'jakarta.servlet:jakarta.servlet-api:3.1.0'
 	testCompile 'junit:junit:4.12'
 }

buildSrc/src/test/resources/samples/integrationtest/withpropdeps/src/integration-test/java/sample/TheTest.java

@@ -1,7 +1,7 @@
 package sample;
 
 import org.junit.Test;
-import jakarta.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequest;
 
 public class TheTest {
 	@Test

cas/spring-security-cas.gradle

@@ -0,0 +1,29 @@
+apply plugin: 'io.spring.convention.spring-module'
+
+dependencies {
+	management platform(project(":spring-security-dependencies"))
+	api project(':spring-security-core')
+	api project(':spring-security-web')
+	api('org.jasig.cas.client:cas-client-core') {
+		exclude group: 'org.glassfish.jaxb', module: 'jaxb-core'
+		exclude group: 'javax.xml.bind', module: 'jaxb-api'
+	}
+	api 'org.springframework:spring-beans'
+	api 'org.springframework:spring-context'
+	api 'org.springframework:spring-core'
+	api 'org.springframework:spring-web'
+
+	optional 'com.fasterxml.jackson.core:jackson-databind'
+	optional 'net.sf.ehcache:ehcache'
+
+	provided 'jakarta.servlet:jakarta.servlet-api'
+
+	testImplementation "org.assertj:assertj-core"
+	testImplementation "org.junit.jupiter:junit-jupiter-api"
+	testImplementation "org.junit.jupiter:junit-jupiter-params"
+	testImplementation "org.junit.jupiter:junit-jupiter-engine"
+	testImplementation "org.mockito:mockito-core"
+	testImplementation "org.mockito:mockito-junit-jupiter"
+	testImplementation "org.springframework:spring-test"
+	testImplementation 'org.skyscreamer:jsonassert'
+}

cas/src/main/java/org/springframework/security/cas/SamlServiceProperties.java

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas;
+
+/**
+ * Sets the appropriate parameters for CAS's implementation of SAML (which is not
+ * guaranteed to be actually SAML compliant).
+ *
+ * @author Scott Battaglia
+ * @since 3.0
+ */
+public final class SamlServiceProperties extends ServiceProperties {
+
+	public static final String DEFAULT_SAML_ARTIFACT_PARAMETER = "SAMLart";
+
+	public static final String DEFAULT_SAML_SERVICE_PARAMETER = "TARGET";
+
+	public SamlServiceProperties() {
+		super.setArtifactParameter(DEFAULT_SAML_ARTIFACT_PARAMETER);
+		super.setServiceParameter(DEFAULT_SAML_SERVICE_PARAMETER);
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/ServiceProperties.java

@@ -0,0 +1,132 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas;
+
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.util.Assert;
+
+/**
+ * Stores properties related to this CAS service.
+ * <p>
+ * Each web application capable of processing CAS tickets is known as a service. This
+ * class stores the properties that are relevant to the local CAS service, being the
+ * application that is being secured by Spring Security.
+ *
+ * @author Ben Alex
+ */
+public class ServiceProperties implements InitializingBean {
+
+	public static final String DEFAULT_CAS_ARTIFACT_PARAMETER = "ticket";
+
+	public static final String DEFAULT_CAS_SERVICE_PARAMETER = "service";
+
+	private String service;
+
+	private boolean authenticateAllArtifacts;
+
+	private boolean sendRenew = false;
+
+	private String artifactParameter = DEFAULT_CAS_ARTIFACT_PARAMETER;
+
+	private String serviceParameter = DEFAULT_CAS_SERVICE_PARAMETER;
+
+	@Override
+	public void afterPropertiesSet() {
+		Assert.hasLength(this.service, "service cannot be empty.");
+		Assert.hasLength(this.artifactParameter, "artifactParameter cannot be empty.");
+		Assert.hasLength(this.serviceParameter, "serviceParameter cannot be empty.");
+	}
+
+	/**
+	 * Represents the service the user is authenticating to.
+	 * <p>
+	 * This service is the callback URL belonging to the local Spring Security System for
+	 * Spring secured application. For example,
+	 *
+	 * <pre>
+	 * https://www.mycompany.com/application/login/cas
+	 * </pre>
+	 * @return the URL of the service the user is authenticating to
+	 */
+	public final String getService() {
+		return this.service;
+	}
+
+	/**
+	 * Indicates whether the <code>renew</code> parameter should be sent to the CAS login
+	 * URL and CAS validation URL.
+	 * <p>
+	 * If <code>true</code>, it will force CAS to authenticate the user again (even if the
+	 * user has previously authenticated). During ticket validation it will require the
+	 * ticket was generated as a consequence of an explicit login. High security
+	 * applications would probably set this to <code>true</code>. Defaults to
+	 * <code>false</code>, providing automated single sign on.
+	 * @return whether to send the <code>renew</code> parameter to CAS
+	 */
+	public final boolean isSendRenew() {
+		return this.sendRenew;
+	}
+
+	public final void setSendRenew(final boolean sendRenew) {
+		this.sendRenew = sendRenew;
+	}
+
+	public final void setService(final String service) {
+		this.service = service;
+	}
+
+	public final String getArtifactParameter() {
+		return this.artifactParameter;
+	}
+
+	/**
+	 * Configures the Request Parameter to look for when attempting to see if a CAS ticket
+	 * was sent from the server.
+	 * @param artifactParameter the id to use. Default is "ticket".
+	 */
+	public final void setArtifactParameter(final String artifactParameter) {
+		this.artifactParameter = artifactParameter;
+	}
+
+	/**
+	 * Configures the Request parameter to look for when attempting to send a request to
+	 * CAS.
+	 * @return the service parameter to use. Default is "service".
+	 */
+	public final String getServiceParameter() {
+		return this.serviceParameter;
+	}
+
+	public final void setServiceParameter(final String serviceParameter) {
+		this.serviceParameter = serviceParameter;
+	}
+
+	public final boolean isAuthenticateAllArtifacts() {
+		return this.authenticateAllArtifacts;
+	}
+
+	/**
+	 * If true, then any non-null artifact (ticket) should be authenticated. Additionally,
+	 * the service will be determined dynamically in order to ensure the service matches
+	 * the expected value for this artifact.
+	 * @param authenticateAllArtifacts
+	 */
+	public final void setAuthenticateAllArtifacts(final boolean authenticateAllArtifacts) {
+		this.authenticateAllArtifacts = authenticateAllArtifacts;
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/CasAssertionAuthenticationToken.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import java.util.ArrayList;
+
+import org.jasig.cas.client.validation.Assertion;
+
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.SpringSecurityCoreVersion;
+
+/**
+ * Temporary authentication object needed to load the user details service.
+ *
+ * @author Scott Battaglia
+ * @since 3.0
+ */
+public final class CasAssertionAuthenticationToken extends AbstractAuthenticationToken {
+
+	private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+
+	private final Assertion assertion;
+
+	private final String ticket;
+
+	public CasAssertionAuthenticationToken(final Assertion assertion, final String ticket) {
+		super(new ArrayList<>());
+		this.assertion = assertion;
+		this.ticket = ticket;
+	}
+
+	@Override
+	public Object getPrincipal() {
+		return this.assertion.getPrincipal().getName();
+	}
+
+	@Override
+	public Object getCredentials() {
+		return this.ticket;
+	}
+
+	public Assertion getAssertion() {
+		return this.assertion;
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationProvider.java

@@ -0,0 +1,244 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.jasig.cas.client.validation.Assertion;
+import org.jasig.cas.client.validation.TicketValidationException;
+import org.jasig.cas.client.validation.TicketValidator;
+
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.context.MessageSource;
+import org.springframework.context.MessageSourceAware;
+import org.springframework.context.support.MessageSourceAccessor;
+import org.springframework.core.log.LogMessage;
+import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.cas.web.CasAuthenticationFilter;
+import org.springframework.security.cas.web.authentication.ServiceAuthenticationDetails;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.SpringSecurityMessageSource;
+import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
+import org.springframework.security.core.authority.mapping.NullAuthoritiesMapper;
+import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper;
+import org.springframework.security.core.userdetails.UserDetailsChecker;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.util.Assert;
+
+/**
+ * An {@link AuthenticationProvider} implementation that integrates with JA-SIG Central
+ * Authentication Service (CAS).
+ * <p>
+ * This <code>AuthenticationProvider</code> is capable of validating
+ * {@link UsernamePasswordAuthenticationToken} requests which contain a
+ * <code>principal</code> name equal to either
+ * {@link CasAuthenticationFilter#CAS_STATEFUL_IDENTIFIER} or
+ * {@link CasAuthenticationFilter#CAS_STATELESS_IDENTIFIER}. It can also validate a
+ * previously created {@link CasAuthenticationToken}.
+ *
+ * @author Ben Alex
+ * @author Scott Battaglia
+ */
+public class CasAuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
+
+	private static final Log logger = LogFactory.getLog(CasAuthenticationProvider.class);
+
+	private AuthenticationUserDetailsService<CasAssertionAuthenticationToken> authenticationUserDetailsService;
+
+	private final UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();
+
+	protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
+
+	private StatelessTicketCache statelessTicketCache = new NullStatelessTicketCache();
+
+	private String key;
+
+	private TicketValidator ticketValidator;
+
+	private ServiceProperties serviceProperties;
+
+	private GrantedAuthoritiesMapper authoritiesMapper = new NullAuthoritiesMapper();
+
+	@Override
+	public void afterPropertiesSet() {
+		Assert.notNull(this.authenticationUserDetailsService, "An authenticationUserDetailsService must be set");
+		Assert.notNull(this.ticketValidator, "A ticketValidator must be set");
+		Assert.notNull(this.statelessTicketCache, "A statelessTicketCache must be set");
+		Assert.hasText(this.key,
+				"A Key is required so CasAuthenticationProvider can identify tokens it previously authenticated");
+		Assert.notNull(this.messages, "A message source must be set");
+	}
+
+	@Override
+	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+		if (!supports(authentication.getClass())) {
+			return null;
+		}
+		if (authentication instanceof UsernamePasswordAuthenticationToken
+				&& (!CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER.equals(authentication.getPrincipal().toString())
+						&& !CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER
+								.equals(authentication.getPrincipal().toString()))) {
+			// UsernamePasswordAuthenticationToken not CAS related
+			return null;
+		}
+		// If an existing CasAuthenticationToken, just check we created it
+		if (authentication instanceof CasAuthenticationToken) {
+			if (this.key.hashCode() != ((CasAuthenticationToken) authentication).getKeyHash()) {
+				throw new BadCredentialsException(this.messages.getMessage("CasAuthenticationProvider.incorrectKey",
+						"The presented CasAuthenticationToken does not contain the expected key"));
+			}
+			return authentication;
+		}
+
+		// Ensure credentials are presented
+		if ((authentication.getCredentials() == null) || "".equals(authentication.getCredentials())) {
+			throw new BadCredentialsException(this.messages.getMessage("CasAuthenticationProvider.noServiceTicket",
+					"Failed to provide a CAS service ticket to validate"));
+		}
+
+		boolean stateless = (authentication instanceof UsernamePasswordAuthenticationToken
+				&& CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER.equals(authentication.getPrincipal()));
+		CasAuthenticationToken result = null;
+
+		if (stateless) {
+			// Try to obtain from cache
+			result = this.statelessTicketCache.getByTicketId(authentication.getCredentials().toString());
+		}
+		if (result == null) {
+			result = this.authenticateNow(authentication);
+			result.setDetails(authentication.getDetails());
+		}
+		if (stateless) {
+			// Add to cache
+			this.statelessTicketCache.putTicketInCache(result);
+		}
+		return result;
+	}
+
+	private CasAuthenticationToken authenticateNow(final Authentication authentication) throws AuthenticationException {
+		try {
+			Assertion assertion = this.ticketValidator.validate(authentication.getCredentials().toString(),
+					getServiceUrl(authentication));
+			UserDetails userDetails = loadUserByAssertion(assertion);
+			this.userDetailsChecker.check(userDetails);
+			return new CasAuthenticationToken(this.key, userDetails, authentication.getCredentials(),
+					this.authoritiesMapper.mapAuthorities(userDetails.getAuthorities()), userDetails, assertion);
+		}
+		catch (TicketValidationException ex) {
+			throw new BadCredentialsException(ex.getMessage(), ex);
+		}
+	}
+
+	/**
+	 * Gets the serviceUrl. If the {@link Authentication#getDetails()} is an instance of
+	 * {@link ServiceAuthenticationDetails}, then
+	 * {@link ServiceAuthenticationDetails#getServiceUrl()} is used. Otherwise, the
+	 * {@link ServiceProperties#getService()} is used.
+	 * @param authentication
+	 * @return
+	 */
+	private String getServiceUrl(Authentication authentication) {
+		String serviceUrl;
+		if (authentication.getDetails() instanceof ServiceAuthenticationDetails) {
+			return ((ServiceAuthenticationDetails) authentication.getDetails()).getServiceUrl();
+		}
+		Assert.state(this.serviceProperties != null,
+				"serviceProperties cannot be null unless Authentication.getDetails() implements ServiceAuthenticationDetails.");
+		Assert.state(this.serviceProperties.getService() != null,
+				"serviceProperties.getService() cannot be null unless Authentication.getDetails() implements ServiceAuthenticationDetails.");
+		serviceUrl = this.serviceProperties.getService();
+		logger.debug(LogMessage.format("serviceUrl = %s", serviceUrl));
+		return serviceUrl;
+	}
+
+	/**
+	 * Template method for retrieving the UserDetails based on the assertion. Default is
+	 * to call configured userDetailsService and pass the username. Deployers can override
+	 * this method and retrieve the user based on any criteria they desire.
+	 * @param assertion The CAS Assertion.
+	 * @return the UserDetails.
+	 */
+	protected UserDetails loadUserByAssertion(final Assertion assertion) {
+		final CasAssertionAuthenticationToken token = new CasAssertionAuthenticationToken(assertion, "");
+		return this.authenticationUserDetailsService.loadUserDetails(token);
+	}
+
+	@SuppressWarnings("unchecked")
+	/**
+	 * Sets the UserDetailsService to use. This is a convenience method to invoke
+	 */
+	public void setUserDetailsService(final UserDetailsService userDetailsService) {
+		this.authenticationUserDetailsService = new UserDetailsByNameServiceWrapper(userDetailsService);
+	}
+
+	public void setAuthenticationUserDetailsService(
+			final AuthenticationUserDetailsService<CasAssertionAuthenticationToken> authenticationUserDetailsService) {
+		this.authenticationUserDetailsService = authenticationUserDetailsService;
+	}
+
+	public void setServiceProperties(final ServiceProperties serviceProperties) {
+		this.serviceProperties = serviceProperties;
+	}
+
+	protected String getKey() {
+		return this.key;
+	}
+
+	public void setKey(String key) {
+		this.key = key;
+	}
+
+	public StatelessTicketCache getStatelessTicketCache() {
+		return this.statelessTicketCache;
+	}
+
+	protected TicketValidator getTicketValidator() {
+		return this.ticketValidator;
+	}
+
+	@Override
+	public void setMessageSource(final MessageSource messageSource) {
+		this.messages = new MessageSourceAccessor(messageSource);
+	}
+
+	public void setStatelessTicketCache(final StatelessTicketCache statelessTicketCache) {
+		this.statelessTicketCache = statelessTicketCache;
+	}
+
+	public void setTicketValidator(final TicketValidator ticketValidator) {
+		this.ticketValidator = ticketValidator;
+	}
+
+	public void setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper) {
+		this.authoritiesMapper = authoritiesMapper;
+	}
+
+	@Override
+	public boolean supports(final Class<?> authentication) {
+		return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication))
+				|| (CasAuthenticationToken.class.isAssignableFrom(authentication))
+				|| (CasAssertionAuthenticationToken.class.isAssignableFrom(authentication));
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationToken.java

@@ -0,0 +1,173 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import java.io.Serializable;
+import java.util.Collection;
+
+import org.jasig.cas.client.validation.Assertion;
+
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.SpringSecurityCoreVersion;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.Assert;
+import org.springframework.util.ObjectUtils;
+
+/**
+ * Represents a successful CAS <code>Authentication</code>.
+ *
+ * @author Ben Alex
+ * @author Scott Battaglia
+ */
+public class CasAuthenticationToken extends AbstractAuthenticationToken implements Serializable {
+
+	private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+
+	private final Object credentials;
+
+	private final Object principal;
+
+	private final UserDetails userDetails;
+
+	private final int keyHash;
+
+	private final Assertion assertion;
+
+	/**
+	 * Constructor.
+	 * @param key to identify if this object made by a given
+	 * {@link CasAuthenticationProvider}
+	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
+	 * @param credentials the service/proxy ticket ID from CAS (cannot be
+	 * <code>null</code>)
+	 * @param authorities the authorities granted to the user (from the
+	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
+	 * be <code>null</code>)
+	 * @param userDetails the user details (from the
+	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
+	 * be <code>null</code>)
+	 * @param assertion the assertion returned from the CAS servers. It contains the
+	 * principal and how to obtain a proxy ticket for the user.
+	 * @throws IllegalArgumentException if a <code>null</code> was passed
+	 */
+	public CasAuthenticationToken(final String key, final Object principal, final Object credentials,
+			final Collection<? extends GrantedAuthority> authorities, final UserDetails userDetails,
+			final Assertion assertion) {
+		this(extractKeyHash(key), principal, credentials, authorities, userDetails, assertion);
+	}
+
+	/**
+	 * Private constructor for Jackson Deserialization support
+	 * @param keyHash hashCode of provided key to identify if this object made by a given
+	 * {@link CasAuthenticationProvider}
+	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
+	 * @param credentials the service/proxy ticket ID from CAS (cannot be
+	 * <code>null</code>)
+	 * @param authorities the authorities granted to the user (from the
+	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
+	 * be <code>null</code>)
+	 * @param userDetails the user details (from the
+	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
+	 * be <code>null</code>)
+	 * @param assertion the assertion returned from the CAS servers. It contains the
+	 * principal and how to obtain a proxy ticket for the user.
+	 * @throws IllegalArgumentException if a <code>null</code> was passed
+	 * @since 4.2
+	 */
+	private CasAuthenticationToken(final Integer keyHash, final Object principal, final Object credentials,
+			final Collection<? extends GrantedAuthority> authorities, final UserDetails userDetails,
+			final Assertion assertion) {
+		super(authorities);
+		if ((principal == null) || "".equals(principal) || (credentials == null) || "".equals(credentials)
+				|| (authorities == null) || (userDetails == null) || (assertion == null)) {
+			throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
+		}
+		this.keyHash = keyHash;
+		this.principal = principal;
+		this.credentials = credentials;
+		this.userDetails = userDetails;
+		this.assertion = assertion;
+		setAuthenticated(true);
+	}
+
+	private static Integer extractKeyHash(String key) {
+		Assert.hasLength(key, "key cannot be null or empty");
+		return key.hashCode();
+	}
+
+	@Override
+	public boolean equals(final Object obj) {
+		if (!super.equals(obj)) {
+			return false;
+		}
+		if (obj instanceof CasAuthenticationToken) {
+			CasAuthenticationToken test = (CasAuthenticationToken) obj;
+			if (!this.assertion.equals(test.getAssertion())) {
+				return false;
+			}
+			if (this.getKeyHash() != test.getKeyHash()) {
+				return false;
+			}
+			return true;
+		}
+		return false;
+	}
+
+	@Override
+	public int hashCode() {
+		int result = super.hashCode();
+		result = 31 * result + this.credentials.hashCode();
+		result = 31 * result + this.principal.hashCode();
+		result = 31 * result + this.userDetails.hashCode();
+		result = 31 * result + this.keyHash;
+		result = 31 * result + ObjectUtils.nullSafeHashCode(this.assertion);
+		return result;
+	}
+
+	@Override
+	public Object getCredentials() {
+		return this.credentials;
+	}
+
+	public int getKeyHash() {
+		return this.keyHash;
+	}
+
+	@Override
+	public Object getPrincipal() {
+		return this.principal;
+	}
+
+	public Assertion getAssertion() {
+		return this.assertion;
+	}
+
+	public UserDetails getUserDetails() {
+		return this.userDetails;
+	}
+
+	@Override
+	public String toString() {
+		StringBuilder sb = new StringBuilder();
+		sb.append(super.toString());
+		sb.append(" Assertion: ").append(this.assertion);
+		sb.append(" Credentials (Service/Proxy Ticket): ").append(this.credentials);
+		return (sb.toString());
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/EhCacheBasedTicketCache.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import net.sf.ehcache.Ehcache;
+import net.sf.ehcache.Element;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.core.log.LogMessage;
+import org.springframework.util.Assert;
+
+/**
+ * Caches tickets using a Spring IoC defined
+ * <a href="https://www.ehcache.org/">EHCACHE</a>.
+ *
+ * @author Ben Alex
+ * @deprecated since 5.6. In favor of JCache based implementations
+ */
+@Deprecated
+public class EhCacheBasedTicketCache implements StatelessTicketCache, InitializingBean {
+
+	private static final Log logger = LogFactory.getLog(EhCacheBasedTicketCache.class);
+
+	private Ehcache cache;
+
+	@Override
+	public void afterPropertiesSet() {
+		Assert.notNull(this.cache, "cache mandatory");
+	}
+
+	@Override
+	public CasAuthenticationToken getByTicketId(final String serviceTicket) {
+		final Element element = this.cache.get(serviceTicket);
+		logger.debug(LogMessage.of(() -> "Cache hit: " + (element != null) + "; service ticket: " + serviceTicket));
+		return (element != null) ? (CasAuthenticationToken) element.getValue() : null;
+	}
+
+	public Ehcache getCache() {
+		return this.cache;
+	}
+
+	@Override
+	public void putTicketInCache(final CasAuthenticationToken token) {
+		final Element element = new Element(token.getCredentials().toString(), token);
+		logger.debug(LogMessage.of(() -> "Cache put: " + element.getKey()));
+		this.cache.put(element);
+	}
+
+	@Override
+	public void removeTicketFromCache(final CasAuthenticationToken token) {
+		logger.debug(LogMessage.of(() -> "Cache remove: " + token.getCredentials().toString()));
+		this.removeTicketFromCache(token.getCredentials().toString());
+	}
+
+	@Override
+	public void removeTicketFromCache(final String serviceTicket) {
+		this.cache.remove(serviceTicket);
+	}
+
+	public void setCache(final Ehcache cache) {
+		this.cache = cache;
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/NullStatelessTicketCache.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+/**
+ * Implementation of @link {@link StatelessTicketCache} that has no backing cache. Useful
+ * in instances where storing of tickets for stateless session management is not required.
+ * <p>
+ * This is the default StatelessTicketCache of the @link {@link CasAuthenticationProvider}
+ * to eliminate the unnecessary dependency on EhCache that applications have even if they
+ * are not using the stateless session management.
+ *
+ * @author Scott Battaglia
+ * @see CasAuthenticationProvider
+ */
+public final class NullStatelessTicketCache implements StatelessTicketCache {
+
+	/**
+	 * @return null since we are not storing any tickets.
+	 */
+	@Override
+	public CasAuthenticationToken getByTicketId(final String serviceTicket) {
+		return null;
+	}
+
+	/**
+	 * This is a no-op since we are not storing tickets.
+	 */
+	@Override
+	public void putTicketInCache(final CasAuthenticationToken token) {
+		// nothing to do
+	}
+
+	/**
+	 * This is a no-op since we are not storing tickets.
+	 */
+	@Override
+	public void removeTicketFromCache(final CasAuthenticationToken token) {
+		// nothing to do
+	}
+
+	/**
+	 * This is a no-op since we are not storing tickets.
+	 */
+	@Override
+	public void removeTicketFromCache(final String serviceTicket) {
+		// nothing to do
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/SpringCacheBasedTicketCache.java

@@ -0,0 +1,69 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.springframework.cache.Cache;
+import org.springframework.core.log.LogMessage;
+import org.springframework.util.Assert;
+
+/**
+ * Caches tickets using a Spring IoC defined {@link Cache}.
+ *
+ * @author Marten Deinum
+ * @since 3.2
+ *
+ */
+public class SpringCacheBasedTicketCache implements StatelessTicketCache {
+
+	private static final Log logger = LogFactory.getLog(SpringCacheBasedTicketCache.class);
+
+	private final Cache cache;
+
+	public SpringCacheBasedTicketCache(Cache cache) {
+		Assert.notNull(cache, "cache mandatory");
+		this.cache = cache;
+	}
+
+	@Override
+	public CasAuthenticationToken getByTicketId(final String serviceTicket) {
+		final Cache.ValueWrapper element = (serviceTicket != null) ? this.cache.get(serviceTicket) : null;
+		logger.debug(LogMessage.of(() -> "Cache hit: " + (element != null) + "; service ticket: " + serviceTicket));
+		return (element != null) ? (CasAuthenticationToken) element.get() : null;
+	}
+
+	@Override
+	public void putTicketInCache(final CasAuthenticationToken token) {
+		String key = token.getCredentials().toString();
+		logger.debug(LogMessage.of(() -> "Cache put: " + key));
+		this.cache.put(key, token);
+	}
+
+	@Override
+	public void removeTicketFromCache(final CasAuthenticationToken token) {
+		logger.debug(LogMessage.of(() -> "Cache remove: " + token.getCredentials().toString()));
+		this.removeTicketFromCache(token.getCredentials().toString());
+	}
+
+	@Override
+	public void removeTicketFromCache(final String serviceTicket) {
+		this.cache.evict(serviceTicket);
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/StatelessTicketCache.java

@@ -0,0 +1,110 @@
+/*
+ * Copyright 2004 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+/**
+ * Caches CAS service tickets and CAS proxy tickets for stateless connections.
+ *
+ * <p>
+ * When a service ticket or proxy ticket is validated against the CAS server, it is unable
+ * to be used again. Most types of callers are stateful and are associated with a given
+ * <code>HttpSession</code>. This allows the affirmative CAS validation outcome to be
+ * stored in the <code>HttpSession</code>, meaning the removal of the ticket from the CAS
+ * server is not an issue.
+ * </p>
+ *
+ * <P>
+ * Stateless callers, such as remoting protocols, cannot take advantage of
+ * <code>HttpSession</code>. If the stateless caller is located a significant network
+ * distance from the CAS server, acquiring a fresh service ticket or proxy ticket for each
+ * invocation would be expensive.
+ * </p>
+ *
+ * <P>
+ * To avoid this issue with stateless callers, it is expected stateless callers will
+ * obtain a single service ticket or proxy ticket, and then present this same ticket to
+ * the Spring Security secured application on each occasion. As no
+ * <code>HttpSession</code> is available for such callers, the affirmative CAS validation
+ * outcome cannot be stored in this location.
+ * </p>
+ *
+ * <P>
+ * The <code>StatelessTicketCache</code> enables the service tickets and proxy tickets
+ * belonging to stateless callers to be placed in a cache. This in-memory cache stores the
+ * <code>CasAuthenticationToken</code>, effectively providing the same capability as a
+ * <code>HttpSession</code> with the ticket identifier being the key rather than a session
+ * identifier.
+ * </p>
+ *
+ * <P>
+ * Implementations should provide a reasonable timeout on stored entries, such that the
+ * stateless caller are not required to unnecessarily acquire fresh CAS service tickets or
+ * proxy tickets.
+ * </p>
+ *
+ * @author Ben Alex
+ */
+public interface StatelessTicketCache {
+
+	/**
+	 * Retrieves the <code>CasAuthenticationToken</code> associated with the specified
+	 * ticket.
+	 *
+	 * <P>
+	 * If not found, returns a <code>null</code><code>CasAuthenticationToken</code>.
+	 * </p>
+	 * @return the fully populated authentication token
+	 */
+	CasAuthenticationToken getByTicketId(String serviceTicket);
+
+	/**
+	 * Adds the specified <code>CasAuthenticationToken</code> to the cache.
+	 *
+	 * <P>
+	 * The {@link CasAuthenticationToken#getCredentials()} method is used to retrieve the
+	 * service ticket number.
+	 * </p>
+	 * @param token to be added to the cache
+	 */
+	void putTicketInCache(CasAuthenticationToken token);
+
+	/**
+	 * Removes the specified ticket from the cache, as per
+	 * {@link #removeTicketFromCache(String)}.
+	 *
+	 * <P>
+	 * Implementations should use {@link CasAuthenticationToken#getCredentials()} to
+	 * obtain the ticket and then delegate to the {@link #removeTicketFromCache(String)}
+	 * method.
+	 * </p>
+	 * @param token to be removed
+	 */
+	void removeTicketFromCache(CasAuthenticationToken token);
+
+	/**
+	 * Removes the specified ticket from the cache, meaning that future calls will require
+	 * a new service ticket.
+	 *
+	 * <P>
+	 * This is in case applications wish to provide a session termination capability for
+	 * their stateless clients.
+	 * </p>
+	 * @param serviceTicket to be removed
+	 */
+	void removeTicketFromCache(String serviceTicket);
+
+}

cas/src/main/java/org/springframework/security/cas/authentication/package-info.java

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * An {@code AuthenticationProvider} that can process CAS service tickets and proxy
+ * tickets.
+ */
+package org.springframework.security.cas.authentication;

cas/src/main/java/org/springframework/security/cas/jackson2/AssertionImplMixin.java

@@ -0,0 +1,69 @@
+/*
+ * Copyright 2015-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.jackson2;
+
+import java.util.Date;
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import org.jasig.cas.client.authentication.AttributePrincipal;
+
+/**
+ * Helps in jackson deserialization of class
+ * {@link org.jasig.cas.client.validation.AssertionImpl}, which is used with
+ * {@link org.springframework.security.cas.authentication.CasAuthenticationToken}. To use
+ * this class we need to register with
+ * {@link com.fasterxml.jackson.databind.ObjectMapper}. Type information will be stored
+ * in @class property.
+ * <p>
+ * <pre>
+ *     ObjectMapper mapper = new ObjectMapper();
+ *     mapper.registerModule(new CasJackson2Module());
+ * </pre>
+ *
+ * @author Jitendra Singh
+ * @since 4.2
+ * @see CasJackson2Module
+ * @see org.springframework.security.jackson2.SecurityJackson2Modules
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonIgnoreProperties(ignoreUnknown = true)
+class AssertionImplMixin {
+
+	/**
+	 * Mixin Constructor helps in deserialize
+	 * {@link org.jasig.cas.client.validation.AssertionImpl}
+	 * @param principal the Principal to associate with the Assertion.
+	 * @param validFromDate when the assertion is valid from.
+	 * @param validUntilDate when the assertion is valid to.
+	 * @param authenticationDate when the assertion is authenticated.
+	 * @param attributes the key/value pairs for this attribute.
+	 */
+	@JsonCreator
+	AssertionImplMixin(@JsonProperty("principal") AttributePrincipal principal,
+			@JsonProperty("validFromDate") Date validFromDate, @JsonProperty("validUntilDate") Date validUntilDate,
+			@JsonProperty("authenticationDate") Date authenticationDate,
+			@JsonProperty("attributes") Map<String, Object> attributes) {
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/jackson2/AttributePrincipalImplMixin.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright 2015-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.jackson2;
+
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import org.jasig.cas.client.proxy.ProxyRetriever;
+
+/**
+ * Helps in deserialize {@link org.jasig.cas.client.authentication.AttributePrincipalImpl}
+ * which is used with
+ * {@link org.springframework.security.cas.authentication.CasAuthenticationToken}. Type
+ * information will be stored in property named @class.
+ * <p>
+ * <pre>
+ *     ObjectMapper mapper = new ObjectMapper();
+ *     mapper.registerModule(new CasJackson2Module());
+ * </pre>
+ *
+ * @author Jitendra Singh
+ * @since 4.2
+ * @see CasJackson2Module
+ * @see org.springframework.security.jackson2.SecurityJackson2Modules
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonIgnoreProperties(ignoreUnknown = true)
+class AttributePrincipalImplMixin {
+
+	/**
+	 * Mixin Constructor helps in deserialize
+	 * {@link org.jasig.cas.client.authentication.AttributePrincipalImpl}
+	 * @param name the unique identifier for the principal.
+	 * @param attributes the key/value pairs for this principal.
+	 * @param proxyGrantingTicket the ticket associated with this principal.
+	 * @param proxyRetriever the ProxyRetriever implementation to call back to the CAS
+	 * server.
+	 */
+	@JsonCreator
+	AttributePrincipalImplMixin(@JsonProperty("name") String name,
+			@JsonProperty("attributes") Map<String, Object> attributes,
+			@JsonProperty("proxyGrantingTicket") String proxyGrantingTicket,
+			@JsonProperty("proxyRetriever") ProxyRetriever proxyRetriever) {
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/jackson2/CasAuthenticationTokenMixin.java

@@ -0,0 +1,83 @@
+/*
+ * Copyright 2015-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.jackson2;
+
+import java.util.Collection;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import org.jasig.cas.client.validation.Assertion;
+
+import org.springframework.security.cas.authentication.CasAuthenticationProvider;
+import org.springframework.security.cas.authentication.CasAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+
+/**
+ * Mixin class which helps in deserialize
+ * {@link org.springframework.security.cas.authentication.CasAuthenticationToken} using
+ * jackson. Two more dependent classes needs to register along with this mixin class.
+ * <ol>
+ * <li>{@link org.springframework.security.cas.jackson2.AssertionImplMixin}</li>
+ * <li>{@link org.springframework.security.cas.jackson2.AttributePrincipalImplMixin}</li>
+ * </ol>
+ *
+ * <p>
+ *
+ * <pre>
+ *     ObjectMapper mapper = new ObjectMapper();
+ *     mapper.registerModule(new CasJackson2Module());
+ * </pre>
+ *
+ * @author Jitendra Singh
+ * @since 4.2
+ * @see CasJackson2Module
+ * @see org.springframework.security.jackson2.SecurityJackson2Modules
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
+		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
+@JsonIgnoreProperties(ignoreUnknown = true)
+class CasAuthenticationTokenMixin {
+
+	/**
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
+	 * @param keyHash hashCode of provided key to identify if this object made by a given
+	 * {@link CasAuthenticationProvider}
+	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
+	 * @param credentials the service/proxy ticket ID from CAS (cannot be
+	 * <code>null</code>)
+	 * @param authorities the authorities granted to the user (from the
+	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
+	 * be <code>null</code>)
+	 * @param userDetails the user details (from the
+	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
+	 * be <code>null</code>)
+	 * @param assertion the assertion returned from the CAS servers. It contains the
+	 * principal and how to obtain a proxy ticket for the user.
+	 */
+	@JsonCreator
+	CasAuthenticationTokenMixin(@JsonProperty("keyHash") Integer keyHash, @JsonProperty("principal") Object principal,
+			@JsonProperty("credentials") Object credentials,
+			@JsonProperty("authorities") Collection<? extends GrantedAuthority> authorities,
+			@JsonProperty("userDetails") UserDetails userDetails, @JsonProperty("assertion") Assertion assertion) {
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/jackson2/CasJackson2Module.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2015-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.jackson2;
+
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import org.jasig.cas.client.authentication.AttributePrincipalImpl;
+import org.jasig.cas.client.validation.AssertionImpl;
+
+import org.springframework.security.cas.authentication.CasAuthenticationToken;
+import org.springframework.security.jackson2.SecurityJackson2Modules;
+
+/**
+ * Jackson module for spring-security-cas. This module register
+ * {@link AssertionImplMixin}, {@link AttributePrincipalImplMixin} and
+ * {@link CasAuthenticationTokenMixin}. If no default typing enabled by default then it'll
+ * enable it because typing info is needed to properly serialize/deserialize objects. In
+ * order to use this module just add this module into your ObjectMapper configuration.
+ *
+ * <pre>
+ *     ObjectMapper mapper = new ObjectMapper();
+ *     mapper.registerModule(new CasJackson2Module());
+ * </pre> <b>Note: use {@link SecurityJackson2Modules#getModules(ClassLoader)} to get list
+ * of all security modules on the classpath.</b>
+ *
+ * @author Jitendra Singh.
+ * @since 4.2
+ * @see org.springframework.security.jackson2.SecurityJackson2Modules
+ */
+public class CasJackson2Module extends SimpleModule {
+
+	public CasJackson2Module() {
+		super(CasJackson2Module.class.getName(), new Version(1, 0, 0, null, null, null));
+	}
+
+	@Override
+	public void setupModule(SetupContext context) {
+		SecurityJackson2Modules.enableDefaultTyping(context.getOwner());
+		context.setMixInAnnotations(AssertionImpl.class, AssertionImplMixin.class);
+		context.setMixInAnnotations(AttributePrincipalImpl.class, AttributePrincipalImplMixin.class);
+		context.setMixInAnnotations(CasAuthenticationToken.class, CasAuthenticationTokenMixin.class);
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/package-info.java

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Spring Security support for Jasig's Central Authentication Service
+ * (<a href="https://www.jasig.org/cas">CAS</a>).
+ */
+package org.springframework.security.cas;

cas/src/main/java/org/springframework/security/cas/userdetails/AbstractCasAssertionUserDetailsService.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.userdetails;
+
+import org.jasig.cas.client.validation.Assertion;
+
+import org.springframework.security.cas.authentication.CasAssertionAuthenticationToken;
+import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
+import org.springframework.security.core.userdetails.UserDetails;
+
+/**
+ * Abstract class for using the provided CAS assertion to construct a new User object.
+ * This generally is most useful when combined with a SAML-based response from the CAS
+ * Server/client.
+ *
+ * @author Scott Battaglia
+ * @since 3.0
+ */
+public abstract class AbstractCasAssertionUserDetailsService
+		implements AuthenticationUserDetailsService<CasAssertionAuthenticationToken> {
+
+	@Override
+	public final UserDetails loadUserDetails(final CasAssertionAuthenticationToken token) {
+		return loadUserDetails(token.getAssertion());
+	}
+
+	/**
+	 * Protected template method for construct a
+	 * {@link org.springframework.security.core.userdetails.UserDetails} via the supplied
+	 * CAS assertion.
+	 * @param assertion the assertion to use to construct the new UserDetails. CANNOT be
+	 * NULL.
+	 * @return the newly constructed UserDetails.
+	 */
+	protected abstract UserDetails loadUserDetails(Assertion assertion);
+
+}

cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java

@@ -0,0 +1,87 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.userdetails;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.jasig.cas.client.validation.Assertion;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.Assert;
+
+/**
+ * Populates the {@link org.springframework.security.core.GrantedAuthority}s for a user by
+ * reading a list of attributes that were returned as part of the CAS response. Each
+ * attribute is read and each value of the attribute is turned into a GrantedAuthority. If
+ * the attribute has no value then its not added.
+ *
+ * @author Scott Battaglia
+ * @since 3.0
+ */
+public final class GrantedAuthorityFromAssertionAttributesUserDetailsService
+		extends AbstractCasAssertionUserDetailsService {
+
+	private static final String NON_EXISTENT_PASSWORD_VALUE = "NO_PASSWORD";
+
+	private final String[] attributes;
+
+	private boolean convertToUpperCase = true;
+
+	public GrantedAuthorityFromAssertionAttributesUserDetailsService(final String[] attributes) {
+		Assert.notNull(attributes, "attributes cannot be null.");
+		Assert.isTrue(attributes.length > 0, "At least one attribute is required to retrieve roles from.");
+		this.attributes = attributes;
+	}
+
+	@SuppressWarnings("unchecked")
+	@Override
+	protected UserDetails loadUserDetails(final Assertion assertion) {
+		List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
+		for (String attribute : this.attributes) {
+			Object value = assertion.getPrincipal().getAttributes().get(attribute);
+			if (value != null) {
+				if (value instanceof List) {
+					for (Object o : (List<?>) value) {
+						grantedAuthorities.add(createSimpleGrantedAuthority(o));
+					}
+				}
+				else {
+					grantedAuthorities.add(createSimpleGrantedAuthority(value));
+				}
+			}
+		}
+		return new User(assertion.getPrincipal().getName(), NON_EXISTENT_PASSWORD_VALUE, true, true, true, true,
+				grantedAuthorities);
+	}
+
+	private SimpleGrantedAuthority createSimpleGrantedAuthority(Object o) {
+		return new SimpleGrantedAuthority(this.convertToUpperCase ? o.toString().toUpperCase() : o.toString());
+	}
+
+	/**
+	 * Converts the returned attribute values to uppercase values.
+	 * @param convertToUpperCase true if it should convert, false otherwise.
+	 */
+	public void setConvertToUpperCase(final boolean convertToUpperCase) {
+		this.convertToUpperCase = convertToUpperCase;
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationEntryPoint.java

@@ -0,0 +1,150 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.jasig.cas.client.util.CommonUtils;
+
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.util.Assert;
+
+/**
+ * Used by the <code>ExceptionTranslationFilter</code> to commence authentication via the
+ * JA-SIG Central Authentication Service (CAS).
+ * <p>
+ * The user's browser will be redirected to the JA-SIG CAS enterprise-wide login page.
+ * This page is specified by the <code>loginUrl</code> property. Once login is complete,
+ * the CAS login page will redirect to the page indicated by the <code>service</code>
+ * property. The <code>service</code> is a HTTP URL belonging to the current application.
+ * The <code>service</code> URL is monitored by the {@link CasAuthenticationFilter}, which
+ * will validate the CAS login was successful.
+ *
+ * @author Ben Alex
+ * @author Scott Battaglia
+ */
+public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, InitializingBean {
+
+	private ServiceProperties serviceProperties;
+
+	private String loginUrl;
+
+	/**
+	 * Determines whether the Service URL should include the session id for the specific
+	 * user. As of CAS 3.0.5, the session id will automatically be stripped. However,
+	 * older versions of CAS (i.e. CAS 2), do not automatically strip the session
+	 * identifier (this is a bug on the part of the older server implementations), so an
+	 * option to disable the session encoding is provided for backwards compatibility.
+	 *
+	 * By default, encoding is enabled.
+	 */
+	private boolean encodeServiceUrlWithSessionId = true;
+
+	@Override
+	public void afterPropertiesSet() {
+		Assert.hasLength(this.loginUrl, "loginUrl must be specified");
+		Assert.notNull(this.serviceProperties, "serviceProperties must be specified");
+		Assert.notNull(this.serviceProperties.getService(), "serviceProperties.getService() cannot be null.");
+	}
+
+	@Override
+	public final void commence(final HttpServletRequest servletRequest, HttpServletResponse response,
+			AuthenticationException authenticationException) throws IOException {
+		String urlEncodedService = createServiceUrl(servletRequest, response);
+		String redirectUrl = createRedirectUrl(urlEncodedService);
+		preCommence(servletRequest, response);
+		response.sendRedirect(redirectUrl);
+	}
+
+	/**
+	 * Constructs a new Service Url. The default implementation relies on the CAS client
+	 * to do the bulk of the work.
+	 * @param request the HttpServletRequest
+	 * @param response the HttpServlet Response
+	 * @return the constructed service url. CANNOT be NULL.
+	 */
+	protected String createServiceUrl(HttpServletRequest request, HttpServletResponse response) {
+		return CommonUtils.constructServiceUrl(null, response, this.serviceProperties.getService(), null,
+				this.serviceProperties.getArtifactParameter(), this.encodeServiceUrlWithSessionId);
+	}
+
+	/**
+	 * Constructs the Url for Redirection to the CAS server. Default implementation relies
+	 * on the CAS client to do the bulk of the work.
+	 * @param serviceUrl the service url that should be included.
+	 * @return the redirect url. CANNOT be NULL.
+	 */
+	protected String createRedirectUrl(String serviceUrl) {
+		return CommonUtils.constructRedirectUrl(this.loginUrl, this.serviceProperties.getServiceParameter(), serviceUrl,
+				this.serviceProperties.isSendRenew(), false);
+	}
+
+	/**
+	 * Template method for you to do your own pre-processing before the redirect occurs.
+	 * @param request the HttpServletRequest
+	 * @param response the HttpServletResponse
+	 */
+	protected void preCommence(HttpServletRequest request, HttpServletResponse response) {
+
+	}
+
+	/**
+	 * The enterprise-wide CAS login URL. Usually something like
+	 * <code>https://www.mycompany.com/cas/login</code>.
+	 * @return the enterprise-wide CAS login URL
+	 */
+	public final String getLoginUrl() {
+		return this.loginUrl;
+	}
+
+	public final ServiceProperties getServiceProperties() {
+		return this.serviceProperties;
+	}
+
+	public final void setLoginUrl(String loginUrl) {
+		this.loginUrl = loginUrl;
+	}
+
+	public final void setServiceProperties(ServiceProperties serviceProperties) {
+		this.serviceProperties = serviceProperties;
+	}
+
+	/**
+	 * Sets whether to encode the service url with the session id or not.
+	 * @param encodeServiceUrlWithSessionId whether to encode the service url with the
+	 * session id or not.
+	 */
+	public final void setEncodeServiceUrlWithSessionId(boolean encodeServiceUrlWithSessionId) {
+		this.encodeServiceUrlWithSessionId = encodeServiceUrlWithSessionId;
+	}
+
+	/**
+	 * Sets whether to encode the service url with the session id or not.
+	 * @return whether to encode the service url with the session id or not.
+	 *
+	 */
+	protected boolean getEncodeServiceUrlWithSessionId() {
+		return this.encodeServiceUrlWithSessionId;
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java

@@ -0,0 +1,415 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web;
+
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.jasig.cas.client.proxy.ProxyGrantingTicketStorage;
+import org.jasig.cas.client.util.CommonUtils;
+import org.jasig.cas.client.validation.TicketValidator;
+
+import org.springframework.core.log.LogMessage;
+import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.authentication.AuthenticationDetailsSource;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.cas.web.authentication.ServiceAuthenticationDetails;
+import org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
+import org.springframework.security.web.context.NullSecurityContextRepository;
+import org.springframework.security.web.context.SecurityContextRepository;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.util.Assert;
+
+/**
+ * Processes a CAS service ticket, obtains proxy granting tickets, and processes proxy
+ * tickets.
+ * <h2>Service Tickets</h2>
+ * <p>
+ * A service ticket consists of an opaque ticket string. It arrives at this filter by the
+ * user's browser successfully authenticating using CAS, and then receiving a HTTP
+ * redirect to a <code>service</code>. The opaque ticket string is presented in the
+ * <code>ticket</code> request parameter.
+ * <p>
+ * This filter monitors the <code>service</code> URL so it can receive the service ticket
+ * and process it. By default this filter processes the URL <tt>/login/cas</tt>. When
+ * processing this URL, the value of {@link ServiceProperties#getService()} is used as the
+ * <tt>service</tt> when validating the <code>ticket</code>. This means that it is
+ * important that {@link ServiceProperties#getService()} specifies the same value as the
+ * <tt>filterProcessesUrl</tt>.
+ * <p>
+ * Processing the service ticket involves creating a
+ * <code>UsernamePasswordAuthenticationToken</code> which uses
+ * {@link #CAS_STATEFUL_IDENTIFIER} for the <code>principal</code> and the opaque ticket
+ * string as the <code>credentials</code>.
+ * <h2>Obtaining Proxy Granting Tickets</h2>
+ * <p>
+ * If specified, the filter can also monitor the <code>proxyReceptorUrl</code>. The filter
+ * will respond to requests matching this url so that the CAS Server can provide a PGT to
+ * the filter. Note that in addition to the <code>proxyReceptorUrl</code> a non-null
+ * <code>proxyGrantingTicketStorage</code> must be provided in order for the filter to
+ * respond to proxy receptor requests. By configuring a shared
+ * {@link ProxyGrantingTicketStorage} between the {@link TicketValidator} and the
+ * CasAuthenticationFilter one can have the CasAuthenticationFilter handle the proxying
+ * requirements for CAS.
+ * <h2>Proxy Tickets</h2>
+ * <p>
+ * The filter can process tickets present on any url. This is useful when wanting to
+ * process proxy tickets. In order for proxy tickets to get processed
+ * {@link ServiceProperties#isAuthenticateAllArtifacts()} must return <code>true</code>.
+ * Additionally, if the request is already authenticated, authentication will <b>not</b>
+ * occur. Last, {@link AuthenticationDetailsSource#buildDetails(Object)} must return a
+ * {@link ServiceAuthenticationDetails}. This can be accomplished using the
+ * {@link ServiceAuthenticationDetailsSource}. In this case
+ * {@link ServiceAuthenticationDetails#getServiceUrl()} will be used for the service url.
+ * <p>
+ * Processing the proxy ticket involves creating a
+ * <code>UsernamePasswordAuthenticationToken</code> which uses
+ * {@link #CAS_STATELESS_IDENTIFIER} for the <code>principal</code> and the opaque ticket
+ * string as the <code>credentials</code>. When a proxy ticket is successfully
+ * authenticated, the FilterChain continues and the
+ * <code>authenticationSuccessHandler</code> is not used.
+ * <h2>Notes about the <code>AuthenticationManager</code></h2>
+ * <p>
+ * The configured <code>AuthenticationManager</code> is expected to provide a provider
+ * that can recognise <code>UsernamePasswordAuthenticationToken</code>s containing this
+ * special <code>principal</code> name, and process them accordingly by validation with
+ * the CAS server. Additionally, it should be capable of using the result of
+ * {@link ServiceAuthenticationDetails#getServiceUrl()} as the service when validating the
+ * ticket.
+ * <h2>Example Configuration</h2>
+ * <p>
+ * An example configuration that supports service tickets, obtaining proxy granting
+ * tickets, and proxy tickets is illustrated below:
+ *
+ * <pre>
+ * &lt;b:bean id=&quot;serviceProperties&quot;
+ *     class=&quot;org.springframework.security.cas.ServiceProperties&quot;
+ *     p:service=&quot;https://service.example.com/cas-sample/login/cas&quot;
+ *     p:authenticateAllArtifacts=&quot;true&quot;/&gt;
+ * &lt;b:bean id=&quot;casEntryPoint&quot;
+ *     class=&quot;org.springframework.security.cas.web.CasAuthenticationEntryPoint&quot;
+ *     p:serviceProperties-ref=&quot;serviceProperties&quot; p:loginUrl=&quot;https://login.example.org/cas/login&quot; /&gt;
+ * &lt;b:bean id=&quot;casFilter&quot;
+ *     class=&quot;org.springframework.security.cas.web.CasAuthenticationFilter&quot;
+ *     p:authenticationManager-ref=&quot;authManager&quot;
+ *     p:serviceProperties-ref=&quot;serviceProperties&quot;
+ *     p:proxyGrantingTicketStorage-ref=&quot;pgtStorage&quot;
+ *     p:proxyReceptorUrl=&quot;/login/cas/proxyreceptor&quot;&gt;
+ *     &lt;b:property name=&quot;authenticationDetailsSource&quot;&gt;
+ *         &lt;b:bean class=&quot;org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource&quot;/&gt;
+ *     &lt;/b:property&gt;
+ *     &lt;b:property name=&quot;authenticationFailureHandler&quot;&gt;
+ *         &lt;b:bean class=&quot;org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler&quot;
+ *             p:defaultFailureUrl=&quot;/casfailed.jsp&quot;/&gt;
+ *     &lt;/b:property&gt;
+ * &lt;/b:bean&gt;
+ * &lt;!--
+ *     NOTE: In a real application you should not use an in memory implementation. You will also want
+ *           to ensure to clean up expired tickets by calling ProxyGrantingTicketStorage.cleanup()
+ *  --&gt;
+ * &lt;b:bean id=&quot;pgtStorage&quot; class=&quot;org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl&quot;/&gt;
+ * &lt;b:bean id=&quot;casAuthProvider&quot; class=&quot;org.springframework.security.cas.authentication.CasAuthenticationProvider&quot;
+ *     p:serviceProperties-ref=&quot;serviceProperties&quot;
+ *     p:key=&quot;casAuthProviderKey&quot;&gt;
+ *     &lt;b:property name=&quot;authenticationUserDetailsService&quot;&gt;
+ *         &lt;b:bean
+ *             class=&quot;org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper&quot;&gt;
+ *             &lt;b:constructor-arg ref=&quot;userService&quot; /&gt;
+ *         &lt;/b:bean&gt;
+ *     &lt;/b:property&gt;
+ *     &lt;b:property name=&quot;ticketValidator&quot;&gt;
+ *         &lt;b:bean
+ *             class=&quot;org.jasig.cas.client.validation.Cas20ProxyTicketValidator&quot;
+ *             p:acceptAnyProxy=&quot;true&quot;
+ *             p:proxyCallbackUrl=&quot;https://service.example.com/cas-sample/login/cas/proxyreceptor&quot;
+ *             p:proxyGrantingTicketStorage-ref=&quot;pgtStorage&quot;&gt;
+ *             &lt;b:constructor-arg value=&quot;https://login.example.org/cas&quot; /&gt;
+ *         &lt;/b:bean&gt;
+ *     &lt;/b:property&gt;
+ *     &lt;b:property name=&quot;statelessTicketCache&quot;&gt;
+ *         &lt;b:bean class=&quot;org.springframework.security.cas.authentication.EhCacheBasedTicketCache&quot;&gt;
+ *             &lt;b:property name=&quot;cache&quot;&gt;
+ *                 &lt;b:bean class=&quot;net.sf.ehcache.Cache&quot;
+ *                   init-method=&quot;initialise&quot;
+ *                   destroy-method=&quot;dispose&quot;&gt;
+ *                     &lt;b:constructor-arg value=&quot;casTickets&quot;/&gt;
+ *                     &lt;b:constructor-arg value=&quot;50&quot;/&gt;
+ *                     &lt;b:constructor-arg value=&quot;true&quot;/&gt;
+ *                     &lt;b:constructor-arg value=&quot;false&quot;/&gt;
+ *                     &lt;b:constructor-arg value=&quot;3600&quot;/&gt;
+ *                     &lt;b:constructor-arg value=&quot;900&quot;/&gt;
+ *                 &lt;/b:bean&gt;
+ *             &lt;/b:property&gt;
+ *         &lt;/b:bean&gt;
+ *     &lt;/b:property&gt;
+ * &lt;/b:bean&gt;
+ * </pre>
+ *
+ * @author Ben Alex
+ * @author Rob Winch
+ */
+public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
+
+	/**
+	 * Used to identify a CAS request for a stateful user agent, such as a web browser.
+	 */
+	public static final String CAS_STATEFUL_IDENTIFIER = "_cas_stateful_";
+
+	/**
+	 * Used to identify a CAS request for a stateless user agent, such as a remoting
+	 * protocol client (e.g. Hessian, Burlap, SOAP etc). Results in a more aggressive
+	 * caching strategy being used, as the absence of a <code>HttpSession</code> will
+	 * result in a new authentication attempt on every request.
+	 */
+	public static final String CAS_STATELESS_IDENTIFIER = "_cas_stateless_";
+
+	/**
+	 * The last portion of the receptor url, i.e. /proxy/receptor
+	 */
+	private RequestMatcher proxyReceptorMatcher;
+
+	/**
+	 * The backing storage to store ProxyGrantingTicket requests.
+	 */
+	private ProxyGrantingTicketStorage proxyGrantingTicketStorage;
+
+	private String artifactParameter = ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER;
+
+	private boolean authenticateAllArtifacts;
+
+	private AuthenticationFailureHandler proxyFailureHandler = new SimpleUrlAuthenticationFailureHandler();
+
+	private SecurityContextRepository securityContextRepository = new NullSecurityContextRepository();
+
+	public CasAuthenticationFilter() {
+		super("/login/cas");
+		setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler());
+	}
+
+	@Override
+	protected final void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
+			FilterChain chain, Authentication authResult) throws IOException, ServletException {
+		boolean continueFilterChain = proxyTicketRequest(serviceTicketRequest(request, response), request);
+		if (!continueFilterChain) {
+			super.successfulAuthentication(request, response, chain, authResult);
+			return;
+		}
+		this.logger.debug(
+				LogMessage.format("Authentication success. Updating SecurityContextHolder to contain: %s", authResult));
+		SecurityContext context = SecurityContextHolder.createEmptyContext();
+		context.setAuthentication(authResult);
+		SecurityContextHolder.setContext(context);
+		this.securityContextRepository.saveContext(context, request, response);
+		if (this.eventPublisher != null) {
+			this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
+		}
+		chain.doFilter(request, response);
+	}
+
+	@Override
+	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
+			throws AuthenticationException, IOException {
+		// if the request is a proxy request process it and return null to indicate the
+		// request has been processed
+		if (proxyReceptorRequest(request)) {
+			this.logger.debug("Responding to proxy receptor request");
+			CommonUtils.readAndRespondToProxyReceptorRequest(request, response, this.proxyGrantingTicketStorage);
+			return null;
+		}
+		boolean serviceTicketRequest = serviceTicketRequest(request, response);
+		String username = serviceTicketRequest ? CAS_STATEFUL_IDENTIFIER : CAS_STATELESS_IDENTIFIER;
+		String password = obtainArtifact(request);
+		if (password == null) {
+			this.logger.debug("Failed to obtain an artifact (cas ticket)");
+			password = "";
+		}
+		UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username,
+				password);
+		authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
+		return this.getAuthenticationManager().authenticate(authRequest);
+	}
+
+	/**
+	 * If present, gets the artifact (CAS ticket) from the {@link HttpServletRequest}.
+	 * @param request
+	 * @return if present the artifact from the {@link HttpServletRequest}, else null
+	 */
+	protected String obtainArtifact(HttpServletRequest request) {
+		return request.getParameter(this.artifactParameter);
+	}
+
+	/**
+	 * Overridden to provide proxying capabilities.
+	 */
+	@Override
+	protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
+		final boolean serviceTicketRequest = serviceTicketRequest(request, response);
+		final boolean result = serviceTicketRequest || proxyReceptorRequest(request)
+				|| (proxyTicketRequest(serviceTicketRequest, request));
+		if (this.logger.isDebugEnabled()) {
+			this.logger.debug("requiresAuthentication = " + result);
+		}
+		return result;
+	}
+
+	/**
+	 * Sets the {@link SecurityContextRepository} to save the {@link SecurityContext} on
+	 * authentication success. The default action is not to save the
+	 * {@link SecurityContext}.
+	 * @param securityContextRepository the {@link SecurityContextRepository} to use.
+	 * Cannot be null.
+	 */
+	public void setSecurityContextRepository(SecurityContextRepository securityContextRepository) {
+		Assert.notNull(securityContextRepository, "securityContextRepository cannot be null");
+		this.securityContextRepository = securityContextRepository;
+	}
+
+	/**
+	 * Sets the {@link AuthenticationFailureHandler} for proxy requests.
+	 * @param proxyFailureHandler
+	 */
+	public final void setProxyAuthenticationFailureHandler(AuthenticationFailureHandler proxyFailureHandler) {
+		Assert.notNull(proxyFailureHandler, "proxyFailureHandler cannot be null");
+		this.proxyFailureHandler = proxyFailureHandler;
+	}
+
+	/**
+	 * Wraps the {@link AuthenticationFailureHandler} to distinguish between handling
+	 * proxy ticket authentication failures and service ticket failures.
+	 */
+	@Override
+	public final void setAuthenticationFailureHandler(AuthenticationFailureHandler failureHandler) {
+		super.setAuthenticationFailureHandler(new CasAuthenticationFailureHandler(failureHandler));
+	}
+
+	public final void setProxyReceptorUrl(final String proxyReceptorUrl) {
+		this.proxyReceptorMatcher = new AntPathRequestMatcher("/**" + proxyReceptorUrl);
+	}
+
+	public final void setProxyGrantingTicketStorage(final ProxyGrantingTicketStorage proxyGrantingTicketStorage) {
+		this.proxyGrantingTicketStorage = proxyGrantingTicketStorage;
+	}
+
+	public final void setServiceProperties(final ServiceProperties serviceProperties) {
+		this.artifactParameter = serviceProperties.getArtifactParameter();
+		this.authenticateAllArtifacts = serviceProperties.isAuthenticateAllArtifacts();
+	}
+
+	/**
+	 * Indicates if the request is elgible to process a service ticket. This method exists
+	 * for readability.
+	 * @param request
+	 * @param response
+	 * @return
+	 */
+	private boolean serviceTicketRequest(HttpServletRequest request, HttpServletResponse response) {
+		boolean result = super.requiresAuthentication(request, response);
+		this.logger.debug(LogMessage.format("serviceTicketRequest = %s", result));
+		return result;
+	}
+
+	/**
+	 * Indicates if the request is elgible to process a proxy ticket.
+	 * @param request
+	 * @return
+	 */
+	private boolean proxyTicketRequest(boolean serviceTicketRequest, HttpServletRequest request) {
+		if (serviceTicketRequest) {
+			return false;
+		}
+		boolean result = this.authenticateAllArtifacts && obtainArtifact(request) != null && !authenticated();
+		this.logger.debug(LogMessage.format("proxyTicketRequest = %s", result));
+		return result;
+	}
+
+	/**
+	 * Determines if a user is already authenticated.
+	 * @return
+	 */
+	private boolean authenticated() {
+		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+		return authentication != null && authentication.isAuthenticated()
+				&& !(authentication instanceof AnonymousAuthenticationToken);
+	}
+
+	/**
+	 * Indicates if the request is elgible to be processed as the proxy receptor.
+	 * @param request
+	 * @return
+	 */
+	private boolean proxyReceptorRequest(HttpServletRequest request) {
+		final boolean result = proxyReceptorConfigured() && this.proxyReceptorMatcher.matches(request);
+		this.logger.debug(LogMessage.format("proxyReceptorRequest = %s", result));
+		return result;
+	}
+
+	/**
+	 * Determines if the {@link CasAuthenticationFilter} is configured to handle the proxy
+	 * receptor requests.
+	 * @return
+	 */
+	private boolean proxyReceptorConfigured() {
+		final boolean result = this.proxyGrantingTicketStorage != null && this.proxyReceptorMatcher != null;
+		this.logger.debug(LogMessage.format("proxyReceptorConfigured = %s", result));
+		return result;
+	}
+
+	/**
+	 * A wrapper for the AuthenticationFailureHandler that will flex the
+	 * {@link AuthenticationFailureHandler} that is used. The value
+	 * {@link CasAuthenticationFilter#setProxyAuthenticationFailureHandler(AuthenticationFailureHandler)}
+	 * will be used for proxy requests that fail. The value
+	 * {@link CasAuthenticationFilter#setAuthenticationFailureHandler(AuthenticationFailureHandler)}
+	 * will be used for service tickets that fail.
+	 */
+	private class CasAuthenticationFailureHandler implements AuthenticationFailureHandler {
+
+		private final AuthenticationFailureHandler serviceTicketFailureHandler;
+
+		CasAuthenticationFailureHandler(AuthenticationFailureHandler failureHandler) {
+			Assert.notNull(failureHandler, "failureHandler");
+			this.serviceTicketFailureHandler = failureHandler;
+		}
+
+		@Override
+		public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
+				AuthenticationException exception) throws IOException, ServletException {
+			if (serviceTicketRequest(request, response)) {
+				this.serviceTicketFailureHandler.onAuthenticationFailure(request, response, exception);
+			}
+			else {
+				CasAuthenticationFilter.this.proxyFailureHandler.onAuthenticationFailure(request, response, exception);
+			}
+		}
+
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetails.java

@@ -0,0 +1,146 @@
+/*
+ * Copyright 2011-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web.authentication;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.regex.Pattern;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.springframework.security.web.authentication.WebAuthenticationDetails;
+import org.springframework.security.web.util.UrlUtils;
+import org.springframework.util.Assert;
+
+/**
+ * A default implementation of {@link ServiceAuthenticationDetails} that figures out the
+ * value for {@link #getServiceUrl()} by inspecting the current {@link HttpServletRequest}
+ * and using the current URL minus the artifact and the corresponding value.
+ *
+ * @author Rob Winch
+ */
+final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
+		implements ServiceAuthenticationDetails {
+
+	private static final long serialVersionUID = 6192409090610517700L;
+
+	private final String serviceUrl;
+
+	/**
+	 * Creates a new instance
+	 * @param request the current {@link HttpServletRequest} to obtain the
+	 * {@link #getServiceUrl()} from.
+	 * @param artifactPattern the {@link Pattern} that will be used to clean up the query
+	 * string from containing the artifact name and value. This can be created using
+	 * {@link #createArtifactPattern(String)}.
+	 */
+	DefaultServiceAuthenticationDetails(String casService, HttpServletRequest request, Pattern artifactPattern)
+			throws MalformedURLException {
+		super(request);
+		URL casServiceUrl = new URL(casService);
+		int port = getServicePort(casServiceUrl);
+		final String query = getQueryString(request, artifactPattern);
+		this.serviceUrl = UrlUtils.buildFullRequestUrl(casServiceUrl.getProtocol(), casServiceUrl.getHost(), port,
+				request.getRequestURI(), query);
+	}
+
+	/**
+	 * Returns the current URL minus the artifact parameter and its value, if present.
+	 * @see org.springframework.security.cas.web.authentication.ServiceAuthenticationDetails#getServiceUrl()
+	 */
+	@Override
+	public String getServiceUrl() {
+		return this.serviceUrl;
+	}
+
+	@Override
+	public boolean equals(Object obj) {
+		if (this == obj) {
+			return true;
+		}
+		if (!super.equals(obj) || !(obj instanceof DefaultServiceAuthenticationDetails)) {
+			return false;
+		}
+		ServiceAuthenticationDetails that = (ServiceAuthenticationDetails) obj;
+		return this.serviceUrl.equals(that.getServiceUrl());
+	}
+
+	@Override
+	public int hashCode() {
+		final int prime = 31;
+		int result = super.hashCode();
+		result = prime * result + this.serviceUrl.hashCode();
+		return result;
+	}
+
+	@Override
+	public String toString() {
+		StringBuilder result = new StringBuilder();
+		result.append(super.toString());
+		result.append("ServiceUrl: ");
+		result.append(this.serviceUrl);
+		return result.toString();
+	}
+
+	/**
+	 * If present, removes the artifactParameterName and the corresponding value from the
+	 * query String.
+	 * @param request
+	 * @return the query String minus the artifactParameterName and the corresponding
+	 * value.
+	 */
+	private String getQueryString(final HttpServletRequest request, final Pattern artifactPattern) {
+		final String query = request.getQueryString();
+		if (query == null) {
+			return null;
+		}
+		String result = artifactPattern.matcher(query).replaceFirst("");
+		if (result.length() == 0) {
+			return null;
+		}
+		// strip off the trailing & only if the artifact was the first query param
+		return result.startsWith("&") ? result.substring(1) : result;
+	}
+
+	/**
+	 * Creates a {@link Pattern} that can be passed into the constructor. This allows the
+	 * {@link Pattern} to be reused for every instance of
+	 * {@link DefaultServiceAuthenticationDetails}.
+	 * @param artifactParameterName
+	 * @return
+	 */
+	static Pattern createArtifactPattern(String artifactParameterName) {
+		Assert.hasLength(artifactParameterName, "artifactParameterName is expected to have a length");
+		return Pattern.compile("&?" + Pattern.quote(artifactParameterName) + "=[^&]*");
+	}
+
+	/**
+	 * Gets the port from the casServiceURL ensuring to return the proper value if the
+	 * default port is being used.
+	 * @param casServiceUrl the casServerUrl to be used (i.e.
+	 * "https://example.com/context/login/cas")
+	 * @return the port that is configured for the casServerUrl
+	 */
+	private static int getServicePort(URL casServiceUrl) {
+		int port = casServiceUrl.getPort();
+		if (port == -1) {
+			port = casServiceUrl.getDefaultPort();
+		}
+		return port;
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/web/authentication/ServiceAuthenticationDetails.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 2011-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web.authentication;
+
+import java.io.Serializable;
+
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.cas.authentication.CasAuthenticationProvider;
+import org.springframework.security.core.Authentication;
+
+/**
+ * In order for the {@link CasAuthenticationProvider} to provide the correct service url
+ * to authenticate the ticket, the returned value of {@link Authentication#getDetails()}
+ * should implement this interface when tickets can be sent to any URL rather than only
+ * {@link ServiceProperties#getService()}.
+ *
+ * @author Rob Winch
+ * @see ServiceAuthenticationDetailsSource
+ */
+public interface ServiceAuthenticationDetails extends Serializable {
+
+	/**
+	 * Gets the absolute service url (i.e. https://example.com/service/).
+	 * @return the service url. Cannot be <code>null</code>.
+	 */
+	String getServiceUrl();
+
+}

cas/src/main/java/org/springframework/security/cas/web/authentication/ServiceAuthenticationDetailsSource.java

@@ -0,0 +1,83 @@
+/*
+ * Copyright 2011-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web.authentication;
+
+import java.net.MalformedURLException;
+import java.util.regex.Pattern;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.springframework.security.authentication.AuthenticationDetailsSource;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.util.Assert;
+
+/**
+ * The {@code AuthenticationDetailsSource} that is set on the
+ * {@code CasAuthenticationFilter} should return a value that implements
+ * {@code ServiceAuthenticationDetails} if the application needs to authenticate dynamic
+ * service urls. The
+ * {@code ServiceAuthenticationDetailsSource#buildDetails(HttpServletRequest)} creates a
+ * default {@code ServiceAuthenticationDetails}.
+ *
+ * @author Rob Winch
+ */
+public class ServiceAuthenticationDetailsSource
+		implements AuthenticationDetailsSource<HttpServletRequest, ServiceAuthenticationDetails> {
+
+	private final Pattern artifactPattern;
+
+	private ServiceProperties serviceProperties;
+
+	/**
+	 * Creates an implementation that uses the specified ServiceProperties and the default
+	 * CAS artifactParameterName.
+	 * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
+	 */
+	public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties) {
+		this(serviceProperties, ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
+	}
+
+	/**
+	 * Creates an implementation that uses the specified artifactParameterName
+	 * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
+	 * @param artifactParameterName the artifactParameterName that is removed from the
+	 * current URL. The result becomes the service url. Cannot be null and cannot be an
+	 * empty String.
+	 */
+	public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties, String artifactParameterName) {
+		Assert.notNull(serviceProperties, "serviceProperties cannot be null");
+		this.serviceProperties = serviceProperties;
+		this.artifactPattern = DefaultServiceAuthenticationDetails.createArtifactPattern(artifactParameterName);
+	}
+
+	/**
+	 * @param context the {@code HttpServletRequest} object.
+	 * @return the {@code ServiceAuthenticationDetails} containing information about the
+	 * current request
+	 */
+	@Override
+	public ServiceAuthenticationDetails buildDetails(HttpServletRequest context) {
+		try {
+			return new DefaultServiceAuthenticationDetails(this.serviceProperties.getService(), context,
+					this.artifactPattern);
+		}
+		catch (MalformedURLException ex) {
+			throw new RuntimeException(ex);
+		}
+	}
+
+}

cas/src/main/java/org/springframework/security/cas/web/authentication/package-info.java

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Authentication processing mechanisms which respond to the submission of authentication
+ * credentials using CAS.
+ */
+package org.springframework.security.cas.web.authentication;

cas/src/main/java/org/springframework/security/cas/web/package-info.java

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Authenticates standard web browser users via CAS.
+ */
+package org.springframework.security.cas.web;

cas/src/test/java/org/springframework/security/cas/authentication/AbstractStatelessTicketCacheTests.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.jasig.cas.client.validation.Assertion;
+import org.jasig.cas.client.validation.AssertionImpl;
+
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.userdetails.User;
+
+/**
+ * @author Scott Battaglia
+ * @since 2.0
+ *
+ */
+public abstract class AbstractStatelessTicketCacheTests {
+
+	protected CasAuthenticationToken getToken() {
+		List<String> proxyList = new ArrayList<>();
+		proxyList.add("https://localhost/newPortal/login/cas");
+		User user = new User("rod", "password", true, true, true, true,
+				AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO"));
+		final Assertion assertion = new AssertionImpl("rod");
+		return new CasAuthenticationToken("key", user, "ST-0-ER94xMJmn6pha35CQRoZ",
+				AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO"), user, assertion);
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/authentication/CasAuthenticationProviderTests.java

@@ -0,0 +1,382 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.jasig.cas.client.validation.Assertion;
+import org.jasig.cas.client.validation.AssertionImpl;
+import org.jasig.cas.client.validation.TicketValidator;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.cas.web.CasAuthenticationFilter;
+import org.springframework.security.cas.web.authentication.ServiceAuthenticationDetails;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.web.authentication.WebAuthenticationDetails;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
+import static org.assertj.core.api.Assertions.fail;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+
+/**
+ * Tests {@link CasAuthenticationProvider}.
+ *
+ * @author Ben Alex
+ * @author Scott Battaglia
+ */
+@SuppressWarnings("unchecked")
+public class CasAuthenticationProviderTests {
+
+	private UserDetails makeUserDetails() {
+		return new User("user", "password", true, true, true, true,
+				AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO"));
+	}
+
+	private UserDetails makeUserDetailsFromAuthoritiesPopulator() {
+		return new User("user", "password", true, true, true, true,
+				AuthorityUtils.createAuthorityList("ROLE_A", "ROLE_B"));
+	}
+
+	private ServiceProperties makeServiceProperties() {
+		final ServiceProperties serviceProperties = new ServiceProperties();
+		serviceProperties.setSendRenew(false);
+		serviceProperties.setService("http://test.com");
+		return serviceProperties;
+	}
+
+	@Test
+	public void statefulAuthenticationIsSuccessful() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		StatelessTicketCache cache = new MockStatelessTicketCache();
+		cap.setStatelessTicketCache(cache);
+		cap.setServiceProperties(makeServiceProperties());
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.afterPropertiesSet();
+		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
+				.unauthenticated(CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER, "ST-123");
+		token.setDetails("details");
+		Authentication result = cap.authenticate(token);
+		// Confirm ST-123 was NOT added to the cache
+		assertThat(cache.getByTicketId("ST-456") == null).isTrue();
+		if (!(result instanceof CasAuthenticationToken)) {
+			fail("Should have returned a CasAuthenticationToken");
+		}
+		CasAuthenticationToken casResult = (CasAuthenticationToken) result;
+		assertThat(casResult.getPrincipal()).isEqualTo(makeUserDetailsFromAuthoritiesPopulator());
+		assertThat(casResult.getCredentials()).isEqualTo("ST-123");
+		assertThat(casResult.getAuthorities()).contains(new SimpleGrantedAuthority("ROLE_A"));
+		assertThat(casResult.getAuthorities()).contains(new SimpleGrantedAuthority("ROLE_B"));
+		assertThat(casResult.getKeyHash()).isEqualTo(cap.getKey().hashCode());
+		assertThat(casResult.getDetails()).isEqualTo("details");
+		// Now confirm the CasAuthenticationToken is automatically re-accepted.
+		// To ensure TicketValidator not called again, set it to deliver an exception...
+		cap.setTicketValidator(new MockTicketValidator(false));
+		Authentication laterResult = cap.authenticate(result);
+		assertThat(laterResult).isEqualTo(result);
+	}
+
+	@Test
+	public void statelessAuthenticationIsSuccessful() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		StatelessTicketCache cache = new MockStatelessTicketCache();
+		cap.setStatelessTicketCache(cache);
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		cap.afterPropertiesSet();
+		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
+				.unauthenticated(CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, "ST-456");
+		token.setDetails("details");
+		Authentication result = cap.authenticate(token);
+		// Confirm ST-456 was added to the cache
+		assertThat(cache.getByTicketId("ST-456") != null).isTrue();
+		if (!(result instanceof CasAuthenticationToken)) {
+			fail("Should have returned a CasAuthenticationToken");
+		}
+		assertThat(result.getPrincipal()).isEqualTo(makeUserDetailsFromAuthoritiesPopulator());
+		assertThat(result.getCredentials()).isEqualTo("ST-456");
+		assertThat(result.getDetails()).isEqualTo("details");
+		// Now try to authenticate again. To ensure TicketValidator not
+		// called again, set it to deliver an exception...
+		cap.setTicketValidator(new MockTicketValidator(false));
+		// Previously created UsernamePasswordAuthenticationToken is OK
+		Authentication newResult = cap.authenticate(token);
+		assertThat(newResult.getPrincipal()).isEqualTo(makeUserDetailsFromAuthoritiesPopulator());
+		assertThat(newResult.getCredentials()).isEqualTo("ST-456");
+	}
+
+	@Test
+	public void authenticateAllNullService() throws Exception {
+		String serviceUrl = "https://service/context";
+		ServiceAuthenticationDetails details = mock(ServiceAuthenticationDetails.class);
+		given(details.getServiceUrl()).willReturn(serviceUrl);
+		TicketValidator validator = mock(TicketValidator.class);
+		given(validator.validate(any(String.class), any(String.class))).willReturn(new AssertionImpl("rod"));
+		ServiceProperties serviceProperties = makeServiceProperties();
+		serviceProperties.setAuthenticateAllArtifacts(true);
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		cap.setTicketValidator(validator);
+		cap.setServiceProperties(serviceProperties);
+		cap.afterPropertiesSet();
+		String ticket = "ST-456";
+		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
+				.unauthenticated(CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, ticket);
+		Authentication result = cap.authenticate(token);
+	}
+
+	@Test
+	public void authenticateAllAuthenticationIsSuccessful() throws Exception {
+		String serviceUrl = "https://service/context";
+		ServiceAuthenticationDetails details = mock(ServiceAuthenticationDetails.class);
+		given(details.getServiceUrl()).willReturn(serviceUrl);
+		TicketValidator validator = mock(TicketValidator.class);
+		given(validator.validate(any(String.class), any(String.class))).willReturn(new AssertionImpl("rod"));
+		ServiceProperties serviceProperties = makeServiceProperties();
+		serviceProperties.setAuthenticateAllArtifacts(true);
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		cap.setTicketValidator(validator);
+		cap.setServiceProperties(serviceProperties);
+		cap.afterPropertiesSet();
+		String ticket = "ST-456";
+		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
+				.unauthenticated(CasAuthenticationFilter.CAS_STATELESS_IDENTIFIER, ticket);
+		Authentication result = cap.authenticate(token);
+		verify(validator).validate(ticket, serviceProperties.getService());
+		serviceProperties.setAuthenticateAllArtifacts(true);
+		result = cap.authenticate(token);
+		verify(validator, times(2)).validate(ticket, serviceProperties.getService());
+		token.setDetails(details);
+		result = cap.authenticate(token);
+		verify(validator).validate(ticket, serviceUrl);
+		serviceProperties.setAuthenticateAllArtifacts(false);
+		serviceProperties.setService(null);
+		cap.setServiceProperties(serviceProperties);
+		cap.afterPropertiesSet();
+		result = cap.authenticate(token);
+		verify(validator, times(2)).validate(ticket, serviceUrl);
+		token.setDetails(new WebAuthenticationDetails(new MockHttpServletRequest()));
+		assertThatIllegalStateException().isThrownBy(() -> cap.authenticate(token));
+		cap.setServiceProperties(null);
+		cap.afterPropertiesSet();
+		assertThatIllegalStateException().isThrownBy(() -> cap.authenticate(token));
+	}
+
+	@Test
+	public void missingTicketIdIsDetected() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		StatelessTicketCache cache = new MockStatelessTicketCache();
+		cap.setStatelessTicketCache(cache);
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		cap.afterPropertiesSet();
+		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
+				.unauthenticated(CasAuthenticationFilter.CAS_STATEFUL_IDENTIFIER, "");
+		assertThatExceptionOfType(BadCredentialsException.class).isThrownBy(() -> cap.authenticate(token));
+	}
+
+	@Test
+	public void invalidKeyIsDetected() throws Exception {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		StatelessTicketCache cache = new MockStatelessTicketCache();
+		cap.setStatelessTicketCache(cache);
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		cap.afterPropertiesSet();
+		CasAuthenticationToken token = new CasAuthenticationToken("WRONG_KEY", makeUserDetails(), "credentials",
+				AuthorityUtils.createAuthorityList("XX"), makeUserDetails(), assertion);
+		assertThatExceptionOfType(BadCredentialsException.class).isThrownBy(() -> cap.authenticate(token));
+	}
+
+	@Test
+	public void detectsMissingAuthoritiesPopulator() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setKey("qwerty");
+		cap.setStatelessTicketCache(new MockStatelessTicketCache());
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		assertThatIllegalArgumentException().isThrownBy(() -> cap.afterPropertiesSet());
+	}
+
+	@Test
+	public void detectsMissingKey() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setStatelessTicketCache(new MockStatelessTicketCache());
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		assertThatIllegalArgumentException().isThrownBy(() -> cap.afterPropertiesSet());
+	}
+
+	@Test
+	public void detectsMissingStatelessTicketCache() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		// set this explicitly to null to test failure
+		cap.setStatelessTicketCache(null);
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		assertThatIllegalArgumentException().isThrownBy(() -> cap.afterPropertiesSet());
+	}
+
+	@Test
+	public void detectsMissingTicketValidator() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		cap.setStatelessTicketCache(new MockStatelessTicketCache());
+		cap.setServiceProperties(makeServiceProperties());
+		assertThatIllegalArgumentException().isThrownBy(() -> cap.afterPropertiesSet());
+	}
+
+	@Test
+	public void gettersAndSettersMatch() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		cap.setStatelessTicketCache(new MockStatelessTicketCache());
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		cap.afterPropertiesSet();
+		// TODO disabled because why do we need to expose this?
+		// assertThat(cap.getUserDetailsService() != null).isTrue();
+		assertThat(cap.getKey()).isEqualTo("qwerty");
+		assertThat(cap.getStatelessTicketCache() != null).isTrue();
+		assertThat(cap.getTicketValidator() != null).isTrue();
+	}
+
+	@Test
+	public void ignoresClassesItDoesNotSupport() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		cap.setStatelessTicketCache(new MockStatelessTicketCache());
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		cap.afterPropertiesSet();
+		TestingAuthenticationToken token = new TestingAuthenticationToken("user", "password", "ROLE_A");
+		assertThat(cap.supports(TestingAuthenticationToken.class)).isFalse();
+		// Try it anyway
+		assertThat(cap.authenticate(token)).isNull();
+	}
+
+	@Test
+	public void ignoresUsernamePasswordAuthenticationTokensWithoutCasIdentifiersAsPrincipal() throws Exception {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		cap.setAuthenticationUserDetailsService(new MockAuthoritiesPopulator());
+		cap.setKey("qwerty");
+		cap.setStatelessTicketCache(new MockStatelessTicketCache());
+		cap.setTicketValidator(new MockTicketValidator(true));
+		cap.setServiceProperties(makeServiceProperties());
+		cap.afterPropertiesSet();
+		UsernamePasswordAuthenticationToken token = UsernamePasswordAuthenticationToken
+				.authenticated("some_normal_user", "password", AuthorityUtils.createAuthorityList("ROLE_A"));
+		assertThat(cap.authenticate(token)).isNull();
+	}
+
+	@Test
+	public void supportsRequiredTokens() {
+		CasAuthenticationProvider cap = new CasAuthenticationProvider();
+		assertThat(cap.supports(UsernamePasswordAuthenticationToken.class)).isTrue();
+		assertThat(cap.supports(CasAuthenticationToken.class)).isTrue();
+	}
+
+	private class MockAuthoritiesPopulator implements AuthenticationUserDetailsService {
+
+		@Override
+		public UserDetails loadUserDetails(final Authentication token) throws UsernameNotFoundException {
+			return makeUserDetailsFromAuthoritiesPopulator();
+		}
+
+	}
+
+	private class MockStatelessTicketCache implements StatelessTicketCache {
+
+		private Map<String, CasAuthenticationToken> cache = new HashMap<>();
+
+		@Override
+		public CasAuthenticationToken getByTicketId(String serviceTicket) {
+			return this.cache.get(serviceTicket);
+		}
+
+		@Override
+		public void putTicketInCache(CasAuthenticationToken token) {
+			this.cache.put(token.getCredentials().toString(), token);
+		}
+
+		@Override
+		public void removeTicketFromCache(CasAuthenticationToken token) {
+			throw new UnsupportedOperationException("mock method not implemented");
+		}
+
+		@Override
+		public void removeTicketFromCache(String serviceTicket) {
+			throw new UnsupportedOperationException("mock method not implemented");
+		}
+
+	}
+
+	private class MockTicketValidator implements TicketValidator {
+
+		private boolean returnTicket;
+
+		MockTicketValidator(boolean returnTicket) {
+			this.returnTicket = returnTicket;
+		}
+
+		@Override
+		public Assertion validate(final String ticket, final String service) {
+			if (this.returnTicket) {
+				return new AssertionImpl("rod");
+			}
+			throw new BadCredentialsException("As requested from mock");
+		}
+
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/authentication/CasAuthenticationTokenTests.java

@@ -0,0 +1,169 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import java.util.Collections;
+import java.util.List;
+
+import org.jasig.cas.client.validation.Assertion;
+import org.jasig.cas.client.validation.AssertionImpl;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests {@link CasAuthenticationToken}.
+ *
+ * @author Ben Alex
+ */
+public class CasAuthenticationTokenTests {
+
+	private final List<GrantedAuthority> ROLES = AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO");
+
+	private UserDetails makeUserDetails() {
+		return makeUserDetails("user");
+	}
+
+	private UserDetails makeUserDetails(final String name) {
+		return new User(name, "password", true, true, true, true, this.ROLES);
+	}
+
+	@Test
+	public void testConstructorRejectsNulls() {
+		Assertion assertion = new AssertionImpl("test");
+		assertThatIllegalArgumentException().isThrownBy(() -> new CasAuthenticationToken(null, makeUserDetails(),
+				"Password", this.ROLES, makeUserDetails(), assertion));
+		assertThatIllegalArgumentException().isThrownBy(
+				() -> new CasAuthenticationToken("key", null, "Password", this.ROLES, makeUserDetails(), assertion));
+		assertThatIllegalArgumentException().isThrownBy(() -> new CasAuthenticationToken("key", makeUserDetails(), null,
+				this.ROLES, makeUserDetails(), assertion));
+		assertThatIllegalArgumentException().isThrownBy(() -> new CasAuthenticationToken("key", makeUserDetails(),
+				"Password", this.ROLES, makeUserDetails(), null));
+		assertThatIllegalArgumentException().isThrownBy(
+				() -> new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES, null, assertion));
+		assertThatIllegalArgumentException().isThrownBy(() -> new CasAuthenticationToken("key", makeUserDetails(),
+				"Password", AuthorityUtils.createAuthorityList("ROLE_1", null), makeUserDetails(), assertion));
+	}
+
+	@Test
+	public void constructorWhenEmptyKeyThenThrowsException() {
+		assertThatIllegalArgumentException().isThrownBy(
+				() -> new CasAuthenticationToken("", "user", "password", Collections.<GrantedAuthority>emptyList(),
+						new User("user", "password", Collections.<GrantedAuthority>emptyList()), null));
+	}
+
+	@Test
+	public void testEqualsWhenEqual() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token1 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		CasAuthenticationToken token2 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		assertThat(token2).isEqualTo(token1);
+	}
+
+	@Test
+	public void testGetters() {
+		// Build the proxy list returned in the ticket from CAS
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		assertThat(token.getKeyHash()).isEqualTo("key".hashCode());
+		assertThat(token.getPrincipal()).isEqualTo(makeUserDetails());
+		assertThat(token.getCredentials()).isEqualTo("Password");
+		assertThat(token.getAuthorities()).contains(new SimpleGrantedAuthority("ROLE_ONE"));
+		assertThat(token.getAuthorities()).contains(new SimpleGrantedAuthority("ROLE_TWO"));
+		assertThat(token.getAssertion()).isEqualTo(assertion);
+		assertThat(token.getUserDetails().getUsername()).isEqualTo(makeUserDetails().getUsername());
+	}
+
+	@Test
+	public void testNoArgConstructorDoesntExist() {
+		assertThatExceptionOfType(NoSuchMethodException.class)
+				.isThrownBy(() -> CasAuthenticationToken.class.getDeclaredConstructor((Class[]) null));
+	}
+
+	@Test
+	public void testNotEqualsDueToAbstractParentEqualsCheck() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token1 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		CasAuthenticationToken token2 = new CasAuthenticationToken("key", makeUserDetails("OTHER_NAME"), "Password",
+				this.ROLES, makeUserDetails(), assertion);
+		assertThat(!token1.equals(token2)).isTrue();
+	}
+
+	@Test
+	public void testNotEqualsDueToDifferentAuthenticationClass() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token1 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		UsernamePasswordAuthenticationToken token2 = UsernamePasswordAuthenticationToken.authenticated("Test",
+				"Password", this.ROLES);
+		assertThat(!token1.equals(token2)).isTrue();
+	}
+
+	@Test
+	public void testNotEqualsDueToKey() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token1 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		CasAuthenticationToken token2 = new CasAuthenticationToken("DIFFERENT_KEY", makeUserDetails(), "Password",
+				this.ROLES, makeUserDetails(), assertion);
+		assertThat(!token1.equals(token2)).isTrue();
+	}
+
+	@Test
+	public void testNotEqualsDueToAssertion() {
+		final Assertion assertion = new AssertionImpl("test");
+		final Assertion assertion2 = new AssertionImpl("test");
+		CasAuthenticationToken token1 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		CasAuthenticationToken token2 = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion2);
+		assertThat(!token1.equals(token2)).isTrue();
+	}
+
+	@Test
+	public void testSetAuthenticated() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		assertThat(token.isAuthenticated()).isTrue();
+		token.setAuthenticated(false);
+		assertThat(!token.isAuthenticated()).isTrue();
+	}
+
+	@Test
+	public void testToString() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		String result = token.toString();
+		assertThat(result.lastIndexOf("Credentials (Service/Proxy Ticket):") != -1).isTrue();
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/authentication/EhCacheBasedTicketCacheTests.java

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import net.sf.ehcache.Cache;
+import net.sf.ehcache.CacheManager;
+import net.sf.ehcache.Ehcache;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests {@link EhCacheBasedTicketCache}.
+ *
+ * @author Ben Alex
+ */
+public class EhCacheBasedTicketCacheTests extends AbstractStatelessTicketCacheTests {
+
+	private static CacheManager cacheManager;
+
+	@BeforeAll
+	public static void initCacheManaer() {
+		cacheManager = CacheManager.create();
+		cacheManager.addCache(new Cache("castickets", 500, false, false, 30, 30));
+	}
+
+	@AfterAll
+	public static void shutdownCacheManager() {
+		cacheManager.removalAll();
+		cacheManager.shutdown();
+	}
+
+	@Test
+	public void testCacheOperation() throws Exception {
+		EhCacheBasedTicketCache cache = new EhCacheBasedTicketCache();
+		cache.setCache(cacheManager.getCache("castickets"));
+		cache.afterPropertiesSet();
+		final CasAuthenticationToken token = getToken();
+		// Check it gets stored in the cache
+		cache.putTicketInCache(token);
+		assertThat(cache.getByTicketId("ST-0-ER94xMJmn6pha35CQRoZ")).isEqualTo(token);
+		// Check it gets removed from the cache
+		cache.removeTicketFromCache(getToken());
+		assertThat(cache.getByTicketId("ST-0-ER94xMJmn6pha35CQRoZ")).isNull();
+		// Check it doesn't return values for null or unknown service tickets
+		assertThat(cache.getByTicketId(null)).isNull();
+		assertThat(cache.getByTicketId("UNKNOWN_SERVICE_TICKET")).isNull();
+	}
+
+	@Test
+	public void testStartupDetectsMissingCache() throws Exception {
+		EhCacheBasedTicketCache cache = new EhCacheBasedTicketCache();
+		assertThatIllegalArgumentException().isThrownBy(cache::afterPropertiesSet);
+		Ehcache myCache = cacheManager.getCache("castickets");
+		cache.setCache(myCache);
+		assertThat(cache.getCache()).isEqualTo(myCache);
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/authentication/NullStatelessTicketCacheTests.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Test cases for the @link {@link NullStatelessTicketCache}
+ *
+ * @author Scott Battaglia
+ *
+ */
+public class NullStatelessTicketCacheTests extends AbstractStatelessTicketCacheTests {
+
+	private StatelessTicketCache cache = new NullStatelessTicketCache();
+
+	@Test
+	public void testGetter() {
+		assertThat(this.cache.getByTicketId(null)).isNull();
+		assertThat(this.cache.getByTicketId("test")).isNull();
+	}
+
+	@Test
+	public void testInsertAndGet() {
+		final CasAuthenticationToken token = getToken();
+		this.cache.putTicketInCache(token);
+		assertThat(this.cache.getByTicketId((String) token.getCredentials())).isNull();
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/authentication/SpringCacheBasedTicketCacheTests.java

@@ -0,0 +1,65 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.authentication;
+
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.cache.CacheManager;
+import org.springframework.cache.concurrent.ConcurrentMapCacheManager;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests
+ * {@link org.springframework.security.cas.authentication.SpringCacheBasedTicketCache}.
+ *
+ * @author Marten Deinum
+ * @since 3.2
+ */
+public class SpringCacheBasedTicketCacheTests extends AbstractStatelessTicketCacheTests {
+
+	private static CacheManager cacheManager;
+
+	@BeforeAll
+	public static void initCacheManaer() {
+		cacheManager = new ConcurrentMapCacheManager();
+		cacheManager.getCache("castickets");
+	}
+
+	@Test
+	public void testCacheOperation() throws Exception {
+		SpringCacheBasedTicketCache cache = new SpringCacheBasedTicketCache(cacheManager.getCache("castickets"));
+		final CasAuthenticationToken token = getToken();
+		// Check it gets stored in the cache
+		cache.putTicketInCache(token);
+		assertThat(cache.getByTicketId("ST-0-ER94xMJmn6pha35CQRoZ")).isEqualTo(token);
+		// Check it gets removed from the cache
+		cache.removeTicketFromCache(getToken());
+		assertThat(cache.getByTicketId("ST-0-ER94xMJmn6pha35CQRoZ")).isNull();
+		// Check it doesn't return values for null or unknown service tickets
+		assertThat(cache.getByTicketId(null)).isNull();
+		assertThat(cache.getByTicketId("UNKNOWN_SERVICE_TICKET")).isNull();
+	}
+
+	@Test
+	public void testStartupDetectsMissingCache() throws Exception {
+		assertThatIllegalArgumentException().isThrownBy(() -> new SpringCacheBasedTicketCache(null));
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/jackson2/CasAuthenticationTokenMixinTests.java

@@ -0,0 +1,153 @@
+/*
+ * Copyright 2015-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.jackson2;
+
+import java.io.IOException;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Date;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.jasig.cas.client.authentication.AttributePrincipalImpl;
+import org.jasig.cas.client.validation.Assertion;
+import org.jasig.cas.client.validation.AssertionImpl;
+import org.json.JSONException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.skyscreamer.jsonassert.JSONAssert;
+
+import org.springframework.security.cas.authentication.CasAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.jackson2.SecurityJackson2Modules;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * @author Jitendra Singh
+ * @since 4.2
+ */
+public class CasAuthenticationTokenMixinTests {
+
+	private static final String KEY = "casKey";
+
+	private static final String PASSWORD = "\"1234\"";
+
+	private static final Date START_DATE = new Date();
+
+	private static final Date END_DATE = new Date();
+
+	public static final String AUTHORITY_JSON = "{\"@class\": \"org.springframework.security.core.authority.SimpleGrantedAuthority\", \"authority\": \"ROLE_USER\"}";
+
+	public static final String AUTHORITIES_SET_JSON = "[\"java.util.Collections$UnmodifiableSet\", [" + AUTHORITY_JSON
+			+ "]]";
+
+	public static final String AUTHORITIES_ARRAYLIST_JSON = "[\"java.util.Collections$UnmodifiableRandomAccessList\", ["
+			+ AUTHORITY_JSON + "]]";
+
+	// @formatter:off
+	public static final String USER_JSON = "{"
+		+ "\"@class\": \"org.springframework.security.core.userdetails.User\", "
+		+ "\"username\": \"admin\","
+		+ " \"password\": " + PASSWORD + ", "
+		+ "\"accountNonExpired\": true, "
+		+ "\"accountNonLocked\": true, "
+		+ "\"credentialsNonExpired\": true, "
+		+ "\"enabled\": true, "
+		+ "\"authorities\": " + AUTHORITIES_SET_JSON
+	+ "}";
+	// @formatter:on
+	private static final String CAS_TOKEN_JSON = "{"
+			+ "\"@class\": \"org.springframework.security.cas.authentication.CasAuthenticationToken\", "
+			+ "\"keyHash\": " + KEY.hashCode() + "," + "\"principal\": " + USER_JSON + ", " + "\"credentials\": "
+			+ PASSWORD + ", " + "\"authorities\": " + AUTHORITIES_ARRAYLIST_JSON + "," + "\"userDetails\": " + USER_JSON
+			+ "," + "\"authenticated\": true, " + "\"details\": null," + "\"assertion\": {"
+			+ "\"@class\": \"org.jasig.cas.client.validation.AssertionImpl\", " + "\"principal\": {"
+			+ "\"@class\": \"org.jasig.cas.client.authentication.AttributePrincipalImpl\", "
+			+ "\"name\": \"assertName\", " + "\"attributes\": {\"@class\": \"java.util.Collections$EmptyMap\"}, "
+			+ "\"proxyGrantingTicket\": null, " + "\"proxyRetriever\": null" + "}, "
+			+ "\"validFromDate\": [\"java.util.Date\", " + START_DATE.getTime() + "], "
+			+ "\"validUntilDate\": [\"java.util.Date\", " + END_DATE.getTime() + "],"
+			+ "\"authenticationDate\": [\"java.util.Date\", " + START_DATE.getTime() + "], "
+			+ "\"attributes\": {\"@class\": \"java.util.Collections$EmptyMap\"}" + "}" + "}";
+
+	private static final String CAS_TOKEN_CLEARED_JSON = CAS_TOKEN_JSON.replaceFirst(PASSWORD, "null");
+
+	protected ObjectMapper mapper;
+
+	@BeforeEach
+	public void setup() {
+		this.mapper = new ObjectMapper();
+		ClassLoader loader = getClass().getClassLoader();
+		this.mapper.registerModules(SecurityJackson2Modules.getModules(loader));
+	}
+
+	@Test
+	public void serializeCasAuthenticationTest() throws JsonProcessingException, JSONException {
+		CasAuthenticationToken token = createCasAuthenticationToken();
+		String actualJson = this.mapper.writeValueAsString(token);
+		JSONAssert.assertEquals(CAS_TOKEN_JSON, actualJson, true);
+	}
+
+	@Test
+	public void serializeCasAuthenticationTestAfterEraseCredentialInvoked()
+			throws JsonProcessingException, JSONException {
+		CasAuthenticationToken token = createCasAuthenticationToken();
+		token.eraseCredentials();
+		String actualJson = this.mapper.writeValueAsString(token);
+		JSONAssert.assertEquals(CAS_TOKEN_CLEARED_JSON, actualJson, true);
+	}
+
+	@Test
+	public void deserializeCasAuthenticationTestAfterEraseCredentialInvoked() throws Exception {
+		CasAuthenticationToken token = this.mapper.readValue(CAS_TOKEN_CLEARED_JSON, CasAuthenticationToken.class);
+		assertThat(((UserDetails) token.getPrincipal()).getPassword()).isNull();
+	}
+
+	@Test
+	public void deserializeCasAuthenticationTest() throws IOException {
+		CasAuthenticationToken token = this.mapper.readValue(CAS_TOKEN_JSON, CasAuthenticationToken.class);
+		assertThat(token).isNotNull();
+		assertThat(token.getPrincipal()).isNotNull().isInstanceOf(User.class);
+		assertThat(((User) token.getPrincipal()).getUsername()).isEqualTo("admin");
+		assertThat(((User) token.getPrincipal()).getPassword()).isEqualTo("1234");
+		assertThat(token.getUserDetails()).isNotNull().isInstanceOf(User.class);
+		assertThat(token.getAssertion()).isNotNull().isInstanceOf(AssertionImpl.class);
+		assertThat(token.getKeyHash()).isEqualTo(KEY.hashCode());
+		assertThat(token.getUserDetails().getAuthorities()).extracting(GrantedAuthority::getAuthority)
+				.containsOnly("ROLE_USER");
+		assertThat(token.getAssertion().getAuthenticationDate()).isEqualTo(START_DATE);
+		assertThat(token.getAssertion().getValidFromDate()).isEqualTo(START_DATE);
+		assertThat(token.getAssertion().getValidUntilDate()).isEqualTo(END_DATE);
+		assertThat(token.getAssertion().getPrincipal().getName()).isEqualTo("assertName");
+		assertThat(token.getAssertion().getAttributes()).hasSize(0);
+	}
+
+	private CasAuthenticationToken createCasAuthenticationToken() {
+		User principal = new User("admin", "1234", Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER")));
+		Collection<? extends GrantedAuthority> authorities = Collections
+				.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
+		Assertion assertion = new AssertionImpl(new AttributePrincipalImpl("assertName"), START_DATE, END_DATE,
+				START_DATE, Collections.<String, Object>emptyMap());
+		return new CasAuthenticationToken(KEY, principal, principal.getPassword(), authorities,
+				new User("admin", "1234", authorities), assertion);
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsServiceTests.java

@@ -0,0 +1,63 @@
+/*
+ * Copyright 2002-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.userdetails;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+import org.jasig.cas.client.authentication.AttributePrincipal;
+import org.jasig.cas.client.validation.Assertion;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.security.cas.authentication.CasAssertionAuthenticationToken;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.userdetails.UserDetails;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.mock;
+
+/**
+ * @author Luke Taylor
+ */
+public class GrantedAuthorityFromAssertionAttributesUserDetailsServiceTests {
+
+	@Test
+	public void correctlyExtractsNamedAttributesFromAssertionAndConvertsThemToAuthorities() {
+		GrantedAuthorityFromAssertionAttributesUserDetailsService uds = new GrantedAuthorityFromAssertionAttributesUserDetailsService(
+				new String[] { "a", "b", "c", "d" });
+		uds.setConvertToUpperCase(false);
+		Assertion assertion = mock(Assertion.class);
+		AttributePrincipal principal = mock(AttributePrincipal.class);
+		Map<String, Object> attributes = new HashMap<>();
+		attributes.put("a", Arrays.asList("role_a1", "role_a2"));
+		attributes.put("b", "role_b");
+		attributes.put("c", "role_c");
+		attributes.put("d", null);
+		attributes.put("someother", "unused");
+		given(assertion.getPrincipal()).willReturn(principal);
+		given(principal.getAttributes()).willReturn(attributes);
+		given(principal.getName()).willReturn("somebody");
+		CasAssertionAuthenticationToken token = new CasAssertionAuthenticationToken(assertion, "ticket");
+		UserDetails user = uds.loadUserDetails(token);
+		Set<String> roles = AuthorityUtils.authorityListToSet(user.getAuthorities());
+		assertThat(roles).containsExactlyInAnyOrder("role_a1", "role_a2", "role_b", "role_c");
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationEntryPointTests.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web;
+
+import java.net.URLEncoder;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.cas.ServiceProperties;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests {@link CasAuthenticationEntryPoint}.
+ *
+ * @author Ben Alex
+ */
+public class CasAuthenticationEntryPointTests {
+
+	@Test
+	public void testDetectsMissingLoginFormUrl() throws Exception {
+		CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
+		ep.setServiceProperties(new ServiceProperties());
+		assertThatIllegalArgumentException().isThrownBy(ep::afterPropertiesSet)
+				.withMessage("loginUrl must be specified");
+	}
+
+	@Test
+	public void testDetectsMissingServiceProperties() throws Exception {
+		CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
+		ep.setLoginUrl("https://cas/login");
+		assertThatIllegalArgumentException().isThrownBy(ep::afterPropertiesSet)
+				.withMessage("serviceProperties must be specified");
+	}
+
+	@Test
+	public void testGettersSetters() {
+		CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
+		ep.setLoginUrl("https://cas/login");
+		assertThat(ep.getLoginUrl()).isEqualTo("https://cas/login");
+		ep.setServiceProperties(new ServiceProperties());
+		assertThat(ep.getServiceProperties() != null).isTrue();
+	}
+
+	@Test
+	public void testNormalOperationWithRenewFalse() throws Exception {
+		ServiceProperties sp = new ServiceProperties();
+		sp.setSendRenew(false);
+		sp.setService("https://mycompany.com/bigWebApp/login/cas");
+		CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
+		ep.setLoginUrl("https://cas/login");
+		ep.setServiceProperties(sp);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setRequestURI("/some_path");
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		ep.afterPropertiesSet();
+		ep.commence(request, response, null);
+		assertThat(
+				"https://cas/login?service=" + URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8"))
+						.isEqualTo(response.getRedirectedUrl());
+	}
+
+	@Test
+	public void testNormalOperationWithRenewTrue() throws Exception {
+		ServiceProperties sp = new ServiceProperties();
+		sp.setSendRenew(true);
+		sp.setService("https://mycompany.com/bigWebApp/login/cas");
+		CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
+		ep.setLoginUrl("https://cas/login");
+		ep.setServiceProperties(sp);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setRequestURI("/some_path");
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		ep.afterPropertiesSet();
+		ep.commence(request, response, null);
+		assertThat("https://cas/login?service="
+				+ URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8") + "&renew=true")
+						.isEqualTo(response.getRedirectedUrl());
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java

@@ -0,0 +1,234 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web;
+
+import javax.servlet.FilterChain;
+
+import org.jasig.cas.client.proxy.ProxyGrantingTicketStorage;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.context.SecurityContextRepository;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+
+/**
+ * Tests {@link CasAuthenticationFilter}.
+ *
+ * @author Ben Alex
+ * @author Rob Winch
+ */
+public class CasAuthenticationFilterTests {
+
+	@AfterEach
+	public void tearDown() {
+		SecurityContextHolder.clearContext();
+	}
+
+	@Test
+	public void testGettersSetters() {
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+		filter.setProxyReceptorUrl("/someurl");
+		filter.setServiceProperties(new ServiceProperties());
+	}
+
+	@Test
+	public void testNormalOperation() throws Exception {
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setServletPath("/login/cas");
+		request.addParameter("ticket", "ST-0-ER94xMJmn6pha35CQRoZ");
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		filter.setAuthenticationManager((a) -> a);
+		assertThat(filter.requiresAuthentication(request, new MockHttpServletResponse())).isTrue();
+		Authentication result = filter.attemptAuthentication(request, new MockHttpServletResponse());
+		assertThat(result != null).isTrue();
+	}
+
+	@Test
+	public void testNullServiceTicketHandledGracefully() throws Exception {
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		filter.setAuthenticationManager((a) -> {
+			throw new BadCredentialsException("Rejected");
+		});
+		assertThatExceptionOfType(AuthenticationException.class).isThrownBy(
+				() -> filter.attemptAuthentication(new MockHttpServletRequest(), new MockHttpServletResponse()));
+	}
+
+	@Test
+	public void testRequiresAuthenticationFilterProcessUrl() {
+		String url = "/login/cas";
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		filter.setFilterProcessesUrl(url);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		request.setServletPath(url);
+		assertThat(filter.requiresAuthentication(request, response)).isTrue();
+	}
+
+	@Test
+	public void testRequiresAuthenticationProxyRequest() {
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		request.setServletPath("/pgtCallback");
+		assertThat(filter.requiresAuthentication(request, response)).isFalse();
+		filter.setProxyReceptorUrl(request.getServletPath());
+		assertThat(filter.requiresAuthentication(request, response)).isFalse();
+		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+		assertThat(filter.requiresAuthentication(request, response)).isTrue();
+		request.setServletPath("/other");
+		assertThat(filter.requiresAuthentication(request, response)).isFalse();
+	}
+
+	@Test
+	public void testRequiresAuthenticationAuthAll() {
+		ServiceProperties properties = new ServiceProperties();
+		properties.setAuthenticateAllArtifacts(true);
+		String url = "/login/cas";
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		filter.setFilterProcessesUrl(url);
+		filter.setServiceProperties(properties);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		request.setServletPath(url);
+		assertThat(filter.requiresAuthentication(request, response)).isTrue();
+		request.setServletPath("/other");
+		assertThat(filter.requiresAuthentication(request, response)).isFalse();
+		request.setParameter(properties.getArtifactParameter(), "value");
+		assertThat(filter.requiresAuthentication(request, response)).isTrue();
+		SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("key", "principal",
+				AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
+		assertThat(filter.requiresAuthentication(request, response)).isTrue();
+		SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("un", "principal"));
+		assertThat(filter.requiresAuthentication(request, response)).isTrue();
+		SecurityContextHolder.getContext()
+				.setAuthentication(new TestingAuthenticationToken("un", "principal", "ROLE_ANONYMOUS"));
+		assertThat(filter.requiresAuthentication(request, response)).isFalse();
+	}
+
+	@Test
+	public void testAuthenticateProxyUrl() throws Exception {
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		request.setServletPath("/pgtCallback");
+		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+		filter.setProxyReceptorUrl(request.getServletPath());
+		assertThat(filter.attemptAuthentication(request, response)).isNull();
+	}
+
+	@Test
+	public void testDoFilterAuthenticateAll() throws Exception {
+		AuthenticationSuccessHandler successHandler = mock(AuthenticationSuccessHandler.class);
+		AuthenticationManager manager = mock(AuthenticationManager.class);
+		Authentication authentication = new TestingAuthenticationToken("un", "pwd", "ROLE_USER");
+		given(manager.authenticate(any(Authentication.class))).willReturn(authentication);
+		ServiceProperties serviceProperties = new ServiceProperties();
+		serviceProperties.setAuthenticateAllArtifacts(true);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setParameter("ticket", "ST-1-123");
+		request.setServletPath("/authenticate");
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain chain = mock(FilterChain.class);
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		filter.setServiceProperties(serviceProperties);
+		filter.setAuthenticationSuccessHandler(successHandler);
+		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+		filter.setAuthenticationManager(manager);
+		filter.afterPropertiesSet();
+		filter.doFilter(request, response, chain);
+		assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull()
+				.withFailMessage("Authentication should not be null");
+		verify(chain).doFilter(request, response);
+		verifyNoMoreInteractions(successHandler);
+		// validate for when the filterProcessUrl matches
+		filter.setFilterProcessesUrl(request.getServletPath());
+		SecurityContextHolder.clearContext();
+		filter.doFilter(request, response, chain);
+		verifyNoMoreInteractions(chain);
+		verify(successHandler).onAuthenticationSuccess(request, response, authentication);
+	}
+
+	@Test
+	public void testSecurityContextHolder() throws Exception {
+		SecurityContextRepository securityContextRepository = mock(SecurityContextRepository.class);
+		AuthenticationManager manager = mock(AuthenticationManager.class);
+		Authentication authentication = new TestingAuthenticationToken("un", "pwd", "ROLE_USER");
+		given(manager.authenticate(any(Authentication.class))).willReturn(authentication);
+		ServiceProperties serviceProperties = new ServiceProperties();
+		serviceProperties.setAuthenticateAllArtifacts(true);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setParameter("ticket", "ST-1-123");
+		request.setServletPath("/authenticate");
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain chain = mock(FilterChain.class);
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		filter.setServiceProperties(serviceProperties);
+		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+		filter.setAuthenticationManager(manager);
+		filter.setSecurityContextRepository(securityContextRepository);
+		filter.afterPropertiesSet();
+		filter.doFilter(request, response, chain);
+		assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull()
+				.withFailMessage("Authentication should not be null");
+		verify(chain).doFilter(request, response);
+		// validate for when the filterProcessUrl matches
+		filter.setFilterProcessesUrl(request.getServletPath());
+		SecurityContextHolder.clearContext();
+		filter.doFilter(request, response, chain);
+		ArgumentCaptor<SecurityContext> contextArg = ArgumentCaptor.forClass(SecurityContext.class);
+		verify(securityContextRepository).saveContext(contextArg.capture(), eq(request), eq(response));
+		assertThat(contextArg.getValue().getAuthentication().getPrincipal()).isEqualTo(authentication.getName());
+	}
+
+	// SEC-1592
+	@Test
+	public void testChainNotInvokedForProxyReceptor() throws Exception {
+		CasAuthenticationFilter filter = new CasAuthenticationFilter();
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain chain = mock(FilterChain.class);
+		request.setServletPath("/pgtCallback");
+		filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+		filter.setProxyReceptorUrl(request.getServletPath());
+		filter.doFilter(request, response, chain);
+		verifyNoMoreInteractions(chain);
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/web/ServicePropertiesTests.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.security.cas.SamlServiceProperties;
+import org.springframework.security.cas.ServiceProperties;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests {@link ServiceProperties}.
+ *
+ * @author Ben Alex
+ */
+public class ServicePropertiesTests {
+
+	@Test
+	public void detectsMissingService() throws Exception {
+		ServiceProperties sp = new ServiceProperties();
+		assertThatIllegalArgumentException().isThrownBy(sp::afterPropertiesSet);
+	}
+
+	@Test
+	public void nullServiceWhenAuthenticateAllTokens() throws Exception {
+		ServiceProperties sp = new ServiceProperties();
+		sp.setAuthenticateAllArtifacts(true);
+		assertThatIllegalArgumentException().isThrownBy(sp::afterPropertiesSet);
+		sp.setAuthenticateAllArtifacts(false);
+		assertThatIllegalArgumentException().isThrownBy(sp::afterPropertiesSet);
+	}
+
+	@Test
+	public void testGettersSetters() throws Exception {
+		ServiceProperties[] sps = { new ServiceProperties(), new SamlServiceProperties() };
+		for (ServiceProperties sp : sps) {
+			sp.setSendRenew(false);
+			assertThat(sp.isSendRenew()).isFalse();
+			sp.setSendRenew(true);
+			assertThat(sp.isSendRenew()).isTrue();
+			sp.setArtifactParameter("notticket");
+			assertThat(sp.getArtifactParameter()).isEqualTo("notticket");
+			sp.setServiceParameter("notservice");
+			assertThat(sp.getServiceParameter()).isEqualTo("notservice");
+			sp.setService("https://mycompany.com/service");
+			assertThat(sp.getService()).isEqualTo("https://mycompany.com/service");
+			sp.afterPropertiesSet();
+		}
+	}
+
+}

cas/src/test/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetailsTests.java

@@ -0,0 +1,132 @@
+/*
+ * Copyright 2011-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.cas.web.authentication;
+
+import java.util.regex.Pattern;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.context.support.GenericXmlApplicationContext;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.web.util.UrlUtils;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * @author Rob Winch
+ */
+public class DefaultServiceAuthenticationDetailsTests {
+
+	private DefaultServiceAuthenticationDetails details;
+
+	private MockHttpServletRequest request;
+
+	private Pattern artifactPattern;
+
+	private String casServiceUrl;
+
+	private ConfigurableApplicationContext context;
+
+	@BeforeEach
+	public void setUp() {
+		this.casServiceUrl = "https://localhost:8443/j_spring_security_cas";
+		this.request = new MockHttpServletRequest();
+		this.request.setScheme("https");
+		this.request.setServerName("localhost");
+		this.request.setServerPort(8443);
+		this.request.setRequestURI("/cas-sample/secure/");
+		this.artifactPattern = DefaultServiceAuthenticationDetails
+				.createArtifactPattern(ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
+	}
+
+	@AfterEach
+	public void cleanup() {
+		if (this.context != null) {
+			this.context.close();
+		}
+	}
+
+	@Test
+	public void getServiceUrlNullQuery() throws Exception {
+		this.details = new DefaultServiceAuthenticationDetails(this.casServiceUrl, this.request, this.artifactPattern);
+		assertThat(this.details.getServiceUrl()).isEqualTo(UrlUtils.buildFullRequestUrl(this.request));
+	}
+
+	@Test
+	public void getServiceUrlTicketOnlyParam() throws Exception {
+		this.request.setQueryString("ticket=123");
+		this.details = new DefaultServiceAuthenticationDetails(this.casServiceUrl, this.request, this.artifactPattern);
+		String serviceUrl = this.details.getServiceUrl();
+		this.request.setQueryString(null);
+		assertThat(serviceUrl).isEqualTo(UrlUtils.buildFullRequestUrl(this.request));
+	}
+
+	@Test
+	public void getServiceUrlTicketFirstMultiParam() throws Exception {
+		this.request.setQueryString("ticket=123&other=value");
+		this.details = new DefaultServiceAuthenticationDetails(this.casServiceUrl, this.request, this.artifactPattern);
+		String serviceUrl = this.details.getServiceUrl();
+		this.request.setQueryString("other=value");
+		assertThat(serviceUrl).isEqualTo(UrlUtils.buildFullRequestUrl(this.request));
+	}
+
+	@Test
+	public void getServiceUrlTicketLastMultiParam() throws Exception {
+		this.request.setQueryString("other=value&ticket=123");
+		this.details = new DefaultServiceAuthenticationDetails(this.casServiceUrl, this.request, this.artifactPattern);
+		String serviceUrl = this.details.getServiceUrl();
+		this.request.setQueryString("other=value");
+		assertThat(serviceUrl).isEqualTo(UrlUtils.buildFullRequestUrl(this.request));
+	}
+
+	@Test
+	public void getServiceUrlTicketMiddleMultiParam() throws Exception {
+		this.request.setQueryString("other=value&ticket=123&last=this");
+		this.details = new DefaultServiceAuthenticationDetails(this.casServiceUrl, this.request, this.artifactPattern);
+		String serviceUrl = this.details.getServiceUrl();
+		this.request.setQueryString("other=value&last=this");
+		assertThat(serviceUrl).isEqualTo(UrlUtils.buildFullRequestUrl(this.request));
+	}
+
+	@Test
+	public void getServiceUrlDoesNotUseHostHeader() throws Exception {
+		this.casServiceUrl = "https://example.com/j_spring_security_cas";
+		this.request.setServerName("evil.com");
+		this.details = new DefaultServiceAuthenticationDetails(this.casServiceUrl, this.request, this.artifactPattern);
+		assertThat(this.details.getServiceUrl()).isEqualTo("https://example.com/cas-sample/secure/");
+	}
+
+	@Test
+	public void getServiceUrlDoesNotUseHostHeaderExplicit() {
+		this.casServiceUrl = "https://example.com/j_spring_security_cas";
+		this.request.setServerName("evil.com");
+		ServiceAuthenticationDetails details = loadServiceAuthenticationDetails(
+				"defaultserviceauthenticationdetails-explicit.xml");
+		assertThat(details.getServiceUrl()).isEqualTo("https://example.com/cas-sample/secure/");
+	}
+
+	private ServiceAuthenticationDetails loadServiceAuthenticationDetails(String resourceName) {
+		this.context = new GenericXmlApplicationContext(getClass(), resourceName);
+		ServiceAuthenticationDetailsSource source = this.context.getBean(ServiceAuthenticationDetailsSource.class);
+		return source.buildDetails(this.request);
+	}
+
+}

cas/src/test/resources/logback-test.xml

@@ -0,0 +1,15 @@
+<configuration>
+	<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+	<encoder>
+		<pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+	</encoder>
+	</appender>
+
+	<logger name="org.springframework.security" level="${sec.log.level:-WARN}"/>
+
+
+	<root level="${root.level:-WARN}">
+	<appender-ref ref="STDOUT" />
+	</root>
+
+</configuration>

cas/src/test/resources/org/springframework/security/cas/web/authentication/defaultserviceauthenticationdetails-explicit.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	   xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
+	   xsi:schemaLocation="http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop https://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
+
+	<bean id="serviceProperties"
+		  class="org.springframework.security.cas.ServiceProperties">
+		<property name="service"
+				  value="https://example.com/j_spring_security_cas"/>
+		<property name="sendRenew" value="false"/>
+	</bean>
+	<bean id="serviceProperties2"
+		  class="org.springframework.security.cas.ServiceProperties">
+		<property name="service"
+				  value="https://example2.com/j_spring_security_cas"/>
+		<property name="sendRenew" value="false"/>
+	</bean>
+
+	<bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
+		<constructor-arg ref="serviceProperties"/>
+	</bean>
+</beans>

cas/src/test/resources/org/springframework/security/cas/web/authentication/defaultserviceauthenticationdetails-passivity.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	   xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
+	   xsi:schemaLocation="http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop https://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
+
+	<bean id="serviceProperties"
+		  class="org.springframework.security.cas.ServiceProperties">
+		<property name="service"
+				  value="https://example.com/j_spring_security_cas"/>
+		<property name="sendRenew" value="false"/>
+	</bean>
+
+	<bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
+</beans>

config/spring-security-config.gradle

@@ -23,6 +23,7 @@ dependencies {
 	optional project(':spring-security-oauth2-client')
 	optional project(':spring-security-oauth2-jose')
 	optional project(':spring-security-oauth2-resource-server')
+	optional project(':spring-security-openid')
 	optional project(':spring-security-rsocket')
 	optional project(':spring-security-web')
 	optional 'io.projectreactor:reactor-core'
@@ -41,15 +42,15 @@ dependencies {
 	provided 'jakarta.servlet:jakarta.servlet-api'
 
 	testImplementation project(':spring-security-aspects')
+	testImplementation project(':spring-security-cas')
 	testImplementation project(':spring-security-test')
 	testImplementation project(path : ':spring-security-core', configuration : 'tests')
 	testImplementation project(path : ':spring-security-ldap', configuration : 'tests')
 	testImplementation project(path : ':spring-security-oauth2-client', configuration : 'tests')
 	testImplementation project(path : ':spring-security-oauth2-resource-server', configuration : 'tests')
-	testImplementation project(':spring-security-saml2-service-provider')
 	testImplementation project(path : ':spring-security-saml2-service-provider', configuration : 'tests')
+	testImplementation project(path : ':spring-security-saml2-service-provider', configuration : 'opensaml4MainImplementation')
 	testImplementation project(path : ':spring-security-web', configuration : 'tests')
-	testImplementation "jakarta.inject:jakarta.inject-api"
 	testImplementation "org.assertj:assertj-core"
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testImplementation "org.junit.jupiter:junit-jupiter-params"
@@ -61,10 +62,10 @@ dependencies {
 	testImplementation 'ch.qos.logback:logback-classic'
 	testImplementation 'io.projectreactor.netty:reactor-netty'
 	testImplementation 'io.rsocket:rsocket-transport-netty'
-	testImplementation 'jakarta.annotation:jakarta.annotation-api'
+	testImplementation 'jakarta.annotation:jakarta.annotation-api:1.0'
+	testImplementation "jakarta.inject:jakarta.inject-api"
+	testImplementation "jakarta.transaction:jakarta.transaction-api"
 	testImplementation 'jakarta.xml.bind:jakarta.xml.bind-api'
-	testImplementation 'jakarta.websocket:jakarta.websocket-api'
-	testImplementation 'jakarta.websocket:jakarta.websocket-client-api'
 	testImplementation 'ldapsdk:ldapsdk:4.1'
 	testImplementation('net.sourceforge.htmlunit:htmlunit') {
 		exclude group: 'commons-logging', module: 'commons-logging'
@@ -76,11 +77,20 @@ dependencies {
 	testImplementation "org.apache.directory.server:apacheds-server-jndi"
 	testImplementation 'org.apache.directory.shared:shared-ldap'
 	testImplementation "com.unboundid:unboundid-ldapsdk"
-	testImplementation 'jakarta.persistence:jakarta.persistence-api'
-	testImplementation "org.hibernate.orm:hibernate-core"
+	testImplementation 'org.eclipse.persistence:javax.persistence'
+	testImplementation('org.hibernate:hibernate-entitymanager') {
+		exclude group: 'javax.activation', module: 'javax.activation-api'
+		exclude group: 'javax.persistence', module: 'javax.persistence-api'
+		exclude group: 'javax.xml.bind', module: 'jaxb-api'
+		exclude group: 'org.jboss.spec.javax.transaction', module: 'jboss-transaction-api_1.2_spec'
+	}
 	testImplementation 'org.hsqldb:hsqldb'
 	testImplementation 'org.mockito:mockito-core'
 	testImplementation "org.mockito:mockito-inline"
+	testImplementation ('org.openid4java:openid4java-nodeps') {
+		exclude group: 'com.google.code.guice', module: 'guice'
+		exclude group: 'commons-logging', module: 'commons-logging'
+	}
 	testImplementation('org.seleniumhq.selenium:htmlunit-driver') {
 		exclude group: 'commons-logging', module: 'commons-logging'
 	}
@@ -93,30 +103,16 @@ dependencies {
 	testImplementation 'org.springframework:spring-jdbc'
 	testImplementation 'org.springframework:spring-orm'
 	testImplementation 'org.springframework:spring-tx'
-	testImplementation 'org.springframework:spring-core-test'
 	testImplementation ('org.springframework.data:spring-data-jpa') {
 		exclude group: 'org.aspectj', module: 'aspectjrt'
 	}
 	testImplementation 'org.jetbrains.kotlinx:kotlinx-coroutines-core'
 	testImplementation 'org.jetbrains.kotlinx:kotlinx-coroutines-reactor'
 	testImplementation 'io.mockk:mockk'
-	testImplementation 'org.junit.platform:junit-platform-launcher'
-	testImplementation 'org.apache.maven.resolver:maven-resolver-connector-basic'
-	testImplementation ('org.apache.maven.resolver:maven-resolver-impl') {
-		exclude(group: "javax.annotation", module: "javax.annotation-api")
-	}
-	testImplementation ('org.apache.maven:maven-resolver-provider') {
-		exclude(group: "javax.inject", module: "javax.inject")
-		exclude(group: "javax.annotation", module: "javax.annotation-api")
-	}
-	testImplementation ('org.apache.maven.resolver:maven-resolver-transport-http') {
-		exclude group: "org.slf4j", module: "jcl-over-slf4j"
-	}
 
 	testRuntimeOnly 'org.hsqldb:hsqldb'
 }
 
-
 rncToXsd {
 	rncDir = file('src/main/resources/org/springframework/security/config/')
 	xsdDir = rncDir
@@ -125,11 +121,45 @@ rncToXsd {
 
 tasks.withType(KotlinCompile).configureEach {
 	kotlinOptions {
-		languageVersion = "1.7"
-		apiVersion = "1.7"
+		languageVersion = "1.3"
+		apiVersion = "1.3"
 		freeCompilerArgs = ["-Xjsr305=strict", "-Xsuppress-version-warnings"]
-		jvmTarget = "17"
+		jvmTarget = "1.8"
 	}
 }
 
 build.dependsOn rncToXsd
+
+compileTestJava {
+	exclude "org/springframework/security/config/annotation/web/configurers/saml2/**", "org/springframework/security/config/http/Saml2*"
+}
+
+task compileSaml2TestJava(type: JavaCompile) {
+	javaCompiler = javaToolchains.compilerFor {
+		languageVersion = JavaLanguageVersion.of(11)
+	}
+	source = sourceSets.test.java.srcDirs
+	include "org/springframework/security/config/annotation/web/configurers/saml2/**", "org/springframework/security/config/http/Saml2*"
+	classpath = sourceSets.test.compileClasspath
+	destinationDirectory = new File("${buildDir}/classes/java/test")
+	options.sourcepath = sourceSets.test.java.getSourceDirectories()
+}
+
+task saml2Tests(type: Test) {
+	javaLauncher = javaToolchains.launcherFor {
+		languageVersion = JavaLanguageVersion.of(11)
+	}
+	filter {
+		includeTestsMatching "org.springframework.security.config.annotation.web.configurers.saml2.*"
+	}
+	useJUnitPlatform()
+	dependsOn compileSaml2TestJava
+}
+
+test {
+	shouldRunAfter saml2Tests
+}
+
+tasks.named('check') {
+	dependsOn saml2Tests
+}

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderBuilderSecurityBuilderTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,15 +28,14 @@ import org.junit.jupiter.api.extension.ExtendWith;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
 import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -70,6 +69,7 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 	public void defaultConfiguration() {
 		this.spring.register(DefaultLdapConfig.class).autowire();
 		LdapAuthenticationProvider provider = ldapProvider();
+
 		LdapAuthoritiesPopulator authoritiesPopulator = getAuthoritiesPopulator(provider);
 		assertThat(authoritiesPopulator).hasFieldOrPropertyWithValue("groupRoleAttribute", "cn");
 		assertThat(authoritiesPopulator).hasFieldOrPropertyWithValue("groupSearchBase", "");
@@ -155,12 +155,11 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 		return port;
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class DefaultLdapConfig extends BaseLdapProviderConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -169,20 +168,13 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			// @formatter:on
 		}
 
-		@Bean
-		AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
-				throws Exception {
-			return authenticationConfiguration.getAuthenticationManager();
-		}
-
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class GroupRolesConfig extends BaseLdapProviderConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -192,20 +184,13 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			// @formatter:on
 		}
 
-		@Bean
-		AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
-				throws Exception {
-			return authenticationConfiguration.getAuthenticationManager();
-		}
-
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class GroupSearchConfig extends BaseLdapProviderConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -215,20 +200,13 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			// @formatter:on
 		}
 
-		@Bean
-		AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
-				throws Exception {
-			return authenticationConfiguration.getAuthenticationManager();
-		}
-
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class GroupSubtreeSearchConfig extends BaseLdapProviderConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -239,20 +217,13 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			// @formatter:on
 		}
 
-		@Bean
-		AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
-				throws Exception {
-			return authenticationConfiguration.getAuthenticationManager();
-		}
-
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class RolePrefixConfig extends BaseLdapProviderConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -262,20 +233,13 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			// @formatter:on
 		}
 
-		@Bean
-		AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
-				throws Exception {
-			return authenticationConfiguration.getAuthenticationManager();
-		}
-
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class BindAuthenticationConfig extends BaseLdapServerConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -286,20 +250,13 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			// @formatter:on
 		}
 
-		@Bean
-		AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
-				throws Exception {
-			return authenticationConfiguration.getAuthenticationManager();
-		}
-
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class PasswordEncoderConfig extends BaseLdapServerConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -311,15 +268,8 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			// @formatter:on
 		}
 
-		@Bean
-		AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
-				throws Exception {
-			return authenticationConfiguration.getAuthenticationManager();
-		}
-
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	abstract static class BaseLdapServerConfig extends BaseLdapProviderConfig {
 
@@ -333,11 +283,10 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	@EnableGlobalAuthentication
 	@Import(ObjectPostProcessorConfiguration.class)
-	abstract static class BaseLdapProviderConfig {
+	abstract static class BaseLdapProviderConfig extends WebSecurityConfigurerAdapter {
 
 		@Bean
 		BaseLdapPathContextSource contextSource() throws Exception {
@@ -349,6 +298,15 @@ public class LdapAuthenticationProviderBuilderSecurityBuilderTests {
 			return contextSource;
 		}
 
+		@Bean
+		AuthenticationManager authenticationManager(AuthenticationManagerBuilder auth) throws Exception {
+			configure(auth);
+			return auth.build();
+		}
+
+		@Override
+		protected abstract void configure(AuthenticationManagerBuilder auth) throws Exception;
+
 	}
 
 }

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderConfigurerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2020 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,10 +22,10 @@ import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.authentication.ldap.LdapAuthenticationProviderBuilderSecurityBuilderTests.BaseLdapProviderConfig;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
 import org.springframework.security.core.authority.AuthorityUtils;
@@ -104,22 +104,21 @@ public class LdapAuthenticationProviderConfigurerTests {
 
 		// @formatter:off
 		SecurityMockMvcRequestBuilders.FormLoginRequestBuilder request = formLogin()
-				.user("otherben")
-				.password("otherbenspassword");
+				.user("ben")
+				.password("benspassword");
 		SecurityMockMvcResultMatchers.AuthenticatedMatcher expectedUser = authenticated()
-				.withUsername("otherben")
+				.withUsername("ben")
 				.withAuthorities(
 						AuthorityUtils.createAuthorityList("ROLE_SUBMANAGERS", "ROLE_MANAGERS", "ROLE_DEVELOPERS"));
 		// @formatter:on
 		this.mockMvc.perform(request).andExpect(expectedUser);
 	}
 
-	@Configuration
 	@EnableWebSecurity
-	static class MultiLdapAuthenticationProvidersConfig {
+	static class MultiLdapAuthenticationProvidersConfig extends WebSecurityConfigurerAdapter {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -136,12 +135,11 @@ public class LdapAuthenticationProviderConfigurerTests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
-	static class MultiLdapWithCustomRolePrefixAuthenticationProvidersConfig {
+	static class MultiLdapWithCustomRolePrefixAuthenticationProvidersConfig extends WebSecurityConfigurerAdapter {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -160,12 +158,11 @@ public class LdapAuthenticationProviderConfigurerTests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
-	static class LdapWithRandomPortConfig {
+	static class LdapWithRandomPortConfig extends WebSecurityConfigurerAdapter {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -173,18 +170,17 @@ public class LdapAuthenticationProviderConfigurerTests {
 					.groupSearchFilter("(member={0})")
 					.userDnPatterns("uid={0},ou=people")
 					.contextSource()
-					.port(0);
+						.port(0);
 			// @formatter:on
 		}
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class GroupSubtreeSearchConfig extends BaseLdapProviderConfig {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/NamespaceLdapAuthenticationProviderTestsConfigs.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,10 +16,9 @@
 
 package org.springframework.security.config.annotation.authentication.ldap;
 
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;
@@ -30,12 +29,11 @@ import org.springframework.security.ldap.userdetails.PersonContextMapper;
  */
 public class NamespaceLdapAuthenticationProviderTestsConfigs {
 
-	@Configuration
 	@EnableWebSecurity
-	static class LdapAuthenticationProviderConfig {
+	static class LdapAuthenticationProviderConfig extends WebSecurityConfigurerAdapter {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -46,12 +44,11 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
-	static class CustomLdapAuthenticationProviderConfig {
+	static class CustomLdapAuthenticationProviderConfig extends WebSecurityConfigurerAdapter {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -70,20 +67,19 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
 						.managerPassword("secret") // ldap-server@manager-password
 						.port(0) // ldap-server@port
 						.root("dc=springframework,dc=org"); // ldap-server@root
-			// .url("ldap://localhost:33389/dc-springframework,dc=org") this overrides root and port and is used for external
+						// .url("ldap://localhost:33389/dc-springframework,dc=org") this overrides root and port and is used for external
 			// @formatter:on
 		}
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
-	static class CustomAuthoritiesPopulatorConfig {
+	static class CustomAuthoritiesPopulatorConfig extends WebSecurityConfigurerAdapter {
 
 		static LdapAuthoritiesPopulator LAP;
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()
@@ -94,12 +90,11 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
-	static class PasswordCompareLdapConfig {
+	static class PasswordCompareLdapConfig extends WebSecurityConfigurerAdapter {
 
-		@Autowired
-		void configure(AuthenticationManagerBuilder auth) throws Exception {
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 			// @formatter:off
 			auth
 				.ldapAuthentication()

config/src/integration-test/java/org/springframework/security/config/ldap/EmbeddedLdapServerContextSourceFactoryBeanITests.java

@@ -22,7 +22,6 @@ import org.junit.jupiter.api.extension.ExtendWith;
 import org.springframework.beans.factory.UnsatisfiedDependencyException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.ldap.core.support.LdapContextSource;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -78,11 +77,10 @@ public class EmbeddedLdapServerContextSourceFactoryBeanITests {
 	public void contextSourceFactoryBeanWhenManagerDnAndNoPasswordThenException() {
 		assertThatExceptionOfType(UnsatisfiedDependencyException.class)
 				.isThrownBy(() -> this.spring.register(CustomManagerDnNoPasswordConfig.class).autowire())
-				.havingRootCause().isInstanceOf(IllegalStateException.class)
+				.withRootCauseInstanceOf(IllegalStateException.class)
 				.withMessageContaining("managerPassword is required if managerDn is supplied");
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class FromEmbeddedLdapServerConfig {
 
@@ -100,7 +98,6 @@ public class EmbeddedLdapServerContextSourceFactoryBeanITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class PortZeroConfig {
 
@@ -121,7 +118,6 @@ public class EmbeddedLdapServerContextSourceFactoryBeanITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomLdifAndRootConfig {
 
@@ -143,7 +139,6 @@ public class EmbeddedLdapServerContextSourceFactoryBeanITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomManagerDnConfig {
 
@@ -166,7 +161,6 @@ public class EmbeddedLdapServerContextSourceFactoryBeanITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomManagerDnNoPasswordConfig {
 

config/src/integration-test/java/org/springframework/security/config/ldap/LdapBindAuthenticationManagerFactoryITests.java

@@ -27,7 +27,6 @@ import org.junit.jupiter.api.extension.ExtendWith;
 import org.springframework.beans.factory.DisposableBean;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.ldap.core.DirContextAdapter;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
@@ -132,7 +131,6 @@ public class LdapBindAuthenticationManagerFactoryITests {
 				.andExpect(authenticated().withUsername("bob"));
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class FromContextSourceConfig extends BaseLdapServerConfig {
 
@@ -145,7 +143,6 @@ public class LdapBindAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomAuthoritiesMapperConfig extends BaseLdapServerConfig {
 
@@ -161,7 +158,6 @@ public class LdapBindAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomAuthoritiesPopulatorConfig extends BaseLdapServerConfig {
 
@@ -177,7 +173,6 @@ public class LdapBindAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomUserDetailsContextMapperConfig extends BaseLdapServerConfig {
 
@@ -193,7 +188,6 @@ public class LdapBindAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomUserDnPatternsConfig extends BaseLdapServerConfig {
 
@@ -206,7 +200,6 @@ public class LdapBindAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomUserSearchConfig extends BaseLdapServerConfig {
 
@@ -220,7 +213,6 @@ public class LdapBindAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	abstract static class BaseLdapServerConfig implements DisposableBean {
 

config/src/integration-test/java/org/springframework/security/config/ldap/LdapPasswordComparisonAuthenticationManagerFactoryITests.java

@@ -22,7 +22,6 @@ import org.junit.jupiter.api.extension.ExtendWith;
 import org.springframework.beans.factory.DisposableBean;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -60,7 +59,6 @@ public class LdapPasswordComparisonAuthenticationManagerFactoryITests {
 		this.mockMvc.perform(formLogin().user("bob").password("bob")).andExpect(authenticated().withUsername("bob"));
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomPasswordEncoderConfig extends BaseLdapServerConfig {
 
@@ -74,7 +72,6 @@ public class LdapPasswordComparisonAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	static class CustomPasswordAttributeConfig extends BaseLdapServerConfig {
 
@@ -89,7 +86,6 @@ public class LdapPasswordComparisonAuthenticationManagerFactoryITests {
 
 	}
 
-	@Configuration
 	@EnableWebSecurity
 	abstract static class BaseLdapServerConfig implements DisposableBean {
 

config/src/integration-test/resources/test-server.ldif

@@ -28,16 +28,6 @@ sn: Alex
 uid: ben
 userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=
 
-dn: uid=otherben,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Other Ben Alex
-sn: Alex
-uid: otherben
-userPassword: otherbenspassword
-
 dn: uid=bcrypt,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
@@ -85,7 +75,6 @@ cn: developers
 ou: developer
 member: uid=bcrypt,ou=people,dc=springframework,dc=org
 member: uid=ben,ou=people,dc=springframework,dc=org
-member: uid=otherben,ou=people,dc=springframework,dc=org
 member: uid=bob,ou=people,dc=springframework,dc=org
 
 dn: cn=managers,ou=groups,dc=springframework,dc=org
@@ -94,7 +83,6 @@ objectclass: groupOfNames
 cn: managers
 ou: manager
 member: uid=ben,ou=people,dc=springframework,dc=org
-member: uid=otherben,ou=people,dc=springframework,dc=org
 member: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
 
 dn: cn=submanagers,ou=subgroups,ou=groups,dc=springframework,dc=org
@@ -103,4 +91,3 @@ objectclass: groupOfNames
 cn: submanagers
 ou: submanager
 member: uid=ben,ou=people,dc=springframework,dc=org
-member: uid=otherben,ou=people,dc=springframework,dc=org

config/src/main/java/org/springframework/security/config/Elements.java

@@ -72,6 +72,12 @@ public abstract class Elements {
 
 	public static final String FORM_LOGIN = "form-login";
 
+	public static final String OPENID_LOGIN = "openid-login";
+
+	public static final String OPENID_ATTRIBUTE_EXCHANGE = "attribute-exchange";
+
+	public static final String OPENID_ATTRIBUTE = "openid-attribute";
+
 	public static final String BASIC_AUTH = "http-basic";
 
 	public static final String REMEMBER_ME = "remember-me";

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -95,7 +95,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 		if (!namespaceMatchesVersion(element)) {
 			pc.getReaderContext().fatal("You cannot use a spring-security-2.0.xsd or spring-security-3.0.xsd or "
 					+ "spring-security-3.1.xsd schema or spring-security-3.2.xsd schema or spring-security-4.0.xsd schema "
-					+ "with Spring Security 6.0. Please update your schema declarations to the 6.0 schema.", element);
+					+ "with Spring Security 5.8. Please update your schema declarations to the 5.8 schema.", element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
 		BeanDefinitionParser parser = this.parsers.get(name);
@@ -218,7 +218,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 
 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-6\\.0.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-5\\.8.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/AuthenticationManagerBeanRegistrationAotProcessor.java

@@ -1,62 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.authentication.configuration;
-
-import java.util.Set;
-
-import org.springframework.aop.framework.AopProxyUtils;
-import org.springframework.aot.generate.GenerationContext;
-import org.springframework.aot.hint.ProxyHints;
-import org.springframework.beans.factory.aot.BeanRegistrationAotContribution;
-import org.springframework.beans.factory.aot.BeanRegistrationAotProcessor;
-import org.springframework.beans.factory.aot.BeanRegistrationCode;
-import org.springframework.beans.factory.support.RegisteredBean;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.util.ClassUtils;
-
-/**
- * AOT {@code BeanRegistrationAotProcessor} that detects beans that implement
- * {@link AuthenticationManager} creates the required proxy hints.
- *
- * @author Marcus da Coregio
- * @since 6.0.1
- * @see AuthenticationConfiguration#getAuthenticationManager()
- */
-class AuthenticationManagerBeanRegistrationAotProcessor implements BeanRegistrationAotProcessor {
-
-	@Override
-	public BeanRegistrationAotContribution processAheadOfTime(RegisteredBean registeredBean) {
-		Class<?> beanClass = registeredBean.getBeanClass();
-		Set<Class<?>> allInterfacesForClass = ClassUtils.getAllInterfacesForClassAsSet(beanClass);
-		if (allInterfacesForClass.contains(AuthenticationManager.class)) {
-			return new AuthenticationManagerBeanRegistrationAotContribution();
-		}
-		return null;
-	}
-
-	private static class AuthenticationManagerBeanRegistrationAotContribution
-			implements BeanRegistrationAotContribution {
-
-		@Override
-		public void applyTo(GenerationContext generationContext, BeanRegistrationCode beanRegistrationCode) {
-			ProxyHints proxyHints = generationContext.getRuntimeHints().proxies();
-			proxyHints.registerJdkProxy(AopProxyUtils.completeJdkProxyInterfaces(AuthenticationManager.class));
-		}
-
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/EnableGlobalAuthentication.java

@@ -22,6 +22,7 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
@@ -105,6 +106,7 @@ import org.springframework.security.config.annotation.web.servlet.configuration.
 @Target(ElementType.TYPE)
 @Documented
 @Import(AuthenticationConfiguration.class)
+@Configuration
 public @interface EnableGlobalAuthentication {
 
 }

config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2020 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -61,14 +61,6 @@ import org.springframework.util.ClassUtils;
 public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuilder<B>>
 		extends SecurityConfigurerAdapter<AuthenticationManager, B> {
 
-	private static final String APACHEDS_CLASSNAME = "org.apache.directory.server.core.DefaultDirectoryService";
-
-	private static final String UNBOUNDID_CLASSNAME = "com.unboundid.ldap.listener.InMemoryDirectoryServer";
-
-	private static final boolean apacheDsPresent;
-
-	private static final boolean unboundIdPresent;
-
 	private String groupRoleAttribute = "cn";
 
 	private String groupSearchBase = "";
@@ -99,12 +91,6 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 
 	private GrantedAuthoritiesMapper authoritiesMapper;
 
-	static {
-		ClassLoader classLoader = LdapAuthenticationProviderConfigurer.class.getClassLoader();
-		apacheDsPresent = ClassUtils.isPresent(APACHEDS_CLASSNAME, classLoader);
-		unboundIdPresent = ClassUtils.isPresent(UNBOUNDID_CLASSNAME, classLoader);
-	}
-
 	private LdapAuthenticationProvider build() throws Exception {
 		BaseLdapPathContextSource contextSource = getContextSource();
 		LdapAuthenticator ldapAuthenticator = createLdapAuthenticator(contextSource);
@@ -155,7 +141,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 		defaultAuthoritiesPopulator.setGroupSearchFilter(this.groupSearchFilter);
 		defaultAuthoritiesPopulator.setSearchSubtree(this.groupSearchSubtree);
 		defaultAuthoritiesPopulator.setRolePrefix(this.rolePrefix);
-		this.ldapAuthoritiesPopulator = postProcess(defaultAuthoritiesPopulator);
+		this.ldapAuthoritiesPopulator = defaultAuthoritiesPopulator;
 		return defaultAuthoritiesPopulator;
 	}
 
@@ -576,13 +562,13 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 		}
 
 		private void startEmbeddedLdapServer() throws Exception {
-			if (apacheDsPresent) {
+			if (ClassUtils.isPresent(APACHEDS_CLASSNAME, getClass().getClassLoader())) {
 				ApacheDSContainer apacheDsContainer = new ApacheDSContainer(this.root, this.ldif);
 				apacheDsContainer.setPort(getPort());
 				postProcess(apacheDsContainer);
 				this.port = apacheDsContainer.getLocalPort();
 			}
-			else if (unboundIdPresent) {
+			else if (ClassUtils.isPresent(UNBOUNDID_CLASSNAME, getClass().getClassLoader())) {
 				UnboundIdContainer unboundIdContainer = new UnboundIdContainer(this.root, this.ldif);
 				unboundIdContainer.setPort(getPort());
 				postProcess(unboundIdContainer);

config/src/main/java/org/springframework/security/config/annotation/method/configuration/DeferringObservationAuthorizationManager.java

@@ -1,50 +0,0 @@
-/*
- * Copyright 2002-2022 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.method.configuration;
-
-import java.util.function.Supplier;
-
-import io.micrometer.observation.ObservationRegistry;
-
-import org.springframework.beans.factory.ObjectProvider;
-import org.springframework.security.authorization.AuthorizationDecision;
-import org.springframework.security.authorization.AuthorizationManager;
-import org.springframework.security.authorization.ObservationAuthorizationManager;
-import org.springframework.security.core.Authentication;
-import org.springframework.util.function.SingletonSupplier;
-
-final class DeferringObservationAuthorizationManager<T> implements AuthorizationManager<T> {
-
-	private final Supplier<AuthorizationManager<T>> delegate;
-
-	DeferringObservationAuthorizationManager(ObjectProvider<ObservationRegistry> provider,
-			AuthorizationManager<T> delegate) {
-		this.delegate = SingletonSupplier.of(() -> {
-			ObservationRegistry registry = provider.getIfAvailable(() -> ObservationRegistry.NOOP);
-			if (registry.isNoop()) {
-				return delegate;
-			}
-			return new ObservationAuthorizationManager<>(registry, delegate);
-		});
-	}
-
-	@Override
-	public AuthorizationDecision check(Supplier<Authentication> authentication, T object) {
-		return this.delegate.get().check(authentication, object);
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableGlobalMethodSecurity.java

@@ -23,6 +23,7 @@ import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
 import org.springframework.context.annotation.AdviceMode;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.core.Ordered;
 import org.springframework.security.access.annotation.Secured;
@@ -50,6 +51,7 @@ import org.springframework.security.config.annotation.authentication.configurati
 @Documented
 @Import({ GlobalMethodSecuritySelector.class })
 @EnableGlobalAuthentication
+@Configuration
 public @interface EnableGlobalMethodSecurity {
 
 	/**

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableMethodSecurity.java

@@ -23,6 +23,7 @@ import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
 import org.springframework.context.annotation.AdviceMode;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.security.access.prepost.PostAuthorize;
@@ -40,6 +41,7 @@ import org.springframework.security.access.prepost.PreFilter;
 @Target(ElementType.TYPE)
 @Documented
 @Import(MethodSecuritySelector.class)
+@Configuration
 public @interface EnableMethodSecurity {
 
 	/**

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableReactiveMethodSecurity.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2017 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
 import org.springframework.context.annotation.AdviceMode;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.core.Ordered;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;
@@ -36,6 +37,7 @@ import org.springframework.security.authorization.ReactiveAuthorizationManager;
 @Target(ElementType.TYPE)
 @Documented
 @Import(ReactiveMethodSecuritySelector.class)
+@Configuration
 public @interface EnableReactiveMethodSecurity {
 
 	/**
@@ -73,6 +75,6 @@ public @interface EnableReactiveMethodSecurity {
 	 * used.
 	 * @since 5.8
 	 */
-	boolean useAuthorizationManager() default true;
+	boolean useAuthorizationManager() default false;
 
 }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/Jsr250MethodSecurityConfiguration.java

@@ -16,16 +16,12 @@
 
 package org.springframework.security.config.annotation.method.configuration;
 
-import io.micrometer.observation.ObservationRegistry;
-import org.aopalliance.intercept.MethodInvocation;
-
 import org.springframework.aop.Advisor;
-import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Role;
-import org.springframework.security.authorization.AuthorizationManager;
 import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
 import org.springframework.security.authorization.method.Jsr250AuthorizationManager;
 import org.springframework.security.config.core.GrantedAuthorityDefaults;
@@ -44,21 +40,28 @@ import org.springframework.security.core.context.SecurityContextHolderStrategy;
 @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
 final class Jsr250MethodSecurityConfiguration {
 
+	private final Jsr250AuthorizationManager jsr250AuthorizationManager = new Jsr250AuthorizationManager();
+
+	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
+			.getContextHolderStrategy();
+
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static Advisor jsr250AuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
-			ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
-			ObjectProvider<ObservationRegistry> registryProvider) {
-		Jsr250AuthorizationManager jsr250 = new Jsr250AuthorizationManager();
-		defaultsProvider.ifAvailable((d) -> jsr250.setRolePrefix(d.getRolePrefix()));
-		SecurityContextHolderStrategy strategy = strategyProvider
-				.getIfAvailable(SecurityContextHolder::getContextHolderStrategy);
-		AuthorizationManager<MethodInvocation> manager = new DeferringObservationAuthorizationManager<>(
-				registryProvider, jsr250);
+	Advisor jsr250AuthorizationMethodInterceptor() {
 		AuthorizationManagerBeforeMethodInterceptor interceptor = AuthorizationManagerBeforeMethodInterceptor
-				.jsr250(manager);
-		interceptor.setSecurityContextHolderStrategy(strategy);
+				.jsr250(this.jsr250AuthorizationManager);
+		interceptor.setSecurityContextHolderStrategy(this.securityContextHolderStrategy);
 		return interceptor;
 	}
 
+	@Autowired(required = false)
+	void setGrantedAuthorityDefaults(GrantedAuthorityDefaults grantedAuthorityDefaults) {
+		this.jsr250AuthorizationManager.setRolePrefix(grantedAuthorityDefaults.getRolePrefix());
+	}
+
+	@Autowired(required = false)
+	void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
+		this.securityContextHolderStrategy = securityContextHolderStrategy;
+	}
+
 }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java

@@ -16,10 +16,8 @@
 
 package org.springframework.security.config.annotation.method.configuration;
 
-import io.micrometer.observation.ObservationRegistry;
-
 import org.springframework.aop.Advisor;
-import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
@@ -28,7 +26,7 @@ import org.springframework.context.annotation.Role;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.authorization.AuthorizationEventPublisher;
-import org.springframework.security.authorization.AuthorizationManager;
+import org.springframework.security.authorization.SpringAuthorizationEventPublisher;
 import org.springframework.security.authorization.method.AuthorizationManagerAfterMethodInterceptor;
 import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
 import org.springframework.security.authorization.method.PostAuthorizeAuthorizationManager;
@@ -50,76 +48,85 @@ import org.springframework.security.core.context.SecurityContextHolderStrategy;
 @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
 final class PrePostMethodSecurityConfiguration {
 
-	@Bean
-	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static Advisor preFilterAuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
-			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
-			ObjectProvider<SecurityContextHolderStrategy> strategyProvider, ApplicationContext context) {
-		PreFilterAuthorizationMethodInterceptor preFilter = new PreFilterAuthorizationMethodInterceptor();
-		strategyProvider.ifAvailable(preFilter::setSecurityContextHolderStrategy);
-		preFilter.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
-		return preFilter;
+	private final PreFilterAuthorizationMethodInterceptor preFilterAuthorizationMethodInterceptor = new PreFilterAuthorizationMethodInterceptor();
+
+	private final AuthorizationManagerBeforeMethodInterceptor preAuthorizeAuthorizationMethodInterceptor;
+
+	private final PreAuthorizeAuthorizationManager preAuthorizeAuthorizationManager = new PreAuthorizeAuthorizationManager();
+
+	private final AuthorizationManagerAfterMethodInterceptor postAuthorizeAuthorizaitonMethodInterceptor;
+
+	private final PostAuthorizeAuthorizationManager postAuthorizeAuthorizationManager = new PostAuthorizeAuthorizationManager();
+
+	private final PostFilterAuthorizationMethodInterceptor postFilterAuthorizationMethodInterceptor = new PostFilterAuthorizationMethodInterceptor();
+
+	private final DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
+
+	@Autowired
+	PrePostMethodSecurityConfiguration(ApplicationContext context) {
+		this.preAuthorizeAuthorizationManager.setExpressionHandler(this.expressionHandler);
+		this.preAuthorizeAuthorizationMethodInterceptor = AuthorizationManagerBeforeMethodInterceptor
+				.preAuthorize(this.preAuthorizeAuthorizationManager);
+		this.postAuthorizeAuthorizationManager.setExpressionHandler(this.expressionHandler);
+		this.postAuthorizeAuthorizaitonMethodInterceptor = AuthorizationManagerAfterMethodInterceptor
+				.postAuthorize(this.postAuthorizeAuthorizationManager);
+		this.preFilterAuthorizationMethodInterceptor.setExpressionHandler(this.expressionHandler);
+		this.postFilterAuthorizationMethodInterceptor.setExpressionHandler(this.expressionHandler);
+		this.expressionHandler.setApplicationContext(context);
+		AuthorizationEventPublisher publisher = new SpringAuthorizationEventPublisher(context);
+		this.preAuthorizeAuthorizationMethodInterceptor.setAuthorizationEventPublisher(publisher);
+		this.postAuthorizeAuthorizaitonMethodInterceptor.setAuthorizationEventPublisher(publisher);
 	}
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static Advisor preAuthorizeAuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
-			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
-			ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
-			ObjectProvider<AuthorizationEventPublisher> eventPublisherProvider,
-			ObjectProvider<ObservationRegistry> registryProvider, ApplicationContext context) {
-		PreAuthorizeAuthorizationManager manager = new PreAuthorizeAuthorizationManager();
-		manager.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
-		AuthorizationManagerBeforeMethodInterceptor preAuthorize = AuthorizationManagerBeforeMethodInterceptor
-				.preAuthorize(manager(manager, registryProvider));
-		strategyProvider.ifAvailable(preAuthorize::setSecurityContextHolderStrategy);
-		eventPublisherProvider.ifAvailable(preAuthorize::setAuthorizationEventPublisher);
-		return preAuthorize;
+	Advisor preFilterAuthorizationMethodInterceptor() {
+		return this.preFilterAuthorizationMethodInterceptor;
 	}
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static Advisor postAuthorizeAuthorizationMethodInterceptor(
-			ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
-			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
-			ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
-			ObjectProvider<AuthorizationEventPublisher> eventPublisherProvider,
-			ObjectProvider<ObservationRegistry> registryProvider, ApplicationContext context) {
-		PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager();
-		manager.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
-		AuthorizationManagerAfterMethodInterceptor postAuthorize = AuthorizationManagerAfterMethodInterceptor
-				.postAuthorize(manager(manager, registryProvider));
-		strategyProvider.ifAvailable(postAuthorize::setSecurityContextHolderStrategy);
-		eventPublisherProvider.ifAvailable(postAuthorize::setAuthorizationEventPublisher);
-		return postAuthorize;
+	Advisor preAuthorizeAuthorizationMethodInterceptor() {
+		return this.preAuthorizeAuthorizationMethodInterceptor;
 	}
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static Advisor postFilterAuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
-			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
-			ObjectProvider<SecurityContextHolderStrategy> strategyProvider, ApplicationContext context) {
-		PostFilterAuthorizationMethodInterceptor postFilter = new PostFilterAuthorizationMethodInterceptor();
-		strategyProvider.ifAvailable(postFilter::setSecurityContextHolderStrategy);
-		postFilter.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
-		return postFilter;
+	Advisor postAuthorizeAuthorizationMethodInterceptor() {
+		return this.postAuthorizeAuthorizaitonMethodInterceptor;
 	}
 
-	private static MethodSecurityExpressionHandler defaultExpressionHandler(
-			ObjectProvider<GrantedAuthorityDefaults> defaultsProvider, ApplicationContext context) {
-		DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
-		defaultsProvider.ifAvailable((d) -> handler.setDefaultRolePrefix(d.getRolePrefix()));
-		handler.setApplicationContext(context);
-		return handler;
+	@Bean
+	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
+	Advisor postFilterAuthorizationMethodInterceptor() {
+		return this.postFilterAuthorizationMethodInterceptor;
 	}
 
-	static <T> AuthorizationManager<T> manager(AuthorizationManager<T> delegate,
-			ObjectProvider<ObservationRegistry> registryProvider) {
-		return new DeferringObservationAuthorizationManager<>(registryProvider, delegate);
+	@Autowired(required = false)
+	void setMethodSecurityExpressionHandler(MethodSecurityExpressionHandler methodSecurityExpressionHandler) {
+		this.preFilterAuthorizationMethodInterceptor.setExpressionHandler(methodSecurityExpressionHandler);
+		this.preAuthorizeAuthorizationManager.setExpressionHandler(methodSecurityExpressionHandler);
+		this.postAuthorizeAuthorizationManager.setExpressionHandler(methodSecurityExpressionHandler);
+		this.postFilterAuthorizationMethodInterceptor.setExpressionHandler(methodSecurityExpressionHandler);
+	}
+
+	@Autowired(required = false)
+	void setSecurityContextHolderStrategy(SecurityContextHolderStrategy strategy) {
+		this.preFilterAuthorizationMethodInterceptor.setSecurityContextHolderStrategy(strategy);
+		this.preAuthorizeAuthorizationMethodInterceptor.setSecurityContextHolderStrategy(strategy);
+		this.postAuthorizeAuthorizaitonMethodInterceptor.setSecurityContextHolderStrategy(strategy);
+		this.postFilterAuthorizationMethodInterceptor.setSecurityContextHolderStrategy(strategy);
+	}
+
+	@Autowired(required = false)
+	void setGrantedAuthorityDefaults(GrantedAuthorityDefaults grantedAuthorityDefaults) {
+		this.expressionHandler.setDefaultRolePrefix(grantedAuthorityDefaults.getRolePrefix());
+	}
+
+	@Autowired(required = false)
+	void setAuthorizationEventPublisher(AuthorizationEventPublisher eventPublisher) {
+		this.preAuthorizeAuthorizationMethodInterceptor.setAuthorizationEventPublisher(eventPublisher);
+		this.postAuthorizeAuthorizaitonMethodInterceptor.setAuthorizationEventPublisher(eventPublisher);
 	}
 
 }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/ReactiveAuthorizationManagerMethodSecurityConfiguration.java

@@ -16,10 +16,6 @@
 
 package org.springframework.security.config.annotation.method.configuration;
 
-import io.micrometer.observation.ObservationRegistry;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Bean;
@@ -28,11 +24,8 @@ import org.springframework.context.annotation.Role;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.authentication.ReactiveAuthenticationManager;
-import org.springframework.security.authorization.ObservationReactiveAuthorizationManager;
-import org.springframework.security.authorization.ReactiveAuthorizationManager;
 import org.springframework.security.authorization.method.AuthorizationManagerAfterReactiveMethodInterceptor;
 import org.springframework.security.authorization.method.AuthorizationManagerBeforeReactiveMethodInterceptor;
-import org.springframework.security.authorization.method.MethodInvocationResult;
 import org.springframework.security.authorization.method.PostAuthorizeReactiveAuthorizationManager;
 import org.springframework.security.authorization.method.PostFilterAuthorizationReactiveMethodInterceptor;
 import org.springframework.security.authorization.method.PreAuthorizeReactiveAuthorizationManager;
@@ -50,39 +43,39 @@ final class ReactiveAuthorizationManagerMethodSecurityConfiguration {
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static PreFilterAuthorizationReactiveMethodInterceptor preFilterInterceptor(
+	PreFilterAuthorizationReactiveMethodInterceptor preFilterInterceptor(
 			MethodSecurityExpressionHandler expressionHandler) {
 		return new PreFilterAuthorizationReactiveMethodInterceptor(expressionHandler);
 	}
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static AuthorizationManagerBeforeReactiveMethodInterceptor preAuthorizeInterceptor(
-			MethodSecurityExpressionHandler expressionHandler, ObjectProvider<ObservationRegistry> registryProvider) {
-		ReactiveAuthorizationManager<MethodInvocation> authorizationManager = manager(
-				new PreAuthorizeReactiveAuthorizationManager(expressionHandler), registryProvider);
+	AuthorizationManagerBeforeReactiveMethodInterceptor preAuthorizeInterceptor(
+			MethodSecurityExpressionHandler expressionHandler) {
+		PreAuthorizeReactiveAuthorizationManager authorizationManager = new PreAuthorizeReactiveAuthorizationManager(
+				expressionHandler);
 		return AuthorizationManagerBeforeReactiveMethodInterceptor.preAuthorize(authorizationManager);
 	}
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static PostFilterAuthorizationReactiveMethodInterceptor postFilterInterceptor(
+	PostFilterAuthorizationReactiveMethodInterceptor postFilterInterceptor(
 			MethodSecurityExpressionHandler expressionHandler) {
 		return new PostFilterAuthorizationReactiveMethodInterceptor(expressionHandler);
 	}
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static AuthorizationManagerAfterReactiveMethodInterceptor postAuthorizeInterceptor(
-			MethodSecurityExpressionHandler expressionHandler, ObjectProvider<ObservationRegistry> registryProvider) {
-		ReactiveAuthorizationManager<MethodInvocationResult> authorizationManager = manager(
-				new PostAuthorizeReactiveAuthorizationManager(expressionHandler), registryProvider);
+	AuthorizationManagerAfterReactiveMethodInterceptor postAuthorizeInterceptor(
+			MethodSecurityExpressionHandler expressionHandler) {
+		PostAuthorizeReactiveAuthorizationManager authorizationManager = new PostAuthorizeReactiveAuthorizationManager(
+				expressionHandler);
 		return AuthorizationManagerAfterReactiveMethodInterceptor.postAuthorize(authorizationManager);
 	}
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static DefaultMethodSecurityExpressionHandler methodSecurityExpressionHandler(
+	DefaultMethodSecurityExpressionHandler methodSecurityExpressionHandler(
 			@Autowired(required = false) GrantedAuthorityDefaults grantedAuthorityDefaults) {
 		DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
 		if (grantedAuthorityDefaults != null) {
@@ -91,13 +84,4 @@ final class ReactiveAuthorizationManagerMethodSecurityConfiguration {
 		return handler;
 	}
 
-	static <T> ReactiveAuthorizationManager<T> manager(ReactiveAuthorizationManager<T> delegate,
-			ObjectProvider<ObservationRegistry> registryProvider) {
-		ObservationRegistry registry = registryProvider.getIfAvailable(() -> ObservationRegistry.NOOP);
-		if (registry.isNoop()) {
-			return delegate;
-		}
-		return new ObservationReactiveAuthorizationManager<>(registry, delegate);
-	}
-
 }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/SecuredMethodSecurityConfiguration.java

@@ -16,19 +16,14 @@
 
 package org.springframework.security.config.annotation.method.configuration;
 
-import io.micrometer.observation.ObservationRegistry;
-import org.aopalliance.intercept.MethodInvocation;
-
 import org.springframework.aop.Advisor;
-import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Role;
 import org.springframework.security.access.annotation.Secured;
-import org.springframework.security.authorization.AuthorizationManager;
 import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
-import org.springframework.security.authorization.method.SecuredAuthorizationManager;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
 
@@ -44,19 +39,20 @@ import org.springframework.security.core.context.SecurityContextHolderStrategy;
 @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
 final class SecuredMethodSecurityConfiguration {
 
+	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
+			.getContextHolderStrategy();
+
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	static Advisor securedAuthorizationMethodInterceptor(ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
-			ObjectProvider<ObservationRegistry> registryProvider) {
-		SecuredAuthorizationManager secured = new SecuredAuthorizationManager();
-		SecurityContextHolderStrategy strategy = strategyProvider
-				.getIfAvailable(SecurityContextHolder::getContextHolderStrategy);
-		AuthorizationManager<MethodInvocation> manager = new DeferringObservationAuthorizationManager<>(
-				registryProvider, secured);
-		AuthorizationManagerBeforeMethodInterceptor interceptor = AuthorizationManagerBeforeMethodInterceptor
-				.secured(manager);
-		interceptor.setSecurityContextHolderStrategy(strategy);
+	Advisor securedAuthorizationMethodInterceptor() {
+		AuthorizationManagerBeforeMethodInterceptor interceptor = AuthorizationManagerBeforeMethodInterceptor.secured();
+		interceptor.setSecurityContextHolderStrategy(this.securityContextHolderStrategy);
 		return interceptor;
 	}
 
+	@Autowired(required = false)
+	void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
+		this.securityContextHolderStrategy = securityContextHolderStrategy;
+	}
+
 }

config/src/main/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.java

@@ -55,7 +55,6 @@ import org.springframework.security.rsocket.util.matcher.RoutePayloadExchangeMat
  * A minimal example can be found below:
  *
  * <pre class="code">
- * &#064;Configuration
  * &#064;EnableRSocketSecurity
  * public class SecurityConfig {
  *     &#064;Bean
@@ -83,7 +82,6 @@ import org.springframework.security.rsocket.util.matcher.RoutePayloadExchangeMat
  * A more advanced configuration can be seen below:
  *
  * <pre class="code">
- * &#064;Configuration
  * &#064;EnableRSocketSecurity
  * public class SecurityConfig {
  *     &#064;Bean

config/src/main/java/org/springframework/security/config/annotation/rsocket/RSocketSecurityConfiguration.java

@@ -16,14 +16,11 @@
 
 package org.springframework.security.config.annotation.rsocket;
 
-import io.micrometer.observation.ObservationRegistry;
-
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Scope;
-import org.springframework.security.authentication.ObservationReactiveAuthenticationManager;
 import org.springframework.security.authentication.ReactiveAuthenticationManager;
 import org.springframework.security.authentication.UserDetailsRepositoryReactiveAuthenticationManager;
 import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
@@ -46,8 +43,6 @@ class RSocketSecurityConfiguration {
 
 	private PasswordEncoder passwordEncoder;
 
-	private ObservationRegistry observationRegistry = ObservationRegistry.NOOP;
-
 	@Autowired(required = false)
 	void setAuthenticationManager(ReactiveAuthenticationManager authenticationManager) {
 		this.authenticationManager = authenticationManager;
@@ -63,11 +58,6 @@ class RSocketSecurityConfiguration {
 		this.passwordEncoder = passwordEncoder;
 	}
 
-	@Autowired(required = false)
-	void setObservationRegistry(ObservationRegistry observationRegistry) {
-		this.observationRegistry = observationRegistry;
-	}
-
 	@Bean(name = RSOCKET_SECURITY_BEAN_NAME)
 	@Scope("prototype")
 	RSocketSecurity rsocketSecurity(ApplicationContext context) {
@@ -86,9 +76,6 @@ class RSocketSecurityConfiguration {
 			if (this.passwordEncoder != null) {
 				manager.setPasswordEncoder(this.passwordEncoder);
 			}
-			if (!this.observationRegistry.isNoop()) {
-				return new ObservationReactiveAuthenticationManager(this.observationRegistry, manager);
-			}
 			return manager;
 		}
 		return null;

config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java

@@ -20,7 +20,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
-import jakarta.servlet.DispatcherType;
+import javax.servlet.DispatcherType;
 
 import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
@@ -89,6 +89,90 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 		return configurer;
 	}
 
+	/**
+	 * Maps a {@link List} of
+	 * {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
+	 * instances.
+	 * @param method the {@link HttpMethod} to use for any {@link HttpMethod}.
+	 * @return the object that is chained after creating the {@link RequestMatcher}
+	 * @deprecated use {@link #requestMatchers(HttpMethod)} instead
+	 */
+	@Deprecated
+	public C antMatchers(HttpMethod method) {
+		return antMatchers(method, "/**");
+	}
+
+	/**
+	 * Maps a {@link List} of
+	 * {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
+	 * instances.
+	 * @param method the {@link HttpMethod} to use or {@code null} for any
+	 * {@link HttpMethod}.
+	 * @param antPatterns the ant patterns to create. If {@code null} or empty, then
+	 * matches on nothing.
+	 * @return the object that is chained after creating the {@link RequestMatcher}
+	 * @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
+	 */
+	@Deprecated
+	public C antMatchers(HttpMethod method, String... antPatterns) {
+		Assert.state(!this.anyRequestConfigured, "Can't configure antMatchers after anyRequest");
+		return chainRequestMatchers(RequestMatchers.antMatchers(method, antPatterns));
+	}
+
+	/**
+	 * Maps a {@link List} of
+	 * {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
+	 * instances that do not care which {@link HttpMethod} is used.
+	 * @param antPatterns the ant patterns to create
+	 * {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} from
+	 * @return the object that is chained after creating the {@link RequestMatcher}
+	 * @deprecated use {@link #requestMatchers(String...)} instead
+	 */
+	@Deprecated
+	public C antMatchers(String... antPatterns) {
+		Assert.state(!this.anyRequestConfigured, "Can't configure antMatchers after anyRequest");
+		return chainRequestMatchers(RequestMatchers.antMatchers(antPatterns));
+	}
+
+	/**
+	 * <p>
+	 * Maps an {@link MvcRequestMatcher} that does not care which {@link HttpMethod} is
+	 * used. This matcher will use the same rules that Spring MVC uses for matching. For
+	 * example, often times a mapping of the path "/path" will match on "/path", "/path/",
+	 * "/path.html", etc.
+	 * </p>
+	 * <p>
+	 * If the current request will not be processed by Spring MVC, a reasonable default
+	 * using the pattern as a ant pattern will be used.
+	 * </p>
+	 * @param mvcPatterns the patterns to match on. The rules for matching are defined by
+	 * Spring MVC
+	 * @return the object that is chained after creating the {@link RequestMatcher}.
+	 * @deprecated use {@link #requestMatchers(String...)} instead
+	 */
+	@Deprecated
+	public abstract C mvcMatchers(String... mvcPatterns);
+
+	/**
+	 * <p>
+	 * Maps an {@link MvcRequestMatcher} that also specifies a specific {@link HttpMethod}
+	 * to match on. This matcher will use the same rules that Spring MVC uses for
+	 * matching. For example, often times a mapping of the path "/path" will match on
+	 * "/path", "/path/", "/path.html", etc.
+	 * </p>
+	 * <p>
+	 * If the current request will not be processed by Spring MVC, a reasonable default
+	 * using the pattern as a ant pattern will be used.
+	 * </p>
+	 * @param method the HTTP method to match on
+	 * @param mvcPatterns the patterns to match on. The rules for matching are defined by
+	 * Spring MVC
+	 * @return the object that is chained after creating the {@link RequestMatcher}.
+	 * @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
+	 */
+	@Deprecated
+	public abstract C mvcMatchers(HttpMethod method, String... mvcPatterns);
+
 	/**
 	 * Creates {@link MvcRequestMatcher} instances for the method and patterns passed in
 	 * @param method the HTTP method to use or null if any should be used
@@ -117,6 +201,40 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 		return matchers;
 	}
 
+	/**
+	 * Maps a {@link List} of
+	 * {@link org.springframework.security.web.util.matcher.RegexRequestMatcher}
+	 * instances.
+	 * @param method the {@link HttpMethod} to use or {@code null} for any
+	 * {@link HttpMethod}.
+	 * @param regexPatterns the regular expressions to create
+	 * {@link org.springframework.security.web.util.matcher.RegexRequestMatcher} from
+	 * @return the object that is chained after creating the {@link RequestMatcher}
+	 * @deprecated use {@link #requestMatchers(RequestMatcher...)} with a
+	 * {@link RegexRequestMatcher} instead
+	 */
+	@Deprecated
+	public C regexMatchers(HttpMethod method, String... regexPatterns) {
+		Assert.state(!this.anyRequestConfigured, "Can't configure regexMatchers after anyRequest");
+		return chainRequestMatchers(RequestMatchers.regexMatchers(method, regexPatterns));
+	}
+
+	/**
+	 * Create a {@link List} of
+	 * {@link org.springframework.security.web.util.matcher.RegexRequestMatcher} instances
+	 * that do not specify an {@link HttpMethod}.
+	 * @param regexPatterns the regular expressions to create
+	 * {@link org.springframework.security.web.util.matcher.RegexRequestMatcher} from
+	 * @return the object that is chained after creating the {@link RequestMatcher}
+	 * @deprecated use {@link #requestMatchers(RequestMatcher...)} with a
+	 * {@link RegexRequestMatcher} instead
+	 */
+	@Deprecated
+	public C regexMatchers(String... regexPatterns) {
+		Assert.state(!this.anyRequestConfigured, "Can't configure regexMatchers after anyRequest");
+		return chainRequestMatchers(RequestMatchers.regexMatchers(regexPatterns));
+	}
+
 	/**
 	 * Maps a {@link List} of
 	 * {@link org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher}

config/src/main/java/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java

@@ -16,7 +16,7 @@
 
 package org.springframework.security.config.annotation.web;
 
-import jakarta.servlet.Filter;
+import javax.servlet.Filter;
 
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.config.annotation.SecurityBuilder;
@@ -24,6 +24,7 @@ import org.springframework.security.config.annotation.SecurityConfigurer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter;
+import org.springframework.security.openid.OpenIDAuthenticationFilter;
 import org.springframework.security.web.DefaultSecurityFilterChain;
 import org.springframework.security.web.access.ExceptionTranslationFilter;
 import org.springframework.security.web.access.channel.ChannelProcessingFilter;
@@ -136,6 +137,7 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>>
 	 * <li><a href="
 	 * {@docRoot}/org/springframework/security/cas/web/CasAuthenticationFilter.html">CasAuthenticationFilter</a></li>
 	 * <li>{@link UsernamePasswordAuthenticationFilter}</li>
+	 * <li>{@link OpenIDAuthenticationFilter}</li>
 	 * <li>{@link org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter}</li>
 	 * <li>{@link org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter}</li>
 	 * <li>{@link ConcurrentSessionFilter}</li>

config/src/main/java/org/springframework/security/config/annotation/web/WebSecurityConfigurer.java

@@ -16,7 +16,7 @@
 
 package org.springframework.security.config.annotation.web;
 
-import jakarta.servlet.Filter;
+import javax.servlet.Filter;
 
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.SecurityBuilder;

config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java

@@ -20,7 +20,7 @@ import java.util.Comparator;
 import java.util.HashMap;
 import java.util.Map;
 
-import jakarta.servlet.Filter;
+import javax.servlet.Filter;
 
 import org.springframework.security.web.access.ExceptionTranslationFilter;
 import org.springframework.security.web.access.channel.ChannelProcessingFilter;
@@ -97,6 +97,7 @@ final class FilterOrderRegistration {
 				order.next());
 		put(UsernamePasswordAuthenticationFilter.class, order.next());
 		order.next(); // gh-8105
+		this.filterToOrder.put("org.springframework.security.openid.OpenIDAuthenticationFilter", order.next());
 		put(DefaultLoginPageGeneratingFilter.class, order.next());
 		put(DefaultLogoutPageGeneratingFilter.class, order.next());
 		put(ConcurrentSessionFilter.class, order.next());

config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java

@@ -19,10 +19,10 @@ package org.springframework.security.config.annotation.web.builders;
 import java.util.ArrayList;
 import java.util.List;
 
-import io.micrometer.observation.ObservationRegistry;
-import jakarta.servlet.Filter;
-import jakarta.servlet.ServletContext;
-import jakarta.servlet.http.HttpServletRequest;
+import javax.servlet.Filter;
+import javax.servlet.ServletContext;
+import javax.servlet.http.HttpServletRequest;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
@@ -30,6 +30,7 @@ import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.ApplicationContextAware;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.SecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -46,7 +47,6 @@ import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.web.DefaultSecurityFilterChain;
 import org.springframework.security.web.FilterChainProxy;
 import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.ObservationFilterChainDecorator;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.access.AuthorizationManagerWebInvocationPrivilegeEvaluator;
 import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator;
@@ -56,12 +56,10 @@ import org.springframework.security.web.access.expression.DefaultWebSecurityExpr
 import org.springframework.security.web.access.intercept.AuthorizationFilter;
 import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
 import org.springframework.security.web.debug.DebugFilter;
-import org.springframework.security.web.firewall.CompositeRequestRejectedHandler;
 import org.springframework.security.web.firewall.HttpFirewall;
-import org.springframework.security.web.firewall.HttpStatusRequestRejectedHandler;
-import org.springframework.security.web.firewall.ObservationMarkingRequestRejectedHandler;
 import org.springframework.security.web.firewall.RequestRejectedHandler;
 import org.springframework.security.web.firewall.StrictHttpFirewall;
+import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcherEntry;
 import org.springframework.util.Assert;
@@ -98,6 +96,8 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 
 	private IgnoredRequestConfigurer ignoredRequestRegistry;
 
+	private FilterSecurityInterceptor filterSecurityInterceptor;
+
 	private HttpFirewall httpFirewall;
 
 	private RequestRejectedHandler requestRejectedHandler;
@@ -106,8 +106,6 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 
 	private WebInvocationPrivilegeEvaluator privilegeEvaluator;
 
-	private ObservationRegistry observationRegistry = ObservationRegistry.NOOP;
-
 	private DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
 
 	private SecurityExpressionHandler<FilterInvocation> expressionHandler = this.defaultWebSecurityExpressionHandler;
@@ -214,8 +212,8 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 
 	/**
 	 * Set the {@link WebInvocationPrivilegeEvaluator} to be used. If this is not
-	 * specified, then a {@link RequestMatcherDelegatingWebInvocationPrivilegeEvaluator}
-	 * will be created based on the list of {@link SecurityFilterChain}.
+	 * specified, then a {@link DefaultWebInvocationPrivilegeEvaluator} will be created
+	 * when {@link #securityInterceptor(FilterSecurityInterceptor)} is non null.
 	 * @param privilegeEvaluator the {@link WebInvocationPrivilegeEvaluator} to use
 	 * @return the {@link WebSecurity} for further customizations
 	 */
@@ -249,7 +247,25 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	 * @return the {@link WebInvocationPrivilegeEvaluator} for further customizations
 	 */
 	public WebInvocationPrivilegeEvaluator getPrivilegeEvaluator() {
-		return this.privilegeEvaluator;
+		if (this.privilegeEvaluator != null) {
+			return this.privilegeEvaluator;
+		}
+		return (this.filterSecurityInterceptor != null)
+				? new DefaultWebInvocationPrivilegeEvaluator(this.filterSecurityInterceptor) : null;
+	}
+
+	/**
+	 * Sets the {@link FilterSecurityInterceptor}. This is typically invoked by
+	 * {@link WebSecurityConfiguration#springSecurityFilterChain()}.
+	 * @param securityInterceptor the {@link FilterSecurityInterceptor} to use
+	 * @return the {@link WebSecurity} for further customizations
+	 * @deprecated Use {@link #privilegeEvaluator(WebInvocationPrivilegeEvaluator)}
+	 * instead
+	 */
+	@Deprecated
+	public WebSecurity securityInterceptor(FilterSecurityInterceptor securityInterceptor) {
+		this.filterSecurityInterceptor = securityInterceptor;
+		return this;
 	}
 
 	/**
@@ -310,13 +326,6 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 		if (this.requestRejectedHandler != null) {
 			filterChainProxy.setRequestRejectedHandler(this.requestRejectedHandler);
 		}
-		else if (!this.observationRegistry.isNoop()) {
-			CompositeRequestRejectedHandler requestRejectedHandler = new CompositeRequestRejectedHandler(
-					new ObservationMarkingRequestRejectedHandler(this.observationRegistry),
-					new HttpStatusRequestRejectedHandler());
-			filterChainProxy.setRequestRejectedHandler(requestRejectedHandler);
-		}
-		filterChainProxy.setFilterChainDecorator(getFilterChainDecorator());
 		filterChainProxy.afterPropertiesSet();
 
 		Filter result = filterChainProxy;
@@ -328,7 +337,6 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 					+ "********************************************************************\n\n");
 			result = new DebugFilter(filterChainProxy);
 		}
-
 		this.postBuildAction.run();
 		return result;
 	}
@@ -381,11 +389,6 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 		}
 		catch (NoSuchBeanDefinitionException ex) {
 		}
-		try {
-			this.observationRegistry = applicationContext.getBean(ObservationRegistry.class);
-		}
-		catch (NoSuchBeanDefinitionException ex) {
-		}
 	}
 
 	@Override
@@ -393,11 +396,30 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 		this.servletContext = servletContext;
 	}
 
-	FilterChainProxy.FilterChainDecorator getFilterChainDecorator() {
-		if (this.observationRegistry.isNoop()) {
-			return new FilterChainProxy.VirtualFilterChainDecorator();
+	/**
+	 * An {@link IgnoredRequestConfigurer} that allows optionally configuring the
+	 * {@link MvcRequestMatcher#setMethod(HttpMethod)}
+	 *
+	 * @author Rob Winch
+	 * @deprecated use {@link MvcRequestMatcher.Builder} instead
+	 */
+	@Deprecated
+	public final class MvcMatchersIgnoredRequestConfigurer extends IgnoredRequestConfigurer {
+
+		private final List<MvcRequestMatcher> mvcMatchers;
+
+		private MvcMatchersIgnoredRequestConfigurer(ApplicationContext context, List<MvcRequestMatcher> mvcMatchers) {
+			super(context);
+			this.mvcMatchers = mvcMatchers;
 		}
-		return new ObservationFilterChainDecorator(this.observationRegistry);
+
+		public IgnoredRequestConfigurer servletPath(String servletPath) {
+			for (MvcRequestMatcher matcher : this.mvcMatchers) {
+				matcher.setServletPath(servletPath);
+			}
+			return this;
+		}
+
 	}
 
 	/**
@@ -413,6 +435,26 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 			setApplicationContext(context);
 		}
 
+		/**
+		 * @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
+		 */
+		@Override
+		@Deprecated
+		public MvcMatchersIgnoredRequestConfigurer mvcMatchers(HttpMethod method, String... mvcPatterns) {
+			List<MvcRequestMatcher> mvcMatchers = createMvcMatchers(method, mvcPatterns);
+			WebSecurity.this.ignoredRequests.addAll(mvcMatchers);
+			return new MvcMatchersIgnoredRequestConfigurer(getApplicationContext(), mvcMatchers);
+		}
+
+		/**
+		 * @deprecated use {@link #requestMatchers(String...)} instead
+		 */
+		@Override
+		@Deprecated
+		public MvcMatchersIgnoredRequestConfigurer mvcMatchers(String... mvcPatterns) {
+			return mvcMatchers(null, mvcPatterns);
+		}
+
 		@Override
 		protected IgnoredRequestConfigurer chainRequestMatchers(List<RequestMatcher> requestMatchers) {
 			WebSecurity.this.ignoredRequests.addAll(requestMatchers);

config/src/main/java/org/springframework/security/config/annotation/web/configuration/AutowiredWebSecurityConfigurersIgnoreParents.java

@@ -21,7 +21,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 
-import jakarta.servlet.Filter;
+import javax.servlet.Filter;
 
 import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.context.ApplicationContext;

config/src/main/java/org/springframework/security/config/annotation/web/configuration/EnableWebSecurity.java

@@ -22,6 +22,7 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
 import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
@@ -85,6 +86,7 @@ import org.springframework.security.web.SecurityFilterChain;
 @Import({ WebSecurityConfiguration.class, SpringWebMvcImportSelector.class, OAuth2ImportSelector.class,
 		HttpSecurityConfiguration.class })
 @EnableGlobalAuthentication
+@Configuration
 public @interface EnableWebSecurity {
 
 	/**

config/src/main/java/org/springframework/security/config/annotation/web/configuration/HttpSecurityConfiguration.java

@@ -20,7 +20,6 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
@@ -33,17 +32,11 @@ import org.springframework.security.authentication.DefaultAuthenticationEventPub
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
-import org.springframework.security.config.annotation.authentication.configurers.provisioning.InMemoryUserDetailsManagerConfigurer;
-import org.springframework.security.config.annotation.authentication.configurers.provisioning.JdbcUserDetailsManagerConfigurer;
-import org.springframework.security.config.annotation.authentication.configurers.userdetails.DaoAuthenticationConfigurer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.annotation.web.configurers.DefaultLoginPageConfigurer;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
-import org.springframework.security.core.userdetails.UserDetailsService;
-import org.springframework.security.crypto.factory.PasswordEncoderFactories;
-import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;
 import org.springframework.web.accept.ContentNegotiationStrategy;
 import org.springframework.web.accept.HeaderContentNegotiationStrategy;
@@ -65,6 +58,8 @@ class HttpSecurityConfiguration {
 
 	private ObjectPostProcessor<Object> objectPostProcessor;
 
+	private AuthenticationManager authenticationManager;
+
 	private AuthenticationConfiguration authenticationConfiguration;
 
 	private ApplicationContext context;
@@ -79,6 +74,10 @@ class HttpSecurityConfiguration {
 		this.objectPostProcessor = objectPostProcessor;
 	}
 
+	void setAuthenticationManager(AuthenticationManager authenticationManager) {
+		this.authenticationManager = authenticationManager;
+	}
+
 	@Autowired
 	void setAuthenticationConfiguration(AuthenticationConfiguration authenticationConfiguration) {
 		this.authenticationConfiguration = authenticationConfiguration;
@@ -102,8 +101,9 @@ class HttpSecurityConfiguration {
 	@Bean(HTTPSECURITY_BEAN_NAME)
 	@Scope("prototype")
 	HttpSecurity httpSecurity() throws Exception {
-		LazyPasswordEncoder passwordEncoder = new LazyPasswordEncoder(this.context);
-		AuthenticationManagerBuilder authenticationBuilder = new DefaultPasswordEncoderAuthenticationManagerBuilder(
+		WebSecurityConfigurerAdapter.LazyPasswordEncoder passwordEncoder = new WebSecurityConfigurerAdapter.LazyPasswordEncoder(
+				this.context);
+		AuthenticationManagerBuilder authenticationBuilder = new WebSecurityConfigurerAdapter.DefaultPasswordEncoderAuthenticationManagerBuilder(
 				this.objectPostProcessor, passwordEncoder);
 		authenticationBuilder.parentAuthenticationManager(authenticationManager());
 		authenticationBuilder.authenticationEventPublisher(getAuthenticationEventPublisher());
@@ -129,7 +129,8 @@ class HttpSecurityConfiguration {
 	}
 
 	private AuthenticationManager authenticationManager() throws Exception {
-		return this.authenticationConfiguration.getAuthenticationManager();
+		return (this.authenticationManager != null) ? this.authenticationManager
+				: this.authenticationConfiguration.getAuthenticationManager();
 	}
 
 	private AuthenticationEventPublisher getAuthenticationEventPublisher() {
@@ -155,90 +156,4 @@ class HttpSecurityConfiguration {
 		return sharedObjects;
 	}
 
-	static class DefaultPasswordEncoderAuthenticationManagerBuilder extends AuthenticationManagerBuilder {
-
-		private PasswordEncoder defaultPasswordEncoder;
-
-		/**
-		 * Creates a new instance
-		 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
-		 */
-		DefaultPasswordEncoderAuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
-				PasswordEncoder defaultPasswordEncoder) {
-			super(objectPostProcessor);
-			this.defaultPasswordEncoder = defaultPasswordEncoder;
-		}
-
-		@Override
-		public InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder> inMemoryAuthentication()
-				throws Exception {
-			return super.inMemoryAuthentication().passwordEncoder(this.defaultPasswordEncoder);
-		}
-
-		@Override
-		public JdbcUserDetailsManagerConfigurer<AuthenticationManagerBuilder> jdbcAuthentication() throws Exception {
-			return super.jdbcAuthentication().passwordEncoder(this.defaultPasswordEncoder);
-		}
-
-		@Override
-		public <T extends UserDetailsService> DaoAuthenticationConfigurer<AuthenticationManagerBuilder, T> userDetailsService(
-				T userDetailsService) throws Exception {
-			return super.userDetailsService(userDetailsService).passwordEncoder(this.defaultPasswordEncoder);
-		}
-
-	}
-
-	static class LazyPasswordEncoder implements PasswordEncoder {
-
-		private ApplicationContext applicationContext;
-
-		private PasswordEncoder passwordEncoder;
-
-		LazyPasswordEncoder(ApplicationContext applicationContext) {
-			this.applicationContext = applicationContext;
-		}
-
-		@Override
-		public String encode(CharSequence rawPassword) {
-			return getPasswordEncoder().encode(rawPassword);
-		}
-
-		@Override
-		public boolean matches(CharSequence rawPassword, String encodedPassword) {
-			return getPasswordEncoder().matches(rawPassword, encodedPassword);
-		}
-
-		@Override
-		public boolean upgradeEncoding(String encodedPassword) {
-			return getPasswordEncoder().upgradeEncoding(encodedPassword);
-		}
-
-		private PasswordEncoder getPasswordEncoder() {
-			if (this.passwordEncoder != null) {
-				return this.passwordEncoder;
-			}
-			PasswordEncoder passwordEncoder = getBeanOrNull(PasswordEncoder.class);
-			if (passwordEncoder == null) {
-				passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
-			}
-			this.passwordEncoder = passwordEncoder;
-			return passwordEncoder;
-		}
-
-		private <T> T getBeanOrNull(Class<T> type) {
-			try {
-				return this.applicationContext.getBean(type);
-			}
-			catch (NoSuchBeanDefinitionException ex) {
-				return null;
-			}
-		}
-
-		@Override
-		public String toString() {
-			return getPasswordEncoder().toString();
-		}
-
-	}
-
 }

config/src/main/java/org/springframework/security/config/annotation/web/configuration/OAuth2ClientConfiguration.java

@@ -51,18 +51,12 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 @Import(OAuth2ClientConfiguration.OAuth2ClientWebMvcImportSelector.class)
 final class OAuth2ClientConfiguration {
 
-	private static final boolean webMvcPresent;
-
-	static {
-		ClassLoader classLoader = OAuth2ClientConfiguration.class.getClassLoader();
-		webMvcPresent = ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet", classLoader);
-	}
-
 	static class OAuth2ClientWebMvcImportSelector implements ImportSelector {
 
 		@Override
 		public String[] selectImports(AnnotationMetadata importingClassMetadata) {
-			if (!webMvcPresent) {
+			if (!ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet",
+					getClass().getClassLoader())) {
 				return new String[0];
 			}
 			return new String[] { "org.springframework.security.config.annotation.web.configuration."

config/src/main/java/org/springframework/security/config/annotation/web/configuration/SecurityReactorContextConfiguration.java

@@ -25,8 +25,9 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.Function;
 import java.util.function.Supplier;
 
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.reactivestreams.Publisher;
 import org.reactivestreams.Subscription;
 import reactor.core.CoreSubscriber;