rm .github/workflows for unsupported branch

(cherry picked from commit 31babecfbd)

.gitattributes

@@ -15,4 +15,3 @@
 *.otg      binary
 *.png      binary
 *.hsx      binary
-*.serialized binary

.github/dependabot.yml

@@ -1,72 +0,0 @@
-version: 2
-
-registries:
-  spring-milestones:
-    type: maven-repository
-    url: https://repo.spring.io/milestone
-
-updates:
-
-  - package-ecosystem: "gradle"
-    target-branch: "main"
-    milestone: 319 # 6.2.x
-    directory: "/"
-    schedule:
-      interval: "daily"
-      time: "03:00"
-      timezone: "Etc/UTC"
-    labels: [ "type: dependency-upgrade" ]
-    registries:
-      - "spring-milestones"
-    ignore:
-      - dependency-name: "com.nimbusds:nimbus-jose-jwt" # nimbus-jose-jwt gets updated when oauth2-oidc-sdk is updated to ensure consistency
-      - dependency-name: "org.python:jython" # jython updates break integration tests
-      - dependency-name: "org.apache.directory.server:*" # ApacheDS version > 1.5.5 contains break changes
-      - dependency-name: "org.junit:junit-bom"
-        update-types: [ "version-update:semver-major" ]
-      - dependency-name: "org.mockito:mockito-bom"
-        update-types: [ "version-update:semver-major" ]
-      - dependency-name: "*"
-        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-
-  - package-ecosystem: "gradle"
-    target-branch: "6.1.x"
-    milestone: 318 # 6.1.x
-    directory: "/"
-    schedule:
-      interval: "daily"
-      time: "03:00"
-      timezone: "Etc/UTC"
-    labels: [ "type: dependency-upgrade" ]
-    ignore:
-      - dependency-name: "com.nimbusds:nimbus-jose-jwt" # nimbus-jose-jwt gets updated when oauth2-oidc-sdk is updated to ensure consistency
-      - dependency-name: "org.python:jython" # jython updates break integration tests
-      - dependency-name: "org.apache.directory.server:*" # ApacheDS version > 1.5.5 contains break changes
-      - dependency-name: "org.junit:junit-bom"
-        update-types: [ "version-update:semver-major" ]
-      - dependency-name: "org.mockito:mockito-bom"
-        update-types: [ "version-update:semver-major" ]
-      - dependency-name: "*"
-        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-
-  - package-ecosystem: "gradle"
-    target-branch: "5.8.x"
-    milestone: 246 # 5.8.x
-    directory: "/"
-    schedule:
-      interval: "daily"
-      time: "03:00"
-      timezone: "Etc/UTC"
-    labels: [ "type: dependency-upgrade" ]
-    ignore:
-      - dependency-name: "com.nimbusds:nimbus-jose-jwt" # nimbus-jose-jwt gets updated when oauth2-oidc-sdk is updated to ensure consistency
-      - dependency-name: "org.python:jython" # jython updates break integration tests
-      - dependency-name: "org.apache.directory.server:*" # ApacheDS version > 1.5.5 contains break changes
-      - dependency-name: "io.mockk:mockk" # mockk updates break tests
-      - dependency-name: "org.opensaml:*" # org.opensaml maintains two different versions, so it must be updated manually
-      - dependency-name: "org.junit:junit-bom"
-        update-types: [ "version-update:semver-major" ]
-      - dependency-name: "org.mockito:mockito-bom"
-        update-types: [ "version-update:semver-major" ]
-      - dependency-name: "*"
-        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]

acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java

@@ -118,7 +118,8 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 		if (permission instanceof Permission[]) {
 			return Arrays.asList((Permission[]) permission);
 		}
-		if (permission instanceof String permString) {
+		if (permission instanceof String) {
+			String permString = (String) permission;
 			Permission p = buildPermission(permString);
 			if (p != null) {
 				return Arrays.asList(p);

acl/src/main/java/org/springframework/security/acls/domain/AbstractPermission.java

@@ -56,9 +56,10 @@ public abstract class AbstractPermission implements Permission {
 		if (obj == null) {
 			return false;
 		}
-		if (!(obj instanceof Permission other)) {
+		if (!(obj instanceof Permission)) {
 			return false;
 		}
+		Permission other = (Permission) obj;
 		return (this.mask == other.getMask());
 	}
 

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcAclServiceTests.java

@@ -112,7 +112,7 @@ public class JdbcAclServiceTests {
 		given(this.jdbcOperations.query(anyString(), eq(args), any(RowMapper.class))).willReturn(result);
 		ObjectIdentity objectIdentity = new ObjectIdentityImpl(MockLongIdDomainObject.class, 1L);
 		List<ObjectIdentity> objectIdentities = this.aclService.findChildren(objectIdentity);
-		assertThat(objectIdentities).hasSize(1);
+		assertThat(objectIdentities.size()).isEqualTo(1);
 		assertThat(objectIdentities.get(0).getIdentifier()).isEqualTo("5577");
 	}
 
@@ -127,7 +127,7 @@ public class JdbcAclServiceTests {
 	public void findChildrenWithoutIdType() {
 		ObjectIdentity objectIdentity = new ObjectIdentityImpl(MockLongIdDomainObject.class, 4711L);
 		List<ObjectIdentity> objectIdentities = this.aclServiceIntegration.findChildren(objectIdentity);
-		assertThat(objectIdentities).hasSize(1);
+		assertThat(objectIdentities.size()).isEqualTo(1);
 		assertThat(objectIdentities.get(0).getType()).isEqualTo(MockUntypedIdDomainObject.class.getName());
 		assertThat(objectIdentities.get(0).getIdentifier()).isEqualTo(5000L);
 	}
@@ -143,7 +143,7 @@ public class JdbcAclServiceTests {
 	public void findChildrenOfIdTypeLong() {
 		ObjectIdentity objectIdentity = new ObjectIdentityImpl("location", "US-PAL");
 		List<ObjectIdentity> objectIdentities = this.aclServiceIntegration.findChildren(objectIdentity);
-		assertThat(objectIdentities).hasSize(2);
+		assertThat(objectIdentities.size()).isEqualTo(2);
 		assertThat(objectIdentities.get(0).getType()).isEqualTo(MockLongIdDomainObject.class.getName());
 		assertThat(objectIdentities.get(0).getIdentifier()).isEqualTo(4711L);
 		assertThat(objectIdentities.get(1).getType()).isEqualTo(MockLongIdDomainObject.class.getName());
@@ -155,7 +155,7 @@ public class JdbcAclServiceTests {
 		ObjectIdentity objectIdentity = new ObjectIdentityImpl("location", "US");
 		this.aclServiceIntegration.setAclClassIdSupported(true);
 		List<ObjectIdentity> objectIdentities = this.aclServiceIntegration.findChildren(objectIdentity);
-		assertThat(objectIdentities).hasSize(1);
+		assertThat(objectIdentities.size()).isEqualTo(1);
 		assertThat(objectIdentities.get(0).getType()).isEqualTo("location");
 		assertThat(objectIdentities.get(0).getIdentifier()).isEqualTo("US-PAL");
 	}
@@ -165,7 +165,7 @@ public class JdbcAclServiceTests {
 		ObjectIdentity objectIdentity = new ObjectIdentityImpl(MockUntypedIdDomainObject.class, 5000L);
 		this.aclServiceIntegration.setAclClassIdSupported(true);
 		List<ObjectIdentity> objectIdentities = this.aclServiceIntegration.findChildren(objectIdentity);
-		assertThat(objectIdentities).hasSize(1);
+		assertThat(objectIdentities.size()).isEqualTo(1);
 		assertThat(objectIdentities.get(0).getType()).isEqualTo("costcenter");
 		assertThat(objectIdentities.get(0).getIdentifier())
 			.isEqualTo(UUID.fromString("25d93b3f-c3aa-4814-9d5e-c7c96ced7762"));
@@ -186,7 +186,7 @@ public class JdbcAclServiceTests {
 		ObjectIdentity objectIdentity = new ObjectIdentityImpl("location", "US");
 		this.aclServiceIntegration.setAclClassIdSupported(true);
 		List<ObjectIdentity> objectIdentities = this.aclServiceIntegration.findChildren(objectIdentity);
-		assertThat(objectIdentities).hasSize(1);
+		assertThat(objectIdentities.size()).isEqualTo(1);
 		assertThat(objectIdentities.get(0).getType()).isEqualTo("location");
 		assertThat(objectIdentities.get(0).getIdentifier()).isEqualTo("prefix:US-PAL");
 	}

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcMutableAclServiceTests.java

@@ -454,7 +454,7 @@ public class JdbcMutableAclServiceTests {
 		CustomSid customSid = new CustomSid("Custom sid");
 		given(customJdbcMutableAclService.createOrRetrieveSidPrimaryKey("Custom sid", false, false)).willReturn(1L);
 		Long result = customJdbcMutableAclService.createOrRetrieveSidPrimaryKey(customSid, false);
-		assertThat(Long.valueOf(1L)).isEqualTo(result);
+		assertThat(new Long(1L)).isEqualTo(result);
 	}
 
 	protected Authentication getAuth() {

acl/src/test/java/org/springframework/security/acls/sid/SidTests.java

@@ -120,9 +120,9 @@ public class SidTests {
 		PrincipalSid principalSid = new PrincipalSid(authentication);
 		GrantedAuthority ga = new SimpleGrantedAuthority("ROLE_TEST");
 		GrantedAuthoritySid gaSid = new GrantedAuthoritySid(ga);
-		assertThat("johndoe").isEqualTo(principalSid.getPrincipal());
+		assertThat("johndoe".equals(principalSid.getPrincipal())).isTrue();
 		assertThat("scott".equals(principalSid.getPrincipal())).isFalse();
-		assertThat("ROLE_TEST").isEqualTo(gaSid.getGrantedAuthority());
+		assertThat("ROLE_TEST".equals(gaSid.getGrantedAuthority())).isTrue();
 		assertThat("ROLE_TEST2".equals(gaSid.getGrantedAuthority())).isFalse();
 	}
 

aspects/spring-security-aspects.gradle

@@ -29,4 +29,10 @@ dependencies {
 	testAspect sourceSets.main.output
 }
 
+sourceSets.main.aspectj.srcDir "src/main/java"
+sourceSets.main.java.srcDirs = files()
+
+sourceSets.test.aspectj.srcDir "src/test/java"
+sourceSets.test.java.srcDirs = files()
+
 compileAspectj.ajcOptions.outxmlfile = "META-INF/aop.xml"

aspects/src/test/java/org/springframework/security/access/intercept/aspectj/aspect/AnnotationSecurityAspectTests.java

@@ -143,8 +143,8 @@ public class AnnotationSecurityAspectTests {
 		SecurityContextHolder.getContext().setAuthentication(this.anne);
 		List<String> objects = this.prePostSecured.postFilterMethod();
 		assertThat(objects).hasSize(2);
-		assertThat(objects).contains("apple");
-		assertThat(objects).contains("aubergine");
+		assertThat(objects.contains("apple")).isTrue();
+		assertThat(objects.contains("aubergine")).isTrue();
 	}
 
 	private void configureForElAnnotations() {

build.gradle

@@ -14,17 +14,12 @@ buildscript {
 	}
 }
 
-plugins {
-	alias(libs.plugins.org.gradle.wrapper.upgrade)
-}
-
 apply plugin: 'io.spring.nohttp'
 apply plugin: 'locks'
 apply plugin: 's101'
 apply plugin: 'io.spring.convention.root'
 apply plugin: 'org.jetbrains.kotlin.jvm'
 apply plugin: 'org.springframework.security.versions.verify-dependencies-versions'
-apply plugin: 'org.springframework.security.check-expected-branch-version'
 apply plugin: 'io.spring.security.release'
 
 group = 'org.springframework.security'
@@ -36,7 +31,6 @@ ext.milestoneBuild = !(snapshotBuild || releaseBuild)
 
 repositories {
 	mavenCentral()
-	maven { url "https://repo.spring.io/milestone" }
 }
 
 springRelease {
@@ -47,31 +41,19 @@ springRelease {
 	replaceSnapshotVersionInReferenceDocUrl = true
 }
 
-def toolchainVersion() {
-	if (project.hasProperty('testToolchain')) {
-		return project.property('testToolchain').toString().toInteger()
-	}
-	return 17
-}
-
 subprojects {
-	java {
-		toolchain {
-			languageVersion = JavaLanguageVersion.of(toolchainVersion())
+	plugins.withType(JavaPlugin) {
+		java {
+			sourceCompatibility=JavaVersion.VERSION_17
 		}
 	}
-	kotlin {
-		jvmToolchain {
-			languageVersion = JavaLanguageVersion.of(17)
-		}
-	}
-	tasks.withType(JavaCompile).configureEach {
+	tasks.withType(JavaCompile) {
 		options.encoding = "UTF-8"
 		options.compilerArgs.add("-parameters")
-		options.release.set(17)
 	}
 }
 
+
 allprojects {
 	if (!['spring-security-bom', 'spring-security-docs'].contains(project.name)) {
 		apply plugin: 'io.spring.javaformat'
@@ -96,6 +78,12 @@ allprojects {
 			}
 		}
 	}
+
+	tasks.withType(JavaCompile).configureEach {
+		javaCompiler = javaToolchains.compilerFor {
+			languageVersion = JavaLanguageVersion.of(17)
+		}
+	}
 }
 
 develocity {
@@ -121,12 +109,3 @@ s101 {
 	repository = 'https://structure101.com/binaries/latest'
 	configurationDirectory = project.file("etc/s101")
 }
-
-wrapperUpgrade {
-	gradle {
-		'spring-security' {
-			repo = 'spring-projects/spring-security'
-			baseBranch = '6.1.x' // runs only on 6.1.x and the update is merged forward to main
-		}
-	}
-}

buildSrc/build.gradle

@@ -11,7 +11,6 @@ java {
 repositories {
 	gradlePluginPortal()
 	mavenCentral()
-	maven { url 'https://repo.spring.io/milestone' }
 }
 
 sourceSets {
@@ -47,10 +46,6 @@ gradlePlugin {
 			id = "org.springframework.security.versions.verify-dependencies-versions"
 			implementationClass = "org.springframework.security.convention.versions.VerifyDependenciesVersionsPlugin"
 		}
-		checkExpectedBranchVersion {
-			id = "org.springframework.security.check-expected-branch-version"
-			implementationClass = "org.springframework.security.CheckExpectedBranchVersionPlugin"
-		}
 	}
 }
 

buildSrc/src/main/groovy/io/spring/gradle/convention/CheckstylePlugin.groovy

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2019 the original author or authors.
+ * Copyright 2016-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not
  * use this file except in compliance with the License. You may obtain a copy of

buildSrc/src/main/groovy/io/spring/gradle/convention/EclipsePlugin.groovy

@@ -63,7 +63,6 @@ class EclipsePlugin implements Plugin<Project> {
 						// test sources. Relax those from error to warning
 						properties['org.eclipse.jdt.core.circularClasspath'] = 'warning'
 						properties['org.eclipse.jdt.core.incompleteClasspath'] = 'warning'
-						properties['org.eclipse.jdt.core.compiler.codegen.methodParameters'] = 'generate'
 					}
 				}
 			}

buildSrc/src/main/java/org/springframework/gradle/classpath/CheckClasspathForProhibitedDependenciesPlugin.java

@@ -35,7 +35,9 @@ public class CheckClasspathForProhibitedDependenciesPlugin implements Plugin<Pro
 	@Override
 	public void apply(Project project) {
 		project.getPlugins().apply(CheckProhibitedDependenciesLifecyclePlugin.class);
-		project.getPlugins().withType(JavaBasePlugin.class, javaBasePlugin -> configureProhibitedDependencyChecks(project));
+		project.getPlugins().withType(JavaBasePlugin.class, javaBasePlugin -> {
+			configureProhibitedDependencyChecks(project);
+		});
 	}
 
 	private void configureProhibitedDependencyChecks(Project project) {

buildSrc/src/main/java/org/springframework/gradle/classpath/CheckProhibitedDependenciesLifecyclePlugin.java

@@ -34,6 +34,8 @@ public class CheckProhibitedDependenciesLifecyclePlugin implements Plugin<Projec
 			task.setGroup(JavaBasePlugin.VERIFICATION_GROUP);
 			task.setDescription("Checks both the compile/runtime classpath of every SourceSet for prohibited dependencies");
 		});
-		project.getTasks().named(JavaBasePlugin.CHECK_TASK_NAME, checkTask -> checkTask.dependsOn(checkProhibitedDependencies));
+		project.getTasks().named(JavaBasePlugin.CHECK_TASK_NAME, checkTask -> {
+			checkTask.dependsOn(checkProhibitedDependencies);
+		});
 	}
 }

buildSrc/src/main/java/org/springframework/gradle/maven/SpringSigningPlugin.java

@@ -21,6 +21,7 @@ import org.gradle.api.Plugin;
 import org.gradle.api.Project;
 import org.gradle.api.publish.Publication;
 import org.gradle.api.publish.PublishingExtension;
+import org.gradle.api.publish.plugins.PublishingPlugin;
 import org.gradle.plugins.signing.SigningExtension;
 import org.gradle.plugins.signing.SigningPlugin;
 
@@ -43,7 +44,12 @@ public class SpringSigningPlugin implements Plugin<Project> {
 
 	private void sign(Project project) {
 		SigningExtension signing = project.getExtensions().findByType(SigningExtension.class);
-		signing.setRequired((Callable<Boolean>) () -> project.getGradle().getTaskGraph().hasTask("publishArtifacts"));
+		signing.setRequired(new Callable<Boolean>() {
+			@Override
+			public Boolean call() throws Exception {
+				return project.getGradle().getTaskGraph().hasTask("publishArtifacts");
+			}
+		});
 		String signingKeyId = (String) project.findProperty("signingKeyId");
 		String signingKey = (String) project.findProperty("signingKey");
 		String signingPassword = (String) project.findProperty("signingPassword");

buildSrc/src/main/java/org/springframework/security/CheckExpectedBranchVersionPlugin.java

@@ -1,115 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security;
-
-import org.gradle.api.DefaultTask;
-import org.gradle.api.Plugin;
-import org.gradle.api.Project;
-import org.gradle.api.Task;
-import org.gradle.api.file.RegularFileProperty;
-import org.gradle.api.plugins.JavaBasePlugin;
-import org.gradle.api.provider.Property;
-import org.gradle.api.tasks.CacheableTask;
-import org.gradle.api.tasks.Input;
-import org.gradle.api.tasks.OutputFile;
-import org.gradle.api.tasks.TaskAction;
-import org.gradle.api.tasks.TaskExecutionException;
-import org.gradle.api.tasks.TaskProvider;
-import org.gradle.api.tasks.VerificationException;
-
-import java.io.IOException;
-import java.nio.file.Files;
-
-/**
- * @author Marcus da Coregio
- */
-public class CheckExpectedBranchVersionPlugin implements Plugin<Project> {
-
-	@Override
-	public void apply(Project project) {
-		TaskProvider<CheckExpectedBranchVersionTask> checkExpectedBranchVersionTask = project.getTasks().register("checkExpectedBranchVersion", CheckExpectedBranchVersionTask.class, (task) -> {
-			task.setGroup("Build");
-			task.setDescription("Check if the project version matches the branch version");
-			task.onlyIf("skipCheckExpectedBranchVersion property is false or not present", CheckExpectedBranchVersionPlugin::skipPropertyFalseOrNotPresent);
-			task.getVersion().convention(project.provider(() -> project.getVersion().toString()));
-			task.getBranchName().convention(project.getProviders().exec(execSpec -> execSpec.setCommandLine("git", "symbolic-ref", "--short", "HEAD")).getStandardOutput().getAsText());
-			task.getOutputFile().convention(project.getLayout().getBuildDirectory().file("check-expected-branch-version"));
-		});
-		project.getTasks().named(JavaBasePlugin.CHECK_TASK_NAME, checkTask -> checkTask.dependsOn(checkExpectedBranchVersionTask));
-	}
-
-	private static boolean skipPropertyFalseOrNotPresent(Task task) {
-		return task.getProject()
-				.getProviders()
-				.gradleProperty("skipCheckExpectedBranchVersion")
-				.orElse("false")
-				.map("false"::equalsIgnoreCase)
-				.get();
-	}
-
-	@CacheableTask
-	public static abstract class CheckExpectedBranchVersionTask extends DefaultTask {
-
-		@Input
-		abstract Property<String> getVersion();
-
-		@Input
-		abstract Property<String> getBranchName();
-
-		@OutputFile
-		abstract RegularFileProperty getOutputFile();
-
-		@TaskAction
-		public void run() {
-			String version = getVersion().get();
-			String branchVersion = getBranchName().map(String::trim).get();
-			if (!branchVersion.matches("^[0-9]+\\.[0-9]+\\.x$")) {
-				String msg = String.format("Branch version [%s] does not match *.x, ignoring", branchVersion);
-				getLogger().warn(msg);
-				writeExpectedVersionOutput(msg);
-				return;
-			}
-			if (!versionsMatch(version, branchVersion)) {
-				String msg = String.format("Project version [%s] does not match branch version [%s]. " +
-						"Please verify that the branch contains the right version.", version, branchVersion);
-				writeExpectedVersionOutput(msg);
-				throw new VerificationException(msg);
-			}
-
-			writeExpectedVersionOutput(version);
-		}
-
-		private void writeExpectedVersionOutput(String fileContent) {
-			try {
-				Files.writeString(getOutputFile().get().getAsFile().toPath(), fileContent);
-			} catch (IOException e) {
-				throw new TaskExecutionException(this, e);
-			}
-		}
-
-		private boolean versionsMatch(String projectVersion, String branchVersion) {
-			String[] projectVersionParts = projectVersion.split("\\.");
-			String[] branchVersionParts = branchVersion.split("\\.");
-			if (projectVersionParts.length < 2 || branchVersionParts.length < 2) {
-				return false;
-			}
-			return projectVersionParts[0].equals(branchVersionParts[0]) && projectVersionParts[1].equals(branchVersionParts[1]);
-		}
-
-	}
-
-}

buildSrc/src/main/java/org/springframework/security/convention/versions/VerifyDependenciesVersionsPlugin.java

@@ -19,81 +19,52 @@ package org.springframework.security.convention.versions;
 import org.gradle.api.DefaultTask;
 import org.gradle.api.Plugin;
 import org.gradle.api.Project;
-import org.gradle.api.artifacts.Dependency;
 import org.gradle.api.artifacts.MinimalExternalModuleDependency;
 import org.gradle.api.artifacts.VersionCatalog;
 import org.gradle.api.artifacts.VersionCatalogsExtension;
-import org.gradle.api.file.RegularFile;
-import org.gradle.api.file.RegularFileProperty;
 import org.gradle.api.plugins.JavaBasePlugin;
-import org.gradle.api.provider.Property;
-import org.gradle.api.provider.Provider;
-import org.gradle.api.tasks.CacheableTask;
-import org.gradle.api.tasks.Input;
-import org.gradle.api.tasks.OutputFile;
 import org.gradle.api.tasks.TaskAction;
-import org.gradle.api.tasks.TaskExecutionException;
 import org.gradle.api.tasks.TaskProvider;
-import org.gradle.api.tasks.VerificationException;
-
-import java.io.File;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.util.Optional;
 
 public class VerifyDependenciesVersionsPlugin implements Plugin<Project> {
 
 	@Override
 	public void apply(Project project) {
-		VersionCatalog versionCatalog = project.getExtensions().getByType(VersionCatalogsExtension.class).named("libs");
-		Optional<Provider<MinimalExternalModuleDependency>> oauth2OidcSdk = versionCatalog.findLibrary("com-nimbusds-oauth2-oidc-sdk");
-		Optional<Provider<MinimalExternalModuleDependency>> nimbusJoseJwt = versionCatalog.findLibrary("com-nimbusds-nimbus-jose-jwt");
-
-		if (oauth2OidcSdk.isEmpty()) {
-			throw new VerificationException("Library [com-nimbusds-oauth2-oidc-sdk] does not exist in the version catalog named libs.");
-		}
-
-		if (nimbusJoseJwt.isEmpty()) {
-			throw new VerificationException("Library [com-nimbusds-nimbus-jose-jwt] does not exist in the version catalog named libs.");
-		}
-
 		TaskProvider<VerifyDependenciesVersionsTask> verifyDependenciesVersionsTaskProvider = project.getTasks().register("verifyDependenciesVersions", VerifyDependenciesVersionsTask.class, (task) -> {
 			task.setGroup("Verification");
 			task.setDescription("Verify that specific dependencies are using the same version");
-			task.getOauth2OidcSdkVersion().convention(oauth2OidcSdk.get().map(Dependency::getVersion));
-			task.getExpectedNimbusJoseJwtVersion().convention(nimbusJoseJwt.get().map(Dependency::getVersion));
-			task.getOutputFile().convention(project.getLayout().getBuildDirectory().file("verify-dependencies-versions"));
+			VersionCatalog versionCatalog = project.getExtensions().getByType(VersionCatalogsExtension.class).named("libs");
+			MinimalExternalModuleDependency oauth2OidcSdk = versionCatalog.findLibrary("com-nimbusds-oauth2-oidc-sdk").get().get();
+			MinimalExternalModuleDependency nimbusJoseJwt = versionCatalog.findLibrary("com-nimbusds-nimbus-jose-jwt").get().get();
+			task.setOauth2OidcSdkVersion(oauth2OidcSdk.getVersion());
+			task.setExpectedNimbusJoseJwtVersion(nimbusJoseJwt.getVersion());
 		});
 		project.getTasks().named(JavaBasePlugin.CHECK_TASK_NAME, checkTask -> checkTask.dependsOn(verifyDependenciesVersionsTaskProvider));
 	}
 
-	@CacheableTask
-	public abstract static class VerifyDependenciesVersionsTask extends DefaultTask {
+	public static class VerifyDependenciesVersionsTask extends DefaultTask {
 
-		@Input
-		abstract Property<String> getOauth2OidcSdkVersion();
+		private String oauth2OidcSdkVersion;
 
-		@Input
-		abstract Property<String> getExpectedNimbusJoseJwtVersion();
+		private String expectedNimbusJoseJwtVersion;
 
-		@OutputFile
-		abstract RegularFileProperty getOutputFile();
+		public void setOauth2OidcSdkVersion(String oauth2OidcSdkVersion) {
+			this.oauth2OidcSdkVersion = oauth2OidcSdkVersion;
+		}
+
+		public void setExpectedNimbusJoseJwtVersion(String expectedNimbusJoseJwtVersion) {
+			this.expectedNimbusJoseJwtVersion = expectedNimbusJoseJwtVersion;
+		}
 
 		@TaskAction
-		public void verify()  {
-			String oauth2OidcSdkVersion = this.getOauth2OidcSdkVersion().get();
-			String transitiveNimbusJoseJwtVersion = TransitiveDependencyLookupUtils.lookupJwtVersion(oauth2OidcSdkVersion);
-			String expectedNimbusJoseJwtVersion = this.getExpectedNimbusJoseJwtVersion().get();
-			if (!transitiveNimbusJoseJwtVersion.equals(expectedNimbusJoseJwtVersion)) {
-				String message = String.format("Found transitive nimbus-jose-jwt:%s in oauth2-oidc-sdk:%s, but the project contains a different version of nimbus-jose-jwt [%s]. Please align the versions.", transitiveNimbusJoseJwtVersion, oauth2OidcSdkVersion, expectedNimbusJoseJwtVersion);
-				throw new VerificationException(message);
-			}
-			String message = String.format("Found transitive nimbus-jose-jwt:%s in oauth2-oidc-sdk:%s, the project contains expected version of nimbus-jose-jwt [%s]. Verified all versions align.", transitiveNimbusJoseJwtVersion, oauth2OidcSdkVersion, expectedNimbusJoseJwtVersion);
-			try {
-				Files.writeString(getOutputFile().get().getAsFile().toPath(), message);
-			} catch (IOException e) {
-				throw new TaskExecutionException(this, e);
+		public void verify() {
+			String transitiveNimbusJoseJwtVersion = TransitiveDependencyLookupUtils.lookupJwtVersion(this.oauth2OidcSdkVersion);
+			if (!transitiveNimbusJoseJwtVersion.equals(this.expectedNimbusJoseJwtVersion)) {
+				String message = String.format("Found transitive nimbus-jose-jwt:%s in oauth2-oidc-sdk:%s, but the project contains a different version of nimbus-jose-jwt [%s]. Please align the versions.", transitiveNimbusJoseJwtVersion, this.oauth2OidcSdkVersion, this.expectedNimbusJoseJwtVersion);
+				throw new IllegalStateException(message);
 			}
 		}
+
 	}
+
 }

cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java

@@ -18,7 +18,6 @@ package org.springframework.security.cas.userdetails;
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Locale;
 
 import org.apereo.cas.client.validation.Assertion;
 
@@ -74,8 +73,7 @@ public final class GrantedAuthorityFromAssertionAttributesUserDetailsService
 	}
 
 	private SimpleGrantedAuthority createSimpleGrantedAuthority(Object o) {
-		return new SimpleGrantedAuthority(
-				this.convertToUpperCase ? o.toString().toUpperCase(Locale.ROOT) : o.toString());
+		return new SimpleGrantedAuthority(this.convertToUpperCase ? o.toString().toUpperCase() : o.toString());
 	}
 
 	/**

cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java

@@ -39,7 +39,6 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
@@ -197,9 +196,6 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 
 	private SecurityContextRepository securityContextRepository = new HttpSessionSecurityContextRepository();
 
-	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
-		.getContextHolderStrategy();
-
 	private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
 
 	public CasAuthenticationFilter() {
@@ -218,10 +214,9 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 		}
 		this.logger.debug(
 				LogMessage.format("Authentication success. Updating SecurityContextHolder to contain: %s", authResult));
-
-		SecurityContext context = this.securityContextHolderStrategy.createEmptyContext();
+		SecurityContext context = SecurityContextHolder.createEmptyContext();
 		context.setAuthentication(authResult);
-		this.securityContextHolderStrategy.setContext(context);
+		SecurityContextHolder.setContext(context);
 		this.securityContextRepository.saveContext(context, request, response);
 		if (this.eventPublisher != null) {
 			this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
@@ -312,12 +307,6 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 		this.securityContextRepository = securityContextRepository;
 	}
 
-	@Override
-	public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
-		super.setSecurityContextHolderStrategy(securityContextHolderStrategy);
-		this.securityContextHolderStrategy = securityContextHolderStrategy;
-	}
-
 	/**
 	 * Indicates if the request is elgible to process a service ticket. This method exists
 	 * for readability.

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java

@@ -37,8 +37,6 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
-import org.springframework.security.core.context.SecurityContextImpl;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.context.SecurityContextRepository;
 import org.springframework.test.util.ReflectionTestUtils;
@@ -234,15 +232,4 @@ public class CasAuthenticationFilterTests {
 		verify(securityContextRepository).saveContext(any(SecurityContext.class), any(), any());
 	}
 
-	@Test
-	void successfulAuthenticationWhenSecurityContextHolderStrategySetThenUses() throws ServletException, IOException {
-		SecurityContextHolderStrategy securityContextRepository = mock(SecurityContextHolderStrategy.class);
-		given(securityContextRepository.createEmptyContext()).willReturn(new SecurityContextImpl());
-		CasAuthenticationFilter filter = new CasAuthenticationFilter();
-		filter.setSecurityContextHolderStrategy(securityContextRepository);
-		filter.successfulAuthentication(new MockHttpServletRequest(), new MockHttpServletResponse(),
-				new MockFilterChain(), mock(Authentication.class));
-		verify(securityContextRepository).setContext(any(SecurityContext.class));
-	}
-
 }

config/spring-security-config.gradle

@@ -80,6 +80,7 @@ dependencies {
 	testImplementation "org.hibernate.orm:hibernate-core"
 	testImplementation 'org.hsqldb:hsqldb'
 	testImplementation 'org.mockito:mockito-core'
+	testImplementation "org.mockito:mockito-inline"
 	testImplementation('org.seleniumhq.selenium:htmlunit-driver') {
 		exclude group: 'commons-logging', module: 'commons-logging'
 		exclude group: 'xml-apis', module: 'xml-apis'
@@ -112,7 +113,6 @@ dependencies {
 	testImplementation ('org.apache.maven.resolver:maven-resolver-transport-http') {
 		exclude group: "org.slf4j", module: "jcl-over-slf4j"
 	}
-	testImplementation libs.org.instancio.instancio.junit
 
 	testRuntimeOnly 'org.hsqldb:hsqldb'
 }
@@ -154,9 +154,3 @@ tasks.withType(KotlinCompile).configureEach {
 		jvmTarget = "17"
 	}
 }
-
-configure(project.tasks.withType(Test)) {
-	doFirst {
-		systemProperties['springSecurityVersion'] = version
-	}
-}

config/src/integration-test/java/org/springframework/security/config/annotation/rsocket/RSocketMessageHandlerITests.java

@@ -294,7 +294,7 @@ public class RSocketMessageHandlerITests {
 
 		@MessageMapping({ "secure.send", "send" })
 		Mono<Void> send(Mono<String> payload) {
-			return payload.doOnNext(this::add).then(Mono.fromRunnable(this::doNotifyAll));
+			return payload.doOnNext(this::add).then(Mono.fromRunnable(() -> doNotifyAll()));
 		}
 
 		private synchronized void doNotifyAll() {

config/src/integration-test/java/org/springframework/security/config/ldap/LdapUserServiceBeanDefinitionParserTests.java

@@ -87,7 +87,7 @@ public class LdapUserServiceBeanDefinitionParserTests {
 
 		Set<String> authorities = AuthorityUtils.authorityListToSet(ben.getAuthorities());
 		assertThat(authorities).hasSize(3);
-		assertThat(authorities).contains("ROLE_DEVELOPERS");
+		assertThat(authorities.contains("ROLE_DEVELOPERS")).isTrue();
 	}
 
 	@Test
@@ -128,7 +128,7 @@ public class LdapUserServiceBeanDefinitionParserTests {
 
 		Set<String> authorities = AuthorityUtils.authorityListToSet(ben.getAuthorities());
 		assertThat(authorities).hasSize(3);
-		assertThat(authorities).contains("ROLE_DEVELOPER");
+		assertThat(authorities.contains("ROLE_DEVELOPER")).isTrue();
 
 	}
 

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -96,7 +96,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 			pc.getReaderContext()
 				.fatal("You cannot use a spring-security-2.0.xsd or spring-security-3.0.xsd or "
 						+ "spring-security-3.1.xsd schema or spring-security-3.2.xsd schema or spring-security-4.0.xsd schema "
-						+ "with Spring Security 6.2. Please update your schema declarations to the 6.2 schema.",
+						+ "with Spring Security 6.1. Please update your schema declarations to the 6.1 schema.",
 						element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
@@ -221,7 +221,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 
 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-6\\.2.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-6\\.1.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}

config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,7 +27,6 @@ import java.util.Map;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.DelegatingFilterProxy;
@@ -118,10 +117,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	 * @param configurer
 	 * @return the {@link SecurityConfigurerAdapter} for further customizations
 	 * @throws Exception
-	 * @deprecated For removal in 7.0. Use
-	 * {@link #with(SecurityConfigurerAdapter, Customizer)} instead.
 	 */
-	@Deprecated(since = "6.2", forRemoval = true)
 	@SuppressWarnings("unchecked")
 	public <C extends SecurityConfigurerAdapter<O, B>> C apply(C configurer) throws Exception {
 		configurer.addObjectPostProcessor(this.objectPostProcessor);
@@ -143,23 +139,6 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		return configurer;
 	}
 
-	/**
-	 * Applies a {@link SecurityConfigurerAdapter} to this {@link SecurityBuilder} and
-	 * invokes {@link SecurityConfigurerAdapter#setBuilder(SecurityBuilder)}.
-	 * @param configurer
-	 * @return the {@link SecurityBuilder} for further customizations
-	 * @throws Exception
-	 * @since 6.2
-	 */
-	@SuppressWarnings("unchecked")
-	public <C extends SecurityConfigurerAdapter<O, B>> B with(C configurer, Customizer<C> customizer) throws Exception {
-		configurer.addObjectPostProcessor(this.objectPostProcessor);
-		configurer.setBuilder((B) this);
-		add(configurer);
-		customizer.customize(configurer);
-		return (B) this;
-	}
-
 	/**
 	 * Sets an object that is shared by multiple {@link SecurityConfigurer}.
 	 * @param sharedType the Class to key the shared object by.

config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecuritySelector.java

@@ -41,8 +41,7 @@ final class MethodSecuritySelector implements ImportSelector {
 
 	@Override
 	public String[] selectImports(@NonNull AnnotationMetadata importMetadata) {
-		if (!importMetadata.hasAnnotation(EnableMethodSecurity.class.getName())
-				&& !importMetadata.hasMetaAnnotation(EnableMethodSecurity.class.getName())) {
+		if (!importMetadata.hasAnnotation(EnableMethodSecurity.class.getName())) {
 			return new String[0];
 		}
 		EnableMethodSecurity annotation = importMetadata.getAnnotations().get(EnableMethodSecurity.class).synthesize();

config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,6 @@ import java.util.Collection;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
 
@@ -43,13 +42,11 @@ import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher;
-import org.springframework.security.web.util.matcher.OrRequestMatcher;
 import org.springframework.security.web.util.matcher.RegexRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
 import org.springframework.web.context.WebApplicationContext;
-import org.springframework.web.servlet.DispatcherServlet;
 import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
 
 /**
@@ -206,22 +203,43 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 		if (servletContext == null) {
 			return requestMatchers(RequestMatchers.antMatchersAsArray(method, patterns));
 		}
+		boolean isProgrammaticApiAvailable = isProgrammaticApiAvailable(servletContext);
 		List<RequestMatcher> matchers = new ArrayList<>();
 		for (String pattern : patterns) {
 			AntPathRequestMatcher ant = new AntPathRequestMatcher(pattern, (method != null) ? method.name() : null);
 			MvcRequestMatcher mvc = createMvcMatchers(method, pattern).get(0);
-			matchers.add(new DeferredRequestMatcher((c) -> resolve(ant, mvc, c), mvc, ant));
+			if (isProgrammaticApiAvailable) {
+				matchers.add(resolve(ant, mvc, servletContext));
+			}
+			else {
+				this.logger
+					.warn("The ServletRegistration API was not available at startup time. This may be due to a misconfiguration; "
+							+ "if you are using AbstractSecurityWebApplicationInitializer, please double-check the recommendations outlined in "
+							+ "https://docs.spring.io/spring-security/reference/servlet/configuration/java.html#abstractsecuritywebapplicationinitializer-with-spring-mvc");
+				matchers.add(new DeferredRequestMatcher((request) -> resolve(ant, mvc, request.getServletContext()),
+						mvc, ant));
+			}
 		}
 		return requestMatchers(matchers.toArray(new RequestMatcher[0]));
 	}
 
+	private static boolean isProgrammaticApiAvailable(ServletContext servletContext) {
+		try {
+			servletContext.getServletRegistrations();
+			return true;
+		}
+		catch (UnsupportedOperationException ex) {
+			return false;
+		}
+	}
+
 	private RequestMatcher resolve(AntPathRequestMatcher ant, MvcRequestMatcher mvc, ServletContext servletContext) {
 		Map<String, ? extends ServletRegistration> registrations = mappableServletRegistrations(servletContext);
 		if (registrations.isEmpty()) {
-			return new DispatcherServletDelegatingRequestMatcher(ant, mvc, new MockMvcRequestMatcher());
+			return ant;
 		}
 		if (!hasDispatcherServlet(registrations)) {
-			return new DispatcherServletDelegatingRequestMatcher(ant, mvc, new MockMvcRequestMatcher());
+			return ant;
 		}
 		ServletRegistration dispatcherServlet = requireOneRootDispatcherServlet(registrations);
 		if (dispatcherServlet != null) {
@@ -315,7 +333,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 		}
 	}
 
-	private static String computeErrorMessage(Collection<? extends ServletRegistration> registrations) {
+	private String computeErrorMessage(Collection<? extends ServletRegistration> registrations) {
 		String template = "This method cannot decide whether these patterns are Spring MVC patterns or not. "
 				+ "If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); "
 				+ "otherwise, please use requestMatchers(AntPathRequestMatcher).\n\n"
@@ -456,29 +474,34 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 
 	static class DeferredRequestMatcher implements RequestMatcher {
 
-		final Function<ServletContext, RequestMatcher> requestMatcherFactory;
+		final Function<HttpServletRequest, RequestMatcher> requestMatcherFactory;
 
 		final AtomicReference<String> description = new AtomicReference<>();
 
-		final Map<ServletContext, RequestMatcher> requestMatchers = new ConcurrentHashMap<>();
+		volatile RequestMatcher requestMatcher;
 
-		DeferredRequestMatcher(Function<ServletContext, RequestMatcher> resolver, RequestMatcher... candidates) {
-			this.requestMatcherFactory = (sc) -> this.requestMatchers.computeIfAbsent(sc, resolver);
+		DeferredRequestMatcher(Function<HttpServletRequest, RequestMatcher> resolver, RequestMatcher... candidates) {
+			this.requestMatcherFactory = (request) -> {
+				if (this.requestMatcher == null) {
+					synchronized (this) {
+						if (this.requestMatcher == null) {
+							this.requestMatcher = resolver.apply(request);
+						}
+					}
+				}
+				return this.requestMatcher;
+			};
 			this.description.set("Deferred " + Arrays.toString(candidates));
 		}
 
-		RequestMatcher requestMatcher(ServletContext servletContext) {
-			return this.requestMatcherFactory.apply(servletContext);
-		}
-
 		@Override
 		public boolean matches(HttpServletRequest request) {
-			return this.requestMatcherFactory.apply(request.getServletContext()).matches(request);
+			return this.requestMatcherFactory.apply(request).matches(request);
 		}
 
 		@Override
 		public MatchResult matcher(HttpServletRequest request) {
-			return this.requestMatcherFactory.apply(request.getServletContext()).matcher(request);
+			return this.requestMatcherFactory.apply(request).matcher(request);
 		}
 
 		@Override
@@ -488,76 +511,53 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 
 	}
 
-	static class MockMvcRequestMatcher implements RequestMatcher {
-
-		@Override
-		public boolean matches(HttpServletRequest request) {
-			return request.getAttribute("org.springframework.test.web.servlet.MockMvc.MVC_RESULT_ATTRIBUTE") != null;
-		}
-
-	}
-
-	static class DispatcherServletRequestMatcher implements RequestMatcher {
-
-		private final ServletContext servletContext;
-
-		DispatcherServletRequestMatcher(ServletContext servletContext) {
-			this.servletContext = servletContext;
-		}
-
-		@Override
-		public boolean matches(HttpServletRequest request) {
-			String name = request.getHttpServletMapping().getServletName();
-			ServletRegistration registration = this.servletContext.getServletRegistration(name);
-			Assert.notNull(registration,
-					() -> computeErrorMessage(this.servletContext.getServletRegistrations().values()));
-			try {
-				Class<?> clazz = Class.forName(registration.getClassName());
-				return DispatcherServlet.class.isAssignableFrom(clazz);
-			}
-			catch (ClassNotFoundException ex) {
-				return false;
-			}
-		}
-
-	}
-
 	static class DispatcherServletDelegatingRequestMatcher implements RequestMatcher {
 
 		private final AntPathRequestMatcher ant;
 
 		private final MvcRequestMatcher mvc;
 
-		private final RequestMatcher dispatcherServlet;
+		private final ServletContext servletContext;
 
 		DispatcherServletDelegatingRequestMatcher(AntPathRequestMatcher ant, MvcRequestMatcher mvc,
 				ServletContext servletContext) {
-			this(ant, mvc, new OrRequestMatcher(new MockMvcRequestMatcher(),
-					new DispatcherServletRequestMatcher(servletContext)));
-		}
-
-		DispatcherServletDelegatingRequestMatcher(AntPathRequestMatcher ant, MvcRequestMatcher mvc,
-				RequestMatcher dispatcherServlet) {
 			this.ant = ant;
 			this.mvc = mvc;
-			this.dispatcherServlet = dispatcherServlet;
-		}
-
-		RequestMatcher requestMatcher(HttpServletRequest request) {
-			if (this.dispatcherServlet.matches(request)) {
-				return this.mvc;
-			}
-			return this.ant;
+			this.servletContext = servletContext;
 		}
 
 		@Override
 		public boolean matches(HttpServletRequest request) {
-			return requestMatcher(request).matches(request);
+			String name = request.getHttpServletMapping().getServletName();
+			ServletRegistration registration = this.servletContext.getServletRegistration(name);
+			Assert.notNull(registration, "Failed to find servlet [" + name + "] in the servlet context");
+			if (isDispatcherServlet(registration)) {
+				return this.mvc.matches(request);
+			}
+			return this.ant.matches(request);
 		}
 
 		@Override
 		public MatchResult matcher(HttpServletRequest request) {
-			return requestMatcher(request).matcher(request);
+			String name = request.getHttpServletMapping().getServletName();
+			ServletRegistration registration = this.servletContext.getServletRegistration(name);
+			Assert.notNull(registration, "Failed to find servlet [" + name + "] in the servlet context");
+			if (isDispatcherServlet(registration)) {
+				return this.mvc.matcher(request);
+			}
+			return this.ant.matcher(request);
+		}
+
+		private boolean isDispatcherServlet(ServletRegistration registration) {
+			Class<?> dispatcherServlet = ClassUtils
+				.resolveClassName("org.springframework.web.servlet.DispatcherServlet", null);
+			try {
+				Class<?> clazz = Class.forName(registration.getClassName());
+				return dispatcherServlet.isAssignableFrom(clazz);
+			}
+			catch (ClassNotFoundException ex) {
+				return false;
+			}
 		}
 
 		@Override

config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

@@ -70,7 +70,6 @@ import org.springframework.security.config.annotation.web.configurers.SessionMan
 import org.springframework.security.config.annotation.web.configurers.X509Configurer;
 import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer;
 import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer;
-import org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer;
 import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer;
 import org.springframework.security.config.annotation.web.configurers.saml2.Saml2LoginConfigurer;
 import org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer;
@@ -2836,16 +2835,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 		return HttpSecurity.this;
 	}
 
-	public OidcLogoutConfigurer<HttpSecurity> oidcLogout() throws Exception {
-		return getOrApply(new OidcLogoutConfigurer<>());
-	}
-
-	public HttpSecurity oidcLogout(Customizer<OidcLogoutConfigurer<HttpSecurity>> oidcLogoutCustomizer)
-			throws Exception {
-		oidcLogoutCustomizer.customize(getOrApply(new OidcLogoutConfigurer<>()));
-		return HttpSecurity.this;
-	}
-
 	/**
 	 * Configures OAuth 2.0 Client support.
 	 * @return the {@link OAuth2ClientConfigurer} for further customizations

config/src/main/java/org/springframework/security/config/annotation/web/configuration/HttpSecurityConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,7 +47,6 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;
 import org.springframework.web.accept.ContentNegotiationStrategy;
 import org.springframework.web.accept.HeaderContentNegotiationStrategy;
-import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
 import static org.springframework.security.config.Customizer.withDefaults;
 
@@ -55,7 +54,6 @@ import static org.springframework.security.config.Customizer.withDefaults;
  * {@link Configuration} that exposes the {@link HttpSecurity} bean.
  *
  * @author Eleftheria Stein
- * @author Jinwoo Bae
  * @since 5.4
  */
 @Configuration(proxyBeanMethods = false)
@@ -126,17 +124,10 @@ class HttpSecurityConfiguration {
 			.apply(new DefaultLoginPageConfigurer<>());
 		http.logout(withDefaults());
 		// @formatter:on
-		applyCorsIfAvailable(http);
 		applyDefaultConfigurers(http);
 		return http;
 	}
 
-	private void applyCorsIfAvailable(HttpSecurity http) throws Exception {
-		if (this.context.getBeanNamesForType(UrlBasedCorsConfigurationSource.class).length > 0) {
-			http.cors(withDefaults());
-		}
-	}
-
 	private AuthenticationManager authenticationManager() throws Exception {
 		return this.authenticationConfiguration.getAuthenticationManager();
 	}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/OAuth2ClientConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,46 +16,19 @@
 
 package org.springframework.security.config.annotation.web.configuration;
 
-import java.util.ArrayList;
-import java.util.Collection;
 import java.util.List;
-import java.util.Set;
-import java.util.function.Consumer;
 
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
-import org.springframework.beans.factory.BeanFactoryUtils;
-import org.springframework.beans.factory.BeanInitializationException;
-import org.springframework.beans.factory.ListableBeanFactory;
-import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.BeanDefinitionRegistry;
-import org.springframework.beans.factory.support.BeanDefinitionRegistryPostProcessor;
-import org.springframework.context.annotation.AnnotationBeanNameGenerator;
-import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.context.annotation.ImportSelector;
-import org.springframework.core.ResolvableType;
 import org.springframework.core.type.AnnotationMetadata;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
-import org.springframework.security.oauth2.client.AuthorizationCodeOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.ClientCredentialsOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.DelegatingOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.JwtBearerOAuth2AuthorizedClientProvider;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.RefreshTokenOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
 import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
 import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequest;
 import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
 import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
 import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
@@ -75,8 +48,7 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
  * @since 5.1
  * @see OAuth2ImportSelector
  */
-@Import({ OAuth2ClientConfiguration.OAuth2ClientWebMvcImportSelector.class,
-		OAuth2ClientConfiguration.OAuth2AuthorizedClientManagerConfiguration.class })
+@Import(OAuth2ClientConfiguration.OAuth2ClientWebMvcImportSelector.class)
 final class OAuth2ClientConfiguration {
 
 	private static final boolean webMvcPresent;
@@ -93,22 +65,8 @@ final class OAuth2ClientConfiguration {
 			if (!webMvcPresent) {
 				return new String[0];
 			}
-			return new String[] {
-					OAuth2ClientConfiguration.class.getName() + ".OAuth2ClientWebMvcSecurityConfiguration" };
-		}
-
-	}
-
-	/**
-	 * @author Joe Grandja
-	 * @since 6.2.0
-	 */
-	@Configuration(proxyBeanMethods = false)
-	static class OAuth2AuthorizedClientManagerConfiguration {
-
-		@Bean(name = OAuth2AuthorizedClientManagerRegistrar.BEAN_NAME)
-		OAuth2AuthorizedClientManagerRegistrar authorizedClientManagerRegistrar() {
-			return new OAuth2AuthorizedClientManagerRegistrar();
+			return new String[] { "org.springframework.security.config.annotation.web.configuration."
+					+ "OAuth2ClientConfiguration.OAuth2ClientWebMvcSecurityConfiguration" };
 		}
 
 	}
@@ -116,12 +74,16 @@ final class OAuth2ClientConfiguration {
 	@Configuration(proxyBeanMethods = false)
 	static class OAuth2ClientWebMvcSecurityConfiguration implements WebMvcConfigurer {
 
+		private ClientRegistrationRepository clientRegistrationRepository;
+
+		private OAuth2AuthorizedClientRepository authorizedClientRepository;
+
+		private OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> accessTokenResponseClient;
+
 		private OAuth2AuthorizedClientManager authorizedClientManager;
 
 		private SecurityContextHolderStrategy securityContextHolderStrategy;
 
-		private OAuth2AuthorizedClientManagerRegistrar authorizedClientManagerRegistrar;
-
 		@Override
 		public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers) {
 			OAuth2AuthorizedClientManager authorizedClientManager = getAuthorizedClientManager();
@@ -135,6 +97,26 @@ final class OAuth2ClientConfiguration {
 			}
 		}
 
+		@Autowired(required = false)
+		void setClientRegistrationRepository(List<ClientRegistrationRepository> clientRegistrationRepositories) {
+			if (clientRegistrationRepositories.size() == 1) {
+				this.clientRegistrationRepository = clientRegistrationRepositories.get(0);
+			}
+		}
+
+		@Autowired(required = false)
+		void setAuthorizedClientRepository(List<OAuth2AuthorizedClientRepository> authorizedClientRepositories) {
+			if (authorizedClientRepositories.size() == 1) {
+				this.authorizedClientRepository = authorizedClientRepositories.get(0);
+			}
+		}
+
+		@Autowired(required = false)
+		void setAccessTokenResponseClient(
+				OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> accessTokenResponseClient) {
+			this.accessTokenResponseClient = accessTokenResponseClient;
+		}
+
 		@Autowired(required = false)
 		void setAuthorizedClientManager(List<OAuth2AuthorizedClientManager> authorizedClientManagers) {
 			if (authorizedClientManagers.size() == 1) {
@@ -147,267 +129,35 @@ final class OAuth2ClientConfiguration {
 			this.securityContextHolderStrategy = strategy;
 		}
 
-		@Autowired
-		void setAuthorizedClientManagerRegistrar(
-				OAuth2AuthorizedClientManagerRegistrar authorizedClientManagerRegistrar) {
-			this.authorizedClientManagerRegistrar = authorizedClientManagerRegistrar;
-		}
-
 		private OAuth2AuthorizedClientManager getAuthorizedClientManager() {
 			if (this.authorizedClientManager != null) {
 				return this.authorizedClientManager;
 			}
-			return this.authorizedClientManagerRegistrar.getAuthorizedClientManagerIfAvailable();
-		}
-
-	}
-
-	/**
-	 * A registrar for registering the default {@link OAuth2AuthorizedClientManager} bean
-	 * definition, if not already present.
-	 *
-	 * @author Joe Grandja
-	 * @author Steve Riesenberg
-	 * @since 6.2.0
-	 */
-	static final class OAuth2AuthorizedClientManagerRegistrar
-			implements BeanDefinitionRegistryPostProcessor, BeanFactoryAware {
-
-		static final String BEAN_NAME = "authorizedClientManagerRegistrar";
-
-		static final String FACTORY_METHOD_NAME = "getAuthorizedClientManager";
-
-		// @formatter:off
-		private static final Set<Class<?>> KNOWN_AUTHORIZED_CLIENT_PROVIDERS = Set.of(
-				AuthorizationCodeOAuth2AuthorizedClientProvider.class,
-				RefreshTokenOAuth2AuthorizedClientProvider.class,
-				ClientCredentialsOAuth2AuthorizedClientProvider.class,
-				PasswordOAuth2AuthorizedClientProvider.class,
-				JwtBearerOAuth2AuthorizedClientProvider.class
-		);
-		// @formatter:on
-
-		private final AnnotationBeanNameGenerator beanNameGenerator = new AnnotationBeanNameGenerator();
-
-		private ListableBeanFactory beanFactory;
-
-		@Override
-		public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {
-			if (getBeanNamesForType(OAuth2AuthorizedClientManager.class).length != 0
-					|| getBeanNamesForType(ClientRegistrationRepository.class).length != 1
-					|| getBeanNamesForType(OAuth2AuthorizedClientRepository.class).length != 1) {
-				return;
-			}
-
-			BeanDefinition beanDefinition = BeanDefinitionBuilder
-				.rootBeanDefinition(OAuth2AuthorizedClientManager.class)
-				.setFactoryMethodOnBean(FACTORY_METHOD_NAME, BEAN_NAME)
-				.getBeanDefinition();
-
-			registry.registerBeanDefinition(this.beanNameGenerator.generateBeanName(beanDefinition, registry),
-					beanDefinition);
-		}
-
-		@Override
-		public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {
-		}
-
-		@Override
-		public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-			this.beanFactory = (ListableBeanFactory) beanFactory;
-		}
-
-		OAuth2AuthorizedClientManager getAuthorizedClientManagerIfAvailable() {
-			if (getBeanNamesForType(ClientRegistrationRepository.class).length != 1
-					|| getBeanNamesForType(OAuth2AuthorizedClientRepository.class).length != 1) {
-				return null;
-			}
-			return getAuthorizedClientManager();
-		}
-
-		OAuth2AuthorizedClientManager getAuthorizedClientManager() {
-			ClientRegistrationRepository clientRegistrationRepository = BeanFactoryUtils
-				.beanOfTypeIncludingAncestors(this.beanFactory, ClientRegistrationRepository.class, true, true);
-
-			OAuth2AuthorizedClientRepository authorizedClientRepository = BeanFactoryUtils
-				.beanOfTypeIncludingAncestors(this.beanFactory, OAuth2AuthorizedClientRepository.class, true, true);
-
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviderBeans = BeanFactoryUtils
-				.beansOfTypeIncludingAncestors(this.beanFactory, OAuth2AuthorizedClientProvider.class, true, true)
-				.values();
-
-			OAuth2AuthorizedClientProvider authorizedClientProvider;
-			if (hasDelegatingAuthorizedClientProvider(authorizedClientProviderBeans)) {
-				authorizedClientProvider = authorizedClientProviderBeans.iterator().next();
-			}
-			else {
-				List<OAuth2AuthorizedClientProvider> authorizedClientProviders = new ArrayList<>();
-				authorizedClientProviders
-					.add(getAuthorizationCodeAuthorizedClientProvider(authorizedClientProviderBeans));
-				authorizedClientProviders.add(getRefreshTokenAuthorizedClientProvider(authorizedClientProviderBeans));
-				authorizedClientProviders
-					.add(getClientCredentialsAuthorizedClientProvider(authorizedClientProviderBeans));
-				authorizedClientProviders.add(getPasswordAuthorizedClientProvider(authorizedClientProviderBeans));
-
-				OAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = getJwtBearerAuthorizedClientProvider(
-						authorizedClientProviderBeans);
-				if (jwtBearerAuthorizedClientProvider != null) {
-					authorizedClientProviders.add(jwtBearerAuthorizedClientProvider);
+			OAuth2AuthorizedClientManager authorizedClientManager = null;
+			if (this.clientRegistrationRepository != null && this.authorizedClientRepository != null) {
+				if (this.accessTokenResponseClient != null) {
+					// @formatter:off
+					OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder
+						.builder()
+						.authorizationCode()
+						.refreshToken()
+						.clientCredentials((configurer) -> configurer.accessTokenResponseClient(this.accessTokenResponseClient))
+						.password()
+						.build();
+					// @formatter:on
+					DefaultOAuth2AuthorizedClientManager defaultAuthorizedClientManager = new DefaultOAuth2AuthorizedClientManager(
+							this.clientRegistrationRepository, this.authorizedClientRepository);
+					defaultAuthorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
+					authorizedClientManager = defaultAuthorizedClientManager;
+				}
+				else {
+					authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(
+							this.clientRegistrationRepository, this.authorizedClientRepository);
 				}
-
-				authorizedClientProviders.addAll(getAdditionalAuthorizedClientProviders(authorizedClientProviderBeans));
-				authorizedClientProvider = new DelegatingOAuth2AuthorizedClientProvider(authorizedClientProviders);
 			}
-
-			DefaultOAuth2AuthorizedClientManager authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(
-					clientRegistrationRepository, authorizedClientRepository);
-			authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
-
-			Consumer<DefaultOAuth2AuthorizedClientManager> authorizedClientManagerConsumer = getBeanOfType(
-					ResolvableType.forClassWithGenerics(Consumer.class, DefaultOAuth2AuthorizedClientManager.class));
-			if (authorizedClientManagerConsumer != null) {
-				authorizedClientManagerConsumer.accept(authorizedClientManager);
-			}
-
 			return authorizedClientManager;
 		}
 
-		private boolean hasDelegatingAuthorizedClientProvider(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-			if (authorizedClientProviders.size() != 1) {
-				return false;
-			}
-			return authorizedClientProviders.iterator().next() instanceof DelegatingOAuth2AuthorizedClientProvider;
-		}
-
-		private OAuth2AuthorizedClientProvider getAuthorizationCodeAuthorizedClientProvider(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-			AuthorizationCodeOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-					authorizedClientProviders, AuthorizationCodeOAuth2AuthorizedClientProvider.class);
-			if (authorizedClientProvider == null) {
-				authorizedClientProvider = new AuthorizationCodeOAuth2AuthorizedClientProvider();
-			}
-
-			return authorizedClientProvider;
-		}
-
-		private OAuth2AuthorizedClientProvider getRefreshTokenAuthorizedClientProvider(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-			RefreshTokenOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-					authorizedClientProviders, RefreshTokenOAuth2AuthorizedClientProvider.class);
-			if (authorizedClientProvider == null) {
-				authorizedClientProvider = new RefreshTokenOAuth2AuthorizedClientProvider();
-			}
-
-			OAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> accessTokenResponseClient = getBeanOfType(
-					ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-							OAuth2RefreshTokenGrantRequest.class));
-			if (accessTokenResponseClient != null) {
-				authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-			}
-
-			return authorizedClientProvider;
-		}
-
-		private OAuth2AuthorizedClientProvider getClientCredentialsAuthorizedClientProvider(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-			ClientCredentialsOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-					authorizedClientProviders, ClientCredentialsOAuth2AuthorizedClientProvider.class);
-			if (authorizedClientProvider == null) {
-				authorizedClientProvider = new ClientCredentialsOAuth2AuthorizedClientProvider();
-			}
-
-			OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> accessTokenResponseClient = getBeanOfType(
-					ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-							OAuth2ClientCredentialsGrantRequest.class));
-			if (accessTokenResponseClient != null) {
-				authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-			}
-
-			return authorizedClientProvider;
-		}
-
-		private OAuth2AuthorizedClientProvider getPasswordAuthorizedClientProvider(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-			PasswordOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-					authorizedClientProviders, PasswordOAuth2AuthorizedClientProvider.class);
-			if (authorizedClientProvider == null) {
-				authorizedClientProvider = new PasswordOAuth2AuthorizedClientProvider();
-			}
-
-			OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient = getBeanOfType(
-					ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-							OAuth2PasswordGrantRequest.class));
-			if (accessTokenResponseClient != null) {
-				authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-			}
-
-			return authorizedClientProvider;
-		}
-
-		private OAuth2AuthorizedClientProvider getJwtBearerAuthorizedClientProvider(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-			JwtBearerOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-					authorizedClientProviders, JwtBearerOAuth2AuthorizedClientProvider.class);
-
-			OAuth2AccessTokenResponseClient<JwtBearerGrantRequest> accessTokenResponseClient = getBeanOfType(
-					ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-							JwtBearerGrantRequest.class));
-			if (accessTokenResponseClient != null) {
-				if (authorizedClientProvider == null) {
-					authorizedClientProvider = new JwtBearerOAuth2AuthorizedClientProvider();
-				}
-
-				authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-			}
-
-			return authorizedClientProvider;
-		}
-
-		private List<OAuth2AuthorizedClientProvider> getAdditionalAuthorizedClientProviders(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-			List<OAuth2AuthorizedClientProvider> additionalAuthorizedClientProviders = new ArrayList<>(
-					authorizedClientProviders);
-			additionalAuthorizedClientProviders
-				.removeIf((provider) -> KNOWN_AUTHORIZED_CLIENT_PROVIDERS.contains(provider.getClass()));
-			return additionalAuthorizedClientProviders;
-		}
-
-		private <T extends OAuth2AuthorizedClientProvider> T getAuthorizedClientProviderByType(
-				Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders, Class<T> providerClass) {
-			T authorizedClientProvider = null;
-			for (OAuth2AuthorizedClientProvider current : authorizedClientProviders) {
-				if (providerClass.isInstance(current)) {
-					assertAuthorizedClientProviderIsNull(authorizedClientProvider);
-					authorizedClientProvider = providerClass.cast(current);
-				}
-			}
-			return authorizedClientProvider;
-		}
-
-		private static void assertAuthorizedClientProviderIsNull(
-				OAuth2AuthorizedClientProvider authorizedClientProvider) {
-			if (authorizedClientProvider != null) {
-				// @formatter:off
-				throw new BeanInitializationException(String.format(
-						"Unable to create an %s bean. Expected one bean of type %s, but found multiple. " +
-						"Please consider defining only a single bean of this type, or define an %s bean yourself.",
-						OAuth2AuthorizedClientManager.class.getName(),
-						authorizedClientProvider.getClass().getName(),
-						OAuth2AuthorizedClientManager.class.getName()));
-				// @formatter:on
-			}
-		}
-
-		private <T> String[] getBeanNamesForType(Class<T> beanClass) {
-			return BeanFactoryUtils.beanNamesForTypeIncludingAncestors(this.beanFactory, beanClass, true, true);
-		}
-
-		private <T> T getBeanOfType(ResolvableType resolvableType) {
-			ObjectProvider<T> objectProvider = this.beanFactory.getBeanProvider(resolvableType, true);
-			return objectProvider.getIfAvailable();
-		}
-
 	}
 
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/AnonymousConfigurer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -53,8 +53,6 @@ public final class AnonymousConfigurer<H extends HttpSecurityBuilder<H>>
 
 	private List<GrantedAuthority> authorities = AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS");
 
-	private String computedKey;
-
 	/**
 	 * Creates a new instance
 	 * @see HttpSecurity#anonymous()
@@ -146,31 +144,26 @@ public final class AnonymousConfigurer<H extends HttpSecurityBuilder<H>>
 		if (this.authenticationProvider == null) {
 			this.authenticationProvider = new AnonymousAuthenticationProvider(getKey());
 		}
+		if (this.authenticationFilter == null) {
+			this.authenticationFilter = new AnonymousAuthenticationFilter(getKey(), this.principal, this.authorities);
+			this.authenticationFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
+		}
+		this.authenticationFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
 		this.authenticationProvider = postProcess(this.authenticationProvider);
 		http.authenticationProvider(this.authenticationProvider);
 	}
 
 	@Override
 	public void configure(H http) {
-		if (this.authenticationFilter == null) {
-			this.authenticationFilter = new AnonymousAuthenticationFilter(getKey(), this.principal, this.authorities);
-		}
-		this.authenticationFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
 		this.authenticationFilter.afterPropertiesSet();
 		http.addFilter(this.authenticationFilter);
 	}
 
 	private String getKey() {
-		if (this.computedKey != null) {
-			return this.computedKey;
-		}
 		if (this.key == null) {
-			this.computedKey = UUID.randomUUID().toString();
+			this.key = UUID.randomUUID().toString();
 		}
-		else {
-			this.computedKey = this.key;
-		}
-		return this.computedKey;
+		return this.key;
 	}
 
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java

@@ -35,7 +35,6 @@ import org.springframework.security.authorization.SpringAuthorizationEventPublis
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
-import org.springframework.security.config.core.GrantedAuthorityDefaults;
 import org.springframework.security.web.access.intercept.AuthorizationFilter;
 import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
 import org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager;
@@ -63,8 +62,6 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
 
 	private final Supplier<RoleHierarchy> roleHierarchy;
 
-	private String rolePrefix = "ROLE_";
-
 	/**
 	 * Creates an instance.
 	 * @param context the {@link ApplicationContext} to use
@@ -79,11 +76,6 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
 		}
 		this.roleHierarchy = SingletonSupplier.of(() -> (context.getBeanNamesForType(RoleHierarchy.class).length > 0)
 				? context.getBean(RoleHierarchy.class) : new NullRoleHierarchy());
-		String[] grantedAuthorityDefaultsBeanNames = context.getBeanNamesForType(GrantedAuthorityDefaults.class);
-		if (grantedAuthorityDefaultsBeanNames.length > 0) {
-			GrantedAuthorityDefaults grantedAuthorityDefaults = context.getBean(GrantedAuthorityDefaults.class);
-			this.rolePrefix = grantedAuthorityDefaults.getRolePrefix();
-		}
 	}
 
 	/**
@@ -171,8 +163,7 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
 			Assert.state(this.mappingCount > 0,
 					"At least one mapping is required (for example, authorizeHttpRequests().anyRequest().authenticated())");
 			ObservationRegistry registry = getObservationRegistry();
-			AuthorizationManager<HttpServletRequest> manager = postProcess(
-					(AuthorizationManager<HttpServletRequest>) this.managerBuilder.build());
+			RequestMatcherDelegatingAuthorizationManager manager = postProcess(this.managerBuilder.build());
 			if (registry.isNoop()) {
 				return manager;
 			}
@@ -288,8 +279,7 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
 		 * customizations
 		 */
 		public AuthorizationManagerRequestMatcherRegistry hasRole(String role) {
-			return access(withRoleHierarchy(AuthorityAuthorizationManager
-				.hasAnyRole(AuthorizeHttpRequestsConfigurer.this.rolePrefix, new String[] { role })));
+			return access(withRoleHierarchy(AuthorityAuthorizationManager.hasRole(role)));
 		}
 
 		/**
@@ -301,8 +291,7 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
 		 * customizations
 		 */
 		public AuthorizationManagerRequestMatcherRegistry hasAnyRole(String... roles) {
-			return access(withRoleHierarchy(
-					AuthorityAuthorizationManager.hasAnyRole(AuthorizeHttpRequestsConfigurer.this.rolePrefix, roles)));
+			return access(withRoleHierarchy(AuthorityAuthorizationManager.hasAnyRole(roles)));
 		}
 
 		/**

config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java

@@ -40,6 +40,7 @@ import org.springframework.security.web.csrf.CsrfLogoutHandler;
 import org.springframework.security.web.csrf.CsrfTokenRepository;
 import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
 import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
+import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
 import org.springframework.security.web.csrf.MissingCsrfTokenException;
 import org.springframework.security.web.session.InvalidSessionAccessDeniedHandler;
 import org.springframework.security.web.session.InvalidSessionStrategy;
@@ -82,7 +83,7 @@ import org.springframework.util.Assert;
 public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
 		extends AbstractHttpConfigurer<CsrfConfigurer<H>, H> {
 
-	private CsrfTokenRepository csrfTokenRepository = new HttpSessionCsrfTokenRepository();
+	private CsrfTokenRepository csrfTokenRepository = new LazyCsrfTokenRepository(new HttpSessionCsrfTokenRepository());
 
 	private RequestMatcher requireCsrfProtectionMatcher = CsrfFilter.DEFAULT_CSRF_MATCHER;
 
@@ -104,7 +105,7 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
 
 	/**
 	 * Specify the {@link CsrfTokenRepository} to use. The default is an
-	 * {@link HttpSessionCsrfTokenRepository}.
+	 * {@link HttpSessionCsrfTokenRepository} wrapped by {@link LazyCsrfTokenRepository}.
 	 * @param csrfTokenRepository the {@link CsrfTokenRepository} to use
 	 * @return the {@link CsrfConfigurer} for further customizations
 	 */

config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java

@@ -296,7 +296,7 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
 	 * @param sessionAuthenticationStrategy
 	 * @return the {@link SessionManagementConfigurer} for further customizations
 	 */
-	public SessionManagementConfigurer<H> addSessionAuthenticationStrategy(
+	SessionManagementConfigurer<H> addSessionAuthenticationStrategy(
 			SessionAuthenticationStrategy sessionAuthenticationStrategy) {
 		this.sessionAuthenticationStrategies.add(sessionAuthenticationStrategy);
 		return this;

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/DefaultOidcLogoutTokenValidatorFactory.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import java.util.function.Function;
-
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.jwt.JwtTimestampValidator;
-
-final class DefaultOidcLogoutTokenValidatorFactory implements Function<ClientRegistration, OAuth2TokenValidator<Jwt>> {
-
-	@Override
-	public OAuth2TokenValidator<Jwt> apply(ClientRegistration clientRegistration) {
-		return new DelegatingOAuth2TokenValidator<>(new JwtTimestampValidator(),
-				new OidcBackChannelLogoutTokenValidator(clientRegistration));
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2ClientConfigurer.java

@@ -16,8 +16,6 @@
 
 package org.springframework.security.config.annotation.web.configurers.oauth2.client;
 
-import org.springframework.context.ApplicationContext;
-import org.springframework.core.ResolvableType;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
@@ -309,22 +307,7 @@ public final class OAuth2ClientConfigurer<B extends HttpSecurityBuilder<B>>
 			if (this.accessTokenResponseClient != null) {
 				return this.accessTokenResponseClient;
 			}
-			ResolvableType resolvableType = ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-					OAuth2AuthorizationCodeGrantRequest.class);
-			OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> bean = getBeanOrNull(resolvableType);
-			return (bean != null) ? bean : new DefaultAuthorizationCodeTokenResponseClient();
-		}
-
-		@SuppressWarnings("unchecked")
-		private <T> T getBeanOrNull(ResolvableType type) {
-			ApplicationContext context = getBuilder().getSharedObject(ApplicationContext.class);
-			if (context != null) {
-				String[] names = context.getBeanNamesForType(type);
-				if (names.length == 1) {
-					return (T) context.getBean(names[0]);
-				}
-			}
-			return null;
+			return new DefaultAuthorizationCodeTokenResponseClient();
 		}
 
 	}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2ClientConfigurerUtils.java

@@ -25,8 +25,6 @@ import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.oauth2.client.InMemoryOAuth2AuthorizedClientService;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
-import org.springframework.security.oauth2.client.oidc.session.InMemoryOidcSessionRegistry;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry;
 import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
 import org.springframework.security.oauth2.client.web.AuthenticatedPrincipalOAuth2AuthorizedClientRepository;
 import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
@@ -114,13 +112,4 @@ final class OAuth2ClientConfigurerUtils {
 		return (!authorizedClientServiceMap.isEmpty() ? authorizedClientServiceMap.values().iterator().next() : null);
 	}
 
-	static <B extends HttpSecurityBuilder<B>> OidcSessionRegistry getOidcSessionRegistry(B builder) {
-		OidcSessionRegistry sessionRegistry = builder.getSharedObject(OidcSessionRegistry.class);
-		if (sessionRegistry == null) {
-			sessionRegistry = new InMemoryOidcSessionRegistry();
-			builder.setSharedObject(OidcSessionRegistry.class, sessionRegistry);
-		}
-		return sessionRegistry;
-	}
-
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,18 +22,9 @@ import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
 
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import jakarta.servlet.http.HttpSession;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
 import org.springframework.beans.factory.BeanFactoryUtils;
 import org.springframework.beans.factory.NoUniqueBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationListener;
-import org.springframework.context.event.GenericApplicationListenerAdapter;
-import org.springframework.context.event.SmartApplicationListener;
 import org.springframework.core.ResolvableType;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.config.Customizer;
@@ -41,14 +32,9 @@ import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractAuthenticationFilterConfigurer;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
-import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer;
-import org.springframework.security.context.DelegatingApplicationListener;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
-import org.springframework.security.core.session.AbstractSessionEvent;
-import org.springframework.security.core.session.SessionDestroyedEvent;
-import org.springframework.security.core.session.SessionIdChangedEvent;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
 import org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationProvider;
 import org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationToken;
@@ -56,9 +42,6 @@ import org.springframework.security.oauth2.client.endpoint.DefaultAuthorizationC
 import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
 import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
 import org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeAuthenticationProvider;
-import org.springframework.security.oauth2.client.oidc.session.InMemoryOidcSessionRegistry;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionInformation;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
 import org.springframework.security.oauth2.client.registration.ClientRegistration;
@@ -84,10 +67,7 @@ import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.RedirectStrategy;
 import org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint;
 import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
-import org.springframework.security.web.authentication.session.SessionAuthenticationException;
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
-import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.security.web.savedrequest.RequestCache;
 import org.springframework.security.web.util.matcher.AndRequestMatcher;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@@ -144,7 +124,6 @@ import org.springframework.util.ReflectionUtils;
  * <li>{@link DefaultLoginPageGeneratingFilter} - if {@link #loginPage(String)} is not
  * configured and {@code DefaultLoginPageGeneratingFilter} is available, then a default
  * login page will be made available</li>
- * <li>{@link OidcSessionRegistry}</li>
  * </ul>
  *
  * @author Joe Grandja
@@ -223,18 +202,6 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 		return this;
 	}
 
-	/**
-	 * Sets the registry for managing the OIDC client-provider session link
-	 * @param oidcSessionRegistry the {@link OidcSessionRegistry} to use
-	 * @return the {@link OAuth2LoginConfigurer} for further configuration
-	 * @since 6.2
-	 */
-	public OAuth2LoginConfigurer<B> oidcSessionRegistry(OidcSessionRegistry oidcSessionRegistry) {
-		Assert.notNull(oidcSessionRegistry, "oidcSessionRegistry cannot be null");
-		getBuilder().setSharedObject(OidcSessionRegistry.class, oidcSessionRegistry);
-		return this;
-	}
-
 	/**
 	 * Returns the {@link AuthorizationEndpointConfig} for configuring the Authorization
 	 * Server's Authorization Endpoint.
@@ -363,7 +330,10 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 				super.init(http);
 			}
 		}
-		OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient = getAccessTokenResponseClient();
+		OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient = this.tokenEndpointConfig.accessTokenResponseClient;
+		if (accessTokenResponseClient == null) {
+			accessTokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient();
+		}
 		OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService = getOAuth2UserService();
 		OAuth2LoginAuthenticationProvider oauth2LoginAuthenticationProvider = new OAuth2LoginAuthenticationProvider(
 				accessTokenResponseClient, oauth2UserService);
@@ -430,7 +400,6 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 			authenticationFilter
 				.setAuthorizationRequestRepository(this.authorizationEndpointConfig.authorizationRequestRepository);
 		}
-		configureOidcSessionRegistry(http);
 		super.configure(http);
 	}
 
@@ -473,16 +442,6 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 		return (!grantedAuthoritiesMapperMap.isEmpty() ? grantedAuthoritiesMapperMap.values().iterator().next() : null);
 	}
 
-	private OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> getAccessTokenResponseClient() {
-		if (this.tokenEndpointConfig.accessTokenResponseClient != null) {
-			return this.tokenEndpointConfig.accessTokenResponseClient;
-		}
-		ResolvableType resolvableType = ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-				OAuth2AuthorizationCodeGrantRequest.class);
-		OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> bean = getBeanOrNull(resolvableType);
-		return (bean != null) ? bean : new DefaultAuthorizationCodeTokenResponseClient();
-	}
-
 	private OAuth2UserService<OidcUserRequest, OidcUser> getOidcUserService() {
 		if (this.userInfoEndpointConfig.oidcUserService != null) {
 			return this.userInfoEndpointConfig.oidcUserService;
@@ -581,33 +540,6 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 		return AnyRequestMatcher.INSTANCE;
 	}
 
-	private void configureOidcSessionRegistry(B http) {
-		if (http.getConfigurer(OidcLogoutConfigurer.class) == null
-				&& http.getSharedObject(OidcSessionRegistry.class) == null) {
-			return;
-		}
-		OidcSessionRegistry sessionRegistry = OAuth2ClientConfigurerUtils.getOidcSessionRegistry(http);
-		SessionManagementConfigurer<B> sessionConfigurer = http.getConfigurer(SessionManagementConfigurer.class);
-		if (sessionConfigurer != null) {
-			OidcSessionRegistryAuthenticationStrategy sessionAuthenticationStrategy = new OidcSessionRegistryAuthenticationStrategy();
-			sessionAuthenticationStrategy.setSessionRegistry(sessionRegistry);
-			sessionConfigurer.addSessionAuthenticationStrategy(sessionAuthenticationStrategy);
-		}
-		OidcClientSessionEventListener listener = new OidcClientSessionEventListener();
-		listener.setSessionRegistry(sessionRegistry);
-		registerDelegateApplicationListener(listener);
-	}
-
-	private void registerDelegateApplicationListener(ApplicationListener<?> delegate) {
-		DelegatingApplicationListener delegating = getBeanOrNull(
-				ResolvableType.forType(DelegatingApplicationListener.class));
-		if (delegating == null) {
-			return;
-		}
-		SmartApplicationListener smartListener = new GenericApplicationListenerAdapter(delegate);
-		delegating.addListener(smartListener);
-	}
-
 	/**
 	 * Configuration options for the Authorization Server's Authorization Endpoint.
 	 */
@@ -855,88 +787,4 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 
 	}
 
-	private static final class OidcClientSessionEventListener implements ApplicationListener<AbstractSessionEvent> {
-
-		private final Log logger = LogFactory.getLog(OidcClientSessionEventListener.class);
-
-		private OidcSessionRegistry sessionRegistry = new InMemoryOidcSessionRegistry();
-
-		/**
-		 * {@inheritDoc}
-		 */
-		@Override
-		public void onApplicationEvent(AbstractSessionEvent event) {
-			if (event instanceof SessionDestroyedEvent destroyed) {
-				this.logger.debug("Received SessionDestroyedEvent");
-				this.sessionRegistry.removeSessionInformation(destroyed.getId());
-				return;
-			}
-			if (event instanceof SessionIdChangedEvent changed) {
-				this.logger.debug("Received SessionIdChangedEvent");
-				OidcSessionInformation information = this.sessionRegistry
-					.removeSessionInformation(changed.getOldSessionId());
-				if (information == null) {
-					this.logger
-						.debug("Failed to register new session id since old session id was not found in registry");
-					return;
-				}
-				this.sessionRegistry.saveSessionInformation(information.withSessionId(changed.getNewSessionId()));
-			}
-		}
-
-		/**
-		 * The registry where OIDC Provider sessions are linked to the Client session.
-		 * Defaults to in-memory storage.
-		 * @param sessionRegistry the {@link OidcSessionRegistry} to use
-		 */
-		void setSessionRegistry(OidcSessionRegistry sessionRegistry) {
-			Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
-			this.sessionRegistry = sessionRegistry;
-		}
-
-	}
-
-	private static final class OidcSessionRegistryAuthenticationStrategy implements SessionAuthenticationStrategy {
-
-		private final Log logger = LogFactory.getLog(getClass());
-
-		private OidcSessionRegistry sessionRegistry = new InMemoryOidcSessionRegistry();
-
-		/**
-		 * {@inheritDoc}
-		 */
-		@Override
-		public void onAuthentication(Authentication authentication, HttpServletRequest request,
-				HttpServletResponse response) throws SessionAuthenticationException {
-			HttpSession session = request.getSession(false);
-			if (session == null) {
-				return;
-			}
-			if (!(authentication.getPrincipal() instanceof OidcUser user)) {
-				return;
-			}
-			String sessionId = session.getId();
-			CsrfToken csrfToken = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
-			Map<String, String> headers = (csrfToken != null) ? Map.of(csrfToken.getHeaderName(), csrfToken.getToken())
-					: Collections.emptyMap();
-			OidcSessionInformation registration = new OidcSessionInformation(sessionId, headers, user);
-			if (this.logger.isTraceEnabled()) {
-				this.logger
-					.trace(String.format("Linking a provider [%s] session to this client's session", user.getIssuer()));
-			}
-			this.sessionRegistry.saveSessionInformation(registration);
-		}
-
-		/**
-		 * The registration for linking OIDC Provider Session information to the Client's
-		 * session. Defaults to in-memory storage.
-		 * @param sessionRegistry the {@link OidcSessionRegistry} to use
-		 */
-		void setSessionRegistry(OidcSessionRegistry sessionRegistry) {
-			Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
-			this.sessionRegistry = sessionRegistry;
-		}
-
-	}
-
 }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutAuthentication.java

@@ -1,66 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import java.util.Collections;
-
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-
-/**
- * An {@link org.springframework.security.core.Authentication} implementation that
- * represents the result of authenticating an OIDC Logout token for the purposes of
- * performing Back-Channel Logout.
- *
- * @author Josh Cummings
- * @since 6.2
- * @see OidcLogoutAuthenticationToken
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel
- * Logout</a>
- */
-class OidcBackChannelLogoutAuthentication extends AbstractAuthenticationToken {
-
-	private final OidcLogoutToken logoutToken;
-
-	/**
-	 * Construct an {@link OidcBackChannelLogoutAuthentication}
-	 * @param logoutToken a deserialized, verified OIDC Logout Token
-	 */
-	OidcBackChannelLogoutAuthentication(OidcLogoutToken logoutToken) {
-		super(Collections.emptyList());
-		this.logoutToken = logoutToken;
-		setAuthenticated(true);
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public OidcLogoutToken getPrincipal() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public OidcLogoutToken getCredentials() {
-		return this.logoutToken;
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutAuthenticationProvider.java

@@ -1,140 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jose.proc.DefaultJOSEObjectTypeVerifier;
-import com.nimbusds.jose.proc.JOSEObjectTypeVerifier;
-import com.nimbusds.jose.proc.SecurityContext;
-
-import org.springframework.security.authentication.AuthenticationProvider;
-import org.springframework.security.authentication.AuthenticationServiceException;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.oauth2.client.oidc.authentication.OidcIdTokenDecoderFactory;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.oauth2.core.converter.ClaimTypeConverter;
-import org.springframework.security.oauth2.jwt.BadJwtException;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.jwt.JwtDecoder;
-import org.springframework.security.oauth2.jwt.JwtDecoderFactory;
-import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
-import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
-
-/**
- * An {@link AuthenticationProvider} that authenticates an OIDC Logout Token; namely
- * deserializing it, verifying its signature, and validating its claims.
- *
- * <p>
- * Intended to be included in a
- * {@link org.springframework.security.authentication.ProviderManager}
- *
- * @author Josh Cummings
- * @since 6.2
- * @see OidcLogoutAuthenticationToken
- * @see org.springframework.security.authentication.ProviderManager
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel
- * Logout</a>
- */
-final class OidcBackChannelLogoutAuthenticationProvider implements AuthenticationProvider {
-
-	private JwtDecoderFactory<ClientRegistration> logoutTokenDecoderFactory;
-
-	/**
-	 * Construct an {@link OidcBackChannelLogoutAuthenticationProvider}
-	 */
-	OidcBackChannelLogoutAuthenticationProvider() {
-		DefaultOidcLogoutTokenValidatorFactory jwtValidator = new DefaultOidcLogoutTokenValidatorFactory();
-		this.logoutTokenDecoderFactory = (clientRegistration) -> {
-			String jwkSetUri = clientRegistration.getProviderDetails().getJwkSetUri();
-			if (!StringUtils.hasText(jwkSetUri)) {
-				OAuth2Error oauth2Error = new OAuth2Error("missing_signature_verifier",
-						"Failed to find a Signature Verifier for Client Registration: '"
-								+ clientRegistration.getRegistrationId()
-								+ "'. Check to ensure you have configured the JwkSet URI.",
-						null);
-				throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
-			}
-			JOSEObjectTypeVerifier<SecurityContext> typeVerifier = new DefaultJOSEObjectTypeVerifier<>(null,
-					JOSEObjectType.JWT, new JOSEObjectType("logout+jwt"));
-			NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri)
-				.jwtProcessorCustomizer((processor) -> processor.setJWSTypeVerifier(typeVerifier))
-				.build();
-			decoder.setJwtValidator(jwtValidator.apply(clientRegistration));
-			decoder.setClaimSetConverter(
-					new ClaimTypeConverter(OidcIdTokenDecoderFactory.createDefaultClaimTypeConverters()));
-			return decoder;
-		};
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
-		if (!(authentication instanceof OidcLogoutAuthenticationToken token)) {
-			return null;
-		}
-		String logoutToken = token.getLogoutToken();
-		ClientRegistration registration = token.getClientRegistration();
-		Jwt jwt = decode(registration, logoutToken);
-		OidcLogoutToken oidcLogoutToken = OidcLogoutToken.withTokenValue(logoutToken)
-			.claims((claims) -> claims.putAll(jwt.getClaims()))
-			.build();
-		return new OidcBackChannelLogoutAuthentication(oidcLogoutToken);
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public boolean supports(Class<?> authentication) {
-		return OidcLogoutAuthenticationToken.class.isAssignableFrom(authentication);
-	}
-
-	private Jwt decode(ClientRegistration registration, String token) {
-		JwtDecoder logoutTokenDecoder = this.logoutTokenDecoderFactory.createDecoder(registration);
-		try {
-			return logoutTokenDecoder.decode(token);
-		}
-		catch (BadJwtException failed) {
-			OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST, failed.getMessage(),
-					"https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation");
-			throw new OAuth2AuthenticationException(error, failed);
-		}
-		catch (Exception failed) {
-			throw new AuthenticationServiceException(failed.getMessage(), failed);
-		}
-	}
-
-	/**
-	 * Use this {@link JwtDecoderFactory} to generate {@link JwtDecoder}s that correspond
-	 * to the {@link ClientRegistration} associated with the OIDC logout token.
-	 * @param logoutTokenDecoderFactory the {@link JwtDecoderFactory} to use
-	 */
-	void setLogoutTokenDecoderFactory(JwtDecoderFactory<ClientRegistration> logoutTokenDecoderFactory) {
-		Assert.notNull(logoutTokenDecoderFactory, "logoutTokenDecoderFactory cannot be null");
-		this.logoutTokenDecoderFactory = logoutTokenDecoderFactory;
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutFilter.java

@@ -1,139 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import java.io.IOException;
-
-import jakarta.servlet.FilterChain;
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import org.springframework.http.server.ServletServerHttpResponse;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.AuthenticationServiceException;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter;
-import org.springframework.security.web.authentication.AuthenticationConverter;
-import org.springframework.security.web.authentication.logout.LogoutHandler;
-import org.springframework.util.Assert;
-import org.springframework.web.filter.OncePerRequestFilter;
-
-/**
- * A filter for the Client-side OIDC Back-Channel Logout endpoint
- *
- * @author Josh Cummings
- * @since 6.2
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel Logout
- * Spec</a>
- */
-class OidcBackChannelLogoutFilter extends OncePerRequestFilter {
-
-	private final Log logger = LogFactory.getLog(getClass());
-
-	private final AuthenticationConverter authenticationConverter;
-
-	private final AuthenticationManager authenticationManager;
-
-	private final OAuth2ErrorHttpMessageConverter errorHttpMessageConverter = new OAuth2ErrorHttpMessageConverter();
-
-	private LogoutHandler logoutHandler = new OidcBackChannelLogoutHandler();
-
-	/**
-	 * Construct an {@link OidcBackChannelLogoutFilter}
-	 * @param authenticationConverter the {@link AuthenticationConverter} for deriving
-	 * Logout Token authentication
-	 * @param authenticationManager the {@link AuthenticationManager} for authenticating
-	 * Logout Tokens
-	 */
-	OidcBackChannelLogoutFilter(AuthenticationConverter authenticationConverter,
-			AuthenticationManager authenticationManager) {
-		Assert.notNull(authenticationConverter, "authenticationConverter cannot be null");
-		Assert.notNull(authenticationManager, "authenticationManager cannot be null");
-		this.authenticationConverter = authenticationConverter;
-		this.authenticationManager = authenticationManager;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
-			throws ServletException, IOException {
-		Authentication token;
-		try {
-			token = this.authenticationConverter.convert(request);
-		}
-		catch (AuthenticationServiceException ex) {
-			this.logger.debug("Failed to process OIDC Back-Channel Logout", ex);
-			throw ex;
-		}
-		catch (AuthenticationException ex) {
-			handleAuthenticationFailure(response, ex);
-			return;
-		}
-		if (token == null) {
-			chain.doFilter(request, response);
-			return;
-		}
-		Authentication authentication;
-		try {
-			authentication = this.authenticationManager.authenticate(token);
-		}
-		catch (AuthenticationServiceException ex) {
-			this.logger.debug("Failed to process OIDC Back-Channel Logout", ex);
-			throw ex;
-		}
-		catch (AuthenticationException ex) {
-			handleAuthenticationFailure(response, ex);
-			return;
-		}
-		this.logoutHandler.logout(request, response, authentication);
-	}
-
-	private void handleAuthenticationFailure(HttpServletResponse response, Exception ex) throws IOException {
-		this.logger.debug("Failed to process OIDC Back-Channel Logout", ex);
-		response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
-		this.errorHttpMessageConverter.write(oauth2Error(ex), null, new ServletServerHttpResponse(response));
-	}
-
-	private OAuth2Error oauth2Error(Exception ex) {
-		if (ex instanceof OAuth2AuthenticationException oauth2) {
-			return oauth2.getError();
-		}
-		return new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST, ex.getMessage(),
-				"https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation");
-	}
-
-	/**
-	 * The strategy for expiring all Client sessions indicated by the logout request.
-	 * Defaults to {@link OidcBackChannelLogoutHandler}.
-	 * @param logoutHandler the {@link LogoutHandler} to use
-	 */
-	void setLogoutHandler(LogoutHandler logoutHandler) {
-		Assert.notNull(logoutHandler, "logoutHandler cannot be null");
-		this.logoutHandler = logoutHandler;
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutHandler.java

@@ -1,205 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Map;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import org.springframework.http.HttpEntity;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.server.ServletServerHttpResponse;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-import org.springframework.security.oauth2.client.oidc.session.InMemoryOidcSessionRegistry;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionInformation;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter;
-import org.springframework.security.web.authentication.logout.LogoutHandler;
-import org.springframework.security.web.util.UrlUtils;
-import org.springframework.util.Assert;
-import org.springframework.web.client.RestClientException;
-import org.springframework.web.client.RestOperations;
-import org.springframework.web.client.RestTemplate;
-import org.springframework.web.util.UriComponents;
-import org.springframework.web.util.UriComponentsBuilder;
-
-/**
- * A {@link LogoutHandler} that locates the sessions associated with a given OIDC
- * Back-Channel Logout Token and invalidates each one.
- *
- * @author Josh Cummings
- * @since 6.2
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel Logout
- * Spec</a>
- */
-final class OidcBackChannelLogoutHandler implements LogoutHandler {
-
-	private final Log logger = LogFactory.getLog(getClass());
-
-	private OidcSessionRegistry sessionRegistry = new InMemoryOidcSessionRegistry();
-
-	private RestOperations restOperations = new RestTemplate();
-
-	private String logoutUri = "{baseScheme}://localhost{basePort}/logout";
-
-	private String sessionCookieName = "JSESSIONID";
-
-	private final OAuth2ErrorHttpMessageConverter errorHttpMessageConverter = new OAuth2ErrorHttpMessageConverter();
-
-	@Override
-	public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
-		if (!(authentication instanceof OidcBackChannelLogoutAuthentication token)) {
-			if (this.logger.isDebugEnabled()) {
-				String message = "Did not perform OIDC Back-Channel Logout since authentication [%s] was of the wrong type";
-				this.logger.debug(String.format(message, authentication.getClass().getSimpleName()));
-			}
-			return;
-		}
-		Iterable<OidcSessionInformation> sessions = this.sessionRegistry.removeSessionInformation(token.getPrincipal());
-		Collection<String> errors = new ArrayList<>();
-		int totalCount = 0;
-		int invalidatedCount = 0;
-		for (OidcSessionInformation session : sessions) {
-			totalCount++;
-			try {
-				eachLogout(request, session);
-				invalidatedCount++;
-			}
-			catch (RestClientException ex) {
-				this.logger.debug("Failed to invalidate session", ex);
-				errors.add(ex.getMessage());
-				this.sessionRegistry.saveSessionInformation(session);
-			}
-		}
-		if (this.logger.isTraceEnabled()) {
-			this.logger.trace(String.format("Invalidated %d out of %d sessions", invalidatedCount, totalCount));
-		}
-		if (!errors.isEmpty()) {
-			handleLogoutFailure(response, oauth2Error(errors));
-		}
-	}
-
-	private void eachLogout(HttpServletRequest request, OidcSessionInformation session) {
-		HttpHeaders headers = new HttpHeaders();
-		headers.add(HttpHeaders.COOKIE, this.sessionCookieName + "=" + session.getSessionId());
-		for (Map.Entry<String, String> credential : session.getAuthorities().entrySet()) {
-			headers.add(credential.getKey(), credential.getValue());
-		}
-		String logout = computeLogoutEndpoint(request);
-		HttpEntity<?> entity = new HttpEntity<>(null, headers);
-		this.restOperations.postForEntity(logout, entity, Object.class);
-	}
-
-	String computeLogoutEndpoint(HttpServletRequest request) {
-		// @formatter:off
-		UriComponents uriComponents = UriComponentsBuilder
-				.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
-				.replacePath(request.getContextPath())
-				.replaceQuery(null)
-				.fragment(null)
-				.build();
-
-		Map<String, String> uriVariables = new HashMap<>();
-		String scheme = uriComponents.getScheme();
-		uriVariables.put("baseScheme", (scheme != null) ? scheme : "");
-		uriVariables.put("baseUrl", uriComponents.toUriString());
-
-		String host = uriComponents.getHost();
-		uriVariables.put("baseHost", (host != null) ? host : "");
-
-		String path = uriComponents.getPath();
-		uriVariables.put("basePath", (path != null) ? path : "");
-
-		int port = uriComponents.getPort();
-		uriVariables.put("basePort", (port == -1) ? "" : ":" + port);
-
-		return UriComponentsBuilder.fromUriString(this.logoutUri)
-				.buildAndExpand(uriVariables)
-				.toUriString();
-		// @formatter:on
-	}
-
-	private OAuth2Error oauth2Error(Collection<String> errors) {
-		return new OAuth2Error("partial_logout", "not all sessions were terminated: " + errors,
-				"https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation");
-	}
-
-	private void handleLogoutFailure(HttpServletResponse response, OAuth2Error error) {
-		response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
-		try {
-			this.errorHttpMessageConverter.write(error, null, new ServletServerHttpResponse(response));
-		}
-		catch (IOException ex) {
-			throw new IllegalStateException(ex);
-		}
-	}
-
-	/**
-	 * Use this {@link OidcSessionRegistry} to identify sessions to invalidate. Note that
-	 * this class uses
-	 * {@link OidcSessionRegistry#removeSessionInformation(OidcLogoutToken)} to identify
-	 * sessions.
-	 * @param sessionRegistry the {@link OidcSessionRegistry} to use
-	 */
-	void setSessionRegistry(OidcSessionRegistry sessionRegistry) {
-		Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
-		this.sessionRegistry = sessionRegistry;
-	}
-
-	/**
-	 * Use this {@link RestOperations} to perform the per-session back-channel logout
-	 * @param restOperations the {@link RestOperations} to use
-	 */
-	void setRestOperations(RestOperations restOperations) {
-		Assert.notNull(restOperations, "restOperations cannot be null");
-		this.restOperations = restOperations;
-	}
-
-	/**
-	 * Use this logout URI for performing per-session logout. Defaults to {@code /logout}
-	 * since that is the default URI for
-	 * {@link org.springframework.security.web.authentication.logout.LogoutFilter}.
-	 * @param logoutUri the URI to use
-	 */
-	void setLogoutUri(String logoutUri) {
-		Assert.hasText(logoutUri, "logoutUri cannot be empty");
-		this.logoutUri = logoutUri;
-	}
-
-	/**
-	 * Use this cookie name for the session identifier. Defaults to {@code JSESSIONID}.
-	 *
-	 * <p>
-	 * Note that if you are using Spring Session, this likely needs to change to SESSION.
-	 * @param sessionCookieName the cookie name to use
-	 */
-	void setSessionCookieName(String sessionCookieName) {
-		Assert.hasText(sessionCookieName, "clientSessionCookieName cannot be empty");
-		this.sessionCookieName = sessionCookieName;
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutTokenValidator.java

@@ -1,121 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.security.oauth2.client.oidc.authentication.logout.LogoutTokenClaimAccessor;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.util.Assert;
-
-/**
- * A {@link OAuth2TokenValidator} that validates OIDC Logout Token claims in conformance
- * with the OIDC Back-Channel Logout Spec.
- *
- * @author Josh Cummings
- * @since 6.2
- * @see OidcLogoutToken
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken">Logout
- * Token</a>
- * @see <a target="blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation">the OIDC
- * Back-Channel Logout spec</a>
- */
-final class OidcBackChannelLogoutTokenValidator implements OAuth2TokenValidator<Jwt> {
-
-	private static final String LOGOUT_VALIDATION_URL = "https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation";
-
-	private static final String BACK_CHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
-
-	private final String audience;
-
-	private final String issuer;
-
-	OidcBackChannelLogoutTokenValidator(ClientRegistration clientRegistration) {
-		this.audience = clientRegistration.getClientId();
-		String issuer = clientRegistration.getProviderDetails().getIssuerUri();
-		Assert.hasText(issuer, "Provider issuer cannot be null");
-		this.issuer = issuer;
-	}
-
-	@Override
-	public OAuth2TokenValidatorResult validate(Jwt jwt) {
-		Collection<OAuth2Error> errors = new ArrayList<>();
-
-		LogoutTokenClaimAccessor logoutClaims = jwt::getClaims;
-		Map<String, Object> events = logoutClaims.getEvents();
-		if (events == null) {
-			errors.add(invalidLogoutToken("events claim must not be null"));
-		}
-		else if (events.get(BACK_CHANNEL_LOGOUT_EVENT) == null) {
-			errors.add(invalidLogoutToken("events claim map must contain \"" + BACK_CHANNEL_LOGOUT_EVENT + "\" key"));
-		}
-
-		String issuer = logoutClaims.getIssuer().toExternalForm();
-		if (issuer == null) {
-			errors.add(invalidLogoutToken("iss claim must not be null"));
-		}
-		else if (!this.issuer.equals(issuer)) {
-			errors.add(invalidLogoutToken(
-					"iss claim value must match `ClientRegistration#getProviderDetails#getIssuerUri`"));
-		}
-
-		List<String> audience = logoutClaims.getAudience();
-		if (audience == null) {
-			errors.add(invalidLogoutToken("aud claim must not be null"));
-		}
-		else if (!audience.contains(this.audience)) {
-			errors.add(invalidLogoutToken("aud claim value must include `ClientRegistration#getClientId`"));
-		}
-
-		Instant issuedAt = logoutClaims.getIssuedAt();
-		if (issuedAt == null) {
-			errors.add(invalidLogoutToken("iat claim must not be null"));
-		}
-
-		String jwtId = logoutClaims.getId();
-		if (jwtId == null) {
-			errors.add(invalidLogoutToken("jti claim must not be null"));
-		}
-
-		if (logoutClaims.getSubject() == null && logoutClaims.getSessionId() == null) {
-			errors.add(invalidLogoutToken("sub and sid claims must not both be null"));
-		}
-
-		if (logoutClaims.getClaim("nonce") != null) {
-			errors.add(invalidLogoutToken("nonce claim must not be present"));
-		}
-
-		return OAuth2TokenValidatorResult.failure(errors);
-	}
-
-	private static OAuth2Error invalidLogoutToken(String description) {
-		return new OAuth2Error(OAuth2ErrorCodes.INVALID_TOKEN, description, LOGOUT_VALIDATION_URL);
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcLogoutAuthenticationConverter.java

@@ -1,85 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import jakarta.servlet.http.HttpServletRequest;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.web.authentication.AuthenticationConverter;
-import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
-import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.util.Assert;
-
-/**
- * An {@link AuthenticationConverter} that extracts the OIDC Logout Token authentication
- * request
- *
- * @author Josh Cummings
- * @since 6.2
- */
-final class OidcLogoutAuthenticationConverter implements AuthenticationConverter {
-
-	private static final String DEFAULT_LOGOUT_URI = "/logout/connect/back-channel/{registrationId}";
-
-	private final Log logger = LogFactory.getLog(getClass());
-
-	private final ClientRegistrationRepository clientRegistrationRepository;
-
-	private RequestMatcher requestMatcher = new AntPathRequestMatcher(DEFAULT_LOGOUT_URI, "POST");
-
-	OidcLogoutAuthenticationConverter(ClientRegistrationRepository clientRegistrationRepository) {
-		Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
-		this.clientRegistrationRepository = clientRegistrationRepository;
-	}
-
-	@Override
-	public Authentication convert(HttpServletRequest request) {
-		RequestMatcher.MatchResult result = this.requestMatcher.matcher(request);
-		if (!result.isMatch()) {
-			return null;
-		}
-		String registrationId = result.getVariables().get("registrationId");
-		ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId(registrationId);
-		if (clientRegistration == null) {
-			this.logger.debug("Did not process OIDC Back-Channel Logout since no ClientRegistration was found");
-			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
-		}
-		String logoutToken = request.getParameter("logout_token");
-		if (logoutToken == null) {
-			this.logger.debug("Failed to process OIDC Back-Channel Logout since no logout token was found");
-			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
-		}
-		return new OidcLogoutAuthenticationToken(logoutToken, clientRegistration);
-	}
-
-	/**
-	 * The logout endpoint. Defaults to
-	 * {@code /logout/connect/back-channel/{registrationId}}.
-	 * @param requestMatcher the {@link RequestMatcher} to use
-	 */
-	void setRequestMatcher(RequestMatcher requestMatcher) {
-		Assert.notNull(requestMatcher, "requestMatcher cannot be null");
-		this.requestMatcher = requestMatcher;
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcLogoutAuthenticationToken.java

@@ -1,80 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-
-/**
- * An {@link org.springframework.security.core.Authentication} instance that represents a
- * request to authenticate an OIDC Logout Token.
- *
- * @author Josh Cummings
- * @since 6.2
- */
-class OidcLogoutAuthenticationToken extends AbstractAuthenticationToken {
-
-	private final String logoutToken;
-
-	private final ClientRegistration clientRegistration;
-
-	/**
-	 * Construct an {@link OidcLogoutAuthenticationToken}
-	 * @param logoutToken a signed, serialized OIDC Logout token
-	 * @param clientRegistration the {@link ClientRegistration client} associated with
-	 * this token; this is usually derived from material in the logout HTTP request
-	 */
-	OidcLogoutAuthenticationToken(String logoutToken, ClientRegistration clientRegistration) {
-		super(AuthorityUtils.NO_AUTHORITIES);
-		this.logoutToken = logoutToken;
-		this.clientRegistration = clientRegistration;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public String getCredentials() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public String getPrincipal() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * Get the signed, serialized OIDC Logout token
-	 * @return the logout token
-	 */
-	String getLogoutToken() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * Get the {@link ClientRegistration} associated with this logout token
-	 * @return the {@link ClientRegistration}
-	 */
-	ClientRegistration getClientRegistration() {
-		return this.clientRegistration;
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcLogoutConfigurer.java

@@ -1,196 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configurers.oauth2.client;
-
-import java.util.function.Consumer;
-import java.util.function.Function;
-
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.ProviderManager;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
-import org.springframework.security.web.authentication.AuthenticationConverter;
-import org.springframework.security.web.authentication.logout.LogoutHandler;
-import org.springframework.security.web.csrf.CsrfFilter;
-import org.springframework.util.Assert;
-
-/**
- * An {@link AbstractHttpConfigurer} for OIDC Logout flows
- *
- * <p>
- * OIDC Logout provides an application with the capability to have users log out by using
- * their existing account at an OAuth 2.0 or OpenID Connect 1.0 Provider.
- *
- *
- * <h2>Security Filters</h2>
- *
- * The following {@code Filter} is populated:
- *
- * <ul>
- * <li>{@link OidcBackChannelLogoutFilter}</li>
- * </ul>
- *
- * <h2>Shared Objects Used</h2>
- *
- * The following shared objects are used:
- *
- * <ul>
- * <li>{@link ClientRegistrationRepository}</li>
- * </ul>
- *
- * @author Josh Cummings
- * @since 6.2
- * @see HttpSecurity#oidcLogout()
- * @see OidcBackChannelLogoutFilter
- * @see ClientRegistrationRepository
- */
-public final class OidcLogoutConfigurer<B extends HttpSecurityBuilder<B>>
-		extends AbstractHttpConfigurer<OidcLogoutConfigurer<B>, B> {
-
-	private BackChannelLogoutConfigurer backChannel;
-
-	/**
-	 * Sets the repository of client registrations.
-	 * @param clientRegistrationRepository the repository of client registrations
-	 * @return the {@link OAuth2LoginConfigurer} for further configuration
-	 */
-	public OidcLogoutConfigurer<B> clientRegistrationRepository(
-			ClientRegistrationRepository clientRegistrationRepository) {
-		Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
-		this.getBuilder().setSharedObject(ClientRegistrationRepository.class, clientRegistrationRepository);
-		return this;
-	}
-
-	/**
-	 * Sets the registry for managing the OIDC client-provider session link
-	 * @param oidcSessionRegistry the {@link OidcSessionRegistry} to use
-	 * @return the {@link OAuth2LoginConfigurer} for further configuration
-	 */
-	public OidcLogoutConfigurer<B> oidcSessionRegistry(OidcSessionRegistry oidcSessionRegistry) {
-		Assert.notNull(oidcSessionRegistry, "oidcSessionRegistry cannot be null");
-		getBuilder().setSharedObject(OidcSessionRegistry.class, oidcSessionRegistry);
-		return this;
-	}
-
-	/**
-	 * Configure OIDC Back-Channel Logout using the provided {@link Consumer}
-	 * @return the {@link OidcLogoutConfigurer} for further configuration
-	 */
-	public OidcLogoutConfigurer<B> backChannel(Customizer<BackChannelLogoutConfigurer> backChannelLogoutConfigurer) {
-		if (this.backChannel == null) {
-			this.backChannel = new BackChannelLogoutConfigurer();
-		}
-		backChannelLogoutConfigurer.customize(this.backChannel);
-		return this;
-	}
-
-	@Deprecated(forRemoval = true, since = "6.2")
-	public B and() {
-		return getBuilder();
-	}
-
-	@Override
-	public void configure(B builder) throws Exception {
-		if (this.backChannel != null) {
-			this.backChannel.configure(builder);
-		}
-	}
-
-	/**
-	 * A configurer for configuring OIDC Back-Channel Logout
-	 */
-	public final class BackChannelLogoutConfigurer {
-
-		private AuthenticationConverter authenticationConverter;
-
-		private final AuthenticationManager authenticationManager = new ProviderManager(
-				new OidcBackChannelLogoutAuthenticationProvider());
-
-		private Function<B, LogoutHandler> logoutHandler = this::logoutHandler;
-
-		private AuthenticationConverter authenticationConverter(B http) {
-			if (this.authenticationConverter == null) {
-				ClientRegistrationRepository clientRegistrationRepository = OAuth2ClientConfigurerUtils
-					.getClientRegistrationRepository(http);
-				this.authenticationConverter = new OidcLogoutAuthenticationConverter(clientRegistrationRepository);
-			}
-			return this.authenticationConverter;
-		}
-
-		private AuthenticationManager authenticationManager() {
-			return this.authenticationManager;
-		}
-
-		private LogoutHandler logoutHandler(B http) {
-			OidcBackChannelLogoutHandler logoutHandler = new OidcBackChannelLogoutHandler();
-			logoutHandler.setSessionRegistry(OAuth2ClientConfigurerUtils.getOidcSessionRegistry(http));
-			return logoutHandler;
-		}
-
-		/**
-		 * Use this endpoint when invoking a back-channel logout.
-		 *
-		 * <p>
-		 * The resulting {@link LogoutHandler} will {@code POST} the session cookie and
-		 * CSRF token to this endpoint to invalidate the corresponding end-user session.
-		 *
-		 * <p>
-		 * Supports URI templates like {@code {baseUrl}}, {@code {baseScheme}}, and
-		 * {@code {basePort}}.
-		 *
-		 * <p>
-		 * By default, the URI is set to
-		 * {@code {baseScheme}://localhost{basePort}/logout}, meaning that the scheme and
-		 * port of the original back-channel request is preserved, while the host and
-		 * endpoint are changed.
-		 *
-		 * <p>
-		 * If you are using Spring Security for the logout endpoint, the path part of this
-		 * URI should match the value configured there.
-		 *
-		 * <p>
-		 * Otherwise, this is handy in the event that your server configuration means that
-		 * the scheme, server name, or port in the {@code Host} header are different from
-		 * how you would address the same server internally.
-		 * @param logoutUri the URI to request logout on the back-channel
-		 * @return the {@link BackChannelLogoutConfigurer} for further customizations
-		 * @since 6.2.4
-		 */
-		public BackChannelLogoutConfigurer logoutUri(String logoutUri) {
-			this.logoutHandler = (http) -> {
-				OidcBackChannelLogoutHandler logoutHandler = new OidcBackChannelLogoutHandler();
-				logoutHandler.setSessionRegistry(OAuth2ClientConfigurerUtils.getOidcSessionRegistry(http));
-				logoutHandler.setLogoutUri(logoutUri);
-				return logoutHandler;
-			};
-			return this;
-		}
-
-		void configure(B http) {
-			OidcBackChannelLogoutFilter filter = new OidcBackChannelLogoutFilter(authenticationConverter(http),
-					authenticationManager());
-			filter.setLogoutHandler(this.logoutHandler.apply(http));
-			http.addFilterBefore(filter, CsrfFilter.class);
-		}
-
-	}
-
-}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java

@@ -52,7 +52,6 @@ import org.springframework.security.web.util.matcher.NegatedRequestMatcher;
 import org.springframework.security.web.util.matcher.OrRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.security.web.util.matcher.RequestMatchers;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
@@ -115,9 +114,7 @@ public final class Saml2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 
 	private Saml2AuthenticationRequestResolver authenticationRequestResolver;
 
-	private RequestMatcher loginProcessingUrl = RequestMatchers.anyOf(
-			new AntPathRequestMatcher(Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI),
-			new AntPathRequestMatcher("/login/saml2/sso"));
+	private String loginProcessingUrl = Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI;
 
 	private RelyingPartyRegistrationRepository relyingPartyRegistrationRepository;
 
@@ -217,7 +214,7 @@ public final class Saml2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 	@Override
 	public Saml2LoginConfigurer<B> loginProcessingUrl(String loginProcessingUrl) {
 		Assert.hasText(loginProcessingUrl, "loginProcessingUrl cannot be empty");
-		this.loginProcessingUrl = new AntPathRequestMatcher(loginProcessingUrl);
+		this.loginProcessingUrl = loginProcessingUrl;
 		return this;
 	}
 
@@ -243,11 +240,12 @@ public final class Saml2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 	public void init(B http) throws Exception {
 		registerDefaultCsrfOverride(http);
 		relyingPartyRegistrationRepository(http);
-		this.saml2WebSsoAuthenticationFilter = new Saml2WebSsoAuthenticationFilter(getAuthenticationConverter(http));
+		this.saml2WebSsoAuthenticationFilter = new Saml2WebSsoAuthenticationFilter(getAuthenticationConverter(http),
+				this.loginProcessingUrl);
 		this.saml2WebSsoAuthenticationFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
-		this.saml2WebSsoAuthenticationFilter.setRequiresAuthenticationRequestMatcher(this.loginProcessingUrl);
 		setAuthenticationRequestRepository(http, this.saml2WebSsoAuthenticationFilter);
 		setAuthenticationFilter(this.saml2WebSsoAuthenticationFilter);
+		super.loginProcessingUrl(this.loginProcessingUrl);
 		if (StringUtils.hasText(this.loginPage)) {
 			// Set custom login page
 			super.loginPage(this.loginPage);
@@ -354,7 +352,7 @@ public final class Saml2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 			OpenSamlAuthenticationTokenConverter converter = new OpenSamlAuthenticationTokenConverter(
 					this.relyingPartyRegistrationRepository);
 			converter.setAuthenticationRequestRepository(getAuthenticationRequestRepository(http));
-			converter.setRequestMatcher(this.loginProcessingUrl);
+			converter.setRequestMatcher(createLoginProcessingUrlMatcher(this.loginProcessingUrl));
 			return converter;
 		}
 		return authenticationConverterBean;
@@ -372,7 +370,7 @@ public final class Saml2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 		if (csrf == null) {
 			return;
 		}
-		csrf.ignoringRequestMatchers(this.loginProcessingUrl);
+		csrf.ignoringRequestMatchers(new AntPathRequestMatcher(this.loginProcessingUrl));
 	}
 
 	private void initDefaultLoginFilter(B http) {

config/src/main/java/org/springframework/security/config/annotation/web/reactive/WebFluxSecurityConfiguration.java

@@ -21,7 +21,6 @@ import java.util.List;
 
 import io.micrometer.observation.ObservationRegistry;
 
-import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanFactoryPostProcessor;
 import org.springframework.context.ApplicationContext;
@@ -34,8 +33,6 @@ import org.springframework.security.web.reactive.result.view.CsrfRequestDataValu
 import org.springframework.security.web.server.ObservationWebFilterChainDecorator;
 import org.springframework.security.web.server.SecurityWebFilterChain;
 import org.springframework.security.web.server.WebFilterChainProxy;
-import org.springframework.security.web.server.firewall.ServerExchangeRejectedHandler;
-import org.springframework.security.web.server.firewall.ServerWebExchangeFirewall;
 import org.springframework.util.ClassUtils;
 import org.springframework.util.ObjectUtils;
 import org.springframework.web.reactive.result.view.AbstractView;
@@ -82,14 +79,11 @@ class WebFluxSecurityConfiguration {
 
 	@Bean(SPRING_SECURITY_WEBFILTERCHAINFILTER_BEAN_NAME)
 	@Order(WEB_FILTER_CHAIN_FILTER_ORDER)
-	WebFilterChainProxy springSecurityWebFilterChainFilter(ObjectProvider<ServerWebExchangeFirewall> firewall,
-			ObjectProvider<ServerExchangeRejectedHandler> rejectedHandler) {
+	WebFilterChainProxy springSecurityWebFilterChainFilter() {
 		WebFilterChainProxy proxy = new WebFilterChainProxy(getSecurityWebFilterChains());
 		if (!this.observationRegistry.isNoop()) {
 			proxy.setFilterChainDecorator(new ObservationWebFilterChainDecorator(this.observationRegistry));
 		}
-		firewall.ifUnique(proxy::setFirewall);
-		rejectedHandler.ifUnique(proxy::setExchangeRejectedHandler);
 		return proxy;
 	}
 

config/src/main/java/org/springframework/security/config/crypto/RsaKeyConversionServicePostProcessor.java

@@ -68,7 +68,8 @@ public class RsaKeyConversionServicePostProcessor implements BeanFactoryPostProc
 			return;
 		}
 		ConversionService service = beanFactory.getConversionService();
-		if (service instanceof ConverterRegistry registry) {
+		if (service instanceof ConverterRegistry) {
+			ConverterRegistry registry = (ConverterRegistry) service;
 			registry.addConverter(String.class, RSAPrivateKey.class, this.pkcs8);
 			registry.addConverter(String.class, RSAPublicKey.class, this.x509);
 		}

config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -421,10 +421,6 @@ final class AuthenticationConfigBuilder {
 			this.pc.getReaderContext()
 				.registerWithGeneratedName(new RootBeanDefinition(OAuth2ClientWebMvcSecurityPostProcessor.class));
 		}
-		this.pc.getReaderContext()
-			.getRegistry()
-			.registerBeanDefinition(OAuth2AuthorizedClientManagerRegistrar.BEAN_NAME,
-					new RootBeanDefinition(OAuth2AuthorizedClientManagerRegistrar.class));
 	}
 
 	private void createSaml2LoginFilter(BeanReference authenticationManager,

config/src/main/java/org/springframework/security/config/http/ChannelAttributeFactory.java

@@ -42,12 +42,19 @@ public final class ChannelAttributeFactory {
 	}
 
 	public static List<ConfigAttribute> createChannelAttributes(String requiredChannel) {
-		String channelConfigAttribute = switch (requiredChannel) {
-			case OPT_REQUIRES_HTTPS -> "REQUIRES_SECURE_CHANNEL";
-			case OPT_REQUIRES_HTTP -> "REQUIRES_INSECURE_CHANNEL";
-			case OPT_ANY_CHANNEL -> ChannelDecisionManagerImpl.ANY_CHANNEL;
-			default -> throw new BeanCreationException("Unknown channel attribute " + requiredChannel);
-		};
+		String channelConfigAttribute;
+		if (requiredChannel.equals(OPT_REQUIRES_HTTPS)) {
+			channelConfigAttribute = "REQUIRES_SECURE_CHANNEL";
+		}
+		else if (requiredChannel.equals(OPT_REQUIRES_HTTP)) {
+			channelConfigAttribute = "REQUIRES_INSECURE_CHANNEL";
+		}
+		else if (requiredChannel.equals(OPT_ANY_CHANNEL)) {
+			channelConfigAttribute = ChannelDecisionManagerImpl.ANY_CHANNEL;
+		}
+		else {
+			throw new BeanCreationException("Unknown channel attribute " + requiredChannel);
+		}
 		return SecurityConfig.createList(channelConfigAttribute);
 	}
 

config/src/main/java/org/springframework/security/config/http/CsrfBeanDefinitionParser.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,6 +43,7 @@ import org.springframework.security.web.csrf.CsrfAuthenticationStrategy;
 import org.springframework.security.web.csrf.CsrfFilter;
 import org.springframework.security.web.csrf.CsrfLogoutHandler;
 import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
+import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
 import org.springframework.security.web.csrf.MissingCsrfTokenException;
 import org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor;
 import org.springframework.security.web.session.InvalidSessionAccessDeniedHandler;
@@ -108,12 +109,13 @@ public class CsrfBeanDefinitionParser implements BeanDefinitionParser {
 			this.requestHandlerRef = element.getAttribute(ATT_REQUEST_HANDLER);
 		}
 		if (!StringUtils.hasText(this.csrfRepositoryRef)) {
-			BeanDefinitionBuilder httpSessionCsrfTokenRepository = BeanDefinitionBuilder
-				.rootBeanDefinition(HttpSessionCsrfTokenRepository.class);
-			this.csrfRepositoryRef = pc.getReaderContext()
-				.generateBeanName(httpSessionCsrfTokenRepository.getBeanDefinition());
-			pc.registerBeanComponent(new BeanComponentDefinition(httpSessionCsrfTokenRepository.getBeanDefinition(),
-					this.csrfRepositoryRef));
+			RootBeanDefinition csrfTokenRepository = new RootBeanDefinition(HttpSessionCsrfTokenRepository.class);
+			BeanDefinitionBuilder lazyTokenRepository = BeanDefinitionBuilder
+				.rootBeanDefinition(LazyCsrfTokenRepository.class);
+			lazyTokenRepository.addConstructorArgValue(csrfTokenRepository);
+			this.csrfRepositoryRef = pc.getReaderContext().generateBeanName(lazyTokenRepository.getBeanDefinition());
+			pc.registerBeanComponent(
+					new BeanComponentDefinition(lazyTokenRepository.getBeanDefinition(), this.csrfRepositoryRef));
 		}
 		BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(CsrfFilter.class);
 		builder.addConstructorArgReference(this.csrfRepositoryRef);

config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,6 @@ package org.springframework.security.config.http;
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Locale;
 
 import io.micrometer.observation.ObservationRegistry;
 import jakarta.servlet.ServletRequest;
@@ -314,7 +313,7 @@ class HttpConfigurationBuilder {
 
 	// Needed to account for placeholders
 	static String createPath(String path, boolean lowerCase) {
-		return lowerCase ? path.toLowerCase(Locale.ENGLISH) : path;
+		return lowerCase ? path.toLowerCase() : path;
 	}
 
 	BeanMetadataElement getSecurityContextHolderStrategyForAuthenticationFilters() {

config/src/main/java/org/springframework/security/config/http/OAuth2AuthorizedClientManagerRegistrar.java

@@ -1,291 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.http;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-import java.util.Set;
-import java.util.function.Consumer;
-
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
-import org.springframework.beans.factory.BeanFactoryUtils;
-import org.springframework.beans.factory.BeanInitializationException;
-import org.springframework.beans.factory.ListableBeanFactory;
-import org.springframework.beans.factory.ObjectProvider;
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.BeanDefinitionRegistry;
-import org.springframework.beans.factory.support.BeanDefinitionRegistryPostProcessor;
-import org.springframework.context.annotation.AnnotationBeanNameGenerator;
-import org.springframework.core.ResolvableType;
-import org.springframework.security.oauth2.client.AuthorizationCodeOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.ClientCredentialsOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.DelegatingOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.JwtBearerOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.RefreshTokenOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
-import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequest;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
-import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
-
-/**
- * A registrar for registering the default {@link OAuth2AuthorizedClientManager} bean
- * definition, if not already present.
- * <p>
- * Note: This class is a direct copy of
- * {@link org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration.OAuth2AuthorizedClientManagerRegistrar}.
- *
- * @author Joe Grandja
- * @author Steve Riesenberg
- * @since 6.2.0
- */
-final class OAuth2AuthorizedClientManagerRegistrar implements BeanDefinitionRegistryPostProcessor, BeanFactoryAware {
-
-	static final String BEAN_NAME = "authorizedClientManagerRegistrar";
-
-	static final String FACTORY_METHOD_NAME = "getAuthorizedClientManager";
-
-	// @formatter:off
-	private static final Set<Class<?>> KNOWN_AUTHORIZED_CLIENT_PROVIDERS = Set.of(
-			AuthorizationCodeOAuth2AuthorizedClientProvider.class,
-			RefreshTokenOAuth2AuthorizedClientProvider.class,
-			ClientCredentialsOAuth2AuthorizedClientProvider.class,
-			PasswordOAuth2AuthorizedClientProvider.class,
-			JwtBearerOAuth2AuthorizedClientProvider.class
-	);
-	// @formatter:on
-
-	private final AnnotationBeanNameGenerator beanNameGenerator = new AnnotationBeanNameGenerator();
-
-	private ListableBeanFactory beanFactory;
-
-	@Override
-	public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {
-		if (getBeanNamesForType(OAuth2AuthorizedClientManager.class).length != 0
-				|| getBeanNamesForType(ClientRegistrationRepository.class).length != 1
-				|| getBeanNamesForType(OAuth2AuthorizedClientRepository.class).length != 1) {
-			return;
-		}
-
-		BeanDefinition beanDefinition = BeanDefinitionBuilder.rootBeanDefinition(OAuth2AuthorizedClientManager.class)
-			.setFactoryMethodOnBean(FACTORY_METHOD_NAME, BEAN_NAME)
-			.getBeanDefinition();
-
-		registry.registerBeanDefinition(this.beanNameGenerator.generateBeanName(beanDefinition, registry),
-				beanDefinition);
-	}
-
-	@Override
-	public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {
-	}
-
-	@Override
-	public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-		this.beanFactory = (ListableBeanFactory) beanFactory;
-	}
-
-	private OAuth2AuthorizedClientManager getAuthorizedClientManager() {
-		ClientRegistrationRepository clientRegistrationRepository = BeanFactoryUtils
-			.beanOfTypeIncludingAncestors(this.beanFactory, ClientRegistrationRepository.class, true, true);
-
-		OAuth2AuthorizedClientRepository authorizedClientRepository = BeanFactoryUtils
-			.beanOfTypeIncludingAncestors(this.beanFactory, OAuth2AuthorizedClientRepository.class, true, true);
-
-		Collection<OAuth2AuthorizedClientProvider> authorizedClientProviderBeans = BeanFactoryUtils
-			.beansOfTypeIncludingAncestors(this.beanFactory, OAuth2AuthorizedClientProvider.class, true, true)
-			.values();
-
-		OAuth2AuthorizedClientProvider authorizedClientProvider;
-		if (hasDelegatingAuthorizedClientProvider(authorizedClientProviderBeans)) {
-			authorizedClientProvider = authorizedClientProviderBeans.iterator().next();
-		}
-		else {
-			List<OAuth2AuthorizedClientProvider> authorizedClientProviders = new ArrayList<>();
-			authorizedClientProviders.add(getAuthorizationCodeAuthorizedClientProvider(authorizedClientProviderBeans));
-			authorizedClientProviders.add(getRefreshTokenAuthorizedClientProvider(authorizedClientProviderBeans));
-			authorizedClientProviders.add(getClientCredentialsAuthorizedClientProvider(authorizedClientProviderBeans));
-			authorizedClientProviders.add(getPasswordAuthorizedClientProvider(authorizedClientProviderBeans));
-
-			OAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = getJwtBearerAuthorizedClientProvider(
-					authorizedClientProviderBeans);
-			if (jwtBearerAuthorizedClientProvider != null) {
-				authorizedClientProviders.add(jwtBearerAuthorizedClientProvider);
-			}
-
-			authorizedClientProviders.addAll(getAdditionalAuthorizedClientProviders(authorizedClientProviderBeans));
-			authorizedClientProvider = new DelegatingOAuth2AuthorizedClientProvider(authorizedClientProviders);
-		}
-
-		DefaultOAuth2AuthorizedClientManager authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(
-				clientRegistrationRepository, authorizedClientRepository);
-		authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
-
-		Consumer<DefaultOAuth2AuthorizedClientManager> authorizedClientManagerConsumer = getBeanOfType(
-				ResolvableType.forClassWithGenerics(Consumer.class, DefaultOAuth2AuthorizedClientManager.class));
-		if (authorizedClientManagerConsumer != null) {
-			authorizedClientManagerConsumer.accept(authorizedClientManager);
-		}
-
-		return authorizedClientManager;
-	}
-
-	private boolean hasDelegatingAuthorizedClientProvider(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-		if (authorizedClientProviders.size() != 1) {
-			return false;
-		}
-		return authorizedClientProviders.iterator().next() instanceof DelegatingOAuth2AuthorizedClientProvider;
-	}
-
-	private OAuth2AuthorizedClientProvider getAuthorizationCodeAuthorizedClientProvider(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-		AuthorizationCodeOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-				authorizedClientProviders, AuthorizationCodeOAuth2AuthorizedClientProvider.class);
-		if (authorizedClientProvider == null) {
-			authorizedClientProvider = new AuthorizationCodeOAuth2AuthorizedClientProvider();
-		}
-
-		return authorizedClientProvider;
-	}
-
-	private OAuth2AuthorizedClientProvider getRefreshTokenAuthorizedClientProvider(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-		RefreshTokenOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-				authorizedClientProviders, RefreshTokenOAuth2AuthorizedClientProvider.class);
-		if (authorizedClientProvider == null) {
-			authorizedClientProvider = new RefreshTokenOAuth2AuthorizedClientProvider();
-		}
-
-		OAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> accessTokenResponseClient = getBeanOfType(
-				ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-						OAuth2RefreshTokenGrantRequest.class));
-		if (accessTokenResponseClient != null) {
-			authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-		}
-
-		return authorizedClientProvider;
-	}
-
-	private OAuth2AuthorizedClientProvider getClientCredentialsAuthorizedClientProvider(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-		ClientCredentialsOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-				authorizedClientProviders, ClientCredentialsOAuth2AuthorizedClientProvider.class);
-		if (authorizedClientProvider == null) {
-			authorizedClientProvider = new ClientCredentialsOAuth2AuthorizedClientProvider();
-		}
-
-		OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> accessTokenResponseClient = getBeanOfType(
-				ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-						OAuth2ClientCredentialsGrantRequest.class));
-		if (accessTokenResponseClient != null) {
-			authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-		}
-
-		return authorizedClientProvider;
-	}
-
-	private OAuth2AuthorizedClientProvider getPasswordAuthorizedClientProvider(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-		PasswordOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-				authorizedClientProviders, PasswordOAuth2AuthorizedClientProvider.class);
-		if (authorizedClientProvider == null) {
-			authorizedClientProvider = new PasswordOAuth2AuthorizedClientProvider();
-		}
-
-		OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient = getBeanOfType(
-				ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
-						OAuth2PasswordGrantRequest.class));
-		if (accessTokenResponseClient != null) {
-			authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-		}
-
-		return authorizedClientProvider;
-	}
-
-	private OAuth2AuthorizedClientProvider getJwtBearerAuthorizedClientProvider(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-		JwtBearerOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
-				authorizedClientProviders, JwtBearerOAuth2AuthorizedClientProvider.class);
-
-		OAuth2AccessTokenResponseClient<JwtBearerGrantRequest> accessTokenResponseClient = getBeanOfType(ResolvableType
-			.forClassWithGenerics(OAuth2AccessTokenResponseClient.class, JwtBearerGrantRequest.class));
-		if (accessTokenResponseClient != null) {
-			if (authorizedClientProvider == null) {
-				authorizedClientProvider = new JwtBearerOAuth2AuthorizedClientProvider();
-			}
-
-			authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
-		}
-
-		return authorizedClientProvider;
-	}
-
-	private List<OAuth2AuthorizedClientProvider> getAdditionalAuthorizedClientProviders(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
-		List<OAuth2AuthorizedClientProvider> additionalAuthorizedClientProviders = new ArrayList<>(
-				authorizedClientProviders);
-		additionalAuthorizedClientProviders
-			.removeIf((provider) -> KNOWN_AUTHORIZED_CLIENT_PROVIDERS.contains(provider.getClass()));
-		return additionalAuthorizedClientProviders;
-	}
-
-	private <T extends OAuth2AuthorizedClientProvider> T getAuthorizedClientProviderByType(
-			Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders, Class<T> providerClass) {
-		T authorizedClientProvider = null;
-		for (OAuth2AuthorizedClientProvider current : authorizedClientProviders) {
-			if (providerClass.isInstance(current)) {
-				assertAuthorizedClientProviderIsNull(authorizedClientProvider);
-				authorizedClientProvider = providerClass.cast(current);
-			}
-		}
-		return authorizedClientProvider;
-	}
-
-	private static void assertAuthorizedClientProviderIsNull(OAuth2AuthorizedClientProvider authorizedClientProvider) {
-		if (authorizedClientProvider != null) {
-			// @formatter:off
-			throw new BeanInitializationException(String.format(
-					"Unable to create an %s bean. Expected one bean of type %s, but found multiple. " +
-					"Please consider defining only a single bean of this type, or define an %s bean yourself.",
-					OAuth2AuthorizedClientManager.class.getName(),
-					authorizedClientProvider.getClass().getName(),
-					OAuth2AuthorizedClientManager.class.getName()));
-			// @formatter:on
-		}
-	}
-
-	private <T> String[] getBeanNamesForType(Class<T> beanClass) {
-		return BeanFactoryUtils.beanNamesForTypeIncludingAncestors(this.beanFactory, beanClass, false, false);
-	}
-
-	private <T> T getBeanOfType(ResolvableType resolvableType) {
-		ObjectProvider<T> objectProvider = this.beanFactory.getBeanProvider(resolvableType, true);
-		return objectProvider.getIfAvailable();
-	}
-
-}

config/src/main/java/org/springframework/security/config/http/OAuth2ClientBeanDefinitionParser.java

@@ -94,7 +94,7 @@ final class OAuth2ClientBeanDefinitionParser implements BeanDefinitionParser {
 			.rootBeanDefinition(OAuth2AuthorizationRequestRedirectFilter.class);
 		String authorizationRequestResolverRef = (authorizationCodeGrantElt != null)
 				? authorizationCodeGrantElt.getAttribute(ATT_AUTHORIZATION_REQUEST_RESOLVER_REF) : null;
-		if (StringUtils.hasLength(authorizationRequestResolverRef)) {
+		if (!StringUtils.isEmpty(authorizationRequestResolverRef)) {
 			authorizationRequestRedirectFilterBuilder.addConstructorArgReference(authorizationRequestResolverRef);
 		}
 		else {
@@ -125,7 +125,7 @@ final class OAuth2ClientBeanDefinitionParser implements BeanDefinitionParser {
 	private BeanMetadataElement getAuthorizationRequestRepository(Element element) {
 		String authorizationRequestRepositoryRef = (element != null)
 				? element.getAttribute(ATT_AUTHORIZATION_REQUEST_REPOSITORY_REF) : null;
-		if (StringUtils.hasLength(authorizationRequestRepositoryRef)) {
+		if (!StringUtils.isEmpty(authorizationRequestRepositoryRef)) {
 			return new RuntimeBeanReference(authorizationRequestRepositoryRef);
 		}
 		return BeanDefinitionBuilder
@@ -147,7 +147,7 @@ final class OAuth2ClientBeanDefinitionParser implements BeanDefinitionParser {
 	private BeanMetadataElement getAccessTokenResponseClient(Element element) {
 		String accessTokenResponseClientRef = (element != null)
 				? element.getAttribute(ATT_ACCESS_TOKEN_RESPONSE_CLIENT_REF) : null;
-		if (StringUtils.hasLength(accessTokenResponseClientRef)) {
+		if (!StringUtils.isEmpty(accessTokenResponseClientRef)) {
 			return new RuntimeBeanReference(accessTokenResponseClientRef);
 		}
 		return BeanDefinitionBuilder

config/src/main/java/org/springframework/security/config/http/OAuth2ClientBeanDefinitionParserUtils.java

@@ -42,7 +42,7 @@ final class OAuth2ClientBeanDefinitionParserUtils {
 
 	static BeanMetadataElement getClientRegistrationRepository(Element element) {
 		String clientRegistrationRepositoryRef = element.getAttribute(ATT_CLIENT_REGISTRATION_REPOSITORY_REF);
-		if (StringUtils.hasLength(clientRegistrationRepositoryRef)) {
+		if (!StringUtils.isEmpty(clientRegistrationRepositoryRef)) {
 			return new RuntimeBeanReference(clientRegistrationRepositoryRef);
 		}
 		return new RuntimeBeanReference(ClientRegistrationRepository.class);
@@ -50,7 +50,7 @@ final class OAuth2ClientBeanDefinitionParserUtils {
 
 	static BeanMetadataElement getAuthorizedClientRepository(Element element) {
 		String authorizedClientRepositoryRef = element.getAttribute(ATT_AUTHORIZED_CLIENT_REPOSITORY_REF);
-		if (StringUtils.hasLength(authorizedClientRepositoryRef)) {
+		if (!StringUtils.isEmpty(authorizedClientRepositoryRef)) {
 			return new RuntimeBeanReference(authorizedClientRepositoryRef);
 		}
 		return null;
@@ -58,7 +58,7 @@ final class OAuth2ClientBeanDefinitionParserUtils {
 
 	static BeanMetadataElement getAuthorizedClientService(Element element) {
 		String authorizedClientServiceRef = element.getAttribute(ATT_AUTHORIZED_CLIENT_SERVICE_REF);
-		if (StringUtils.hasLength(authorizedClientServiceRef)) {
+		if (!StringUtils.isEmpty(authorizedClientServiceRef)) {
 			return new RuntimeBeanReference(authorizedClientServiceRef);
 		}
 		return null;

config/src/main/java/org/springframework/security/config/http/OAuth2LoginBeanDefinitionParser.java

@@ -176,7 +176,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 		}
 		Object source = parserContext.extractSource(element);
 		String loginProcessingUrl = element.getAttribute(ATT_LOGIN_PROCESSING_URL);
-		if (StringUtils.hasLength(loginProcessingUrl)) {
+		if (!StringUtils.isEmpty(loginProcessingUrl)) {
 			WebConfigUtils.validateHttpRedirect(loginProcessingUrl, parserContext, source);
 			oauth2LoginAuthenticationFilterBuilder.addConstructorArgValue(loginProcessingUrl);
 		}
@@ -189,7 +189,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 			.addConstructorArgValue(accessTokenResponseClient)
 			.addConstructorArgValue(oauth2UserService);
 		String userAuthoritiesMapperRef = element.getAttribute(ATT_USER_AUTHORITIES_MAPPER_REF);
-		if (StringUtils.hasLength(userAuthoritiesMapperRef)) {
+		if (!StringUtils.isEmpty(userAuthoritiesMapperRef)) {
 			oauth2LoginAuthenticationProviderBuilder.addPropertyReference("authoritiesMapper",
 					userAuthoritiesMapperRef);
 		}
@@ -199,7 +199,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 		BeanDefinitionBuilder oauth2AuthorizationRequestRedirectFilterBuilder = BeanDefinitionBuilder
 			.rootBeanDefinition(OAuth2AuthorizationRequestRedirectFilter.class);
 		String authorizationRequestResolverRef = element.getAttribute(ATT_AUTHORIZATION_REQUEST_RESOLVER_REF);
-		if (StringUtils.hasLength(authorizationRequestResolverRef)) {
+		if (!StringUtils.isEmpty(authorizationRequestResolverRef)) {
 			oauth2AuthorizationRequestRedirectFilterBuilder.addConstructorArgReference(authorizationRequestResolverRef);
 		}
 		else {
@@ -212,7 +212,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 		this.oauth2AuthorizationRequestRedirectFilter = oauth2AuthorizationRequestRedirectFilterBuilder
 			.getBeanDefinition();
 		String authenticationSuccessHandlerRef = element.getAttribute(ATT_AUTHENTICATION_SUCCESS_HANDLER_REF);
-		if (StringUtils.hasLength(authenticationSuccessHandlerRef)) {
+		if (!StringUtils.isEmpty(authenticationSuccessHandlerRef)) {
 			oauth2LoginAuthenticationFilterBuilder.addPropertyReference("authenticationSuccessHandler",
 					authenticationSuccessHandlerRef);
 		}
@@ -225,7 +225,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 					successHandlerBuilder.getBeanDefinition());
 		}
 		String loginPage = element.getAttribute(ATT_LOGIN_PAGE);
-		if (StringUtils.hasLength(loginPage)) {
+		if (!StringUtils.isEmpty(loginPage)) {
 			WebConfigUtils.validateHttpRedirect(loginPage, parserContext, source);
 			this.oauth2LoginAuthenticationEntryPoint = BeanDefinitionBuilder
 				.rootBeanDefinition(LoginUrlAuthenticationEntryPoint.class)
@@ -245,7 +245,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 			}
 		}
 		String authenticationFailureHandlerRef = element.getAttribute(ATT_AUTHENTICATION_FAILURE_HANDLER_REF);
-		if (StringUtils.hasLength(authenticationFailureHandlerRef)) {
+		if (!StringUtils.isEmpty(authenticationFailureHandlerRef)) {
 			oauth2LoginAuthenticationFilterBuilder.addPropertyReference("authenticationFailureHandler",
 					authenticationFailureHandlerRef);
 		}
@@ -269,7 +269,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 
 	private BeanMetadataElement getAuthorizationRequestRepository(Element element) {
 		String authorizationRequestRepositoryRef = element.getAttribute(ATT_AUTHORIZATION_REQUEST_REPOSITORY_REF);
-		if (StringUtils.hasLength(authorizationRequestRepositoryRef)) {
+		if (!StringUtils.isEmpty(authorizationRequestRepositoryRef)) {
 			return new RuntimeBeanReference(authorizationRequestRepositoryRef);
 		}
 		return BeanDefinitionBuilder
@@ -299,11 +299,11 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 				"org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeAuthenticationProvider")
 			.addConstructorArgValue(accessTokenResponseClient)
 			.addConstructorArgValue(oidcUserService);
-		if (StringUtils.hasLength(userAuthoritiesMapperRef)) {
+		if (!StringUtils.isEmpty(userAuthoritiesMapperRef)) {
 			oidcAuthProviderBuilder.addPropertyReference("authoritiesMapper", userAuthoritiesMapperRef);
 		}
 		String jwtDecoderFactoryRef = element.getAttribute(ATT_JWT_DECODER_FACTORY_REF);
-		if (StringUtils.hasLength(jwtDecoderFactoryRef)) {
+		if (!StringUtils.isEmpty(jwtDecoderFactoryRef)) {
 			oidcAuthProviderBuilder.addPropertyReference("jwtDecoderFactory", jwtDecoderFactoryRef);
 		}
 		return oidcAuthProviderBuilder.getBeanDefinition();
@@ -311,7 +311,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 
 	private BeanMetadataElement getOidcUserService(Element element) {
 		String oidcUserServiceRef = element.getAttribute(ATT_OIDC_USER_SERVICE_REF);
-		if (StringUtils.hasLength(oidcUserServiceRef)) {
+		if (!StringUtils.isEmpty(oidcUserServiceRef)) {
 			return new RuntimeBeanReference(oidcUserServiceRef);
 		}
 		return BeanDefinitionBuilder
@@ -321,7 +321,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 
 	private BeanMetadataElement getOAuth2UserService(Element element) {
 		String oauth2UserServiceRef = element.getAttribute(ATT_USER_SERVICE_REF);
-		if (StringUtils.hasLength(oauth2UserServiceRef)) {
+		if (!StringUtils.isEmpty(oauth2UserServiceRef)) {
 			return new RuntimeBeanReference(oauth2UserServiceRef);
 		}
 		return BeanDefinitionBuilder
@@ -331,7 +331,7 @@ final class OAuth2LoginBeanDefinitionParser implements BeanDefinitionParser {
 
 	private BeanMetadataElement getAccessTokenResponseClient(Element element) {
 		String accessTokenResponseClientRef = element.getAttribute(ATT_ACCESS_TOKEN_RESPONSE_CLIENT_REF);
-		if (StringUtils.hasLength(accessTokenResponseClientRef)) {
+		if (!StringUtils.isEmpty(accessTokenResponseClientRef)) {
 			return new RuntimeBeanReference(accessTokenResponseClientRef);
 		}
 		return BeanDefinitionBuilder

config/src/main/java/org/springframework/security/config/http/OAuth2ResourceServerBeanDefinitionParser.java

@@ -166,7 +166,7 @@ final class OAuth2ResourceServerBeanDefinitionParser implements BeanDefinitionPa
 
 	BeanMetadataElement getAuthenticationManagerResolver(Element element) {
 		String authenticationManagerResolverRef = element.getAttribute(AUTHENTICATION_MANAGER_RESOLVER_REF);
-		if (StringUtils.hasLength(authenticationManagerResolverRef)) {
+		if (!StringUtils.isEmpty(authenticationManagerResolverRef)) {
 			return new RuntimeBeanReference(authenticationManagerResolverRef);
 		}
 		BeanDefinitionBuilder authenticationManagerResolver = BeanDefinitionBuilder
@@ -177,7 +177,7 @@ final class OAuth2ResourceServerBeanDefinitionParser implements BeanDefinitionPa
 
 	BeanMetadataElement getBearerTokenResolver(Element element) {
 		String bearerTokenResolverRef = element.getAttribute(BEARER_TOKEN_RESOLVER_REF);
-		if (!StringUtils.hasLength(bearerTokenResolverRef)) {
+		if (StringUtils.isEmpty(bearerTokenResolverRef)) {
 			return new RootBeanDefinition(DefaultBearerTokenResolver.class);
 		}
 		return new RuntimeBeanReference(bearerTokenResolverRef);
@@ -185,7 +185,7 @@ final class OAuth2ResourceServerBeanDefinitionParser implements BeanDefinitionPa
 
 	BeanMetadataElement getEntryPoint(Element element) {
 		String entryPointRef = element.getAttribute(ENTRY_POINT_REF);
-		if (!StringUtils.hasLength(entryPointRef)) {
+		if (StringUtils.isEmpty(entryPointRef)) {
 			return this.authenticationEntryPoint;
 		}
 		return new RuntimeBeanReference(entryPointRef);
@@ -224,7 +224,7 @@ final class OAuth2ResourceServerBeanDefinitionParser implements BeanDefinitionPa
 
 		Object getDecoder(Element element) {
 			String decoderRef = element.getAttribute(DECODER_REF);
-			if (StringUtils.hasLength(decoderRef)) {
+			if (!StringUtils.isEmpty(decoderRef)) {
 				return new RuntimeBeanReference(decoderRef);
 			}
 			BeanDefinitionBuilder builder = BeanDefinitionBuilder
@@ -235,7 +235,7 @@ final class OAuth2ResourceServerBeanDefinitionParser implements BeanDefinitionPa
 
 		Object getJwtAuthenticationConverter(Element element) {
 			String jwtDecoderRef = element.getAttribute(JWT_AUTHENTICATION_CONVERTER_REF);
-			return (StringUtils.hasLength(jwtDecoderRef)) ? new RuntimeBeanReference(jwtDecoderRef)
+			return (!StringUtils.isEmpty(jwtDecoderRef)) ? new RuntimeBeanReference(jwtDecoderRef)
 					: new JwtAuthenticationConverter();
 		}
 
@@ -293,7 +293,7 @@ final class OAuth2ResourceServerBeanDefinitionParser implements BeanDefinitionPa
 
 		BeanMetadataElement getIntrospector(Element element) {
 			String introspectorRef = element.getAttribute(INTROSPECTOR_REF);
-			if (StringUtils.hasLength(introspectorRef)) {
+			if (!StringUtils.isEmpty(introspectorRef)) {
 				return new RuntimeBeanReference(introspectorRef);
 			}
 			String introspectionUri = element.getAttribute(INTROSPECTION_URI);

config/src/main/java/org/springframework/security/config/http/Saml2LogoutBeanDefinitionParser.java

@@ -147,7 +147,6 @@ final class Saml2LogoutBeanDefinitionParser implements BeanDefinitionParser {
 		BeanMetadataElement saml2LogoutRequestSuccessHandler = BeanDefinitionBuilder
 			.rootBeanDefinition(Saml2RelyingPartyInitiatedLogoutSuccessHandler.class)
 			.addConstructorArgValue(logoutRequestResolver)
-			.addPropertyValue("logoutRequestRepository", logoutRequestRepository)
 			.getBeanDefinition();
 		this.logoutFilter = BeanDefinitionBuilder.rootBeanDefinition(LogoutFilter.class)
 			.addConstructorArgValue(saml2LogoutRequestSuccessHandler)

config/src/main/java/org/springframework/security/config/oauth2/client/ClientRegistrationsBeanDefinitionParser.java

@@ -174,7 +174,7 @@ public final class ClientRegistrationsBeanDefinitionParser implements BeanDefini
 		if (providers.containsKey(providerId)) {
 			Map<String, String> provider = providers.get(providerId);
 			String issuer = provider.get(ATT_ISSUER_URI);
-			if (StringUtils.hasLength(issuer)) {
+			if (!StringUtils.isEmpty(issuer)) {
 				ClientRegistration.Builder builder = ClientRegistrations.fromIssuerLocation(issuer)
 					.registrationId(registrationId);
 				return getBuilder(parserContext, builder, provider);

config/src/main/java/org/springframework/security/config/web/server/DefaultOidcLogoutTokenValidatorFactory.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import java.util.function.Function;
-
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.jwt.JwtTimestampValidator;
-
-final class DefaultOidcLogoutTokenValidatorFactory implements Function<ClientRegistration, OAuth2TokenValidator<Jwt>> {
-
-	@Override
-	public OAuth2TokenValidator<Jwt> apply(ClientRegistration clientRegistration) {
-		return new DelegatingOAuth2TokenValidator<>(new JwtTimestampValidator(),
-				new OidcBackChannelLogoutTokenValidator(clientRegistration));
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/HttpMessageConverters.java

@@ -1,65 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import org.springframework.http.converter.GenericHttpMessageConverter;
-import org.springframework.http.converter.HttpMessageConverter;
-import org.springframework.http.converter.json.GsonHttpMessageConverter;
-import org.springframework.http.converter.json.JsonbHttpMessageConverter;
-import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
-import org.springframework.util.ClassUtils;
-
-/**
- * Utility methods for {@link HttpMessageConverter}'s.
- *
- * @author Joe Grandja
- * @author luamas
- * @since 5.1
- */
-final class HttpMessageConverters {
-
-	private static final boolean jackson2Present;
-
-	private static final boolean gsonPresent;
-
-	private static final boolean jsonbPresent;
-
-	static {
-		ClassLoader classLoader = HttpMessageConverters.class.getClassLoader();
-		jackson2Present = ClassUtils.isPresent("com.fasterxml.jackson.databind.ObjectMapper", classLoader)
-				&& ClassUtils.isPresent("com.fasterxml.jackson.core.JsonGenerator", classLoader);
-		gsonPresent = ClassUtils.isPresent("com.google.gson.Gson", classLoader);
-		jsonbPresent = ClassUtils.isPresent("jakarta.json.bind.Jsonb", classLoader);
-	}
-
-	private HttpMessageConverters() {
-	}
-
-	static GenericHttpMessageConverter<Object> getJsonMessageConverter() {
-		if (jackson2Present) {
-			return new MappingJackson2HttpMessageConverter();
-		}
-		if (gsonPresent) {
-			return new GsonHttpMessageConverter();
-		}
-		if (jsonbPresent) {
-			return new JsonbHttpMessageConverter();
-		}
-		return null;
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OAuth2ErrorEncoder.java

@@ -1,95 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.util.List;
-import java.util.Map;
-
-import org.jetbrains.annotations.NotNull;
-import org.reactivestreams.Publisher;
-import reactor.core.publisher.Flux;
-import reactor.core.publisher.Mono;
-
-import org.springframework.core.ResolvableType;
-import org.springframework.core.io.buffer.DataBuffer;
-import org.springframework.core.io.buffer.DataBufferFactory;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpOutputMessage;
-import org.springframework.http.MediaType;
-import org.springframework.http.codec.HttpMessageEncoder;
-import org.springframework.http.converter.HttpMessageConverter;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.util.MimeType;
-
-class OAuth2ErrorEncoder implements HttpMessageEncoder<OAuth2Error> {
-
-	private final HttpMessageConverter<Object> messageConverter = HttpMessageConverters.getJsonMessageConverter();
-
-	@NotNull
-	@Override
-	public List<MediaType> getStreamingMediaTypes() {
-		return List.of();
-	}
-
-	@Override
-	public boolean canEncode(ResolvableType elementType, MimeType mimeType) {
-		return getEncodableMimeTypes().contains(mimeType);
-	}
-
-	@NotNull
-	@Override
-	public Flux<DataBuffer> encode(Publisher<? extends OAuth2Error> error, DataBufferFactory bufferFactory,
-			ResolvableType elementType, MimeType mimeType, Map<String, Object> hints) {
-		return Mono.from(error).flatMap((data) -> {
-			ByteArrayHttpOutputMessage bytes = new ByteArrayHttpOutputMessage();
-			try {
-				this.messageConverter.write(data, MediaType.APPLICATION_JSON, bytes);
-				return Mono.just(bytes.getBody().toByteArray());
-			}
-			catch (IOException ex) {
-				return Mono.error(ex);
-			}
-		}).map(bufferFactory::wrap).flux();
-	}
-
-	@NotNull
-	@Override
-	public List<MimeType> getEncodableMimeTypes() {
-		return List.of(MediaType.APPLICATION_JSON);
-	}
-
-	private static class ByteArrayHttpOutputMessage implements HttpOutputMessage {
-
-		private final ByteArrayOutputStream body = new ByteArrayOutputStream();
-
-		@NotNull
-		@Override
-		public ByteArrayOutputStream getBody() {
-			return this.body;
-		}
-
-		@NotNull
-		@Override
-		public HttpHeaders getHeaders() {
-			return new HttpHeaders();
-		}
-
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OidcBackChannelLogoutAuthentication.java

@@ -1,66 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import java.util.Collections;
-
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-
-/**
- * An {@link org.springframework.security.core.Authentication} implementation that
- * represents the result of authenticating an OIDC Logout token for the purposes of
- * performing Back-Channel Logout.
- *
- * @author Josh Cummings
- * @since 6.2
- * @see OidcLogoutAuthenticationToken
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel
- * Logout</a>
- */
-class OidcBackChannelLogoutAuthentication extends AbstractAuthenticationToken {
-
-	private final OidcLogoutToken logoutToken;
-
-	/**
-	 * Construct an {@link OidcBackChannelLogoutAuthentication}
-	 * @param logoutToken a deserialized, verified OIDC Logout Token
-	 */
-	OidcBackChannelLogoutAuthentication(OidcLogoutToken logoutToken) {
-		super(Collections.emptyList());
-		this.logoutToken = logoutToken;
-		setAuthenticated(true);
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public OidcLogoutToken getPrincipal() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public OidcLogoutToken getCredentials() {
-		return this.logoutToken;
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OidcBackChannelLogoutReactiveAuthenticationManager.java

@@ -1,108 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import reactor.core.publisher.Mono;
-
-import org.springframework.security.authentication.AuthenticationProvider;
-import org.springframework.security.authentication.AuthenticationServiceException;
-import org.springframework.security.authentication.ReactiveAuthenticationManager;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.oauth2.client.oidc.authentication.ReactiveOidcIdTokenDecoderFactory;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.oauth2.jwt.BadJwtException;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.jwt.JwtDecoder;
-import org.springframework.security.oauth2.jwt.JwtDecoderFactory;
-import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
-import org.springframework.security.oauth2.jwt.ReactiveJwtDecoderFactory;
-import org.springframework.util.Assert;
-
-/**
- * An {@link AuthenticationProvider} that authenticates an OIDC Logout Token; namely
- * deserializing it, verifying its signature, and validating its claims.
- *
- * <p>
- * Intended to be included in a
- * {@link org.springframework.security.authentication.ProviderManager}
- *
- * @author Josh Cummings
- * @since 6.2
- * @see OidcLogoutAuthenticationToken
- * @see org.springframework.security.authentication.ProviderManager
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel
- * Logout</a>
- */
-final class OidcBackChannelLogoutReactiveAuthenticationManager implements ReactiveAuthenticationManager {
-
-	private ReactiveJwtDecoderFactory<ClientRegistration> logoutTokenDecoderFactory;
-
-	/**
-	 * Construct an {@link OidcBackChannelLogoutReactiveAuthenticationManager}
-	 */
-	OidcBackChannelLogoutReactiveAuthenticationManager() {
-		ReactiveOidcIdTokenDecoderFactory logoutTokenDecoderFactory = new ReactiveOidcIdTokenDecoderFactory();
-		logoutTokenDecoderFactory.setJwtValidatorFactory(new DefaultOidcLogoutTokenValidatorFactory());
-		this.logoutTokenDecoderFactory = logoutTokenDecoderFactory;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public Mono<Authentication> authenticate(Authentication authentication) throws AuthenticationException {
-		if (!(authentication instanceof OidcLogoutAuthenticationToken token)) {
-			return Mono.empty();
-		}
-		String logoutToken = token.getLogoutToken();
-		ClientRegistration registration = token.getClientRegistration();
-		return decode(registration, logoutToken)
-			.map((jwt) -> OidcLogoutToken.withTokenValue(logoutToken)
-				.claims((claims) -> claims.putAll(jwt.getClaims()))
-				.build())
-			.map(OidcBackChannelLogoutAuthentication::new);
-	}
-
-	private Mono<Jwt> decode(ClientRegistration registration, String token) {
-		ReactiveJwtDecoder logoutTokenDecoder = this.logoutTokenDecoderFactory.createDecoder(registration);
-		return logoutTokenDecoder.decode(token).onErrorResume(Exception.class, (ex) -> {
-			if (ex instanceof BadJwtException) {
-				OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST, ex.getMessage(),
-						"https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation");
-				return Mono.error(new OAuth2AuthenticationException(error, ex));
-			}
-			return Mono.error(new AuthenticationServiceException(ex.getMessage(), ex));
-		});
-	}
-
-	/**
-	 * Use this {@link ReactiveJwtDecoderFactory} to generate {@link JwtDecoder}s that
-	 * correspond to the {@link ClientRegistration} associated with the OIDC logout token.
-	 * @param logoutTokenDecoderFactory the {@link JwtDecoderFactory} to use
-	 */
-	void setLogoutTokenDecoderFactory(ReactiveJwtDecoderFactory<ClientRegistration> logoutTokenDecoderFactory) {
-		Assert.notNull(logoutTokenDecoderFactory, "logoutTokenDecoderFactory cannot be null");
-		this.logoutTokenDecoderFactory = logoutTokenDecoderFactory;
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OidcBackChannelLogoutTokenValidator.java

@@ -1,121 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.security.oauth2.client.oidc.authentication.logout.LogoutTokenClaimAccessor;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.util.Assert;
-
-/**
- * A {@link OAuth2TokenValidator} that validates OIDC Logout Token claims in conformance
- * with the OIDC Back-Channel Logout Spec.
- *
- * @author Josh Cummings
- * @since 6.2
- * @see OidcLogoutToken
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken">Logout
- * Token</a>
- * @see <a target="blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation">the OIDC
- * Back-Channel Logout spec</a>
- */
-final class OidcBackChannelLogoutTokenValidator implements OAuth2TokenValidator<Jwt> {
-
-	private static final String LOGOUT_VALIDATION_URL = "https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation";
-
-	private static final String BACK_CHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
-
-	private final String audience;
-
-	private final String issuer;
-
-	OidcBackChannelLogoutTokenValidator(ClientRegistration clientRegistration) {
-		this.audience = clientRegistration.getClientId();
-		String issuer = clientRegistration.getProviderDetails().getIssuerUri();
-		Assert.hasText(issuer, "Provider issuer cannot be null");
-		this.issuer = issuer;
-	}
-
-	@Override
-	public OAuth2TokenValidatorResult validate(Jwt jwt) {
-		Collection<OAuth2Error> errors = new ArrayList<>();
-
-		LogoutTokenClaimAccessor logoutClaims = jwt::getClaims;
-		Map<String, Object> events = logoutClaims.getEvents();
-		if (events == null) {
-			errors.add(invalidLogoutToken("events claim must not be null"));
-		}
-		else if (events.get(BACK_CHANNEL_LOGOUT_EVENT) == null) {
-			errors.add(invalidLogoutToken("events claim map must contain \"" + BACK_CHANNEL_LOGOUT_EVENT + "\" key"));
-		}
-
-		String issuer = logoutClaims.getIssuer().toExternalForm();
-		if (issuer == null) {
-			errors.add(invalidLogoutToken("iss claim must not be null"));
-		}
-		else if (!this.issuer.equals(issuer)) {
-			errors.add(invalidLogoutToken(
-					"iss claim value must match `ClientRegistration#getProviderDetails#getIssuerUri`"));
-		}
-
-		List<String> audience = logoutClaims.getAudience();
-		if (audience == null) {
-			errors.add(invalidLogoutToken("aud claim must not be null"));
-		}
-		else if (!audience.contains(this.audience)) {
-			errors.add(invalidLogoutToken("aud claim value must include `ClientRegistration#getClientId`"));
-		}
-
-		Instant issuedAt = logoutClaims.getIssuedAt();
-		if (issuedAt == null) {
-			errors.add(invalidLogoutToken("iat claim must not be null"));
-		}
-
-		String jwtId = logoutClaims.getId();
-		if (jwtId == null) {
-			errors.add(invalidLogoutToken("jti claim must not be null"));
-		}
-
-		if (logoutClaims.getSubject() == null && logoutClaims.getSessionId() == null) {
-			errors.add(invalidLogoutToken("sub and sid claims must not both be null"));
-		}
-
-		if (logoutClaims.getClaim("nonce") != null) {
-			errors.add(invalidLogoutToken("nonce claim must not be present"));
-		}
-
-		return OAuth2TokenValidatorResult.failure(errors);
-	}
-
-	private static OAuth2Error invalidLogoutToken(String description) {
-		return new OAuth2Error(OAuth2ErrorCodes.INVALID_TOKEN, description, LOGOUT_VALIDATION_URL);
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OidcBackChannelLogoutWebFilter.java

@@ -1,134 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import java.util.Collections;
-
-import jakarta.servlet.http.HttpServletResponse;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import reactor.core.publisher.Mono;
-
-import org.springframework.core.ResolvableType;
-import org.springframework.http.MediaType;
-import org.springframework.http.codec.EncoderHttpMessageWriter;
-import org.springframework.http.codec.HttpMessageWriter;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.AuthenticationServiceException;
-import org.springframework.security.authentication.ReactiveAuthenticationManager;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.web.authentication.AuthenticationConverter;
-import org.springframework.security.web.authentication.logout.LogoutHandler;
-import org.springframework.security.web.server.WebFilterExchange;
-import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
-import org.springframework.security.web.server.authentication.logout.ServerLogoutHandler;
-import org.springframework.util.Assert;
-import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.WebFilter;
-import org.springframework.web.server.WebFilterChain;
-
-/**
- * A filter for the Client-side OIDC Back-Channel Logout endpoint
- *
- * @author Josh Cummings
- * @since 6.2
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel Logout
- * Spec</a>
- */
-class OidcBackChannelLogoutWebFilter implements WebFilter {
-
-	private final Log logger = LogFactory.getLog(getClass());
-
-	private final ServerAuthenticationConverter authenticationConverter;
-
-	private final ReactiveAuthenticationManager authenticationManager;
-
-	private ServerLogoutHandler logoutHandler = new OidcBackChannelServerLogoutHandler();
-
-	private final HttpMessageWriter<OAuth2Error> errorHttpMessageConverter = new EncoderHttpMessageWriter<>(
-			new OAuth2ErrorEncoder());
-
-	/**
-	 * Construct an {@link OidcBackChannelLogoutWebFilter}
-	 * @param authenticationConverter the {@link AuthenticationConverter} for deriving
-	 * Logout Token authentication
-	 * @param authenticationManager the {@link AuthenticationManager} for authenticating
-	 * Logout Tokens
-	 */
-	OidcBackChannelLogoutWebFilter(ServerAuthenticationConverter authenticationConverter,
-			ReactiveAuthenticationManager authenticationManager) {
-		Assert.notNull(authenticationConverter, "authenticationConverter cannot be null");
-		Assert.notNull(authenticationManager, "authenticationManager cannot be null");
-		this.authenticationConverter = authenticationConverter;
-		this.authenticationManager = authenticationManager;
-	}
-
-	@Override
-	public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
-		return this.authenticationConverter.convert(exchange).onErrorResume(AuthenticationException.class, (ex) -> {
-			this.logger.debug("Failed to process OIDC Back-Channel Logout", ex);
-			if (ex instanceof AuthenticationServiceException) {
-				return Mono.error(ex);
-			}
-			return handleAuthenticationFailure(exchange, ex).then(Mono.empty());
-		})
-			.switchIfEmpty(chain.filter(exchange).then(Mono.empty()))
-			.flatMap(this.authenticationManager::authenticate)
-			.onErrorResume(AuthenticationException.class, (ex) -> {
-				this.logger.debug("Failed to process OIDC Back-Channel Logout", ex);
-				if (ex instanceof AuthenticationServiceException) {
-					return Mono.error(ex);
-				}
-				return handleAuthenticationFailure(exchange, ex).then(Mono.empty());
-			})
-			.flatMap((authentication) -> {
-				WebFilterExchange webFilterExchange = new WebFilterExchange(exchange, chain);
-				return this.logoutHandler.logout(webFilterExchange, authentication);
-			});
-	}
-
-	private Mono<Void> handleAuthenticationFailure(ServerWebExchange exchange, Exception ex) {
-		this.logger.debug("Failed to process OIDC Back-Channel Logout", ex);
-		exchange.getResponse().setRawStatusCode(HttpServletResponse.SC_BAD_REQUEST);
-		return this.errorHttpMessageConverter.write(Mono.just(oauth2Error(ex)), ResolvableType.forClass(Object.class),
-				ResolvableType.forClass(Object.class), MediaType.APPLICATION_JSON, exchange.getRequest(),
-				exchange.getResponse(), Collections.emptyMap());
-	}
-
-	private OAuth2Error oauth2Error(Exception ex) {
-		if (ex instanceof OAuth2AuthenticationException oauth2) {
-			return oauth2.getError();
-		}
-		return new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST, ex.getMessage(),
-				"https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation");
-	}
-
-	/**
-	 * The strategy for expiring all Client sessions indicated by the logout request.
-	 * Defaults to {@link OidcBackChannelServerLogoutHandler}.
-	 * @param logoutHandler the {@link LogoutHandler} to use
-	 */
-	void setLogoutHandler(ServerLogoutHandler logoutHandler) {
-		Assert.notNull(logoutHandler, "logoutHandler cannot be null");
-		this.logoutHandler = logoutHandler;
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OidcBackChannelServerLogoutHandler.java

@@ -1,207 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.concurrent.atomic.AtomicInteger;
-
-import jakarta.servlet.http.HttpServletResponse;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import reactor.core.publisher.Mono;
-
-import org.springframework.core.ResolvableType;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.http.codec.EncoderHttpMessageWriter;
-import org.springframework.http.codec.HttpMessageWriter;
-import org.springframework.http.server.reactive.ServerHttpRequest;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
-import org.springframework.security.oauth2.client.oidc.server.session.InMemoryReactiveOidcSessionRegistry;
-import org.springframework.security.oauth2.client.oidc.server.session.ReactiveOidcSessionRegistry;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionInformation;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.web.server.WebFilterExchange;
-import org.springframework.security.web.server.authentication.logout.ServerLogoutHandler;
-import org.springframework.util.Assert;
-import org.springframework.web.reactive.function.client.WebClient;
-import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.util.UriComponents;
-import org.springframework.web.util.UriComponentsBuilder;
-
-/**
- * A {@link ServerLogoutHandler} that locates the sessions associated with a given OIDC
- * Back-Channel Logout Token and invalidates each one.
- *
- * @author Josh Cummings
- * @since 6.2
- * @see <a target="_blank" href=
- * "https://openid.net/specs/openid-connect-backchannel-1_0.html">OIDC Back-Channel Logout
- * Spec</a>
- */
-final class OidcBackChannelServerLogoutHandler implements ServerLogoutHandler {
-
-	private final Log logger = LogFactory.getLog(getClass());
-
-	private ReactiveOidcSessionRegistry sessionRegistry = new InMemoryReactiveOidcSessionRegistry();
-
-	private final HttpMessageWriter<OAuth2Error> errorHttpMessageConverter = new EncoderHttpMessageWriter<>(
-			new OAuth2ErrorEncoder());
-
-	private WebClient web = WebClient.create();
-
-	private String logoutUri = "{baseScheme}://localhost{basePort}/logout";
-
-	private String sessionCookieName = "SESSION";
-
-	@Override
-	public Mono<Void> logout(WebFilterExchange exchange, Authentication authentication) {
-		if (!(authentication instanceof OidcBackChannelLogoutAuthentication token)) {
-			return Mono.defer(() -> {
-				if (this.logger.isDebugEnabled()) {
-					String message = "Did not perform OIDC Back-Channel Logout since authentication [%s] was of the wrong type";
-					this.logger.debug(String.format(message, authentication.getClass().getSimpleName()));
-				}
-				return Mono.empty();
-			});
-		}
-		AtomicInteger totalCount = new AtomicInteger(0);
-		AtomicInteger invalidatedCount = new AtomicInteger(0);
-		return this.sessionRegistry.removeSessionInformation(token.getPrincipal()).concatMap((session) -> {
-			totalCount.incrementAndGet();
-			return eachLogout(exchange, session).flatMap((response) -> {
-				invalidatedCount.incrementAndGet();
-				return Mono.empty();
-			}).onErrorResume((ex) -> {
-				this.logger.debug("Failed to invalidate session", ex);
-				return this.sessionRegistry.saveSessionInformation(session).then(Mono.just(ex.getMessage()));
-			});
-		}).collectList().flatMap((list) -> {
-			if (this.logger.isTraceEnabled()) {
-				this.logger.trace(String.format("Invalidated %d out of %d sessions", invalidatedCount.intValue(),
-						totalCount.intValue()));
-			}
-			if (!list.isEmpty()) {
-				return handleLogoutFailure(exchange.getExchange(), oauth2Error(list));
-			}
-			else {
-				return Mono.empty();
-			}
-		});
-	}
-
-	private Mono<ResponseEntity<Void>> eachLogout(WebFilterExchange exchange, OidcSessionInformation session) {
-		HttpHeaders headers = new HttpHeaders();
-		headers.add(HttpHeaders.COOKIE, this.sessionCookieName + "=" + session.getSessionId());
-		for (Map.Entry<String, String> credential : session.getAuthorities().entrySet()) {
-			headers.add(credential.getKey(), credential.getValue());
-		}
-		String logout = computeLogoutEndpoint(exchange.getExchange().getRequest());
-		return this.web.post().uri(logout).headers((h) -> h.putAll(headers)).retrieve().toBodilessEntity();
-	}
-
-	String computeLogoutEndpoint(ServerHttpRequest request) {
-		// @formatter:off
-		UriComponents uriComponents = UriComponentsBuilder.fromUri(request.getURI())
-				.replacePath(request.getPath().contextPath().value())
-				.replaceQuery(null)
-				.fragment(null)
-				.build();
-
-		Map<String, String> uriVariables = new HashMap<>();
-		String scheme = uriComponents.getScheme();
-		uriVariables.put("baseScheme", (scheme != null) ? scheme : "");
-		uriVariables.put("baseUrl", uriComponents.toUriString());
-
-		String host = uriComponents.getHost();
-		uriVariables.put("baseHost", (host != null) ? host : "");
-
-		String path = uriComponents.getPath();
-		uriVariables.put("basePath", (path != null) ? path : "");
-
-		int port = uriComponents.getPort();
-		uriVariables.put("basePort", (port == -1) ? "" : ":" + port);
-
-		return UriComponentsBuilder.fromUriString(this.logoutUri)
-				.buildAndExpand(uriVariables)
-				.toUriString();
-		// @formatter:on
-	}
-
-	private OAuth2Error oauth2Error(Collection<?> errors) {
-		return new OAuth2Error("partial_logout", "not all sessions were terminated: " + errors,
-				"https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation");
-	}
-
-	private Mono<Void> handleLogoutFailure(ServerWebExchange exchange, OAuth2Error error) {
-		exchange.getResponse().setRawStatusCode(HttpServletResponse.SC_BAD_REQUEST);
-		return this.errorHttpMessageConverter.write(Mono.just(error), ResolvableType.forClass(Object.class),
-				ResolvableType.forClass(Object.class), MediaType.APPLICATION_JSON, exchange.getRequest(),
-				exchange.getResponse(), Collections.emptyMap());
-	}
-
-	/**
-	 * Use this {@link OidcSessionRegistry} to identify sessions to invalidate. Note that
-	 * this class uses
-	 * {@link OidcSessionRegistry#removeSessionInformation(OidcLogoutToken)} to identify
-	 * sessions.
-	 * @param sessionRegistry the {@link OidcSessionRegistry} to use
-	 */
-	void setSessionRegistry(ReactiveOidcSessionRegistry sessionRegistry) {
-		Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
-		this.sessionRegistry = sessionRegistry;
-	}
-
-	/**
-	 * Use this {@link WebClient} to perform the per-session back-channel logout
-	 * @param web the {@link WebClient} to use
-	 */
-	void setWebClient(WebClient web) {
-		Assert.notNull(web, "web cannot be null");
-		this.web = web;
-	}
-
-	/**
-	 * Use this logout URI for performing per-session logout. Defaults to {@code /logout}
-	 * since that is the default URI for
-	 * {@link org.springframework.security.web.authentication.logout.LogoutFilter}.
-	 * @param logoutUri the URI to use
-	 */
-	void setLogoutUri(String logoutUri) {
-		Assert.hasText(logoutUri, "logoutUri cannot be empty");
-		this.logoutUri = logoutUri;
-	}
-
-	/**
-	 * Use this cookie name for the session identifier. Defaults to {@code JSESSIONID}.
-	 *
-	 * <p>
-	 * Note that if you are using Spring Session, this likely needs to change to SESSION.
-	 * @param sessionCookieName the cookie name to use
-	 */
-	void setSessionCookieName(String sessionCookieName) {
-		Assert.hasText(sessionCookieName, "clientSessionCookieName cannot be empty");
-		this.sessionCookieName = sessionCookieName;
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OidcLogoutAuthenticationToken.java

@@ -1,80 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-
-/**
- * An {@link org.springframework.security.core.Authentication} instance that represents a
- * request to authenticate an OIDC Logout Token.
- *
- * @author Josh Cummings
- * @since 6.2
- */
-class OidcLogoutAuthenticationToken extends AbstractAuthenticationToken {
-
-	private final String logoutToken;
-
-	private final ClientRegistration clientRegistration;
-
-	/**
-	 * Construct an {@link OidcLogoutAuthenticationToken}
-	 * @param logoutToken a signed, serialized OIDC Logout token
-	 * @param clientRegistration the {@link ClientRegistration client} associated with
-	 * this token; this is usually derived from material in the logout HTTP request
-	 */
-	OidcLogoutAuthenticationToken(String logoutToken, ClientRegistration clientRegistration) {
-		super(AuthorityUtils.NO_AUTHORITIES);
-		this.logoutToken = logoutToken;
-		this.clientRegistration = clientRegistration;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public String getCredentials() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	@Override
-	public String getPrincipal() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * Get the signed, serialized OIDC Logout token
-	 * @return the logout token
-	 */
-	String getLogoutToken() {
-		return this.logoutToken;
-	}
-
-	/**
-	 * Get the {@link ClientRegistration} associated with this logout token
-	 * @return the {@link ClientRegistration}
-	 */
-	ClientRegistration getClientRegistration() {
-		return this.clientRegistration;
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/OidcLogoutServerAuthenticationConverter.java

@@ -1,90 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import reactor.core.publisher.Mono;
-
-import org.springframework.http.HttpMethod;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
-import org.springframework.security.web.authentication.AuthenticationConverter;
-import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
-import org.springframework.security.web.server.util.matcher.PathPatternParserServerWebExchangeMatcher;
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
-import org.springframework.util.Assert;
-import org.springframework.web.server.ServerWebExchange;
-
-/**
- * An {@link AuthenticationConverter} that extracts the OIDC Logout Token authentication
- * request
- *
- * @author Josh Cummings
- * @since 6.2
- */
-final class OidcLogoutServerAuthenticationConverter implements ServerAuthenticationConverter {
-
-	private static final String DEFAULT_LOGOUT_URI = "/logout/connect/back-channel/{registrationId}";
-
-	private final Log logger = LogFactory.getLog(getClass());
-
-	private final ReactiveClientRegistrationRepository clientRegistrationRepository;
-
-	private ServerWebExchangeMatcher exchangeMatcher = new PathPatternParserServerWebExchangeMatcher(DEFAULT_LOGOUT_URI,
-			HttpMethod.POST);
-
-	OidcLogoutServerAuthenticationConverter(ReactiveClientRegistrationRepository clientRegistrationRepository) {
-		Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
-		this.clientRegistrationRepository = clientRegistrationRepository;
-	}
-
-	@Override
-	public Mono<Authentication> convert(ServerWebExchange exchange) {
-		return this.exchangeMatcher.matches(exchange)
-			.filter(ServerWebExchangeMatcher.MatchResult::isMatch)
-			.flatMap((match) -> {
-				String registrationId = (String) match.getVariables().get("registrationId");
-				return this.clientRegistrationRepository.findByRegistrationId(registrationId)
-					.switchIfEmpty(Mono.error(() -> {
-						this.logger
-							.debug("Did not process OIDC Back-Channel Logout since no ClientRegistration was found");
-						return new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
-					}));
-			})
-			.flatMap((clientRegistration) -> exchange.getFormData().map((data) -> {
-				String logoutToken = data.getFirst("logout_token");
-				return new OidcLogoutAuthenticationToken(logoutToken, clientRegistration);
-			}).switchIfEmpty(Mono.error(() -> {
-				this.logger.debug("Failed to process OIDC Back-Channel Logout since no logout token was found");
-				return new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
-			})));
-	}
-
-	/**
-	 * The logout endpoint. Defaults to
-	 * {@code /logout/connect/back-channel/{registrationId}}.
-	 * @param exchangeMatcher the {@link ServerWebExchangeMatcher} to use
-	 */
-	void setExchangeMatcher(ServerWebExchangeMatcher exchangeMatcher) {
-		Assert.notNull(exchangeMatcher, "exchangeMatcher cannot be null");
-		this.exchangeMatcher = exchangeMatcher;
-	}
-
-}

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,7 +21,6 @@ import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.security.interfaces.RSAPublicKey;
 import java.time.Duration;
-import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -29,13 +28,10 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
-import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.function.Supplier;
 
 import io.micrometer.observation.ObservationRegistry;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 import reactor.core.publisher.Mono;
 import reactor.util.context.Context;
 
@@ -58,7 +54,6 @@ import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.authorization.ObservationReactiveAuthorizationManager;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;
 import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;
@@ -72,9 +67,6 @@ import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCo
 import org.springframework.security.oauth2.client.endpoint.ReactiveOAuth2AccessTokenResponseClient;
 import org.springframework.security.oauth2.client.endpoint.WebClientReactiveAuthorizationCodeTokenResponseClient;
 import org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeReactiveAuthenticationManager;
-import org.springframework.security.oauth2.client.oidc.server.session.InMemoryReactiveOidcSessionRegistry;
-import org.springframework.security.oauth2.client.oidc.server.session.ReactiveOidcSessionRegistry;
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionInformation;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcReactiveOAuth2UserService;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
 import org.springframework.security.oauth2.client.registration.ClientRegistration;
@@ -111,7 +103,6 @@ import org.springframework.security.oauth2.server.resource.web.access.server.Bea
 import org.springframework.security.oauth2.server.resource.web.server.BearerTokenServerAuthenticationEntryPoint;
 import org.springframework.security.oauth2.server.resource.web.server.authentication.ServerBearerTokenAuthenticationConverter;
 import org.springframework.security.web.PortMapper;
-import org.springframework.security.web.authentication.logout.LogoutHandler;
 import org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor;
 import org.springframework.security.web.authentication.preauth.x509.X509PrincipalExtractor;
 import org.springframework.security.web.server.DefaultServerRedirectStrategy;
@@ -122,7 +113,6 @@ import org.springframework.security.web.server.MatcherSecurityWebFilterChain;
 import org.springframework.security.web.server.SecurityWebFilterChain;
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
 import org.springframework.security.web.server.ServerRedirectStrategy;
-import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.security.web.server.authentication.AnonymousAuthenticationWebFilter;
 import org.springframework.security.web.server.authentication.AuthenticationConverterServerWebExchangeMatcher;
 import org.springframework.security.web.server.authentication.AuthenticationWebFilter;
@@ -157,7 +147,6 @@ import org.springframework.security.web.server.context.SecurityContextServerWebE
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
 import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
 import org.springframework.security.web.server.csrf.CsrfServerLogoutHandler;
-import org.springframework.security.web.server.csrf.CsrfToken;
 import org.springframework.security.web.server.csrf.CsrfWebFilter;
 import org.springframework.security.web.server.csrf.ServerCsrfTokenRepository;
 import org.springframework.security.web.server.csrf.ServerCsrfTokenRequestHandler;
@@ -204,10 +193,8 @@ import org.springframework.web.cors.reactive.CorsWebFilter;
 import org.springframework.web.cors.reactive.DefaultCorsProcessor;
 import org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerMapping;
 import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.ServerWebExchangeDecorator;
 import org.springframework.web.server.WebFilter;
 import org.springframework.web.server.WebFilterChain;
-import org.springframework.web.server.WebSession;
 import org.springframework.web.util.pattern.PathPatternParser;
 
 /**
@@ -308,8 +295,6 @@ public class ServerHttpSecurity {
 
 	private OAuth2ClientSpec client;
 
-	private OidcLogoutSpec oidcLogout;
-
 	private LogoutSpec logout = new LogoutSpec();
 
 	private LoginPageSpec loginPage = new LoginPageSpec();
@@ -1108,33 +1093,6 @@ public class ServerHttpSecurity {
 		return this;
 	}
 
-	/**
-	 * Configures OIDC Connect 1.0 Logout support.
-	 *
-	 * <pre class="code">
-	 *  &#064;Bean
-	 *  public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
-	 *      http
-	 *          // ...
-	 *          .oidcLogout((logout) -&gt; logout
-	 *              .backChannel(Customizer.withDefaults())
-	 *          );
-	 *      return http.build();
-	 *  }
-	 * </pre>
-	 * @param oidcLogoutCustomizer the {@link Customizer} to provide more options for the
-	 * {@link OidcLogoutSpec}
-	 * @return the {@link ServerHttpSecurity} to customize
-	 * @since 6.2
-	 */
-	public ServerHttpSecurity oidcLogout(Customizer<OidcLogoutSpec> oidcLogoutCustomizer) {
-		if (this.oidcLogout == null) {
-			this.oidcLogout = new OidcLogoutSpec();
-		}
-		oidcLogoutCustomizer.customize(this.oidcLogout);
-		return this;
-	}
-
 	/**
 	 * Configures HTTP Response Headers. The default headers are:
 	 *
@@ -1579,9 +1537,6 @@ public class ServerHttpSecurity {
 		if (this.resourceServer != null) {
 			this.resourceServer.configure(this);
 		}
-		if (this.oidcLogout != null) {
-			this.oidcLogout.configure(this);
-		}
 		if (this.client != null) {
 			this.client.configure(this);
 		}
@@ -3735,8 +3690,6 @@ public class ServerHttpSecurity {
 
 		private ServerWebExchangeMatcher authenticationMatcher;
 
-		private ReactiveOidcSessionRegistry oidcSessionRegistry;
-
 		private ServerAuthenticationSuccessHandler authenticationSuccessHandler;
 
 		private ServerAuthenticationFailureHandler authenticationFailureHandler;
@@ -3768,20 +3721,6 @@ public class ServerHttpSecurity {
 			return this;
 		}
 
-		/**
-		 * Configures the {@link ReactiveOidcSessionRegistry} to use when logins use OIDC.
-		 * Default is to look the value up as a Bean, or else use an
-		 * {@link InMemoryReactiveOidcSessionRegistry}.
-		 * @param oidcSessionRegistry the registry to use
-		 * @return the {@link OidcLogoutSpec} to customize
-		 * @since 6.2
-		 */
-		public OAuth2LoginSpec oidcSessionRegistry(ReactiveOidcSessionRegistry oidcSessionRegistry) {
-			Assert.notNull(oidcSessionRegistry, "oidcSessionRegistry cannot be null");
-			this.oidcSessionRegistry = oidcSessionRegistry;
-			return this;
-		}
-
 		/**
 		 * The {@link ServerAuthenticationSuccessHandler} used after authentication
 		 * success. Defaults to {@link RedirectServerAuthenticationSuccessHandler}
@@ -3975,11 +3914,8 @@ public class ServerHttpSecurity {
 			oauthRedirectFilter.setRequestCache(http.requestCache.requestCache);
 
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
-			ReactiveOidcSessionRegistry sessionRegistry = getOidcSessionRegistry();
-			AuthenticationWebFilter authenticationFilter = (sessionRegistry != null)
-					? new OidcSessionRegistryAuthenticationWebFilter(manager, authorizedClientRepository,
-							sessionRegistry)
-					: new OAuth2LoginAuthenticationWebFilter(manager, authorizedClientRepository);
+			AuthenticationWebFilter authenticationFilter = new OAuth2LoginAuthenticationWebFilter(manager,
+					authorizedClientRepository);
 			authenticationFilter.setRequiresAuthenticationMatcher(getAuthenticationMatcher());
 			authenticationFilter
 				.setServerAuthenticationConverter(getAuthenticationConverter(clientRegistrationRepository));
@@ -3988,10 +3924,6 @@ public class ServerHttpSecurity {
 			authenticationFilter.setSecurityContextRepository(this.securityContextRepository);
 
 			setDefaultEntryPoints(http);
-			if (sessionRegistry != null) {
-				http.addFilterAfter(new OidcSessionRegistryWebFilter(sessionRegistry),
-						SecurityWebFiltersOrder.HTTP_HEADERS_WRITER);
-			}
 			http.addFilterAt(oauthRedirectFilter, SecurityWebFiltersOrder.HTTP_BASIC);
 			http.addFilterAt(authenticationFilter, SecurityWebFiltersOrder.AUTHENTICATION);
 		}
@@ -4036,19 +3968,6 @@ public class ServerHttpSecurity {
 			http.defaultEntryPoints.add(new DelegateEntry(defaultEntryPointMatcher, defaultEntryPoint));
 		}
 
-		private ReactiveOidcSessionRegistry getOidcSessionRegistry() {
-			if (ServerHttpSecurity.this.oidcLogout == null && this.oidcSessionRegistry == null) {
-				return null;
-			}
-			if (this.oidcSessionRegistry == null) {
-				this.oidcSessionRegistry = getBeanOrNull(ReactiveOidcSessionRegistry.class);
-			}
-			if (this.oidcSessionRegistry == null) {
-				this.oidcSessionRegistry = new InMemoryReactiveOidcSessionRegistry();
-			}
-			return this.oidcSessionRegistry;
-		}
-
 		private ServerAuthenticationSuccessHandler getAuthenticationSuccessHandler(ServerHttpSecurity http) {
 			if (this.authenticationSuccessHandler == null) {
 				RedirectServerAuthenticationSuccessHandler handler = new RedirectServerAuthenticationSuccessHandler();
@@ -4165,156 +4084,6 @@ public class ServerHttpSecurity {
 			return new InMemoryReactiveOAuth2AuthorizedClientService(getClientRegistrationRepository());
 		}
 
-		private static final class OidcSessionRegistryWebFilter implements WebFilter {
-
-			private final ReactiveOidcSessionRegistry oidcSessionRegistry;
-
-			OidcSessionRegistryWebFilter(ReactiveOidcSessionRegistry oidcSessionRegistry) {
-				this.oidcSessionRegistry = oidcSessionRegistry;
-			}
-
-			@Override
-			public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
-				return chain.filter(new OidcSessionRegistryServerWebExchange(exchange));
-			}
-
-			private final class OidcSessionRegistryServerWebExchange extends ServerWebExchangeDecorator {
-
-				private final Mono<WebSession> sessionMono;
-
-				protected OidcSessionRegistryServerWebExchange(ServerWebExchange delegate) {
-					super(delegate);
-					this.sessionMono = delegate.getSession().map(OidcSessionRegistryWebSession::new);
-				}
-
-				@Override
-				public Mono<WebSession> getSession() {
-					return this.sessionMono;
-				}
-
-				private final class OidcSessionRegistryWebSession implements WebSession {
-
-					private final WebSession session;
-
-					OidcSessionRegistryWebSession(WebSession session) {
-						this.session = session;
-					}
-
-					@Override
-					public String getId() {
-						return this.session.getId();
-					}
-
-					@Override
-					public Map<String, Object> getAttributes() {
-						return this.session.getAttributes();
-					}
-
-					@Override
-					public void start() {
-						this.session.start();
-					}
-
-					@Override
-					public boolean isStarted() {
-						return this.session.isStarted();
-					}
-
-					@Override
-					public Mono<Void> changeSessionId() {
-						String currentId = this.session.getId();
-						return this.session.changeSessionId()
-							.then(Mono.defer(() -> OidcSessionRegistryWebFilter.this.oidcSessionRegistry
-								.removeSessionInformation(currentId)
-								.flatMap((information) -> {
-									information = information.withSessionId(this.session.getId());
-									return OidcSessionRegistryWebFilter.this.oidcSessionRegistry
-										.saveSessionInformation(information);
-								})));
-					}
-
-					@Override
-					public Mono<Void> invalidate() {
-						String currentId = this.session.getId();
-						return this.session.invalidate()
-							.then(Mono.defer(() -> OidcSessionRegistryWebFilter.this.oidcSessionRegistry
-								.removeSessionInformation(currentId)
-								.then(Mono.empty())));
-					}
-
-					@Override
-					public Mono<Void> save() {
-						return this.session.save();
-					}
-
-					@Override
-					public boolean isExpired() {
-						return this.session.isExpired();
-					}
-
-					@Override
-					public Instant getCreationTime() {
-						return this.session.getCreationTime();
-					}
-
-					@Override
-					public Instant getLastAccessTime() {
-						return this.session.getLastAccessTime();
-					}
-
-					@Override
-					public void setMaxIdleTime(Duration maxIdleTime) {
-						this.session.setMaxIdleTime(maxIdleTime);
-					}
-
-					@Override
-					public Duration getMaxIdleTime() {
-						return this.session.getMaxIdleTime();
-					}
-
-				}
-
-			}
-
-		}
-
-		static final class OidcSessionRegistryAuthenticationWebFilter extends OAuth2LoginAuthenticationWebFilter {
-
-			private final Log logger = LogFactory.getLog(getClass());
-
-			private final ReactiveOidcSessionRegistry oidcSessionRegistry;
-
-			OidcSessionRegistryAuthenticationWebFilter(ReactiveAuthenticationManager authenticationManager,
-					ServerOAuth2AuthorizedClientRepository authorizedClientRepository,
-					ReactiveOidcSessionRegistry oidcSessionRegistry) {
-				super(authenticationManager, authorizedClientRepository);
-				this.oidcSessionRegistry = oidcSessionRegistry;
-			}
-
-			@Override
-			protected Mono<Void> onAuthenticationSuccess(Authentication authentication,
-					WebFilterExchange webFilterExchange) {
-				if (!(authentication.getPrincipal() instanceof OidcUser user)) {
-					return super.onAuthenticationSuccess(authentication, webFilterExchange);
-				}
-				return webFilterExchange.getExchange().getSession().doOnNext((session) -> {
-					if (this.logger.isTraceEnabled()) {
-						this.logger.trace(String.format("Linking a provider [%s] session to this client's session",
-								user.getIssuer()));
-					}
-				}).flatMap((session) -> {
-					Mono<CsrfToken> csrfToken = webFilterExchange.getExchange().getAttribute(CsrfToken.class.getName());
-					return (csrfToken != null)
-							? csrfToken.map((token) -> new OidcSessionInformation(session.getId(),
-									Map.of(token.getHeaderName(), token.getToken()), user))
-							: Mono.just(new OidcSessionInformation(session.getId(), Map.of(), user));
-				})
-					.flatMap(this.oidcSessionRegistry::saveSessionInformation)
-					.then(super.onAuthenticationSuccess(authentication, webFilterExchange));
-			}
-
-		}
-
 	}
 
 	public final class OAuth2ClientSpec {
@@ -4987,167 +4756,6 @@ public class ServerHttpSecurity {
 
 	}
 
-	/**
-	 * Configures OIDC 1.0 Logout support
-	 *
-	 * @author Josh Cummings
-	 * @since 6.2
-	 */
-	public final class OidcLogoutSpec {
-
-		private ReactiveClientRegistrationRepository clientRegistrationRepository;
-
-		private ReactiveOidcSessionRegistry sessionRegistry;
-
-		private BackChannelLogoutConfigurer backChannel;
-
-		/**
-		 * Configures the {@link ReactiveClientRegistrationRepository}. Default is to look
-		 * the value up as a Bean.
-		 * @param clientRegistrationRepository the repository to use
-		 * @return the {@link OidcLogoutSpec} to customize
-		 */
-		public OidcLogoutSpec clientRegistrationRepository(
-				ReactiveClientRegistrationRepository clientRegistrationRepository) {
-			Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
-			this.clientRegistrationRepository = clientRegistrationRepository;
-			return this;
-		}
-
-		/**
-		 * Configures the {@link ReactiveOidcSessionRegistry}. Default is to use the value
-		 * from {@link OAuth2LoginSpec#oidcSessionRegistry}, then look the value up as a
-		 * Bean, or else use an {@link InMemoryReactiveOidcSessionRegistry}.
-		 * @param sessionRegistry the registry to use
-		 * @return the {@link OidcLogoutSpec} to customize
-		 */
-		public OidcLogoutSpec oidcSessionRegistry(ReactiveOidcSessionRegistry sessionRegistry) {
-			Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
-			this.sessionRegistry = sessionRegistry;
-			return this;
-		}
-
-		/**
-		 * Configure OIDC Back-Channel Logout using the provided {@link Consumer}
-		 * @return the {@link OidcLogoutSpec} for further configuration
-		 */
-		public OidcLogoutSpec backChannel(Customizer<BackChannelLogoutConfigurer> backChannelLogoutConfigurer) {
-			if (this.backChannel == null) {
-				this.backChannel = new OidcLogoutSpec.BackChannelLogoutConfigurer();
-			}
-			backChannelLogoutConfigurer.customize(this.backChannel);
-			return this;
-		}
-
-		@Deprecated(forRemoval = true, since = "6.2")
-		public ServerHttpSecurity and() {
-			return ServerHttpSecurity.this;
-		}
-
-		void configure(ServerHttpSecurity http) {
-			if (this.backChannel != null) {
-				this.backChannel.configure(http);
-			}
-		}
-
-		private ReactiveClientRegistrationRepository getClientRegistrationRepository() {
-			if (this.clientRegistrationRepository == null) {
-				this.clientRegistrationRepository = getBeanOrNull(ReactiveClientRegistrationRepository.class);
-			}
-			return this.clientRegistrationRepository;
-		}
-
-		private ReactiveOidcSessionRegistry getSessionRegistry() {
-			if (this.sessionRegistry == null && ServerHttpSecurity.this.oauth2Login == null) {
-				return new InMemoryReactiveOidcSessionRegistry();
-			}
-			if (this.sessionRegistry == null) {
-				return ServerHttpSecurity.this.oauth2Login.oidcSessionRegistry;
-			}
-			return this.sessionRegistry;
-		}
-
-		/**
-		 * A configurer for configuring OIDC Back-Channel Logout
-		 */
-		public final class BackChannelLogoutConfigurer {
-
-			private ServerAuthenticationConverter authenticationConverter;
-
-			private final ReactiveAuthenticationManager authenticationManager = new OidcBackChannelLogoutReactiveAuthenticationManager();
-
-			private Supplier<ServerLogoutHandler> logoutHandler = this::logoutHandler;
-
-			private ServerAuthenticationConverter authenticationConverter() {
-				if (this.authenticationConverter == null) {
-					this.authenticationConverter = new OidcLogoutServerAuthenticationConverter(
-							OidcLogoutSpec.this.getClientRegistrationRepository());
-				}
-				return this.authenticationConverter;
-			}
-
-			private ReactiveAuthenticationManager authenticationManager() {
-				return this.authenticationManager;
-			}
-
-			private ServerLogoutHandler logoutHandler() {
-				OidcBackChannelServerLogoutHandler logoutHandler = new OidcBackChannelServerLogoutHandler();
-				logoutHandler.setSessionRegistry(OidcLogoutSpec.this.getSessionRegistry());
-				return logoutHandler;
-			}
-
-			/**
-			 * Use this endpoint when invoking a back-channel logout.
-			 *
-			 * <p>
-			 * The resulting {@link LogoutHandler} will {@code POST} the session cookie
-			 * and CSRF token to this endpoint to invalidate the corresponding end-user
-			 * session.
-			 *
-			 * <p>
-			 * Supports URI templates like {@code {baseUrl}}, {@code {baseScheme}}, and
-			 * {@code {basePort}}.
-			 *
-			 * <p>
-			 * By default, the URI is set to
-			 * {@code {baseScheme}://localhost{basePort}/logout}, meaning that the scheme
-			 * and port of the original back-channel request is preserved, while the host
-			 * and endpoint are changed.
-			 *
-			 * <p>
-			 * If you are using Spring Security for the logout endpoint, the path part of
-			 * this URI should match the value configured there.
-			 *
-			 * <p>
-			 * Otherwise, this is handy in the event that your server configuration means
-			 * that the scheme, server name, or port in the {@code Host} header are
-			 * different from how you would address the same server internally.
-			 * @param logoutUri the URI to request logout on the back-channel
-			 * @return the {@link OidcLogoutConfigurer.BackChannelLogoutConfigurer} for
-			 * further customizations
-			 * @since 6.2.4
-			 */
-			public BackChannelLogoutConfigurer logoutUri(String logoutUri) {
-				this.logoutHandler = () -> {
-					OidcBackChannelServerLogoutHandler logoutHandler = new OidcBackChannelServerLogoutHandler();
-					logoutHandler.setSessionRegistry(OidcLogoutSpec.this.getSessionRegistry());
-					logoutHandler.setLogoutUri(logoutUri);
-					return logoutHandler;
-				};
-				return this;
-			}
-
-			void configure(ServerHttpSecurity http) {
-				OidcBackChannelLogoutWebFilter filter = new OidcBackChannelLogoutWebFilter(authenticationConverter(),
-						authenticationManager());
-				filter.setLogoutHandler(this.logoutHandler.get());
-				http.addFilterBefore(filter, SecurityWebFiltersOrder.CSRF);
-			}
-
-		}
-
-	}
-
 	/**
 	 * Configures anonymous authentication
 	 *

config/src/main/kotlin/org/springframework/security/config/annotation/web/HttpSecurityDsl.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,9 +16,6 @@
 
 package org.springframework.security.config.annotation.web
 
-import jakarta.servlet.Filter
-import jakarta.servlet.http.HttpServletRequest
-import org.checkerframework.checker.units.qual.C
 import org.springframework.context.ApplicationContext
 import org.springframework.security.authentication.AuthenticationManager
 import org.springframework.security.config.annotation.SecurityConfigurerAdapter
@@ -27,6 +24,9 @@ import org.springframework.security.oauth2.client.registration.ClientRegistratio
 import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository
 import org.springframework.security.web.DefaultSecurityFilterChain
 import org.springframework.security.web.util.matcher.RequestMatcher
+import org.springframework.util.ClassUtils
+import jakarta.servlet.Filter
+import jakarta.servlet.http.HttpServletRequest
 
 /**
  * Configures [HttpSecurity] using a [HttpSecurity Kotlin DSL][HttpSecurityDsl].
@@ -107,36 +107,6 @@ class HttpSecurityDsl(private val http: HttpSecurity, private val init: HttpSecu
         return this.http.apply(configurer).apply(configuration)
     }
 
-    /**
-     * Applies a [SecurityConfigurerAdapter] to this [HttpSecurity]
-     *
-     * Example:
-     *
-     * ```
-     * @Configuration
-     * @EnableWebSecurity
-     * class SecurityConfig {
-     *
-     *     @Bean
-     *     fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
-     *         http {
-     *             with(CustomSecurityConfigurer<HttpSecurity>()) {
-     *                 customProperty = "..."
-     *             }
-     *         }
-     *         return http.build()
-     *     }
-     * }
-     * ```
-     *
-     * @param configurer
-     * the [HttpSecurity] for further customizations
-     * @since 6.2
-     */
-    fun <C : SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity>> with(configurer: C, configuration: C.() -> Unit = { }): HttpSecurity? {
-        return this.http.with(configurer, configuration)
-    }
-
     /**
      * Allows configuring the [HttpSecurity] to only be invoked when matching the
      * provided pattern.
@@ -868,38 +838,6 @@ class HttpSecurityDsl(private val http: HttpSecurity, private val init: HttpSecu
         this.http.oauth2ResourceServer(oauth2ResourceServerCustomizer)
     }
 
-    /**
-     * Configures OIDC 1.0 logout support.
-     *
-     * Example:
-     *
-     * ```
-     * @Configuration
-     * @EnableWebSecurity
-     * class SecurityConfig {
-     *
-     *     @Bean
-     *     fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
-     *         http {
-     *             oauth2Login { }
-     *             oidcLogout {
-     *                 backChannel { }
-     *             }
-     *         }
-     *         return http.build()
-     *     }
-     * }
-     * ```
-     *
-     * @param oidcLogoutConfiguration custom configuration to configure the
-     * OIDC 1.0 logout support
-     * @see [OidcLogoutDsl]
-     */
-    fun oidcLogout(oidcLogoutConfiguration: OidcLogoutDsl.() -> Unit) {
-        val oidcLogoutCustomizer = OidcLogoutDsl().apply(oidcLogoutConfiguration).get()
-        this.http.oidcLogout(oidcLogoutCustomizer)
-    }
-
     /**
      * Configures Remember Me authentication.
      *

config/src/main/kotlin/org/springframework/security/config/annotation/web/OidcLogoutDsl.kt

@@ -1,75 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web
-
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer
-import org.springframework.security.config.annotation.web.oauth2.login.OidcBackChannelLogoutDsl
-import org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository
-
-/**
- * A Kotlin DSL to configure [HttpSecurity] OAuth 1.0 Logout using idiomatic Kotlin code.
- *
- * @author Josh Cummings
- * @since 6.2
- */
-@SecurityMarker
-class OidcLogoutDsl {
-    var clientRegistrationRepository: ClientRegistrationRepository? = null
-    var oidcSessionRegistry: OidcSessionRegistry? = null
-
-    private var backChannel: ((OidcLogoutConfigurer<HttpSecurity>.BackChannelLogoutConfigurer) -> Unit)? = null
-
-    /**
-     * Configures the OIDC 1.0 Back-Channel endpoint.
-     *
-     * Example:
-     *
-     * ```
-     * @Configuration
-     * @EnableWebSecurity
-     * class SecurityConfig {
-     *
-     *     @Bean
-     *     fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
-     *         http {
-     *             oauth2Login { }
-     *             oidcLogout {
-     *                 backChannel { }
-     *             }
-     *         }
-     *         return http.build()
-     *     }
-     * }
-     * ```
-     *
-     * @param backChannelConfig custom configurations to configure the back-channel endpoint
-     * @see [OidcBackChannelLogoutDsl]
-     */
-    fun backChannel(backChannelConfig: OidcBackChannelLogoutDsl.() -> Unit) {
-        this.backChannel = OidcBackChannelLogoutDsl().apply(backChannelConfig).get()
-    }
-
-    internal fun get(): (OidcLogoutConfigurer<HttpSecurity>) -> Unit {
-        return { oidcLogout ->
-            clientRegistrationRepository?.also { oidcLogout.clientRegistrationRepository(clientRegistrationRepository) }
-            oidcSessionRegistry?.also { oidcLogout.oidcSessionRegistry(oidcSessionRegistry) }
-            backChannel?.also { oidcLogout.backChannel(backChannel) }
-        }
-    }
-}

config/src/main/kotlin/org/springframework/security/config/annotation/web/oauth2/login/OidcBackChannelLogoutDsl.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.oauth2.login
-
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer
-
-/**
- * A Kotlin DSL to configure the OIDC 1.0 Back-Channel configuration using
- * idiomatic Kotlin code.
- *
- * @author Josh Cummings
- * @since 6.2
- */
-@OAuth2LoginSecurityMarker
-class OidcBackChannelLogoutDsl {
-    internal fun get(): (OidcLogoutConfigurer<HttpSecurity>.BackChannelLogoutConfigurer) -> Unit {
-        return { backChannel -> }
-    }
-}

config/src/main/kotlin/org/springframework/security/config/web/server/ServerHttpSecurityDsl.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -650,38 +650,6 @@ class ServerHttpSecurityDsl(private val http: ServerHttpSecurity, private val in
         this.http.oauth2ResourceServer(oauth2ResourceServerCustomizer)
     }
 
-    /**
-     * Configures logout support using an OpenID Connect 1.0 Provider.
-     * A [ReactiveClientRegistrationRepository] is required and must be registered as a Bean or
-     * configured via [ServerOidcLogoutDsl.clientRegistrationRepository].
-     *
-     * Example:
-     *
-     * ```
-     * @Configuration
-     * @EnableWebFluxSecurity
-     * class SecurityConfig {
-     *
-     *  @Bean
-     *  fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-     *      return http {
-     *          oauth2Login { }
-     *          oidcLogout {
-     *              backChannel { }
-     *          }
-     *       }
-     *   }
-     * }
-     * ```
-     *
-     * @param oidcLogoutConfiguration custom configuration to configure the OIDC 1.0 Logout
-     * @see [ServerOidcLogoutDsl]
-     */
-    fun oidcLogout(oidcLogoutConfiguration: ServerOidcLogoutDsl.() -> Unit) {
-        val oidcLogoutCustomizer = ServerOidcLogoutDsl().apply(oidcLogoutConfiguration).get()
-        this.http.oidcLogout(oidcLogoutCustomizer)
-    }
-
     /**
      * Apply all configurations to the provided [ServerHttpSecurity]
      */

config/src/main/kotlin/org/springframework/security/config/web/server/ServerOidcBackChannelLogoutDsl.kt

@@ -1,30 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server
-
-/**
- * A Kotlin DSL to configure [ServerHttpSecurity] OIDC 1.0 Back-Channel Logout support using idiomatic Kotlin code.
- *
- * @author Josh Cummings
- * @since 6.2
- */
-@ServerSecurityMarker
-class ServerOidcBackChannelLogoutDsl {
-    internal fun get(): (ServerHttpSecurity.OidcLogoutSpec.BackChannelLogoutConfigurer) -> Unit {
-        return { backChannel -> }
-    }
-}

config/src/main/kotlin/org/springframework/security/config/web/server/ServerOidcLogoutDsl.kt

@@ -1,71 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.web.server
-
-import org.springframework.security.oauth2.client.oidc.server.session.ReactiveOidcSessionRegistry
-import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository
-
-/**
- * A Kotlin DSL to configure [ServerHttpSecurity] OIDC 1.0 login using idiomatic Kotlin code.
- *
- * @author Josh Cummings
- * @since 6.2
- */
-@ServerSecurityMarker
-class ServerOidcLogoutDsl {
-    var clientRegistrationRepository: ReactiveClientRegistrationRepository? = null
-    var oidcSessionRegistry: ReactiveOidcSessionRegistry? = null
-
-    private var backChannel: ((ServerHttpSecurity.OidcLogoutSpec.BackChannelLogoutConfigurer) -> Unit)? = null
-
-    /**
-     * Enables OIDC 1.0 Back-Channel Logout support.
-     *
-     * Example:
-     *
-     * ```
-     * @Configuration
-     * @EnableWebFluxSecurity
-     * class SecurityConfig {
-     *
-     *  @Bean
-     *  fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-     *      return http {
-     *          oauth2Login { }
-     *          oidcLogout {
-     *              backChannel { }
-     *          }
-     *       }
-     *   }
-     * }
-     * ```
-     *
-     * @param backChannelConfig custom configurations to configure OIDC 1.0 Back-Channel Logout support
-     * @see [ServerOidcBackChannelLogoutDsl]
-     */
-    fun backChannel(backChannelConfig: ServerOidcBackChannelLogoutDsl.() -> Unit) {
-        this.backChannel = ServerOidcBackChannelLogoutDsl().apply(backChannelConfig).get()
-    }
-
-    internal fun get(): (ServerHttpSecurity.OidcLogoutSpec) -> Unit {
-        return { oidcLogout ->
-            clientRegistrationRepository?.also { oidcLogout.clientRegistrationRepository(clientRegistrationRepository) }
-            oidcSessionRegistry?.also { oidcLogout.oidcSessionRegistry(oidcSessionRegistry) }
-            backChannel?.also { oidcLogout.backChannel(backChannel) }
-        }
-    }
-}

config/src/main/resources/META-INF/spring.schemas

@@ -1,5 +1,4 @@
-http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-6.2.xsd
-http\://www.springframework.org/schema/security/spring-security-6.2.xsd=org/springframework/security/config/spring-security-6.2.xsd
+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-6.1.xsd
 http\://www.springframework.org/schema/security/spring-security-6.1.xsd=org/springframework/security/config/spring-security-6.1.xsd
 http\://www.springframework.org/schema/security/spring-security-6.0.xsd=org/springframework/security/config/spring-security-6.0.xsd
 http\://www.springframework.org/schema/security/spring-security-5.8.xsd=org/springframework/security/config/spring-security-5.8.xsd
@@ -22,8 +21,7 @@ http\://www.springframework.org/schema/security/spring-security-2.0.xsd=org/spri
 http\://www.springframework.org/schema/security/spring-security-2.0.1.xsd=org/springframework/security/config/spring-security-2.0.1.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.2.xsd=org/springframework/security/config/spring-security-2.0.2.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.4.xsd=org/springframework/security/config/spring-security-2.0.4.xsd
-https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-6.2.xsd
-https\://www.springframework.org/schema/security/spring-security-6.2.xsd=org/springframework/security/config/spring-security-6.2.xsd
+https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-6.1.xsd
 https\://www.springframework.org/schema/security/spring-security-6.1.xsd=org/springframework/security/config/spring-security-6.1.xsd
 https\://www.springframework.org/schema/security/spring-security-6.0.xsd=org/springframework/security/config/spring-security-6.0.xsd
 https\://www.springframework.org/schema/security/spring-security-5.8.xsd=org/springframework/security/config/spring-security-5.8.xsd

config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java

@@ -1,318 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.NotSerializableException;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
-import java.io.ObjectStreamClass;
-import java.io.Serializable;
-import java.lang.reflect.Modifier;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.stream.Stream;
-
-import org.apereo.cas.client.validation.AssertionImpl;
-import org.instancio.Instancio;
-import org.instancio.InstancioApi;
-import org.instancio.Select;
-import org.instancio.generator.Generator;
-import org.junit.jupiter.api.Disabled;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.MethodSource;
-
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider;
-import org.springframework.core.type.filter.AssignableTypeFilter;
-import org.springframework.security.access.intercept.RunAsUserToken;
-import org.springframework.security.authentication.AnonymousAuthenticationToken;
-import org.springframework.security.authentication.RememberMeAuthenticationToken;
-import org.springframework.security.authentication.TestAuthentication;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.authentication.jaas.JaasAuthenticationToken;
-import org.springframework.security.cas.authentication.CasAssertionAuthenticationToken;
-import org.springframework.security.cas.authentication.CasAuthenticationToken;
-import org.springframework.security.cas.authentication.CasServiceTicketAuthenticationToken;
-import org.springframework.security.core.SpringSecurityCoreVersion;
-import org.springframework.security.core.session.SessionInformation;
-import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
-import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
-import org.springframework.security.oauth2.client.authentication.OAuth2AuthorizationCodeAuthenticationToken;
-import org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationToken;
-import org.springframework.security.oauth2.client.authentication.TestOAuth2AuthenticationTokens;
-import org.springframework.security.oauth2.client.authentication.TestOAuth2AuthorizationCodeAuthenticationTokens;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.client.registration.TestClientRegistrations;
-import org.springframework.security.oauth2.core.TestOAuth2AccessTokens;
-import org.springframework.security.oauth2.core.TestOAuth2AuthenticatedPrincipals;
-import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationExchange;
-import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
-import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationResponse;
-import org.springframework.security.oauth2.core.endpoint.TestOAuth2AuthorizationExchanges;
-import org.springframework.security.oauth2.core.endpoint.TestOAuth2AuthorizationRequests;
-import org.springframework.security.oauth2.core.endpoint.TestOAuth2AuthorizationResponses;
-import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
-import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
-import org.springframework.security.oauth2.core.user.OAuth2UserAuthority;
-import org.springframework.security.oauth2.core.user.TestOAuth2Users;
-import org.springframework.security.oauth2.jwt.TestJwts;
-import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthentication;
-import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken;
-import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
-import org.springframework.security.web.authentication.WebAuthenticationDetails;
-import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.fail;
-
-/**
- * Tests that Spring Security classes that implements {@link Serializable} and have the
- * same serial version as {@link SpringSecurityCoreVersion#SERIAL_VERSION_UID} can be
- * deserialized from a previous minor version.
- * <p>
- * For example, all classes from version 6.2.x that matches the previous requirement
- * should be serialized and saved to a folder, and then later on, in 6.3.x, it is verified
- * if they can be deserialized
- *
- * @author Marcus da Coregio
- * @since 6.2.2
- * @see <a href="https://github.com/spring-projects/spring-security/issues/3737">GitHub
- * Issue #3737</a>
- */
-class SpringSecurityCoreVersionSerializableTests {
-
-	private static final Map<Class<?>, Generator<?>> generatorByClassName = new HashMap<>();
-
-	static final long securitySerialVersionUid = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
-
-	static Path currentVersionFolder = Paths.get("src/test/resources/serialized/" + getCurrentVersion());
-
-	static Path previousVersionFolder = Paths.get("src/test/resources/serialized/" + getPreviousVersion());
-
-	static {
-		ClientRegistration.Builder clientRegistrationBuilder = TestClientRegistrations.clientRegistration();
-		ClientRegistration clientRegistration = clientRegistrationBuilder.build();
-		UserDetails user = TestAuthentication.user();
-		WebAuthenticationDetails details = new WebAuthenticationDetails("remote", "sessionId");
-		generatorByClassName.put(DefaultOAuth2User.class, (r) -> TestOAuth2Users.create());
-		generatorByClassName.put(ClientRegistration.class, (r) -> clientRegistration);
-		generatorByClassName.put(ClientRegistration.ProviderDetails.class,
-				(r) -> clientRegistration.getProviderDetails());
-		generatorByClassName.put(ClientRegistration.ProviderDetails.UserInfoEndpoint.class,
-				(r) -> clientRegistration.getProviderDetails().getUserInfoEndpoint());
-		generatorByClassName.put(ClientRegistration.Builder.class, (r) -> clientRegistrationBuilder);
-		generatorByClassName.put(OAuth2AuthorizationRequest.class,
-				(r) -> TestOAuth2AuthorizationRequests.request().build());
-		generatorByClassName.put(OAuth2AuthorizationResponse.class,
-				(r) -> TestOAuth2AuthorizationResponses.success().build());
-		generatorByClassName.put(OAuth2AuthorizedClient.class,
-				(r) -> new OAuth2AuthorizedClient(clientRegistration, "principal", TestOAuth2AccessTokens.noScopes()));
-		generatorByClassName.put(OAuth2UserAuthority.class, (r) -> new OAuth2UserAuthority(Map.of("username", "user")));
-		generatorByClassName.put(OAuth2AuthorizationExchange.class, (r) -> TestOAuth2AuthorizationExchanges.success());
-		generatorByClassName.put(OidcUserInfo.class, (r) -> OidcUserInfo.builder().email("email@example.com").build());
-		generatorByClassName.put(SessionInformation.class,
-				(r) -> new SessionInformation(user, r.alphanumeric(4), new Date(1704378933936L)));
-		generatorByClassName.put(OAuth2LoginAuthenticationToken.class, (r) -> {
-			var token = new OAuth2LoginAuthenticationToken(clientRegistration,
-					TestOAuth2AuthorizationExchanges.success());
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(OAuth2AuthorizationCodeAuthenticationToken.class, (r) -> {
-			var token = TestOAuth2AuthorizationCodeAuthenticationTokens.authenticated();
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName
-			.put(org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken.class, (r) -> {
-				var token = new org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken(
-						"token");
-				token.setDetails(details);
-				return token;
-			});
-		generatorByClassName.put(BearerTokenAuthenticationToken.class, (r) -> {
-			var token = new BearerTokenAuthenticationToken("token");
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(BearerTokenAuthentication.class, (r) -> {
-			var token = new BearerTokenAuthentication(TestOAuth2AuthenticatedPrincipals.active(),
-					TestOAuth2AccessTokens.noScopes(), user.getAuthorities());
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(OAuth2AuthenticationToken.class, (r) -> {
-			var token = TestOAuth2AuthenticationTokens.authenticated();
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(JwtAuthenticationToken.class, (r) -> {
-			var token = new JwtAuthenticationToken(TestJwts.user());
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(RunAsUserToken.class, (r) -> {
-			RunAsUserToken token = new RunAsUserToken("key", user, "creds", user.getAuthorities(),
-					AnonymousAuthenticationToken.class);
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(CasServiceTicketAuthenticationToken.class, (r) -> {
-			CasServiceTicketAuthenticationToken token = CasServiceTicketAuthenticationToken.stateless("creds");
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(CasAuthenticationToken.class, (r) -> {
-			var token = new CasAuthenticationToken("key", user, "Password", user.getAuthorities(), user,
-					new AssertionImpl("test"));
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(CasAssertionAuthenticationToken.class, (r) -> {
-			var token = new CasAssertionAuthenticationToken(new AssertionImpl("test"), "ticket");
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(RememberMeAuthenticationToken.class, (r) -> {
-			RememberMeAuthenticationToken token = new RememberMeAuthenticationToken("key", user, user.getAuthorities());
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(PreAuthenticatedAuthenticationToken.class, (r) -> {
-			PreAuthenticatedAuthenticationToken token = new PreAuthenticatedAuthenticationToken(user, "creds",
-					user.getAuthorities());
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(UsernamePasswordAuthenticationToken.class, (r) -> {
-			var token = UsernamePasswordAuthenticationToken.unauthenticated(user, "creds");
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(JaasAuthenticationToken.class, (r) -> {
-			var token = new JaasAuthenticationToken(user, "creds", null);
-			token.setDetails(details);
-			return token;
-		});
-	}
-
-	@ParameterizedTest
-	@MethodSource("getClassesToSerialize")
-	@Disabled("This method should only be used to serialize the classes once")
-	void serializeCurrentVersionClasses(Class<?> clazz) throws Exception {
-		Files.createDirectories(currentVersionFolder);
-		Path filePath = Paths.get(currentVersionFolder.toAbsolutePath() + "/" + clazz.getName() + ".serialized");
-		File file = filePath.toFile();
-		if (file.exists()) {
-			return;
-		}
-		Files.createFile(filePath);
-		Object instance = instancioWithDefaults(clazz).create();
-		assertThat(instance).isInstanceOf(clazz);
-		try (FileOutputStream fileOutputStream = new FileOutputStream(file);
-				ObjectOutputStream objectOutputStream = new ObjectOutputStream(fileOutputStream)) {
-			objectOutputStream.writeObject(instance);
-			objectOutputStream.flush();
-		}
-		catch (NotSerializableException ex) {
-			Files.delete(filePath);
-			fail("Could not serialize " + clazz.getName(), ex);
-		}
-	}
-
-	@ParameterizedTest
-	@MethodSource("getFilesToDeserialize")
-	@Disabled("The feature is only supported for versions >= 6.3")
-	void shouldBeAbleToDeserializeClassFromPreviousVersion(Path filePath) {
-		try (FileInputStream fileInputStream = new FileInputStream(filePath.toFile());
-				ObjectInputStream objectInputStream = new ObjectInputStream(fileInputStream)) {
-			Object obj = objectInputStream.readObject();
-			Class<?> clazz = Class.forName(filePath.getFileName().toString().replace(".serialized", ""));
-			assertThat(obj).isInstanceOf(clazz);
-		}
-		catch (IOException | ClassNotFoundException ex) {
-			fail("Could not deserialize " + filePath, ex);
-		}
-	}
-
-	static Stream<Path> getFilesToDeserialize() throws IOException {
-		assertThat(previousVersionFolder.toFile().exists())
-			.as("Make sure that the " + previousVersionFolder + " exists and is not empty")
-			.isTrue();
-		try (Stream<Path> files = Files.list(previousVersionFolder)) {
-			if (files.findFirst().isEmpty()) {
-				fail("Please make sure to run SpringSecurityCoreVersionSerializableTests#serializeCurrentVersionClasses for the "
-						+ getPreviousVersion() + " version");
-			}
-		}
-		return Files.list(previousVersionFolder);
-	}
-
-	static Stream<Class<?>> getClassesToSerialize() throws Exception {
-		ClassPathScanningCandidateComponentProvider provider = new ClassPathScanningCandidateComponentProvider(false);
-		provider.addIncludeFilter(new AssignableTypeFilter(Serializable.class));
-		List<Class<?>> classes = new ArrayList<>();
-
-		Set<BeanDefinition> components = provider.findCandidateComponents("org/springframework/security");
-		for (BeanDefinition component : components) {
-			Class<?> clazz = Class.forName(component.getBeanClassName());
-			boolean isAbstract = Modifier.isAbstract(clazz.getModifiers());
-			boolean matchesExpectedSerialVersion = ObjectStreamClass.lookup(clazz)
-				.getSerialVersionUID() == securitySerialVersionUid;
-			if (!isAbstract && matchesExpectedSerialVersion) {
-				classes.add(clazz);
-			}
-		}
-		return classes.stream();
-	}
-
-	private static InstancioApi<?> instancioWithDefaults(Class<?> clazz) {
-		InstancioApi<?> instancio = Instancio.of(clazz);
-		if (generatorByClassName.containsKey(clazz)) {
-			instancio.supply(Select.all(clazz), generatorByClassName.get(clazz));
-		}
-		return instancio;
-	}
-
-	private static String getCurrentVersion() {
-		String version = System.getProperty("springSecurityVersion");
-		String[] parts = version.split("\\.");
-		parts[2] = "x";
-		return String.join(".", parts);
-	}
-
-	private static String getPreviousVersion() {
-		String version = System.getProperty("springSecurityVersion");
-		String[] parts = version.split("\\.");
-		parts[1] = String.valueOf(Integer.parseInt(parts[1]) - 1);
-		parts[2] = "x";
-		return String.join(".", parts);
-	}
-
-}

config/src/test/java/org/springframework/security/config/annotation/authentication/configurers/provisioning/UserDetailsManagerConfigurerTests.java

@@ -17,13 +17,11 @@
 package org.springframework.security.config.annotation.authentication.configurers.provisioning;
 
 import java.util.Arrays;
-import java.util.Optional;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -75,7 +73,7 @@ public class UserDetailsManagerConfigurerTests {
 				.authorities(authority)
 				.build();
 		// @formatter:on
-		assertThat((Optional<GrantedAuthority>) userDetails.getAuthorities().stream().findFirst()).contains(authority);
+		assertThat(userDetails.getAuthorities().stream().findFirst().get()).isEqualTo(authority);
 	}
 
 	@Test
@@ -101,7 +99,7 @@ public class UserDetailsManagerConfigurerTests {
 				.authorities(Arrays.asList(authority))
 				.build();
 		// @formatter:on
-		assertThat((Optional<GrantedAuthority>) userDetails.getAuthorities().stream().findFirst()).contains(authority);
+		assertThat(userDetails.getAuthorities().stream().findFirst().get()).isEqualTo(authority);
 	}
 
 	private UserDetailsManagerConfigurer<AuthenticationManagerBuilder, InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder>> configurer() {

config/src/test/java/org/springframework/security/config/annotation/issue50/SecurityConfig.java

@@ -66,7 +66,7 @@ public class SecurityConfig {
 
 	@Bean
 	public AuthenticationProvider authenticationProvider() {
-		Assert.notNull(this.myUserRepository, "myUserRepository cannot be null");
+		Assert.notNull(this.myUserRepository);
 		return new AuthenticationProvider() {
 			@Override
 			public boolean supports(Class<?> authentication) {

config/src/test/java/org/springframework/security/config/annotation/method/configuration/EnableAuthorizationManagerReactiveMethodSecurityTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -80,7 +80,7 @@ public class EnableAuthorizationManagerReactiveMethodSecurityTests {
 			.withMessage("The returnType class java.lang.String on public abstract java.lang.String "
 					+ "org.springframework.security.config.annotation.method.configuration.ReactiveMessageService"
 					+ ".notPublisherPreAuthorizeFindById(long) must return an instance of org.reactivestreams"
-					+ ".Publisher (for example, a Mono or Flux) or the function must be a Kotlin coroutine in order to support Reactor Context");
+					+ ".Publisher (for example, a Mono or Flux) in order to support Reactor Context");
 	}
 
 	@Test

config/src/test/java/org/springframework/security/config/annotation/method/configuration/EnableCustomMethodSecurity.java

@@ -1,41 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.method.configuration;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.springframework.context.annotation.AdviceMode;
-import org.springframework.core.annotation.AliasFor;
-
-/**
- * @author Evgeniy Cheban
- */
-@Retention(RetentionPolicy.RUNTIME)
-@Target(ElementType.TYPE)
-@EnableMethodSecurity
-public @interface EnableCustomMethodSecurity {
-
-	@AliasFor(annotation = EnableMethodSecurity.class, attribute = "proxyTargetClass")
-	boolean proxyTargetClass() default false;
-
-	@AliasFor(annotation = EnableMethodSecurity.class, attribute = "mode")
-	AdviceMode mode() default AdviceMode.PROXY;
-
-}

config/src/test/java/org/springframework/security/config/annotation/method/configuration/EnableReactiveMethodSecurityTests.java

@@ -78,7 +78,7 @@ public class EnableReactiveMethodSecurityTests {
 			.withMessage("The returnType class java.lang.String on public abstract java.lang.String "
 					+ "org.springframework.security.config.annotation.method.configuration.ReactiveMessageService"
 					+ ".notPublisherPreAuthorizeFindById(long) must return an instance of org.reactivestreams"
-					+ ".Publisher (for example, a Mono or Flux) or the function must be a Kotlin coroutine in order to support Reactor Context");
+					+ ".Publisher (for example, a Mono or Flux) in order to support Reactor Context");
 	}
 
 	@Test

config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java

@@ -73,8 +73,6 @@ import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.atLeastOnce;
 import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.spy;
-import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 
 /**
@@ -97,21 +95,6 @@ public class PrePostMethodSecurityConfigurationTests {
 	@Autowired(required = false)
 	BusinessService businessService;
 
-	@WithMockUser
-	@Test
-	public void customMethodSecurityPreAuthorizeAdminWhenRoleUserThenAccessDeniedException() {
-		this.spring.register(CustomMethodSecurityServiceConfig.class).autowire();
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.methodSecurityService::preAuthorizeAdmin)
-			.withMessage("Access Denied");
-	}
-
-	@WithMockUser(roles = "ADMIN")
-	@Test
-	public void customMethodSecurityPreAuthorizeAdminWhenRoleAdminThenPasses() {
-		this.spring.register(CustomMethodSecurityServiceConfig.class).autowire();
-		this.methodSecurityService.preAuthorizeAdmin();
-	}
-
 	@WithMockUser(roles = "ADMIN")
 	@Test
 	public void preAuthorizeWhenRoleAdminThenAccessDeniedException() {
@@ -449,33 +432,10 @@ public class PrePostMethodSecurityConfigurationTests {
 			.autowire();
 	}
 
-	// gh-15651
-	@Test
-	@WithMockUser(roles = "ADMIN")
-	public void adviseWhenPrePostEnabledThenEachInterceptorRunsExactlyOnce() {
-		this.spring.register(MethodSecurityServiceConfig.class, CustomMethodSecurityExpressionHandlerConfig.class)
-			.autowire();
-		MethodSecurityExpressionHandler expressionHandler = this.spring.getContext()
-			.getBean(MethodSecurityExpressionHandler.class);
-		this.methodSecurityService.manyAnnotations(new ArrayList<>(Arrays.asList("harold", "jonathan", "tim", "bo")));
-		verify(expressionHandler, times(4)).createEvaluationContext(any(Supplier.class), any());
-	}
-
 	private static Consumer<ConfigurableWebApplicationContext> disallowBeanOverriding() {
 		return (context) -> ((AnnotationConfigWebApplicationContext) context).setAllowBeanDefinitionOverriding(false);
 	}
 
-	@Configuration
-	@EnableCustomMethodSecurity
-	static class CustomMethodSecurityServiceConfig {
-
-		@Bean
-		MethodSecurityService methodSecurityService() {
-			return new MethodSecurityServiceImpl();
-		}
-
-	}
-
 	@Configuration
 	@EnableMethodSecurity
 	static class MethodSecurityServiceConfig {
@@ -537,19 +497,6 @@ public class PrePostMethodSecurityConfigurationTests {
 	}
 
 	@Configuration
-	@EnableMethodSecurity
-	static class CustomMethodSecurityExpressionHandlerConfig {
-
-		private final MethodSecurityExpressionHandler expressionHandler = spy(
-				new DefaultMethodSecurityExpressionHandler());
-
-		@Bean
-		MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
-			return this.expressionHandler;
-		}
-
-	}
-
 	@EnableMethodSecurity
 	static class CustomPermissionEvaluatorConfig {
 

config/src/test/java/org/springframework/security/config/annotation/web/AbstractConfiguredSecurityBuilderTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,7 +21,6 @@ import java.util.List;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
-import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.SecurityConfigurer;
@@ -150,19 +149,6 @@ public class AbstractConfiguredSecurityBuilderTests {
 		assertThat(builder.getConfigurers(DelegateSecurityConfigurer.class)).hasSize(2);
 	}
 
-	@Test
-	public void withWhenConfigurerThenConfigurerAdded() throws Exception {
-		this.builder.with(new TestSecurityConfigurer(), Customizer.withDefaults());
-		assertThat(this.builder.getConfigurers(TestSecurityConfigurer.class)).hasSize(1);
-	}
-
-	@Test
-	public void withWhenDuplicateConfigurerAddedThenDuplicateConfigurerRemoved() throws Exception {
-		this.builder.with(new TestSecurityConfigurer(), Customizer.withDefaults());
-		this.builder.with(new TestSecurityConfigurer(), Customizer.withDefaults());
-		assertThat(this.builder.getConfigurers(TestSecurityConfigurer.class)).hasSize(1);
-	}
-
 	private static class ApplyAndRemoveSecurityConfigurer
 			extends SecurityConfigurerAdapter<Object, TestConfiguredSecurityBuilder> {
 

config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryNoMvcTests.java

@@ -47,7 +47,7 @@ public class AbstractRequestMatcherRegistryNoMvcTests {
 	public void requestMatchersWhenPatternAndMvcNotPresentThenReturnAntPathRequestMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers("/path");
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
 	}
 
@@ -55,7 +55,7 @@ public class AbstractRequestMatcherRegistryNoMvcTests {
 	public void requestMatchersWhenHttpMethodAndPatternAndMvcNotPresentThenReturnAntPathRequestMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers(HttpMethod.GET, "/path");
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
 	}
 
@@ -63,7 +63,7 @@ public class AbstractRequestMatcherRegistryNoMvcTests {
 	public void requestMatchersWhenHttpMethodAndMvcNotPresentThenReturnAntPathMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers(HttpMethod.GET);
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
 	}
 

config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,40 +21,33 @@ import java.util.List;
 
 import jakarta.servlet.DispatcherType;
 import jakarta.servlet.Servlet;
+import jakarta.servlet.http.HttpServletMapping;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.config.MockServletContext;
 import org.springframework.security.config.TestMockHttpServletMappings;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.DispatcherServletDelegatingRequestMatcher;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher;
 import org.springframework.security.web.util.matcher.RegexRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
-import org.springframework.test.web.servlet.MockMvc;
-import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 import org.springframework.web.context.WebApplicationContext;
 import org.springframework.web.servlet.DispatcherServlet;
-import org.springframework.web.servlet.config.annotation.EnableWebMvc;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-import static org.assertj.core.api.InstanceOfAssertFactories.type;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 
 /**
  * Tests for {@link AbstractRequestMatcherRegistry}.
@@ -90,7 +83,7 @@ public class AbstractRequestMatcherRegistryTests {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry
 			.requestMatchers(new RegexRequestMatcher("/a.*", HttpMethod.GET.name()));
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(RegexRequestMatcher.class);
 	}
 
@@ -99,7 +92,7 @@ public class AbstractRequestMatcherRegistryTests {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry
 			.requestMatchers(new RegexRequestMatcher("/a.*", null));
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(RegexRequestMatcher.class);
 	}
 
@@ -108,7 +101,7 @@ public class AbstractRequestMatcherRegistryTests {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry
 			.requestMatchers(new AntPathRequestMatcher("/a.*", HttpMethod.GET.name()));
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
 	}
 
@@ -116,7 +109,7 @@ public class AbstractRequestMatcherRegistryTests {
 	public void antMatchersWhenPatternParamThenReturnAntPathRequestMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers(new AntPathRequestMatcher("/a.*"));
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
 	}
 
@@ -125,7 +118,7 @@ public class AbstractRequestMatcherRegistryTests {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.dispatcherTypeMatchers(HttpMethod.GET,
 				DispatcherType.ASYNC);
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(DispatcherTypeRequestMatcher.class);
 	}
 
@@ -133,7 +126,7 @@ public class AbstractRequestMatcherRegistryTests {
 	public void dispatcherMatchersWhenPatternParamThenReturnAntPathRequestMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.dispatcherTypeMatchers(DispatcherType.INCLUDE);
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(DispatcherTypeRequestMatcher.class);
 	}
 
@@ -141,7 +134,7 @@ public class AbstractRequestMatcherRegistryTests {
 	public void requestMatchersWhenPatternAndMvcPresentThenReturnMvcRequestMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers("/path");
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(MvcRequestMatcher.class);
 	}
 
@@ -149,7 +142,7 @@ public class AbstractRequestMatcherRegistryTests {
 	public void requestMatchersWhenHttpMethodAndPatternAndMvcPresentThenReturnMvcRequestMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers(HttpMethod.GET, "/path");
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(MvcRequestMatcher.class);
 	}
 
@@ -157,7 +150,7 @@ public class AbstractRequestMatcherRegistryTests {
 	public void requestMatchersWhenHttpMethodAndMvcPresentThenReturnMvcRequestMatcherType() {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers(HttpMethod.GET);
 		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.size()).isEqualTo(1);
 		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(MvcRequestMatcher.class);
 	}
 
@@ -175,65 +168,18 @@ public class AbstractRequestMatcherRegistryTests {
 		mockMvcIntrospector(true);
 		MockServletContext servletContext = new MockServletContext();
 		given(this.context.getServletContext()).willReturn(servletContext);
-		MockHttpServletRequest request = new MockHttpServletRequest();
+		servletContext.addServlet("servletOne", Servlet.class).addMapping("/one");
+		servletContext.addServlet("servletTwo", Servlet.class).addMapping("/two");
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers("/**");
 		assertThat(requestMatchers).isNotEmpty();
 		assertThat(requestMatchers).hasSize(1);
-		assertThat(requestMatchers.get(0)).asInstanceOf(type(DispatcherServletDelegatingRequestMatcher.class))
-			.extracting((matcher) -> matcher.requestMatcher(request))
-			.isInstanceOf(AntPathRequestMatcher.class);
-		servletContext.addServlet("servletOne", Servlet.class).addMapping("/one");
-		servletContext.addServlet("servletTwo", Servlet.class).addMapping("/two");
-		requestMatchers = this.matcherRegistry.requestMatchers("/**");
-		assertThat(requestMatchers).isNotEmpty();
-		assertThat(requestMatchers).hasSize(1);
-		assertThat(requestMatchers.get(0)).asInstanceOf(type(DispatcherServletDelegatingRequestMatcher.class))
-			.extracting((matcher) -> matcher.requestMatcher(request))
-			.isInstanceOf(AntPathRequestMatcher.class);
+		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
 		servletContext.addServlet("servletOne", Servlet.class);
 		servletContext.addServlet("servletTwo", Servlet.class);
 		requestMatchers = this.matcherRegistry.requestMatchers("/**");
 		assertThat(requestMatchers).isNotEmpty();
 		assertThat(requestMatchers).hasSize(1);
-		assertThat(requestMatchers.get(0)).asInstanceOf(type(DispatcherServletDelegatingRequestMatcher.class))
-			.extracting((matcher) -> matcher.requestMatcher(request))
-			.isInstanceOf(AntPathRequestMatcher.class);
-	}
-
-	// gh-14418
-	@Test
-	public void requestMatchersWhenNoDispatcherServletMockMvcThenMvcRequestMatcherType() throws Exception {
-		MockServletContext servletContext = new MockServletContext();
-		try (SpringTestContext spring = new SpringTestContext(this)) {
-			spring.register(MockMvcConfiguration.class)
-				.postProcessor((context) -> context.setServletContext(servletContext))
-				.autowire();
-			this.matcherRegistry.setApplicationContext(spring.getContext());
-			MockMvc mvc = MockMvcBuilders.webAppContextSetup(spring.getContext()).build();
-			MockHttpServletRequest request = mvc.perform(get("/")).andReturn().getRequest();
-			List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers("/**");
-			assertThat(requestMatchers).isNotEmpty();
-			assertThat(requestMatchers).hasSize(1);
-			assertThat(requestMatchers.get(0)).asInstanceOf(type(DispatcherServletDelegatingRequestMatcher.class))
-				.extracting((matcher) -> matcher.requestMatcher(request))
-				.isInstanceOf(MvcRequestMatcher.class);
-			servletContext.addServlet("servletOne", Servlet.class).addMapping("/one");
-			servletContext.addServlet("servletTwo", Servlet.class).addMapping("/two");
-			requestMatchers = this.matcherRegistry.requestMatchers("/**");
-			assertThat(requestMatchers).isNotEmpty();
-			assertThat(requestMatchers).hasSize(1);
-			assertThat(requestMatchers.get(0)).asInstanceOf(type(DispatcherServletDelegatingRequestMatcher.class))
-				.extracting((matcher) -> matcher.requestMatcher(request))
-				.isInstanceOf(MvcRequestMatcher.class);
-			servletContext.addServlet("servletOne", Servlet.class);
-			servletContext.addServlet("servletTwo", Servlet.class);
-			requestMatchers = this.matcherRegistry.requestMatchers("/**");
-			assertThat(requestMatchers).isNotEmpty();
-			assertThat(requestMatchers).hasSize(1);
-			assertThat(requestMatchers.get(0)).asInstanceOf(type(DispatcherServletDelegatingRequestMatcher.class))
-				.extracting((matcher) -> matcher.requestMatcher(request))
-				.isInstanceOf(MvcRequestMatcher.class);
-		}
+		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
 	}
 
 	@Test
@@ -282,6 +228,7 @@ public class AbstractRequestMatcherRegistryTests {
 
 	@Test
 	public void requestMatchersWhenOnlyDispatcherServletThenAllows() {
+		mockMvcIntrospector(true);
 		MockServletContext servletContext = new MockServletContext();
 		given(this.context.getServletContext()).willReturn(servletContext);
 		servletContext.addServlet("dispatcherServlet", DispatcherServlet.class).addMapping("/mvc/*");
@@ -305,6 +252,7 @@ public class AbstractRequestMatcherRegistryTests {
 
 	@Test
 	public void requestMatchersWhenPathBasedNonDispatcherServletThenAllows() {
+		mockMvcIntrospector(true);
 		MockServletContext servletContext = new MockServletContext();
 		given(this.context.getServletContext()).willReturn(servletContext);
 		servletContext.addServlet("path", Servlet.class).addMapping("/services/*");
@@ -312,10 +260,19 @@ public class AbstractRequestMatcherRegistryTests {
 		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers("/services/*");
 		assertThat(requestMatchers).hasSize(1);
 		assertThat(requestMatchers.get(0)).isInstanceOf(DispatcherServletDelegatingRequestMatcher.class);
-		MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/endpoint");
-		request.setHttpServletMapping(TestMockHttpServletMappings.defaultMapping());
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/endpoint") {
+			@Override
+			public HttpServletMapping getHttpServletMapping() {
+				return TestMockHttpServletMappings.defaultMapping();
+			}
+		};
 		assertThat(requestMatchers.get(0).matcher(request).isMatch()).isTrue();
-		request.setHttpServletMapping(TestMockHttpServletMappings.path(request, "/services"));
+		request = new MockHttpServletRequest("GET", "/services/endpoint") {
+			@Override
+			public HttpServletMapping getHttpServletMapping() {
+				return TestMockHttpServletMappings.path(this, "/services");
+			}
+		};
 		request.setServletPath("/services");
 		request.setPathInfo("/endpoint");
 		assertThat(requestMatchers.get(0).matcher(request).isMatch()).isTrue();
@@ -330,30 +287,26 @@ public class AbstractRequestMatcherRegistryTests {
 		AntPathRequestMatcher ant = mock(AntPathRequestMatcher.class);
 		DispatcherServletDelegatingRequestMatcher requestMatcher = new DispatcherServletDelegatingRequestMatcher(ant,
 				mvc, servletContext);
-		MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/endpoint");
-		request.setHttpServletMapping(TestMockHttpServletMappings.defaultMapping());
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/endpoint") {
+			@Override
+			public HttpServletMapping getHttpServletMapping() {
+				return TestMockHttpServletMappings.defaultMapping();
+			}
+		};
 		assertThat(requestMatcher.matches(request)).isFalse();
 		verify(mvc).matches(request);
 		verifyNoInteractions(ant);
-		request.setHttpServletMapping(TestMockHttpServletMappings.path(request, "/services"));
+		request = new MockHttpServletRequest("GET", "/services/endpoint") {
+			@Override
+			public HttpServletMapping getHttpServletMapping() {
+				return TestMockHttpServletMappings.path(this, "/services");
+			}
+		};
 		assertThat(requestMatcher.matches(request)).isFalse();
 		verify(ant).matches(request);
 		verifyNoMoreInteractions(mvc);
 	}
 
-	@Test
-	public void matchesWhenNoMappingThenException() {
-		MockServletContext servletContext = new MockServletContext();
-		servletContext.addServlet("default", DispatcherServlet.class).addMapping("/");
-		servletContext.addServlet("path", Servlet.class).addMapping("/services/*");
-		MvcRequestMatcher mvc = mock(MvcRequestMatcher.class);
-		AntPathRequestMatcher ant = mock(AntPathRequestMatcher.class);
-		DispatcherServletDelegatingRequestMatcher requestMatcher = new DispatcherServletDelegatingRequestMatcher(ant,
-				mvc, servletContext);
-		MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/endpoint");
-		assertThatExceptionOfType(IllegalArgumentException.class).isThrownBy(() -> requestMatcher.matcher(request));
-	}
-
 	private void mockMvcIntrospector(boolean isPresent) {
 		ApplicationContext context = this.matcherRegistry.getApplicationContext();
 		given(context.containsBean("mvcHandlerMappingIntrospector")).willReturn(isPresent);
@@ -371,13 +324,11 @@ public class AbstractRequestMatcherRegistryTests {
 			return requestMatchers;
 		}
 
-		private List<RequestMatcher> unwrap(List<RequestMatcher> wrappedMatchers) {
+		private static List<RequestMatcher> unwrap(List<RequestMatcher> wrappedMatchers) {
 			List<RequestMatcher> requestMatchers = new ArrayList<>();
 			for (RequestMatcher requestMatcher : wrappedMatchers) {
-				if (requestMatcher instanceof DeferredRequestMatcher) {
-					DeferredRequestMatcher deferred = (DeferredRequestMatcher) requestMatcher;
-					WebApplicationContext web = (WebApplicationContext) getApplicationContext();
-					requestMatchers.add(deferred.requestMatcher(web.getServletContext()));
+				if (requestMatcher instanceof AbstractRequestMatcherRegistry.DeferredRequestMatcher) {
+					requestMatchers.add(((DeferredRequestMatcher) requestMatcher).requestMatcher);
 				}
 				else {
 					requestMatchers.add(requestMatcher);
@@ -388,11 +339,4 @@ public class AbstractRequestMatcherRegistryTests {
 
 	}
 
-	@Configuration
-	@EnableWebSecurity
-	@EnableWebMvc
-	static class MockMvcConfiguration {
-
-	}
-
 }

config/src/test/java/org/springframework/security/config/annotation/web/configuration/HttpSecurityConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,7 +47,6 @@ import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.authentication.event.AbstractAuthenticationEvent;
 import org.springframework.security.authentication.event.AbstractAuthenticationFailureEvent;
 import org.springframework.security.authentication.event.AuthenticationSuccessEvent;
-import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.SecurityContextChangedListenerConfig;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -64,11 +63,9 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.test.web.servlet.RequestCacheResultMatcher;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
 import org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter;
 import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter;
-import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
@@ -76,10 +73,6 @@ import org.springframework.web.accept.ContentNegotiationStrategy;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.context.request.NativeWebRequest;
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.CorsConfigurationSource;
-import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
-import org.springframework.web.filter.CorsFilter;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -92,8 +85,6 @@ import static org.springframework.security.test.web.servlet.request.SecurityMock
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
-import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
-import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.asyncDispatch;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
@@ -361,50 +352,6 @@ public class HttpSecurityConfigurationTests {
 				DefaultLogoutPageGeneratingFilter.class);
 	}
 
-	@Test
-	public void configureWhenCorsConfigurationSourceThenApplyCors() throws Exception {
-		this.spring.register(CorsConfigurationSourceConfig.class, DefaultWithFilterChainConfig.class).autowire();
-		SecurityFilterChain filterChain = this.spring.getContext().getBean(SecurityFilterChain.class);
-		CorsFilter corsFilter = (CorsFilter) filterChain.getFilters()
-			.stream()
-			.filter((f) -> f instanceof CorsFilter)
-			.findFirst()
-			.get();
-		Object configSource = ReflectionTestUtils.getField(corsFilter, "configSource");
-		assertThat(configSource).isInstanceOf(UrlBasedCorsConfigurationSource.class);
-	}
-
-	// gh-15378
-	@Test
-	public void configureWhenNoUrlBasedCorsConfigThenNoCorsAppliedAndVaryHeaderNotPresent() throws Exception {
-		this.spring.register(NonUrlBasedCorsConfig.class, DefaultWithFilterChainConfig.class).autowire();
-		SecurityFilterChain filterChain = this.spring.getContext().getBean(SecurityFilterChain.class);
-		assertThat(filterChain.getFilters()).noneMatch((filter) -> filter instanceof CorsFilter);
-
-		this.mockMvc.perform(get("/")).andExpect(header().doesNotExist("Vary"));
-	}
-
-	@Test
-	public void configureWhenAddingCustomDslUsingWithThenApplied() throws Exception {
-		this.spring.register(WithCustomDslConfig.class, UserDetailsConfig.class).autowire();
-		SecurityFilterChain filterChain = this.spring.getContext().getBean(SecurityFilterChain.class);
-		List<Filter> filters = filterChain.getFilters();
-		assertThat(filters).hasAtLeastOneElementOfType(UsernamePasswordAuthenticationFilter.class);
-		this.mockMvc.perform(formLogin()).andExpectAll(redirectedUrl("/"), authenticated());
-	}
-
-	@Test
-	public void configureWhenCustomDslAddedFromFactoriesAndDisablingUsingWithThenNotApplied() throws Exception {
-		this.springFactoriesLoader
-			.when(() -> SpringFactoriesLoader.loadFactories(AbstractHttpConfigurer.class, getClass().getClassLoader()))
-			.thenReturn(List.of(new WithCustomDsl()));
-		this.spring.register(WithCustomDslDisabledConfig.class, UserDetailsConfig.class).autowire();
-		SecurityFilterChain filterChain = this.spring.getContext().getBean(SecurityFilterChain.class);
-		List<Filter> filters = filterChain.getFilters();
-		assertThat(filters).doesNotHaveAnyElementsOfTypes(UsernamePasswordAuthenticationFilter.class);
-		this.mockMvc.perform(formLogin()).andExpectAll(status().isNotFound(), unauthenticated());
-	}
-
 	@RestController
 	static class NameController {
 
@@ -669,47 +616,6 @@ public class HttpSecurityConfigurationTests {
 
 	}
 
-	@Configuration
-	static class CorsConfigurationSourceConfig {
-
-		@Bean
-		CorsConfigurationSource corsConfigurationSource() {
-			UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-			CorsConfiguration corsConfiguration = new CorsConfiguration();
-			corsConfiguration.setAllowedOrigins(List.of("http://localhost:8080"));
-			source.registerCorsConfiguration("/**", corsConfiguration);
-			return source;
-		}
-
-	}
-
-	@Configuration
-	@EnableWebSecurity
-	static class NonUrlBasedCorsConfig {
-
-		@Bean
-		CorsConfigurationSource corsConfigurationSource() {
-			return new CustomCorsConfigurationSource();
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			return http.build();
-		}
-
-	}
-
-	static class CustomCorsConfigurationSource implements CorsConfigurationSource {
-
-		@Override
-		public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
-			CorsConfiguration configuration = new CorsConfiguration();
-			configuration.setAllowedOrigins(List.of("http://localhost:8080"));
-			return configuration;
-		}
-
-	}
-
 	static class DefaultConfigurer extends AbstractHttpConfigurer<DefaultConfigurer, HttpSecurity> {
 
 		boolean init;
@@ -728,45 +634,4 @@ public class HttpSecurityConfigurationTests {
 
 	}
 
-	@Configuration
-	@EnableWebSecurity
-	static class WithCustomDslConfig {
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-					.with(new WithCustomDsl(), Customizer.withDefaults())
-					.httpBasic(Customizer.withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-	}
-
-	@Configuration
-	@EnableWebSecurity
-	static class WithCustomDslDisabledConfig {
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-					.with(new WithCustomDsl(), (dsl) -> dsl.disable())
-					.httpBasic(Customizer.withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-	}
-
-	static class WithCustomDsl extends AbstractHttpConfigurer<WithCustomDsl, HttpSecurity> {
-
-		@Override
-		public void init(HttpSecurity builder) throws Exception {
-			builder.formLogin(Customizer.withDefaults());
-		}
-
-	}
-
 }

config/src/test/java/org/springframework/security/config/annotation/web/configuration/OAuth2AuthorizedClientManagerConfigurationTests.java

@@ -1,547 +0,0 @@
-/*
- * Copyright 2002-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.web.configuration;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Objects;
-import java.util.function.Consumer;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.ArgumentCaptor;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.oauth2.client.CommonOAuth2Provider;
-import org.springframework.security.config.test.SpringTestContext;
-import org.springframework.security.oauth2.client.AuthorizationCodeOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.ClientAuthorizationRequiredException;
-import org.springframework.security.oauth2.client.ClientCredentialsOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.JwtBearerOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.OAuth2AuthorizationContext;
-import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.RefreshTokenOAuth2AuthorizedClientProvider;
-import org.springframework.security.oauth2.client.endpoint.AbstractOAuth2AuthorizationGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
-import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest;
-import org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequest;
-import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
-import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
-import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
-import org.springframework.security.oauth2.client.userinfo.DefaultOAuth2UserService;
-import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest;
-import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
-import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
-import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
-import org.springframework.security.oauth2.core.AuthorizationGrantType;
-import org.springframework.security.oauth2.core.OAuth2AccessToken;
-import org.springframework.security.oauth2.core.OAuth2AuthorizationException;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.TestOAuth2RefreshTokens;
-import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
-import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
-import org.springframework.security.oauth2.core.endpoint.TestOAuth2AccessTokenResponses;
-import org.springframework.security.oauth2.core.oidc.user.OidcUser;
-import org.springframework.security.oauth2.core.user.OAuth2User;
-import org.springframework.security.oauth2.jwt.JoseHeaderNames;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.jwt.JwtClaimNames;
-import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
-import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.util.StringUtils;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.spy;
-import static org.mockito.Mockito.verify;
-
-/**
- * Tests for {@link OAuth2ClientConfiguration.OAuth2AuthorizedClientManagerConfiguration}.
- *
- * @author Joe Grandja
- * @author Steve Riesenberg
- */
-public class OAuth2AuthorizedClientManagerConfigurationTests {
-
-	private static OAuth2AccessTokenResponseClient<? super AbstractOAuth2AuthorizationGrantRequest> MOCK_RESPONSE_CLIENT;
-
-	public final SpringTestContext spring = new SpringTestContext(this);
-
-	@Autowired
-	private OAuth2AuthorizedClientManager authorizedClientManager;
-
-	@Autowired
-	private ClientRegistrationRepository clientRegistrationRepository;
-
-	@Autowired
-	private OAuth2AuthorizedClientRepository authorizedClientRepository;
-
-	@Autowired(required = false)
-	private AuthorizationCodeOAuth2AuthorizedClientProvider authorizationCodeAuthorizedClientProvider;
-
-	private MockHttpServletRequest request;
-
-	private MockHttpServletResponse response;
-
-	@BeforeEach
-	@SuppressWarnings("unchecked")
-	public void setUp() {
-		MOCK_RESPONSE_CLIENT = mock(OAuth2AccessTokenResponseClient.class);
-		this.request = new MockHttpServletRequest();
-		this.response = new MockHttpServletResponse();
-	}
-
-	@Test
-	public void loadContextWhenOAuth2ClientEnabledThenConfigured() {
-		this.spring.register(MinimalOAuth2ClientConfig.class).autowire();
-		assertThat(this.authorizedClientManager).isNotNull();
-	}
-
-	@Test
-	public void authorizeWhenAuthorizationCodeAuthorizedClientProviderBeanThenUsed() {
-		this.spring.register(CustomAuthorizedClientProvidersConfig.class).autowire();
-
-		TestingAuthenticationToken authentication = new TestingAuthenticationToken("user", null);
-		// @formatter:off
-		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
-				.withClientRegistrationId("google")
-				.principal(authentication)
-				.attribute(HttpServletRequest.class.getName(), this.request)
-				.attribute(HttpServletResponse.class.getName(), this.response)
-				.build();
-		assertThatExceptionOfType(ClientAuthorizationRequiredException.class)
-				.isThrownBy(() -> this.authorizedClientManager.authorize(authorizeRequest))
-				.extracting(OAuth2AuthorizationException::getError)
-				.extracting(OAuth2Error::getErrorCode)
-				.isEqualTo("client_authorization_required");
-		// @formatter:on
-
-		verify(this.authorizationCodeAuthorizedClientProvider).authorize(any(OAuth2AuthorizationContext.class));
-	}
-
-	@Test
-	public void authorizeWhenRefreshTokenAccessTokenResponseClientBeanThenUsed() {
-		this.spring.register(CustomAccessTokenResponseClientsConfig.class).autowire();
-		testRefreshTokenGrant();
-	}
-
-	@Test
-	public void authorizeWhenRefreshTokenAuthorizedClientProviderBeanThenUsed() {
-		this.spring.register(CustomAuthorizedClientProvidersConfig.class).autowire();
-		testRefreshTokenGrant();
-	}
-
-	private void testRefreshTokenGrant() {
-		OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build();
-		given(MOCK_RESPONSE_CLIENT.getTokenResponse(any(OAuth2RefreshTokenGrantRequest.class)))
-			.willReturn(accessTokenResponse);
-
-		TestingAuthenticationToken authentication = new TestingAuthenticationToken("user", null);
-		ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId("google");
-		OAuth2AuthorizedClient existingAuthorizedClient = new OAuth2AuthorizedClient(clientRegistration,
-				authentication.getName(), getExpiredAccessToken(), TestOAuth2RefreshTokens.refreshToken());
-		this.authorizedClientRepository.saveAuthorizedClient(existingAuthorizedClient, authentication, this.request,
-				this.response);
-		// @formatter:off
-		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
-				.withAuthorizedClient(existingAuthorizedClient)
-				.principal(authentication)
-				.attribute(HttpServletRequest.class.getName(), this.request)
-				.attribute(HttpServletResponse.class.getName(), this.response)
-				.build();
-		// @formatter:on
-		OAuth2AuthorizedClient authorizedClient = this.authorizedClientManager.authorize(authorizeRequest);
-		assertThat(authorizedClient).isNotNull();
-
-		ArgumentCaptor<OAuth2RefreshTokenGrantRequest> grantRequestCaptor = ArgumentCaptor
-			.forClass(OAuth2RefreshTokenGrantRequest.class);
-		verify(MOCK_RESPONSE_CLIENT).getTokenResponse(grantRequestCaptor.capture());
-
-		OAuth2RefreshTokenGrantRequest grantRequest = grantRequestCaptor.getValue();
-		assertThat(grantRequest.getClientRegistration().getRegistrationId())
-			.isEqualTo(clientRegistration.getRegistrationId());
-		assertThat(grantRequest.getGrantType()).isEqualTo(AuthorizationGrantType.REFRESH_TOKEN);
-		assertThat(grantRequest.getAccessToken()).isEqualTo(existingAuthorizedClient.getAccessToken());
-		assertThat(grantRequest.getRefreshToken()).isEqualTo(existingAuthorizedClient.getRefreshToken());
-	}
-
-	@Test
-	public void authorizeWhenClientCredentialsAccessTokenResponseClientBeanThenUsed() {
-		this.spring.register(CustomAccessTokenResponseClientsConfig.class).autowire();
-		testClientCredentialsGrant();
-	}
-
-	@Test
-	public void authorizeWhenClientCredentialsAuthorizedClientProviderBeanThenUsed() {
-		this.spring.register(CustomAuthorizedClientProvidersConfig.class).autowire();
-		testClientCredentialsGrant();
-	}
-
-	private void testClientCredentialsGrant() {
-		OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build();
-		given(MOCK_RESPONSE_CLIENT.getTokenResponse(any(OAuth2ClientCredentialsGrantRequest.class)))
-			.willReturn(accessTokenResponse);
-
-		TestingAuthenticationToken authentication = new TestingAuthenticationToken("user", null);
-		ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId("github");
-		// @formatter:off
-		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
-				.withClientRegistrationId(clientRegistration.getRegistrationId())
-				.principal(authentication)
-				.attribute(HttpServletRequest.class.getName(), this.request)
-				.attribute(HttpServletResponse.class.getName(), this.response)
-				.build();
-		// @formatter:on
-		OAuth2AuthorizedClient authorizedClient = this.authorizedClientManager.authorize(authorizeRequest);
-		assertThat(authorizedClient).isNotNull();
-
-		ArgumentCaptor<OAuth2ClientCredentialsGrantRequest> grantRequestCaptor = ArgumentCaptor
-			.forClass(OAuth2ClientCredentialsGrantRequest.class);
-		verify(MOCK_RESPONSE_CLIENT).getTokenResponse(grantRequestCaptor.capture());
-
-		OAuth2ClientCredentialsGrantRequest grantRequest = grantRequestCaptor.getValue();
-		assertThat(grantRequest.getClientRegistration().getRegistrationId())
-			.isEqualTo(clientRegistration.getRegistrationId());
-		assertThat(grantRequest.getGrantType()).isEqualTo(AuthorizationGrantType.CLIENT_CREDENTIALS);
-	}
-
-	@Test
-	public void authorizeWhenPasswordAccessTokenResponseClientBeanThenUsed() {
-		this.spring.register(CustomAccessTokenResponseClientsConfig.class).autowire();
-		testPasswordGrant();
-	}
-
-	@Test
-	public void authorizeWhenPasswordAuthorizedClientProviderBeanThenUsed() {
-		this.spring.register(CustomAuthorizedClientProvidersConfig.class).autowire();
-		testPasswordGrant();
-	}
-
-	private void testPasswordGrant() {
-		OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build();
-		given(MOCK_RESPONSE_CLIENT.getTokenResponse(any(OAuth2PasswordGrantRequest.class)))
-			.willReturn(accessTokenResponse);
-
-		TestingAuthenticationToken authentication = new TestingAuthenticationToken("user", "password");
-		ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId("facebook");
-		// @formatter:off
-		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
-				.withClientRegistrationId(clientRegistration.getRegistrationId())
-				.principal(authentication)
-				.attribute(HttpServletRequest.class.getName(), this.request)
-				.attribute(HttpServletResponse.class.getName(), this.response)
-				.build();
-		// @formatter:on
-		this.request.setParameter(OAuth2ParameterNames.USERNAME, "user");
-		this.request.setParameter(OAuth2ParameterNames.PASSWORD, "password");
-		OAuth2AuthorizedClient authorizedClient = this.authorizedClientManager.authorize(authorizeRequest);
-		assertThat(authorizedClient).isNotNull();
-
-		ArgumentCaptor<OAuth2PasswordGrantRequest> grantRequestCaptor = ArgumentCaptor
-			.forClass(OAuth2PasswordGrantRequest.class);
-		verify(MOCK_RESPONSE_CLIENT).getTokenResponse(grantRequestCaptor.capture());
-
-		OAuth2PasswordGrantRequest grantRequest = grantRequestCaptor.getValue();
-		assertThat(grantRequest.getClientRegistration().getRegistrationId())
-			.isEqualTo(clientRegistration.getRegistrationId());
-		assertThat(grantRequest.getGrantType()).isEqualTo(AuthorizationGrantType.PASSWORD);
-		assertThat(grantRequest.getUsername()).isEqualTo("user");
-		assertThat(grantRequest.getPassword()).isEqualTo("password");
-	}
-
-	@Test
-	public void authorizeWhenJwtBearerAccessTokenResponseClientBeanThenUsed() {
-		this.spring.register(CustomAccessTokenResponseClientsConfig.class).autowire();
-		testJwtBearerGrant();
-	}
-
-	@Test
-	public void authorizeWhenJwtBearerAuthorizedClientProviderBeanThenUsed() {
-		this.spring.register(CustomAuthorizedClientProvidersConfig.class).autowire();
-		testJwtBearerGrant();
-	}
-
-	private void testJwtBearerGrant() {
-		OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build();
-		given(MOCK_RESPONSE_CLIENT.getTokenResponse(any(JwtBearerGrantRequest.class))).willReturn(accessTokenResponse);
-
-		JwtAuthenticationToken authentication = new JwtAuthenticationToken(getJwt());
-		ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId("okta");
-		// @formatter:off
-		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
-				.withClientRegistrationId(clientRegistration.getRegistrationId())
-				.principal(authentication)
-				.attribute(HttpServletRequest.class.getName(), this.request)
-				.attribute(HttpServletResponse.class.getName(), this.response)
-				.build();
-		// @formatter:on
-		OAuth2AuthorizedClient authorizedClient = this.authorizedClientManager.authorize(authorizeRequest);
-		assertThat(authorizedClient).isNotNull();
-
-		ArgumentCaptor<JwtBearerGrantRequest> grantRequestCaptor = ArgumentCaptor.forClass(JwtBearerGrantRequest.class);
-		verify(MOCK_RESPONSE_CLIENT).getTokenResponse(grantRequestCaptor.capture());
-
-		JwtBearerGrantRequest grantRequest = grantRequestCaptor.getValue();
-		assertThat(grantRequest.getClientRegistration().getRegistrationId())
-			.isEqualTo(clientRegistration.getRegistrationId());
-		assertThat(grantRequest.getGrantType()).isEqualTo(AuthorizationGrantType.JWT_BEARER);
-		assertThat(grantRequest.getJwt().getSubject()).isEqualTo("user");
-	}
-
-	private static OAuth2AccessToken getExpiredAccessToken() {
-		Instant expiresAt = Instant.now().minusSeconds(60);
-		Instant issuedAt = expiresAt.minus(Duration.ofDays(1));
-		return new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "scopes", issuedAt, expiresAt,
-				new HashSet<>(Arrays.asList("read", "write")));
-	}
-
-	private static Jwt getJwt() {
-		Instant issuedAt = Instant.now();
-		return new Jwt("token", issuedAt, issuedAt.plusSeconds(300),
-				Collections.singletonMap(JoseHeaderNames.ALG, "RS256"),
-				Collections.singletonMap(JwtClaimNames.SUB, "user"));
-	}
-
-	@Configuration
-	@EnableWebSecurity
-	static class MinimalOAuth2ClientConfig extends OAuth2ClientBaseConfig {
-
-	}
-
-	@Configuration
-	@EnableWebSecurity
-	static class CustomAccessTokenResponseClientsConfig extends OAuth2ClientBaseConfig {
-
-		@Bean
-		OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> authorizationCodeTokenResponseClient() {
-			return new MockAuthorizationCodeClient();
-		}
-
-		@Bean
-		OAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> refreshTokenTokenResponseClient() {
-			return new MockRefreshTokenClient();
-		}
-
-		@Bean
-		OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient() {
-			return new MockClientCredentialsClient();
-		}
-
-		@Bean
-		OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> passwordTokenResponseClient() {
-			return new MockPasswordClient();
-		}
-
-		@Bean
-		OAuth2AccessTokenResponseClient<JwtBearerGrantRequest> jwtBearerTokenResponseClient() {
-			return new MockJwtBearerClient();
-		}
-
-		@Bean
-		OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
-			return mock(DefaultOAuth2UserService.class);
-		}
-
-		@Bean
-		OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService() {
-			return mock(OidcUserService.class);
-		}
-
-	}
-
-	@Configuration
-	@EnableWebSecurity
-	static class CustomAuthorizedClientProvidersConfig extends OAuth2ClientBaseConfig {
-
-		@Bean
-		AuthorizationCodeOAuth2AuthorizedClientProvider authorizationCodeProvider() {
-			return spy(new AuthorizationCodeOAuth2AuthorizedClientProvider());
-		}
-
-		@Bean
-		RefreshTokenOAuth2AuthorizedClientProvider refreshTokenProvider() {
-			RefreshTokenOAuth2AuthorizedClientProvider authorizedClientProvider = new RefreshTokenOAuth2AuthorizedClientProvider();
-			authorizedClientProvider.setAccessTokenResponseClient(new MockRefreshTokenClient());
-			return authorizedClientProvider;
-		}
-
-		@Bean
-		ClientCredentialsOAuth2AuthorizedClientProvider clientCredentialsProvider() {
-			ClientCredentialsOAuth2AuthorizedClientProvider authorizedClientProvider = new ClientCredentialsOAuth2AuthorizedClientProvider();
-			authorizedClientProvider.setAccessTokenResponseClient(new MockClientCredentialsClient());
-			return authorizedClientProvider;
-		}
-
-		@Bean
-		PasswordOAuth2AuthorizedClientProvider passwordProvider() {
-			PasswordOAuth2AuthorizedClientProvider authorizedClientProvider = new PasswordOAuth2AuthorizedClientProvider();
-			authorizedClientProvider.setAccessTokenResponseClient(new MockPasswordClient());
-			return authorizedClientProvider;
-		}
-
-		@Bean
-		JwtBearerOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider() {
-			JwtBearerOAuth2AuthorizedClientProvider authorizedClientProvider = new JwtBearerOAuth2AuthorizedClientProvider();
-			authorizedClientProvider.setAccessTokenResponseClient(new MockJwtBearerClient());
-			return authorizedClientProvider;
-		}
-
-	}
-
-	abstract static class OAuth2ClientBaseConfig {
-
-		@Bean
-		SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated())
-				.oauth2Login(Customizer.withDefaults())
-				.oauth2Client(Customizer.withDefaults());
-			return http.build();
-			// @formatter:on
-		}
-
-		@Bean
-		ClientRegistrationRepository clientRegistrationRepository() {
-			// @formatter:off
-			return new InMemoryClientRegistrationRepository(Arrays.asList(
-					CommonOAuth2Provider.GOOGLE.getBuilder("google")
-							.clientId("google-client-id")
-							.clientSecret("google-client-secret")
-							.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-							.build(),
-					CommonOAuth2Provider.GITHUB.getBuilder("github")
-							.clientId("github-client-id")
-							.clientSecret("github-client-secret")
-							.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
-							.build(),
-					CommonOAuth2Provider.FACEBOOK.getBuilder("facebook")
-							.clientId("facebook-client-id")
-							.clientSecret("facebook-client-secret")
-							.authorizationGrantType(AuthorizationGrantType.PASSWORD)
-							.build(),
-					CommonOAuth2Provider.OKTA.getBuilder("okta")
-							.clientId("okta-client-id")
-							.clientSecret("okta-client-secret")
-							.authorizationGrantType(AuthorizationGrantType.JWT_BEARER)
-							.build()));
-			// @formatter:on
-		}
-
-		@Bean
-		OAuth2AuthorizedClientRepository authorizedClientRepository() {
-			return mock(OAuth2AuthorizedClientRepository.class);
-		}
-
-		@Bean
-		Consumer<DefaultOAuth2AuthorizedClientManager> authorizedClientManagerConsumer() {
-			return (authorizedClientManager) -> authorizedClientManager
-				.setContextAttributesMapper((authorizeRequest) -> {
-					HttpServletRequest request = Objects
-						.requireNonNull(authorizeRequest.getAttribute(HttpServletRequest.class.getName()));
-					String username = request.getParameter(OAuth2ParameterNames.USERNAME);
-					String password = request.getParameter(OAuth2ParameterNames.PASSWORD);
-
-					Map<String, Object> attributes = Collections.emptyMap();
-					if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
-						attributes = new HashMap<>();
-						attributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
-						attributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
-					}
-
-					return attributes;
-				});
-		}
-
-	}
-
-	private static class MockAuthorizationCodeClient
-			implements OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> {
-
-		@Override
-		public OAuth2AccessTokenResponse getTokenResponse(
-				OAuth2AuthorizationCodeGrantRequest authorizationGrantRequest) {
-			return MOCK_RESPONSE_CLIENT.getTokenResponse(authorizationGrantRequest);
-		}
-
-	}
-
-	private static class MockRefreshTokenClient
-			implements OAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> {
-
-		@Override
-		public OAuth2AccessTokenResponse getTokenResponse(OAuth2RefreshTokenGrantRequest authorizationGrantRequest) {
-			return MOCK_RESPONSE_CLIENT.getTokenResponse(authorizationGrantRequest);
-		}
-
-	}
-
-	private static class MockClientCredentialsClient
-			implements OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> {
-
-		@Override
-		public OAuth2AccessTokenResponse getTokenResponse(
-				OAuth2ClientCredentialsGrantRequest authorizationGrantRequest) {
-			return MOCK_RESPONSE_CLIENT.getTokenResponse(authorizationGrantRequest);
-		}
-
-	}
-
-	private static class MockPasswordClient implements OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> {
-
-		@Override
-		public OAuth2AccessTokenResponse getTokenResponse(OAuth2PasswordGrantRequest authorizationGrantRequest) {
-			return MOCK_RESPONSE_CLIENT.getTokenResponse(authorizationGrantRequest);
-		}
-
-	}
-
-	private static class MockJwtBearerClient implements OAuth2AccessTokenResponseClient<JwtBearerGrantRequest> {
-
-		@Override
-		public OAuth2AccessTokenResponse getTokenResponse(JwtBearerGrantRequest authorizationGrantRequest) {
-			return MOCK_RESPONSE_CLIENT.getTokenResponse(authorizationGrantRequest);
-		}
-
-	}
-
-}

config/src/test/java/org/springframework/security/config/annotation/web/configuration/OAuth2ClientConfigurationTests.java

@@ -180,10 +180,9 @@ public class OAuth2ClientConfigurationTests {
 	@Test
 	public void loadContextWhenAccessTokenResponseClientRegisteredTwiceThenThrowNoUniqueBeanDefinitionException() {
 		// @formatter:off
-		assertThatExceptionOfType(BeanCreationException.class)
+		assertThatExceptionOfType(Exception.class)
 				.isThrownBy(() -> this.spring.register(AccessTokenResponseClientRegisteredTwiceConfig.class).autowire())
-				.havingRootCause()
-				.isInstanceOf(NoUniqueBeanDefinitionException.class)
+				.withRootCauseInstanceOf(NoUniqueBeanDefinitionException.class)
 				.withMessageContaining(
 						"expected single matching bean but found 2: accessTokenResponseClient1,accessTokenResponseClient2");
 		// @formatter:on

config/src/test/java/org/springframework/security/config/annotation/web/configuration/SecurityReactorContextConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,20 +17,14 @@
 package org.springframework.security.config.annotation.web.configuration;
 
 import java.net.URI;
-import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.ThreadFactory;
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.DisabledOnJre;
-import org.junit.jupiter.api.condition.JRE;
 import org.junit.jupiter.api.extension.ExtendWith;
 import reactor.core.CoreSubscriber;
 import reactor.core.publisher.BaseSubscriber;
@@ -41,8 +35,6 @@ import reactor.util.context.Context;
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.core.task.SimpleAsyncTaskExecutor;
-import org.springframework.core.task.VirtualThreadTaskExecutor;
 import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
@@ -54,7 +46,6 @@ import org.springframework.security.config.annotation.web.configuration.Security
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
 import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.security.oauth2.client.web.reactive.function.client.MockExchangeFunction;
@@ -280,58 +271,6 @@ public class SecurityReactorContextConfigurationTests {
 		verify(strategy, times(2)).getContext();
 	}
 
-	@Test
-	public void createPublisherWhenThreadFactoryIsPlatformThenSecurityContextAttributesAvailable() throws Exception {
-		this.spring.register(SecurityConfig.class).autowire();
-
-		ThreadFactory threadFactory = Executors.defaultThreadFactory();
-		assertContextAttributesAvailable(threadFactory);
-	}
-
-	@Test
-	@DisabledOnJre(JRE.JAVA_17)
-	public void createPublisherWhenThreadFactoryIsVirtualThenSecurityContextAttributesAvailable() throws Exception {
-		this.spring.register(SecurityConfig.class).autowire();
-
-		ThreadFactory threadFactory = new VirtualThreadTaskExecutor().getVirtualThreadFactory();
-		assertContextAttributesAvailable(threadFactory);
-	}
-
-	private void assertContextAttributesAvailable(ThreadFactory threadFactory) throws Exception {
-		Map<Object, Object> expectedContextAttributes = new HashMap<>();
-		expectedContextAttributes.put(HttpServletRequest.class, this.servletRequest);
-		expectedContextAttributes.put(HttpServletResponse.class, this.servletResponse);
-		expectedContextAttributes.put(Authentication.class, this.authentication);
-
-		try (SimpleAsyncTaskExecutor taskExecutor = new SimpleAsyncTaskExecutor(threadFactory)) {
-			Future<Map<Object, Object>> future = taskExecutor.submit(this::propagateRequestAttributes);
-			assertThat(future.get()).isEqualTo(expectedContextAttributes);
-		}
-	}
-
-	private Map<Object, Object> propagateRequestAttributes() {
-		RequestAttributes requestAttributes = new ServletRequestAttributes(this.servletRequest, this.servletResponse);
-		RequestContextHolder.setRequestAttributes(requestAttributes);
-
-		SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
-		securityContext.setAuthentication(this.authentication);
-		SecurityContextHolder.setContext(securityContext);
-
-		// @formatter:off
-		return Mono.deferContextual(Mono::just)
-				.filter((ctx) -> ctx.hasKey(SecurityReactorContextSubscriber.SECURITY_CONTEXT_ATTRIBUTES))
-				.map((ctx) -> ctx.<Map<Object, Object>>get(SecurityReactorContextSubscriber.SECURITY_CONTEXT_ATTRIBUTES))
-				.map((attributes) -> {
-					Map<Object, Object> map = new HashMap<>();
-					// Copy over items from lazily loaded map
-					Arrays.asList(HttpServletRequest.class, HttpServletResponse.class, Authentication.class)
-							.forEach((key) -> map.put(key, attributes.get(key)));
-					return map;
-				})
-				.block();
-		// @formatter:on
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class SecurityConfig {

config/src/test/java/org/springframework/security/config/annotation/web/configurers/AnonymousConfigurerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -94,13 +94,6 @@ public class AnonymousConfigurerTests {
 		this.mockMvc.perform(get("/")).andExpect(status().isOk());
 	}
 
-	// gh-14941
-	@Test
-	public void shouldReturnMyCustomAnonymousConfig() throws Exception {
-		this.spring.register(AnonymousInCustomConfigurer.class, PrincipalController.class).autowire();
-		this.mockMvc.perform(get("/")).andExpect(status().isOk()).andExpect(content().string("myAnonymousUser"));
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	@EnableWebMvc
@@ -188,32 +181,6 @@ public class AnonymousConfigurerTests {
 
 	}
 
-	@Configuration
-	@EnableWebMvc
-	@EnableWebSecurity
-	static class AnonymousInCustomConfigurer {
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.authorizeHttpRequests((authorize) -> authorize.anyRequest().permitAll())
-				.with(new CustomDsl(), withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-		static class CustomDsl extends AbstractHttpConfigurer<CustomDsl, HttpSecurity> {
-
-			@Override
-			public void init(HttpSecurity http) throws Exception {
-				http.anonymous((anonymous) -> anonymous.principal("myAnonymousUser"));
-			}
-
-		}
-
-	}
-
 	@RestController
 	static class PrincipalController {
 

config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurerTests.java

@@ -37,7 +37,6 @@ import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.core.GrantedAuthorityDefaults;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
 import org.springframework.security.core.authority.AuthorityUtils;
@@ -153,7 +152,6 @@ public class AuthorizeHttpRequestsConfigurerTests {
 		this.spring.register(ObjectPostProcessorConfig.class).autowire();
 		ObjectPostProcessor objectPostProcessor = this.spring.getContext().getBean(ObjectPostProcessor.class);
 		verify(objectPostProcessor).postProcess(any(RequestMatcherDelegatingAuthorizationManager.class));
-		verify(objectPostProcessor).postProcess(any(AuthorizationManager.class));
 		verify(objectPostProcessor).postProcess(any(AuthorizationFilter.class));
 	}
 
@@ -478,43 +476,6 @@ public class AuthorizeHttpRequestsConfigurerTests {
 		this.mvc.perform(requestWithRoleOther).andExpect(status().isForbidden());
 	}
 
-	@Test
-	public void getWhenCustomRolePrefixAndRoleHasDifferentPrefixThenRespondsWithForbidden() throws Exception {
-		this.spring.register(GrantedAuthorityDefaultHasRoleConfig.class, BasicController.class).autowire();
-		// @formatter:off
-		MockHttpServletRequestBuilder requestWithUser = get("/")
-				.with(user("user")
-						.authorities(new SimpleGrantedAuthority("ROLE_USER")));
-		// @formatter:on
-		this.mvc.perform(requestWithUser).andExpect(status().isForbidden());
-	}
-
-	@Test
-	public void getWhenCustomRolePrefixAndHasRoleThenRespondsWithOk() throws Exception {
-		this.spring.register(GrantedAuthorityDefaultHasRoleConfig.class, BasicController.class).autowire();
-		// @formatter:off
-		MockHttpServletRequestBuilder requestWithUser = get("/")
-				.with(user("user")
-						.authorities(new SimpleGrantedAuthority("CUSTOM_PREFIX_USER")));
-		// @formatter:on
-		this.mvc.perform(requestWithUser).andExpect(status().isOk());
-	}
-
-	@Test
-	public void getWhenCustomRolePrefixAndHasAnyRoleThenRespondsWithOk() throws Exception {
-		this.spring.register(GrantedAuthorityDefaultHasAnyRoleConfig.class, BasicController.class).autowire();
-		// @formatter:off
-		MockHttpServletRequestBuilder requestWithUser = get("/")
-				.with(user("user")
-						.authorities(new SimpleGrantedAuthority("CUSTOM_PREFIX_USER")));
-		MockHttpServletRequestBuilder requestWithAdmin = get("/")
-				.with(user("user")
-						.authorities(new SimpleGrantedAuthority("CUSTOM_PREFIX_ADMIN")));
-		// @formatter:on
-		this.mvc.perform(requestWithUser).andExpect(status().isOk());
-		this.mvc.perform(requestWithAdmin).andExpect(status().isOk());
-	}
-
 	@Test
 	public void getWhenExpressionHasIpAddressLocalhostConfiguredIpAddressIsLocalhostThenRespondsWithOk()
 			throws Exception {
@@ -597,38 +558,6 @@ public class AuthorizeHttpRequestsConfigurerTests {
 		this.mvc.perform(requestWithUser).andExpect(status().isForbidden());
 	}
 
-	@Configuration
-	@EnableWebSecurity
-	static class GrantedAuthorityDefaultHasRoleConfig {
-
-		@Bean
-		GrantedAuthorityDefaults grantedAuthorityDefaults() {
-			return new GrantedAuthorityDefaults("CUSTOM_PREFIX_");
-		}
-
-		@Bean
-		SecurityFilterChain myFilterChain(HttpSecurity http) throws Exception {
-			return http.authorizeHttpRequests((c) -> c.anyRequest().hasRole("USER")).build();
-		}
-
-	}
-
-	@Configuration
-	@EnableWebSecurity
-	static class GrantedAuthorityDefaultHasAnyRoleConfig {
-
-		@Bean
-		GrantedAuthorityDefaults grantedAuthorityDefaults() {
-			return new GrantedAuthorityDefaults("CUSTOM_PREFIX_");
-		}
-
-		@Bean
-		SecurityFilterChain myFilterChain(HttpSecurity http) throws Exception {
-			return http.authorizeHttpRequests((c) -> c.anyRequest().hasAnyRole("USER", "ADMIN")).build();
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class NoRequestsConfig {

config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeRequestsTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -78,7 +78,7 @@ public class AuthorizeRequestsTests {
 	@BeforeEach
 	public void setup() {
 		this.servletContext = spy(MockServletContext.mvc());
-		this.request = new MockHttpServletRequest(this.servletContext, "GET", "");
+		this.request = new MockHttpServletRequest("GET", "");
 		this.request.setMethod("GET");
 		this.response = new MockHttpServletResponse();
 		this.chain = new MockFilterChain();

config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultFiltersTests.java

@@ -85,10 +85,10 @@ public class DefaultFiltersTests {
 		List<SecurityFilterChain> filterChains = this.spring.getContext()
 			.getBean(FilterChainProxy.class)
 			.getFilterChains();
-		assertThat(filterChains).hasSize(1);
+		assertThat(filterChains.size()).isEqualTo(1);
 		DefaultSecurityFilterChain filterChain = (DefaultSecurityFilterChain) filterChains.get(0);
 		assertThat(filterChain.getRequestMatcher()).isInstanceOf(AnyRequestMatcher.class);
-		assertThat(filterChain.getFilters()).hasSize(1);
+		assertThat(filterChain.getFilters().size()).isEqualTo(1);
 		long filter = filterChain.getFilters()
 			.stream()
 			.filter((it) -> it instanceof UsernamePasswordAuthenticationFilter)
@@ -102,25 +102,25 @@ public class DefaultFiltersTests {
 		List<SecurityFilterChain> filterChains = this.spring.getContext()
 			.getBean(FilterChainProxy.class)
 			.getFilterChains();
-		assertThat(filterChains).hasSize(2);
+		assertThat(filterChains.size()).isEqualTo(2);
 		DefaultSecurityFilterChain firstFilter = (DefaultSecurityFilterChain) filterChains.get(0);
 		DefaultSecurityFilterChain secondFilter = (DefaultSecurityFilterChain) filterChains.get(1);
 		assertThat(firstFilter.getFilters().isEmpty()).isEqualTo(true);
 		assertThat(secondFilter.getRequestMatcher()).isInstanceOf(AnyRequestMatcher.class);
-		List<Class<? extends Filter>> classes = secondFilter.getFilters()
+		List<? extends Class<? extends Filter>> classes = secondFilter.getFilters()
 			.stream()
 			.map(Filter::getClass)
 			.collect(Collectors.toList());
-		assertThat(classes).contains(WebAsyncManagerIntegrationFilter.class);
-		assertThat(classes).contains(SecurityContextHolderFilter.class);
-		assertThat(classes).contains(HeaderWriterFilter.class);
-		assertThat(classes).contains(LogoutFilter.class);
-		assertThat(classes).contains(CsrfFilter.class);
-		assertThat(classes).contains(RequestCacheAwareFilter.class);
-		assertThat(classes).contains(SecurityContextHolderAwareRequestFilter.class);
-		assertThat(classes).contains(AnonymousAuthenticationFilter.class);
-		assertThat(classes).contains(ExceptionTranslationFilter.class);
-		assertThat(classes).contains(FilterSecurityInterceptor.class);
+		assertThat(classes.contains(WebAsyncManagerIntegrationFilter.class)).isTrue();
+		assertThat(classes.contains(SecurityContextHolderFilter.class)).isTrue();
+		assertThat(classes.contains(HeaderWriterFilter.class)).isTrue();
+		assertThat(classes.contains(LogoutFilter.class)).isTrue();
+		assertThat(classes.contains(CsrfFilter.class)).isTrue();
+		assertThat(classes.contains(RequestCacheAwareFilter.class)).isTrue();
+		assertThat(classes.contains(SecurityContextHolderAwareRequestFilter.class)).isTrue();
+		assertThat(classes.contains(AnonymousAuthenticationFilter.class)).isTrue();
+		assertThat(classes.contains(ExceptionTranslationFilter.class)).isTrue();
+		assertThat(classes.contains(FilterSecurityInterceptor.class)).isTrue();
 	}
 
 	@Test

config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -96,7 +96,7 @@ public class DefaultLoginPageConfigurerTests {
 						+ "    <meta name=\"author\" content=\"\">\n"
 						+ "    <title>Please sign in</title>\n"
 						+ "    <link href=\"https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M\" crossorigin=\"anonymous\">\n"
-						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" integrity=\"sha384-oOE/3m0LUMPub4kaC09mrdEhIc+e3exm4xOGxAmuFXhBNF4hcg/6MiAXAf5p0P56\" crossorigin=\"anonymous\"/>\n"
+						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" crossorigin=\"anonymous\"/>\n"
 						+ "  </head>\n"
 						+ "  <body>\n"
 						+ "     <div class=\"container\">\n"
@@ -145,7 +145,7 @@ public class DefaultLoginPageConfigurerTests {
 						+ "    <meta name=\"author\" content=\"\">\n"
 						+ "    <title>Please sign in</title>\n"
 						+ "    <link href=\"https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M\" crossorigin=\"anonymous\">\n"
-						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" integrity=\"sha384-oOE/3m0LUMPub4kaC09mrdEhIc+e3exm4xOGxAmuFXhBNF4hcg/6MiAXAf5p0P56\" crossorigin=\"anonymous\"/>\n"
+						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" crossorigin=\"anonymous\"/>\n"
 						+ "  </head>\n"
 						+ "  <body>\n"
 						+ "     <div class=\"container\">\n"
@@ -197,7 +197,7 @@ public class DefaultLoginPageConfigurerTests {
 						+ "    <meta name=\"author\" content=\"\">\n"
 						+ "    <title>Please sign in</title>\n"
 						+ "    <link href=\"https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M\" crossorigin=\"anonymous\">\n"
-						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" integrity=\"sha384-oOE/3m0LUMPub4kaC09mrdEhIc+e3exm4xOGxAmuFXhBNF4hcg/6MiAXAf5p0P56\" crossorigin=\"anonymous\"/>\n"
+						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" crossorigin=\"anonymous\"/>\n"
 						+ "  </head>\n"
 						+ "  <body>\n"
 						+ "     <div class=\"container\">\n"
@@ -250,7 +250,7 @@ public class DefaultLoginPageConfigurerTests {
 						+ "    <meta name=\"author\" content=\"\">\n"
 						+ "    <title>Please sign in</title>\n"
 						+ "    <link href=\"https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M\" crossorigin=\"anonymous\">\n"
-						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" integrity=\"sha384-oOE/3m0LUMPub4kaC09mrdEhIc+e3exm4xOGxAmuFXhBNF4hcg/6MiAXAf5p0P56\" crossorigin=\"anonymous\"/>\n"
+						+ "    <link href=\"https://getbootstrap.com/docs/4.0/examples/signin/signin.css\" rel=\"stylesheet\" crossorigin=\"anonymous\"/>\n"
 						+ "  </head>\n"
 						+ "  <body>\n"
 						+ "     <div class=\"container\">\n"