Add Workflow to Finalize a Release

2026-09-03 16:00:00 +00:00 · 2025-11-04 09:32:41 -07:00
206 changed files with 1308 additions and 3115 deletions
@@ -111,3 +111,11 @@ updates:
    labels:
      - 'type: task'
      - 'in: build'
+  - package-ecosystem: npm
+    target-branch: 6.3.x
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'in: build'
@@ -17,7 +17,7 @@ permissions:
 jobs:
  build:
    name: Build
-    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@v1
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
@@ -30,22 +30,29 @@ jobs:
  deploy-artifacts:
    name: Deploy Artifacts
    needs: [ build]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@v1
    with:
      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
      default-publish-milestones-central: true
    secrets: inherit
+  deploy-docs:
+    name: Deploy Docs
+    needs: [ build ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-docs.yml@v1
+    with:
+      should-deploy-docs: ${{ needs.build.outputs.should-deploy-artifacts }}
+    secrets: inherit
  deploy-schema:
    name: Deploy Schema
    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@v1
    with:
      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
    secrets: inherit
  perform-release:
    name: Perform Release
-    needs: [ deploy-artifacts, deploy-schema ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    needs: [ deploy-artifacts, deploy-docs, deploy-schema ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@v1
    with:
      should-perform-release: ${{ needs.deploy-artifacts.outputs.artifacts-deployed }}
      project-version: ${{ needs.deploy-artifacts.outputs.project-version }}
@@ -61,6 +68,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -1,76 +0,0 @@
-name: Defer Issues
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  defer-issues:
-    name: Defer Issues
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'spring-projects'
-    permissions:
-      issues: write
-    steps:
-    - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - name: Compute Version
-      id: compute-version
-      uses: spring-io/spring-release-actions/compute-version@0.0.3
-    - name: Get Today's Release Version
-      id: todays-release
-      uses: spring-io/spring-release-actions/get-todays-release-version@0.0.3
-      with:
-        snapshot-version: ${{ steps.compute-version.outputs.version }}
-        milestone-repository: ${{ github.repository }}
-        milestone-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Compute Next Version
-      id: next-version
-      uses: spring-io/spring-release-actions/compute-next-version@0.0.3
-      with:
-        version: ${{ steps.todays-release.outputs.release-version }}
-    - name: Schedule Next Milestone
-      uses: spring-io/spring-release-actions/schedule-milestone@0.0.3
-      with:
-        version: ${{ steps.next-version.outputs.version }}
-        version-date: ${{ steps.next-version.outputs.version-date }}
-        repository: ${{ github.repository }}
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Move Open Issues to Next Milestone
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        CURRENT_MILESTONE: ${{ steps.todays-release.outputs.release-version }}
-        NEXT_MILESTONE: ${{ steps.next-version.outputs.version }}
-      run: |
-        current_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
-          --jq ".[] | select(.title == \"$CURRENT_MILESTONE\") | .number")
-        if [ -z "$current_milestone_number" ]; then
-          echo "No milestone found for $CURRENT_MILESTONE"
-          exit 0
-        fi
-        next_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
-          --jq ".[] | select(.title == \"$NEXT_MILESTONE\") | .number")
-        if [ -z "$next_milestone_number" ]; then
-          echo "No milestone found for $NEXT_MILESTONE"
-          exit 1
-        fi
-        echo "Moving open issues from milestone '$CURRENT_MILESTONE' (#$current_milestone_number) to '$NEXT_MILESTONE' (#$next_milestone_number)"
-        page=1
-        while true; do
-          issues=$(gh api "repos/${{ github.repository }}/issues?milestone=$current_milestone_number&state=open&per_page=100&page=$page" \
-            --jq '.[].number')
-          if [ -z "$issues" ]; then
-            break
-          fi
-          for issue in $issues; do
-            echo "Moving issue/PR #$issue to milestone $NEXT_MILESTONE"
-            gh api repos/${{ github.repository }}/issues/$issue \
-              --method PATCH \
-              --field milestone=$next_milestone_number \
-              --silent
-          done
-          page=$((page + 1))
-        done
-        echo "Done."
@@ -17,7 +17,7 @@ jobs:
    if: github.repository_owner == 'spring-projects'
    steps:
    - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
      with:
        ref: docs-build
        fetch-depth: 1
@@ -2,10 +2,6 @@ name: Finalize Release

 on:
  workflow_dispatch: # Manual trigger
-    inputs:
-      version:
-        description: The Spring Security release to finalize (e.g. 7.0.0-RC2)
-        required: true

 env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -14,14 +10,32 @@ permissions:
  contents: read

 jobs:
+  project-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.project-version.outputs.version }}
+    steps:
+      - id: project-version
+        run: echo "version=$(grep '^version=' gradle.properties | cut -d'=' -f2)" >> $GITHUB_OUTPUT
  perform-release:
    name: Perform Release
+    needs: [ project-version ]
    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@v1
    with:
      should-perform-release: true
-      project-version: ${{ inputs.version }}
+      project-version: ${{ needs.project-version.outputs.version }}
      milestone-repo-url: https://repo1.maven.org/maven2
      release-repo-url: https://repo1.maven.org/maven2
      artifact-path: org/springframework/security/spring-security-core
      slack-announcing-id: spring-security-announcing
    secrets: inherit
+  send-notification:
+    name: Send Notification
+    needs: [ perform-release ]
+    if: ${{ !success() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -19,14 +19,14 @@ jobs:
          git config --global user.name 'github-actions[bot]'
          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v4
      - name: Set up JDK 17
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
      - name: Set up Gradle
-        uses: gradle/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        uses: gradle/gradle-build-action@v2
      - name: Upgrade Wrappers
        run: ./gradlew clean upgradeGradleWrapperAll --continue -Porg.gradle.java.installations.auto-download=false
        env:
@@ -30,6 +30,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -11,9 +11,9 @@ jobs:
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'spring-projects/spring-security' }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v4
      - name: Set up gradle
-        uses: spring-io/spring-gradle-build-action@efc55f07f4dfa22f2afd97f9ea1be4212eeed737 # v2.0.5
+        uses: spring-io/spring-gradle-build-action@v2
        with:
          java-version: '17'
          distribution: 'temurin'
@@ -24,9 +24,9 @@ jobs:
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'spring-projects/spring-security' }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v4
      - name: Set up gradle
-        uses: spring-io/spring-gradle-build-action@efc55f07f4dfa22f2afd97f9ea1be4212eeed737 # v2.0.5
+        uses: spring-io/spring-gradle-build-action@v2
        with:
          java-version: '17'
          distribution: 'temurin'
@@ -34,7 +34,7 @@ jobs:
        run: ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
      - name: Upload Docs
        id: upload
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@v4
        with:
          name: docs
          path: docs/build/site
@@ -46,6 +46,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
      with:
        fetch-depth: 1
    - name: Dispatch
@@ -16,9 +16,9 @@ jobs:
    name: Update on Supported Branches
    strategy:
      matrix:
-        branch: [ '6.4.x', '6.5.x', 'main' ]
+        branch: [ '5.8.x', '6.2.x', '6.3.x', 'main' ]
    steps:
-      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@e28269199d1d27975cf7f65e16d6095c555b3cd0
        name: Update
        with:
          docs-branch: ${{ matrix.branch }}
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Update on docs-build
    steps:
-      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@e28269199d1d27975cf7f65e16d6095c555b3cd0
        name: Update
        with:
          docs-branch: 'docs-build'
@@ -9,7 +9,7 @@ permissions:
 jobs:
  update-scheduled-release-version:
    name: Update Scheduled Release Version
-    uses: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    uses: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml@v1
    secrets: inherit
  send-notification:
    name: Send Notification
@@ -18,6 +18,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -68,27 +68,6 @@ The https://github.com/spring-projects/spring-security/tree/docs-build[playbook

 Discover more commands with `./gradlew tasks`.

-=== IDE setup (IntelliJ)
-
-No special steps are needed to open Spring Security in IntelliJ.
-
-=== IDE setup (Eclipse and VS Code)
-
-To work in Eclipse or VS Code, first generate Eclipse metadata so you can import the project into Eclipse or VS Code:
-
-[indent=0]
----
-./gradlew cleanEclipse eclipse
----
-
-If you have not built the project yet, run `./gradlew publishToMavenLocal` first so dependencies are resolved.
-
-*VS Code:* Open the repository root as a folder. The repository includes `.vscode/settings.json` which disables automatic Gradle import so that the generated Eclipse metadata (`.classpath`, `.project`) is used. Do not use the Gradle for Java extension to import the project.
-
-*Eclipse:* File → Import → General → Existing Projects into Workspace, then select the repository root.
-
-The build uses a custom Eclipse plugin to work around Gradle dependency cycles that confuse IDE metadata generation. You may see Eclipse warnings about `xml-apis` from some test dependencies; those are excluded in the build and can be ignored.
-
 == Getting Support
 Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
 https://spring.io/support[Commercial support] is available too.
@@ -39,7 +39,7 @@ interface EvaluationContextPostProcessor<I> {
 	 * that was passed in.
 	 * @param context the original {@link EvaluationContext}
 	 * @param invocation the security invocation object (i.e. Message)
-	 * @return the updated context.
+	 * @return the upated context.
 	 */
 	EvaluationContext postProcess(EvaluationContext context, I invocation);

@@ -20,7 +20,7 @@ import org.springframework.security.acls.model.Acl;

 /**
 * Strategy used by {@link AclImpl} to determine whether a principal is permitted to call
- * administrative methods on the <code>AclImpl</code>.
+ * adminstrative methods on the <code>AclImpl</code>.
 *
 * @author Ben Alex
 */
@@ -42,7 +42,7 @@ public class GrantedAuthoritySid implements Sid {
 	public GrantedAuthoritySid(GrantedAuthority grantedAuthority) {
 		Assert.notNull(grantedAuthority, "GrantedAuthority required");
 		Assert.notNull(grantedAuthority.getAuthority(),
-				"This Sid is only compatible with GrantedAuthority that provide a non-null getAuthority()");
+				"This Sid is only compatible with GrantedAuthoritys that provide a non-null getAuthority()");
 		this.grantedAuthority = grantedAuthority.getAuthority();
 	}

@@ -160,7 +160,7 @@ public class JdbcAclService implements AclService {
 				this.findChildrenSql = DEFAULT_SELECT_ACL_WITH_PARENT_SQL_WITH_CLASS_ID_TYPE;
 			}
 			else {
-				log.debug("Find children statement has already been overridden, so not overriding the default");
+				log.debug("Find children statement has already been overridden, so not overridding the default");
 			}
 		}
 	}
@@ -50,7 +50,7 @@ import org.springframework.util.Assert;
 * The default settings are for HSQLDB. If you are using a different database you will
 * probably need to set the {@link #setSidIdentityQuery(String) sidIdentityQuery} and
 * {@link #setClassIdentityQuery(String) classIdentityQuery} properties appropriately. The
- * other queries, SQL inserts and updates can also be customized to accommodate schema
+ * other queries, SQL inserts and updates can also be customized to accomodate schema
 * variations, but must produce results consistent with those expected by the defaults.
 * <p>
 * See the appendix of the Spring Security reference manual for more information on the
@@ -471,7 +471,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 				this.insertClass = DEFAULT_INSERT_INTO_ACL_CLASS_WITH_ID;
 			}
 			else {
-				log.debug("Insert class statement has already been overridden, so not overriding the default");
+				log.debug("Insert class statement has already been overridden, so not overridding the default");
 			}
 		}
 	}
@@ -2,12 +2,12 @@ apply plugin: 'io.spring.convention.spring-module'
 apply plugin: 'io.freefair.aspectj'

 compileAspectj {
-	sourceCompatibility = "17"
-	targetCompatibility = "17"
+	sourceCompatibility "17"
+	targetCompatibility "17"
 }
 compileTestAspectj {
-	sourceCompatibility = "17"
-	targetCompatibility = "17"
+	sourceCompatibility "17"
+	targetCompatibility "17"
 }

 dependencies {
@@ -10,7 +10,7 @@ buildscript {
 		classpath libs.com.netflix.nebula.nebula.project.plugin
 	}
 	repositories {
-		maven { url='https://plugins.gradle.org/m2/' }
+		maven { url 'https://plugins.gradle.org/m2/' }
 	}
 }

@@ -35,30 +35,57 @@ ext.milestoneBuild = !(snapshotBuild || releaseBuild)

 repositories {
 	mavenCentral()
-	maven { url = "https://repo.spring.io/milestone" }
+	maven { url "https://repo.spring.io/milestone" }
 }

 springRelease {
 	weekOfMonth = 3
 	dayOfWeek = 1
 	referenceDocUrl = "https://docs.spring.io/spring-security/reference/{version}/index.html"
-	apiDocUrl = "https://docs.spring.io/spring-security/reference/{version}/api/java/index.html"
+	apiDocUrl = "https://docs.spring.io/spring-security/site/docs/{version}/api/"
 	replaceSnapshotVersionInReferenceDocUrl = true
 }

+def toolchainVersion() {
+	if (project.hasProperty('testToolchain')) {
+		return project.property('testToolchain').toString().toInteger()
+	}
+	return 17
+}
+
+subprojects {
+	java {
+		toolchain {
+			languageVersion = JavaLanguageVersion.of(toolchainVersion())
+		}
+	}
+	kotlin {
+		jvmToolchain {
+			languageVersion = JavaLanguageVersion.of(17)
+		}
+	}
+	tasks.withType(JavaCompile).configureEach {
+		options.encoding = "UTF-8"
+		options.compilerArgs.add("-parameters")
+		options.release.set(17)
+	}
+}
+
 allprojects {
 	if (!['spring-security-bom', 'spring-security-docs'].contains(project.name)) {
 		apply plugin: 'io.spring.javaformat'
 		apply plugin: 'checkstyle'

-		pluginManager.withPlugin("io.spring.convention.checkstyle") {
-			dependencies {
-				checkstyle libs.io.spring.javaformat.spring.javaformat.checkstyle
+		pluginManager.withPlugin("io.spring.convention.checkstyle", { plugin ->
+			configure(plugin) {
+				dependencies {
+					checkstyle libs.io.spring.javaformat.spring.javaformat.checkstyle
+				}
+				checkstyle {
+					toolVersion = '8.34'
+				}
 			}
-			checkstyle {
-				toolVersion = '8.34'
-			}
-		}
+		})

 		if (project.name.contains('sample')) {
 			tasks.whenTaskAdded { task ->
@@ -12,7 +12,7 @@ java {
 repositories {
 	gradlePluginPortal()
 	mavenCentral()
-	maven { url = 'https://repo.spring.io/snapshot' }
+	maven { url 'https://repo.spring.io/snapshot' }
 }

 sourceSets {
@@ -0,0 +1,5 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.5.1-bin.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
@@ -0,0 +1,240 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+
+APP_NAME="Gradle"
+APP_BASE_NAME=${0##*/}
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+# Collect all arguments for the java command;
+#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#     shell script including quotes and variable substitutions, so put them in
+#     double quotes to make sure that they get re-expanded; and
+#   * put everything else in single quotes, so that it's not re-expanded.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
@@ -0,0 +1,91 @@
+@rem
+@rem Copyright 2004-present the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
@@ -81,8 +81,8 @@ class ArtifactoryPlugin implements Plugin<Project> {
 				repository {
 					repoKey = isSnapshot ? snapshotRepository : isMilestone ? milestoneRepository : releaseRepository
 					if(project.hasProperty('artifactoryUsername')) {
-						username = project.artifactoryUsername
-						password = project.artifactoryPassword
+						username = artifactoryUsername
+						password = artifactoryPassword
 					}
 				}
 			}
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package io.spring.gradle.convention
+
+import org.gradle.api.plugins.JavaPlugin
+import org.gradle.api.tasks.bundling.Zip
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+
+public class DeployDocsPlugin implements Plugin<Project> {
+
+	@Override
+	public void apply(Project project) {
+		project.getPluginManager().apply('org.hidetake.ssh')
+
+		project.ssh.settings {
+			knownHosts = allowAnyHosts
+		}
+		project.remotes {
+			docs {
+				role 'docs'
+				if (project.hasProperty('deployDocsHost')) {
+					host = project.findProperty('deployDocsHost')
+				} else {
+					host = 'docs.af.pivotal.io'
+				}
+				retryCount = 5 // retry 5 times (default is 0)
+				retryWaitSec = 10 // wait 10 seconds between retries (default is 0)
+				user = project.findProperty('deployDocsSshUsername')
+				if (project.hasProperty('deployDocsSshKeyPath')) {
+					identity = project.file(project.findProperty('deployDocsSshKeyPath'))
+				} else if (project.hasProperty('deployDocsSshKey')) {
+					identity = project.findProperty('deployDocsSshKey')
+				}
+				if(project.hasProperty('deployDocsSshPassphrase')) {
+					passphrase = project.findProperty('deployDocsSshPassphrase')
+				}
+			}
+		}
+
+		project.task('deployDocs') {
+			dependsOn 'docsZip'
+			doFirst {
+				project.ssh.run {
+					session(project.remotes.docs) {
+						def now = System.currentTimeMillis()
+						def name = project.rootProject.name
+						def version = project.rootProject.version
+						def tempPath = "/tmp/${name}-${now}-docs/".replaceAll(' ', '_')
+						execute "mkdir -p $tempPath"
+
+						project.tasks.docsZip.outputs.each { o ->
+							put from: o.files, into: tempPath
+						}
+
+						execute "unzip $tempPath*.zip -d $tempPath"
+
+						def extractPath = "/var/www/domains/spring.io/docs/htdocs/autorepo/docs/${name}/${version}/"
+
+						execute "rm -rf $extractPath"
+						execute "mkdir -p $extractPath"
+						execute "mv $tempPath/docs/* $extractPath"
+						execute "chmod -R g+w $extractPath"
+					}
+				}
+			}
+		}
+	}
+}
@@ -17,6 +17,7 @@ public class DocsPlugin implements Plugin<Project> {

 		PluginManager pluginManager = project.getPluginManager();
 		pluginManager.apply(BasePlugin);
+		pluginManager.apply(DeployDocsPlugin);
 		pluginManager.apply(JavadocApiPlugin);

 		Task docsZip = project.tasks.create('docsZip', Zip) {
@@ -31,12 +32,12 @@ public class DocsPlugin implements Plugin<Project> {
 				into 'api'
 			}
 			into 'docs'
-			duplicatesStrategy = 'exclude'
+			duplicatesStrategy 'exclude'
 		}

 		Task docs = project.tasks.create("docs") {
 			group = 'Documentation'
-			description = 'An aggregator task to generate all the documentation'
+			description 'An aggregator task to generate all the documentation'
 			dependsOn docsZip
 		}
 		project.tasks.assemble.dependsOn docs
@@ -90,7 +90,7 @@ public class IntegrationTestPlugin implements Plugin<Project> {
 		project.plugins.withType(IdeaPlugin) {
 			project.idea {
 				module {
-					testSources.from(project.file('src/integration-test/java'))
+					testSourceDirs += project.file('src/integration-test/java')
 					scopes.TEST.plus += [ project.configurations.integrationTestCompileClasspath ]
 				}
 			}
@@ -105,7 +105,7 @@ public class IntegrationTestPlugin implements Plugin<Project> {
 			project.plugins.withType(IdeaPlugin) {
 				project.idea {
 					module {
-						testSources.from(project.file('src/integration-test/groovy'))
+						testSourceDirs += project.file('src/integration-test/groovy')
 					}
 				}
 			}
@@ -26,7 +26,7 @@ import org.gradle.api.Action;
 import org.gradle.api.JavaVersion
 import org.gradle.api.Plugin;
 import org.gradle.api.Project;
-import org.gradle.api.plugins.JavaPluginExtension;
+import org.gradle.api.plugins.JavaPluginConvention;
 import org.gradle.api.tasks.SourceSet;
 import org.gradle.api.tasks.javadoc.Javadoc;
 import org.slf4j.Logger;
@@ -71,7 +71,7 @@ public class JavadocApiPlugin implements Plugin<Project> {
 		}

 		api.setMaxMemory("1024m");
-		api.setDestinationDir(project.layout.getBuildDirectory().dir("api").get().getAsFile());
+		api.setDestinationDir(new File(project.getBuildDir(), "api"));

 		project.getPluginManager().apply("io.spring.convention.javadoc-options");
 	}
@@ -99,7 +99,7 @@ public class JavadocApiPlugin implements Plugin<Project> {
 			public void execute(SpringModulePlugin plugin) {
 				logger.info("Added sources for {}", project);

-				JavaPluginExtension java = project.getExtensions().getByType(JavaPluginExtension.class);
+				JavaPluginConvention java = project.getConvention().getPlugin(JavaPluginConvention.class);
 				SourceSet mainSourceSet = java.getSourceSets().getByName("main");

 				api.setSource(api.getSource().plus(mainSourceSet.getAllJava()));
@@ -40,7 +40,7 @@ public class SchemaZipPlugin implements Plugin<Project> {
 						throw new IllegalStateException("Could not find schema file for resource name " + schemaResourceName + " in src/main/resources")
 					}
 					schemaZip.into (shortName) {
-						duplicatesStrategy = 'exclude'
+						duplicatesStrategy 'exclude'
 						from xsdFile.path
 					}
 					versionlessXsd.getInputFiles().from(xsdFile.path)
@@ -35,7 +35,6 @@ class SpringModulePlugin extends AbstractSpringJavaPlugin {
 		pluginManager.apply(SpringMavenPlugin.class);
 		pluginManager.apply(CheckClasspathForProhibitedDependenciesPlugin.class);
 		pluginManager.apply("io.spring.convention.jacoco");
-		pluginManager.apply("java-toolchain");

 		def deployArtifacts = project.task("deployArtifacts")
 		deployArtifacts.group = 'Deploy tasks'
@@ -1,36 +0,0 @@
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
-import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
-
-def toolchainVersion() {
-	if (project.hasProperty('testToolchain')) {
-		return project.property('testToolchain').toString().toInteger()
-	}
-	return 17
-}
-
-java {
-	toolchain {
-		languageVersion = JavaLanguageVersion.of(toolchainVersion())
-	}
-}
-
-tasks.withType(JavaCompile).configureEach {
-	options.encoding = "UTF-8"
-	options.compilerArgs.add("-parameters")
-	options.release = 17
-}
-
-pluginManager.withPlugin("org.jetbrains.kotlin.jvm") {
-	kotlin {
-		jvmToolchain {
-			languageVersion = JavaLanguageVersion.of(toolchainVersion())
-		}
-	}
-
-	tasks.withType(KotlinCompile).configureEach {
-		compilerOptions {
-			javaParameters = true
-			jvmTarget.set(JvmTarget.JVM_17)
-		}
-	}
-}
@@ -30,6 +30,16 @@ ossrh: {
 		}
 	}
 },
+docs: {
+	stage('Deploy Docs') {
+		node {
+			checkout scm
+			withCredentials([file(credentialsId: 'docs.spring.io-jenkins_private_ssh_key', variable: 'DEPLOY_SSH_KEY')]) {
+				sh "./gradlew deployDocs -PdeployDocsSshKeyPath=$DEPLOY_SSH_KEY -PdeployDocsSshUsername=$SPRING_DOCS_USERNAME --refresh-dependencies --no-daemon --stacktrace"
+			}
+		}
+	}
+},
 schema: {
 	stage('Deploy Schema') {
 		node {
@@ -39,4 +49,4 @@ schema: {
 			}
 		}
 	}
-}
+}
@@ -326,7 +326,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 	/**
 	 * Use this {@code RequestMatcher} to match proxy receptor requests. Without setting
 	 * this matcher, {@link CasAuthenticationFilter} will not capture any proxy receptor
-	 * requests.
+	 * requets.
 	 * @param proxyReceptorMatcher the {@link RequestMatcher} to use
 	 * @since 6.5
 	 */
@@ -383,8 +383,8 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 	}

 	/**
-	 * Indicates if the request is eligible to process a service ticket. This method
-	 * exists for readability.
+	 * Indicates if the request is elgible to process a service ticket. This method exists
+	 * for readability.
 	 * @param request
 	 * @param response
 	 * @return
@@ -396,7 +396,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 	}

 	/**
-	 * Indicates if the request is eligible to process a proxy ticket.
+	 * Indicates if the request is elgible to process a proxy ticket.
 	 * @param request
 	 * @return
 	 */
@@ -419,7 +419,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
 	}

 	/**
-	 * Indicates if the request is eligible to be processed as the proxy receptor.
+	 * Indicates if the request is elgible to be processed as the proxy receptor.
 	 * @param request
 	 * @return
 	 */
@@ -144,14 +144,14 @@ tasks.named('processResources', ProcessResources).configure {
 		into 'org/springframework/security/config/'
 	}
 	from(rncToXsd) {
-		duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+		duplicatesStrategy DuplicatesStrategy.EXCLUDE
 		into 'org/springframework/security/config/'
 	}
 }

 tasks.named('sourcesJar', Jar).configure {
 	from(rncToXsd) {
-		duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+		duplicatesStrategy DuplicatesStrategy.EXCLUDE
 		into 'org/springframework/security/config/'
 	}
 }
@@ -31,7 +31,6 @@ import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebDriverException;
@@ -56,7 +55,6 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.FilterChainProxy;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.util.StringUtils;
 import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
 import org.springframework.web.filter.DelegatingFilterProxy;
 import org.springframework.web.servlet.config.annotation.EnableWebMvc;
@@ -69,7 +67,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 *
 * @author Daniel Garnier-Moiroux
 */
-@Disabled
+@org.junit.jupiter.api.Disabled
 class WebAuthnWebDriverTests {

 	private String baseUrl;
@@ -84,8 +82,6 @@ class WebAuthnWebDriverTests {

 	private static final String PASSWORD = "password";

-	private String authenticatorId = null;
-
 	@BeforeAll
 	static void startChromeDriverService() throws Exception {
 		driverService = new ChromeDriverService.Builder().usingAnyFreePort().build();
@@ -148,7 +144,7 @@ class WebAuthnWebDriverTests {
 	@Test
 	void loginWhenNoValidAuthenticatorCredentialsThenRejects() {
 		createVirtualAuthenticator(true);
-		this.getAndWait("/", "/login");
+		this.driver.get(this.baseUrl);
 		this.driver.findElement(signinWithPasskeyButton()).click();
 		await(() -> assertThat(this.driver.getCurrentUrl()).endsWith("/login?error"));
 	}
@@ -157,7 +153,7 @@ class WebAuthnWebDriverTests {
 	void registerWhenNoLabelThenRejects() {
 		login();

-		this.getAndWait("/webauthn/register");
+		this.driver.get(this.baseUrl + "/webauthn/register");

 		this.driver.findElement(registerPasskeyButton()).click();
 		assertHasAlertStartingWith("error", "Error: Passkey Label is required");
@@ -167,7 +163,7 @@ class WebAuthnWebDriverTests {
 	void registerWhenAuthenticatorNoUserVerificationThenRejects() {
 		createVirtualAuthenticator(false);
 		login();
-		this.getAndWait("/webauthn/register");
+		this.driver.get(this.baseUrl + "/webauthn/register");
 		this.driver.findElement(passkeyLabel()).sendKeys("Virtual authenticator");
 		this.driver.findElement(registerPasskeyButton()).click();

@@ -182,8 +178,7 @@ class WebAuthnWebDriverTests {
 	 * <li>Step 1: Log in with username / password</li>
 	 * <li>Step 2: Register a credential from the virtual authenticator</li>
 	 * <li>Step 3: Log out</li>
-	 * <li>Step 4: Log in with the authenticator (no allowCredentials)</li>
-	 * <li>Step 5: Log in again with the same authenticator (with allowCredentials)</li>
+	 * <li>Step 4: Log in with the authenticator</li>
 	 * </ul>
 	 */
 	@Test
@@ -195,7 +190,7 @@ class WebAuthnWebDriverTests {
 		login();

 		// Step 2: register a credential from the virtual authenticator
-		this.getAndWait("/webauthn/register");
+		this.driver.get(this.baseUrl + "/webauthn/register");
 		this.driver.findElement(passkeyLabel()).sendKeys("Virtual authenticator");
 		this.driver.findElement(registerPasskeyButton()).click();

@@ -217,58 +212,9 @@ class WebAuthnWebDriverTests {
 		logout();

 		// Step 4: log in with the virtual authenticator
-		this.getAndWait("/webauthn/register", "/login");
+		this.driver.get(this.baseUrl + "/webauthn/register");
 		this.driver.findElement(signinWithPasskeyButton()).click();
 		await(() -> assertThat(this.driver.getCurrentUrl()).endsWith("/webauthn/register?continue"));
-
-		// Step 5: authenticate while being already logged in
-		// This simulates some use-cases with MFA. Since the user is already logged in,
-		// the "allowCredentials" property is populated
-		this.getAndWait("/login");
-		this.driver.findElement(signinWithPasskeyButton()).click();
-		await(() -> assertThat(this.driver.getCurrentUrl()).endsWith("/"));
-	}
-
-	@Test
-	void registerWhenAuthenticatorAlreadyRegisteredThenRejects() {
-		createVirtualAuthenticator(true);
-		login();
-		registerAuthenticator("Virtual authenticator");
-
-		// Cannot re-register the same authenticator because excludeCredentials
-		// is not empty and contains the given authenticator
-		this.driver.findElement(passkeyLabel()).sendKeys("Same authenticator");
-		this.driver.findElement(registerPasskeyButton()).click();
-
-		await(() -> assertHasAlertStartingWith("error", "Registration failed"));
-	}
-
-	@Test
-	void registerSecondAuthenticatorThenSucceeds() {
-		createVirtualAuthenticator(true);
-		login();
-
-		registerAuthenticator("Virtual authenticator");
-		this.getAndWait("/webauthn/register");
-		List<WebElement> passkeyRows = this.driver.findElements(passkeyTableRows());
-		assertThat(passkeyRows).hasSize(1)
-			.first()
-			.extracting((row) -> row.findElement(firstCell()))
-			.extracting(WebElement::getText)
-			.isEqualTo("Virtual authenticator");
-
-		// Create second authenticator and register
-		removeAuthenticator();
-		createVirtualAuthenticator(true);
-		registerAuthenticator("Second virtual authenticator");
-
-		this.getAndWait("/webauthn/register");
-
-		passkeyRows = this.driver.findElements(passkeyTableRows());
-		assertThat(passkeyRows).hasSize(2)
-			.extracting((row) -> row.findElement(firstCell()))
-			.extracting(WebElement::getText)
-			.contains("Second virtual authenticator");
 	}

 	/**
@@ -285,14 +231,11 @@ class WebAuthnWebDriverTests {
 	 * "https://chromedevtools.github.io/devtools-protocol/tot/WebAuthn/">https://chromedevtools.github.io/devtools-protocol/tot/WebAuthn/</a>
 	 */
 	private void createVirtualAuthenticator(boolean userIsVerified) {
-		if (StringUtils.hasText(this.authenticatorId)) {
-			throw new IllegalStateException("Authenticator already exists, please remove it before re-creating one");
-		}
 		HasCdp cdpDriver = (HasCdp) this.driver;
 		cdpDriver.executeCdpCommand("WebAuthn.enable", Map.of("enableUI", false));
 		// this.driver.addVirtualAuthenticator(createVirtualAuthenticatorOptions());
 		//@formatter:off
-		Map<String, Object> cmdResponse = cdpDriver.executeCdpCommand("WebAuthn.addVirtualAuthenticator",
+		cdpDriver.executeCdpCommand("WebAuthn.addVirtualAuthenticator",
 				Map.of(
 						"options",
 						Map.of(
@@ -305,38 +248,21 @@ class WebAuthnWebDriverTests {
 						)
 				));
 		//@formatter:on
-		this.authenticatorId = cmdResponse.get("authenticatorId").toString();
-	}
-
-	private void removeAuthenticator() {
-		HasCdp cdpDriver = (HasCdp) this.driver;
-		cdpDriver.executeCdpCommand("WebAuthn.removeVirtualAuthenticator",
-				Map.of("authenticatorId", this.authenticatorId));
-		this.authenticatorId = null;
 	}

 	private void login() {
-		this.getAndWait("/", "/login");
+		this.driver.get(this.baseUrl);
 		this.driver.findElement(usernameField()).sendKeys(USERNAME);
 		this.driver.findElement(passwordField()).sendKeys(PASSWORD);
 		this.driver.findElement(signinWithUsernamePasswordButton()).click();
-		// Ensure login has completed
-		await(() -> assertThat(this.driver.getCurrentUrl()).doesNotContain("/login"));
 	}

 	private void logout() {
-		this.getAndWait("/logout");
+		this.driver.get(this.baseUrl + "/logout");
 		this.driver.findElement(logoutButton()).click();
 		await(() -> assertThat(this.driver.getCurrentUrl()).endsWith("/login?logout"));
 	}

-	private void registerAuthenticator(String passkeyName) {
-		this.getAndWait("/webauthn/register");
-		this.driver.findElement(passkeyLabel()).sendKeys(passkeyName);
-		this.driver.findElement(registerPasskeyButton()).click();
-		await(() -> assertThat(this.driver.getCurrentUrl()).endsWith("/webauthn/register?success"));
-	}
-
 	private AbstractStringAssert<?> assertHasAlertStartingWith(String alertType, String alertMessage) {
 		WebElement alert = this.driver.findElement(new By.ById(alertType));
 		assertThat(alert.isDisplayed())
@@ -363,15 +289,6 @@ class WebAuthnWebDriverTests {
 			});
 	}

-	private void getAndWait(String endpoint) {
-		this.getAndWait(endpoint, endpoint);
-	}
-
-	private void getAndWait(String endpoint, String redirectUrl) {
-		this.driver.get(this.baseUrl + endpoint);
-		this.await(() -> assertThat(this.driver.getCurrentUrl()).endsWith(redirectUrl));
-	}
-
 	private static By.ById passkeyLabel() {
 		return new By.ById("label");
 	}
@@ -408,10 +325,6 @@ class WebAuthnWebDriverTests {
 		return new By.ByCssSelector("button");
 	}

-	private static By.ByCssSelector deletePasskeyButton() {
-		return new By.ByCssSelector("table > tbody > tr > button");
-	}
-
 	/**
 	 * The configuration for WebAuthN tests. It accesses the Server's current port, so we
 	 * can configurer WebAuthnConfigurer#allowedOrigin
@@ -177,7 +177,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * Gets a shared Object. Note that object hierarchies are not considered.
+	 * Gets a shared Object. Note that object heirarchies are not considered.
 	 * @param sharedType the type of the shared Object
 	 * @return the shared Object or null if it is not found
 	 */
@@ -360,7 +360,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui

 	/**
 	 * Subclasses must implement this method to build the object that is being returned.
-	 * @return the Object to be built or null if the implementation allows it
+	 * @return the Object to be buit or null if the implementation allows it
 	 */
 	protected abstract O performBuild();

@@ -414,13 +414,13 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	private enum BuildState {

 		/**
-		 * This is the state before the {@link SecurityBuilder#build()} is invoked
+		 * This is the state before the {@link Builder#build()} is invoked
 		 */
 		UNBUILT(0),

 		/**
-		 * The state from when {@link SecurityBuilder#build()} is first invoked until all
-		 * the {@link SecurityConfigurer#init(SecurityBuilder)} methods have been invoked.
+		 * The state from when {@link Builder#build()} is first invoked until all the
+		 * {@link SecurityConfigurer#init(SecurityBuilder)} methods have been invoked.
 		 */
 		INITIALIZING(1),

@@ -42,8 +42,7 @@ final class MethodSecuritySelector implements ImportSelector {
 		.isPresent("org.springframework.security.data.aot.hint.AuthorizeReturnObjectDataHintsRegistrar", null);

 	private static final boolean isWebPresent = ClassUtils
-		.isPresent("org.springframework.web.servlet.DispatcherServlet", null)
-			&& ClassUtils.isPresent("org.springframework.security.web.util.ThrowableAnalyzer", null);
+		.isPresent("org.springframework.web.servlet.DispatcherServlet", null);

 	private static final boolean isObservabilityPresent = ClassUtils
 		.isPresent("io.micrometer.observation.ObservationRegistry", null);
@@ -82,7 +82,7 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>>
 	<C> void setSharedObject(Class<C> sharedType, C object);

 	/**
-	 * Gets a shared Object. Note that object hierarchies are not considered.
+	 * Gets a shared Object. Note that object heirarchies are not considered.
 	 * @param sharedType the type of the shared Object
 	 * @return the shared Object or null if it is not found
 	 */
@@ -133,7 +133,7 @@ final class FilterOrderRegistration {
 	/**
 	 * Register a {@link Filter} with its specific position. If the {@link Filter} was
 	 * already registered before, the position previously defined is not going to be
-	 * overridden
+	 * overriden
 	 * @param filter the {@link Filter} to register
 	 * @param position the position to associate with the {@link Filter}
 	 */
@@ -2052,6 +2052,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	 * 		http
 	 * 			// ...
 	 * 			.webAuthn((webAuthn) -&gt; webAuthn
+	 * 				.rpName("Spring Security Relying Party")
 	 * 				.rpId("example.com")
 	 * 				.allowedOrigins("https://example.com")
 	 * 			);
@@ -305,7 +305,7 @@ public final class LogoutConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Gets the logoutSuccessUrl or null if a
+	 * Gets the logoutSuccesUrl or null if a
 	 * {@link #logoutSuccessHandler(LogoutSuccessHandler)} was configured.
 	 * @return the logoutSuccessUrl
 	 */
@@ -146,7 +146,7 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>

 	/**
 	 * This should not use RequestAttributeSecurityContextRepository since that is
-	 * stateless and session management is about state management.
+	 * stateless and sesison management is about state management.
 	 */
 	private SecurityContextRepository sessionManagementSecurityContextRepository = new HttpSessionSecurityContextRepository();

@@ -177,7 +177,6 @@ public class WebAuthnConfigurer<H extends HttpSecurityBuilder<H>>
 		WebAuthnAuthenticationFilter webAuthnAuthnFilter = new WebAuthnAuthenticationFilter();
 		webAuthnAuthnFilter.setAuthenticationManager(
 				new ProviderManager(new WebAuthnAuthenticationProvider(rpOperations, userDetailsService)));
-		webAuthnAuthnFilter = postProcess(webAuthnAuthnFilter);
 		WebAuthnRegistrationFilter webAuthnRegistrationFilter = new WebAuthnRegistrationFilter(userCredentials,
 				rpOperations);
 		PublicKeyCredentialCreationOptionsFilter creationOptionsFilter = new PublicKeyCredentialCreationOptionsFilter(
@@ -257,10 +256,9 @@ public class WebAuthnConfigurer<H extends HttpSecurityBuilder<H>>
 			PublicKeyCredentialUserEntityRepository userEntities, UserCredentialRepository userCredentials) {
 		Optional<WebAuthnRelyingPartyOperations> webauthnOperationsBean = getBeanOrNull(
 				WebAuthnRelyingPartyOperations.class);
-		String rpName = (this.rpName != null) ? this.rpName : this.rpId;
-		return webauthnOperationsBean
-			.orElseGet(() -> new Webauthn4JRelyingPartyOperations(userEntities, userCredentials,
-					PublicKeyCredentialRpEntity.builder().id(this.rpId).name(rpName).build(), this.allowedOrigins));
+		return webauthnOperationsBean.orElseGet(() -> new Webauthn4JRelyingPartyOperations(userEntities,
+				userCredentials, PublicKeyCredentialRpEntity.builder().id(this.rpId).name(this.rpName).build(),
+				this.allowedOrigins));
 	}

 }
@@ -16,12 +16,10 @@

 package org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization;

-import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.function.Consumer;

-import jakarta.servlet.Filter;
 import jakarta.servlet.http.HttpServletRequest;

 import org.springframework.http.HttpMethod;
@@ -38,12 +36,10 @@ import org.springframework.security.oauth2.server.authorization.authentication.O
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationValidator;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationConsentAuthenticationProvider;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationConsentAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
 import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
 import org.springframework.security.oauth2.server.authorization.web.OAuth2AuthorizationEndpointFilter;
 import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2AuthorizationCodeRequestAuthenticationConverter;
 import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2AuthorizationConsentAuthenticationConverter;
-import org.springframework.security.web.access.intercept.AuthorizationFilter;
 import org.springframework.security.web.authentication.AuthenticationConverter;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
@@ -54,7 +50,6 @@ import org.springframework.security.web.servlet.util.matcher.PathPatternRequestM
 import org.springframework.security.web.util.matcher.OrRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
-import org.springframework.util.ReflectionUtils;
 import org.springframework.util.StringUtils;

 /**
@@ -88,8 +83,6 @@ public final class OAuth2AuthorizationEndpointConfigurer extends AbstractOAuth2C

 	private Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authorizationCodeRequestAuthenticationValidator;

-	private Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authorizationCodeRequestAuthenticationValidatorComposite;
-
 	private SessionAuthenticationStrategy sessionAuthenticationStrategy;

 	/**
@@ -255,16 +248,8 @@ public final class OAuth2AuthorizationEndpointConfigurer extends AbstractOAuth2C
 			authenticationProviders.addAll(0, this.authenticationProviders);
 		}
 		this.authenticationProvidersConsumer.accept(authenticationProviders);
-		authenticationProviders.forEach((authenticationProvider) -> {
-			httpSecurity.authenticationProvider(postProcess(authenticationProvider));
-			if (authenticationProvider instanceof OAuth2AuthorizationCodeRequestAuthenticationProvider) {
-				Method method = ReflectionUtils.findMethod(OAuth2AuthorizationCodeRequestAuthenticationProvider.class,
-						"getAuthenticationValidatorComposite");
-				ReflectionUtils.makeAccessible(method);
-				this.authorizationCodeRequestAuthenticationValidatorComposite = (Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext>) ReflectionUtils
-					.invokeMethod(method, authenticationProvider);
-			}
-		});
+		authenticationProviders.forEach(
+				(authenticationProvider) -> httpSecurity.authenticationProvider(postProcess(authenticationProvider)));
 	}

 	@Override
@@ -297,18 +282,7 @@ public final class OAuth2AuthorizationEndpointConfigurer extends AbstractOAuth2C
 		if (this.sessionAuthenticationStrategy != null) {
 			authorizationEndpointFilter.setSessionAuthenticationStrategy(this.sessionAuthenticationStrategy);
 		}
-		httpSecurity.addFilterAfter(postProcess(authorizationEndpointFilter), AuthorizationFilter.class);
-		// Create and add
-		// OAuth2AuthorizationEndpointFilter.OAuth2AuthorizationCodeRequestValidatingFilter
-		Method method = ReflectionUtils.findMethod(OAuth2AuthorizationEndpointFilter.class,
-				"createAuthorizationCodeRequestValidatingFilter", RegisteredClientRepository.class, Consumer.class);
-		ReflectionUtils.makeAccessible(method);
-		RegisteredClientRepository registeredClientRepository = OAuth2ConfigurerUtils
-			.getRegisteredClientRepository(httpSecurity);
-		Filter authorizationCodeRequestValidatingFilter = (Filter) ReflectionUtils.invokeMethod(method,
-				authorizationEndpointFilter, registeredClientRepository,
-				this.authorizationCodeRequestAuthenticationValidatorComposite);
-		httpSecurity.addFilterBefore(postProcess(authorizationCodeRequestValidatingFilter),
+		httpSecurity.addFilterBefore(postProcess(authorizationEndpointFilter),
 				AbstractPreAuthenticatedProcessingFilter.class);
 	}

@@ -16,9 +16,14 @@

 package org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization;

+import java.util.Map;
+
 import com.nimbusds.jose.jwk.source.JWKSource;
 import com.nimbusds.jose.proc.SecurityContext;

+import org.springframework.beans.factory.BeanFactoryUtils;
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
+import org.springframework.beans.factory.NoUniqueBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
 import org.springframework.core.ResolvableType;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -40,6 +45,7 @@ import org.springframework.security.oauth2.server.authorization.token.OAuth2Toke
 import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer;
 import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenGenerator;
 import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;

 /**
 * Utility methods for the OAuth 2.0 Configurers.
@@ -201,16 +207,41 @@ final class OAuth2ConfigurerUtils {
 	}

 	static <T> T getBean(HttpSecurity httpSecurity, Class<T> type) {
-		return httpSecurity.getSharedObject(ApplicationContext.class).getBeanProvider(type).getObject();
+		return httpSecurity.getSharedObject(ApplicationContext.class).getBean(type);
+	}
+
+	@SuppressWarnings("unchecked")
+	static <T> T getBean(HttpSecurity httpSecurity, ResolvableType type) {
+		ApplicationContext context = httpSecurity.getSharedObject(ApplicationContext.class);
+		String[] names = context.getBeanNamesForType(type);
+		if (names.length == 1) {
+			return (T) context.getBean(names[0]);
+		}
+		if (names.length > 1) {
+			throw new NoUniqueBeanDefinitionException(type, names);
+		}
+		throw new NoSuchBeanDefinitionException(type);
 	}

 	static <T> T getOptionalBean(HttpSecurity httpSecurity, Class<T> type) {
-		return httpSecurity.getSharedObject(ApplicationContext.class).getBeanProvider(type).getIfUnique();
+		Map<String, T> beansMap = BeanFactoryUtils
+			.beansOfTypeIncludingAncestors(httpSecurity.getSharedObject(ApplicationContext.class), type);
+		if (beansMap.size() > 1) {
+			throw new NoUniqueBeanDefinitionException(type, beansMap.size(),
+					"Expected single matching bean of type '" + type.getName() + "' but found " + beansMap.size() + ": "
+							+ StringUtils.collectionToCommaDelimitedString(beansMap.keySet()));
+		}
+		return (!beansMap.isEmpty() ? beansMap.values().iterator().next() : null);
 	}

 	@SuppressWarnings("unchecked")
 	static <T> T getOptionalBean(HttpSecurity httpSecurity, ResolvableType type) {
-		return (T) httpSecurity.getSharedObject(ApplicationContext.class).getBeanProvider(type).getIfUnique();
+		ApplicationContext context = httpSecurity.getSharedObject(ApplicationContext.class);
+		String[] names = context.getBeanNamesForType(type);
+		if (names.length > 1) {
+			throw new NoUniqueBeanDefinitionException(type, names);
+		}
+		return (names.length == 1) ? (T) context.getBean(names[0]) : null;
 	}

 }
@@ -40,11 +40,11 @@ import org.springframework.security.oauth2.server.authorization.settings.Authori
 import org.springframework.security.oauth2.server.authorization.web.OAuth2DeviceVerificationEndpointFilter;
 import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceAuthorizationConsentAuthenticationConverter;
 import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceVerificationAuthenticationConverter;
-import org.springframework.security.web.access.intercept.AuthorizationFilter;
 import org.springframework.security.web.authentication.AuthenticationConverter;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.DelegatingAuthenticationConverter;
+import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
 import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
 import org.springframework.security.web.util.matcher.OrRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -279,7 +279,8 @@ public final class OAuth2DeviceVerificationEndpointConfigurer extends AbstractOA
 		if (StringUtils.hasText(this.consentPage)) {
 			deviceVerificationEndpointFilter.setConsentPage(this.consentPage);
 		}
-		builder.addFilterAfter(postProcess(deviceVerificationEndpointFilter), AuthorizationFilter.class);
+		builder.addFilterBefore(postProcess(deviceVerificationEndpointFilter),
+				AbstractPreAuthenticatedProcessingFilter.class);
 	}

 	@Override
@@ -95,7 +95,7 @@ public class Saml2MetadataConfigurer<H extends HttpSecurityBuilder<H>>
 	 * If there is no {@code registrationId} and your
 	 * {@link RelyingPartyRegistrationRepository} is {code Iterable}, the metadata
 	 * endpoint will try and show all relying parties' metadata in a single
-	 * {@code <md:EntitiesDescriptor} element.
+	 * {@code <md:EntitiesDecriptor} element.
 	 *
 	 * <p>
 	 * If you need a more sophisticated lookup strategy than these, use
@@ -167,7 +167,7 @@ class ServerHttpSecurityConfiguration {
 	}

 	/**
-	 * Applies all {@code Customizer<ServerHttpSecurity>} Beans to
+	 * Applies all {@code Custmizer<ServerHttpSecurity>} Beans to
 	 * {@link ServerHttpSecurity}.
 	 * @param context the {@link ApplicationContext}
 	 * @param http the {@link ServerHttpSecurity}
@@ -255,9 +255,7 @@ class ServerHttpSecurityConfiguration {
 			if (this.passwordEncoder != null) {
 				manager.setPasswordEncoder(this.passwordEncoder);
 			}
-			if (this.userDetailsPasswordService != null) {
-				manager.setUserDetailsPasswordService(this.userDetailsPasswordService);
-			}
+			manager.setUserDetailsPasswordService(this.userDetailsPasswordService);
 			manager.setCompromisedPasswordChecker(this.compromisedPasswordChecker);
 			return this.postProcessor.postProcess(manager);
 		}
@@ -538,7 +538,7 @@ final class AuthenticationConfigBuilder {
 			}
 			injectAuthenticationDetailsSource(x509Elt, filterBuilder);
 			filter = (RootBeanDefinition) filterBuilder.getBeanDefinition();
-			createPreauthEntryPoint(x509Elt);
+			createPrauthEntryPoint(x509Elt);
 			createX509Provider();
 		}
 		this.x509Filter = filter;
@@ -562,7 +562,7 @@ final class AuthenticationConfigBuilder {
 		this.x509ProviderRef = new RuntimeBeanReference(this.pc.getReaderContext().registerWithGeneratedName(provider));
 	}

-	private void createPreauthEntryPoint(Element source) {
+	private void createPrauthEntryPoint(Element source) {
 		if (this.preAuthEntryPoint == null) {
 			this.preAuthEntryPoint = new RootBeanDefinition(Http403ForbiddenEntryPoint.class);
 			this.preAuthEntryPoint.setSource(this.pc.extractSource(source));
@@ -595,7 +595,7 @@ final class AuthenticationConfigBuilder {
 			adsBldr.addPropertyValue("mappableRolesRetriever", mappableRolesRetriever);
 			filterBuilder.addPropertyValue("authenticationDetailsSource", adsBldr.getBeanDefinition());
 			filter = (RootBeanDefinition) filterBuilder.getBeanDefinition();
-			createPreauthEntryPoint(jeeElt);
+			createPrauthEntryPoint(jeeElt);
 			createJeeProvider();
 		}
 		this.jeeFilter = filter;
@@ -165,20 +165,20 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 	}

 	private RootBeanDefinition getRootBeanDefinition(String mode) {
-		if (isUnboundIdEnabled(mode)) {
+		if (isUnboundidEnabled(mode)) {
 			return new RootBeanDefinition(UNBOUNDID_CONTAINER_CLASSNAME, null, null);
 		}
 		throw new IllegalStateException("Embedded LDAP server is not provided");
 	}

 	private String resolveBeanId(String mode) {
-		if (isUnboundIdEnabled(mode)) {
+		if (isUnboundidEnabled(mode)) {
 			return BeanIds.EMBEDDED_UNBOUNDID;
 		}
 		return null;
 	}

-	private boolean isUnboundIdEnabled(String mode) {
+	private boolean isUnboundidEnabled(String mode) {
 		return "unboundid".equals(mode) || unboundIdPresent;
 	}

@@ -12,8 +12,8 @@ base64 =
 	## Whether a string should be base64 encoded
 	attribute base64 {xsd:boolean}
 request-matcher =
-	## Defines the strategy use for matching incoming requests. Currently the options are 'path' (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for case-insensitive regular expressions.
-	attribute request-matcher {"path" | "regex" | "ciRegex"}
+	## Defines the strategy use for matching incoming requests. Currently the options are 'mvc' (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for case-insensitive regular expressions.
+	attribute request-matcher {"mvc" | "ant" | "regex" | "ciRegex"}
 port =
 	## Specifies an IP port number. Used to configure an embedded LDAP server, for example.
 	attribute port { xsd:nonNegativeInteger }
@@ -27,14 +27,15 @@
  <xs:attributeGroup name="request-matcher">
      <xs:attribute name="request-matcher" use="required">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -1305,14 +1306,15 @@
      </xs:attribute>
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -2472,14 +2474,15 @@
  <xs:attributeGroup name="filter-chain-map.attlist">
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -2577,14 +2580,15 @@
      </xs:attribute>
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -1340,7 +1340,7 @@ public class AuthorizeHttpRequestsConfigurerTests {
 	static class ServletPathConfig {

 		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
+		PathPatternRequestMatcherBuilderFactoryBean requesMatcherBuilder() {
 			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
 			bean.setBasePath("/spring");
 			return bean;
@@ -19,13 +19,10 @@ package org.springframework.security.config.annotation.web.configurers;
 import java.nio.charset.StandardCharsets;
 import java.util.List;

-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;

 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.config.BeanPostProcessor;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpOutputMessage;
@@ -45,7 +42,6 @@ import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.ui.DefaultResourcesFilter;
 import org.springframework.security.web.webauthn.api.PublicKeyCredentialCreationOptions;
 import org.springframework.security.web.webauthn.api.TestPublicKeyCredentialCreationOptions;
-import org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationFilter;
 import org.springframework.security.web.webauthn.management.WebAuthnRelyingPartyOperations;
 import org.springframework.security.web.webauthn.registration.HttpSessionPublicKeyCredentialCreationOptionsRepository;
 import org.springframework.test.web.servlet.MockMvc;
@@ -56,8 +52,6 @@ import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.BDDMockito.willAnswer;
 import static org.mockito.Mockito.mock;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
@@ -94,14 +88,6 @@ public class WebAuthnConfigurerTests {
 			.andExpect(content().string(containsString("body {")));
 	}

-	// gh-18128
-	@Test
-	public void webAuthnAuthenticationFilterIsPostProcessed() throws Exception {
-		this.spring.register(DefaultWebauthnConfiguration.class, PostProcessorConfiguration.class).autowire();
-		PostProcessorConfiguration postProcess = this.spring.getContext().getBean(PostProcessorConfiguration.class);
-		assertThat(postProcess.webauthnFilter).isNotNull();
-	}
-
 	@Test
 	public void webauthnWhenNoFormLoginAndDefaultRegistrationPageConfiguredThenServesJavascript() throws Exception {
 		this.spring.register(NoFormLoginAndDefaultRegistrationPageConfiguration.class).autowire();
@@ -141,42 +127,6 @@ public class WebAuthnConfigurerTests {
 			.hasSize(1);
 	}

-	@Test
-	void webauthnWhenConfiguredDefaultsRpNameToRpId() throws Exception {
-		ObjectMapper mapper = new ObjectMapper();
-		this.spring.register(DefaultWebauthnConfiguration.class).autowire();
-		String response = this.mvc
-			.perform(post("/webauthn/register/options").with(csrf())
-				.with(authentication(new TestingAuthenticationToken("test", "ignored", "ROLE_user"))))
-			.andExpect(status().is2xxSuccessful())
-			.andReturn()
-			.getResponse()
-			.getContentAsString();
-
-		JsonNode parsedResponse = mapper.readTree(response);
-
-		assertThat(parsedResponse.get("rp").get("id").asText()).isEqualTo("example.com");
-		assertThat(parsedResponse.get("rp").get("name").asText()).isEqualTo("example.com");
-	}
-
-	@Test
-	void webauthnWhenRpNameConfiguredUsesRpName() throws Exception {
-		ObjectMapper mapper = new ObjectMapper();
-		this.spring.register(CustomRpNameWebauthnConfiguration.class).autowire();
-		String response = this.mvc
-			.perform(post("/webauthn/register/options").with(csrf())
-				.with(authentication(new TestingAuthenticationToken("test", "ignored", "ROLE_user"))))
-			.andExpect(status().is2xxSuccessful())
-			.andReturn()
-			.getResponse()
-			.getContentAsString();
-
-		JsonNode parsedResponse = mapper.readTree(response);
-
-		assertThat(parsedResponse.get("rp").get("id").asText()).isEqualTo("example.com");
-		assertThat(parsedResponse.get("rp").get("name").asText()).isEqualTo("Test RP Name");
-	}
-
 	@Test
 	public void webauthnWhenConfiguredAndFormLoginThenDoesServesJavascript() throws Exception {
 		this.spring.register(FormLoginAndNoDefaultRegistrationPageConfiguration.class).autowire();
@@ -339,26 +289,6 @@ public class WebAuthnConfigurerTests {

 	}

-	@Configuration(proxyBeanMethods = false)
-	static class PostProcessorConfiguration {
-
-		WebAuthnAuthenticationFilter webauthnFilter;
-
-		@Bean
-		BeanPostProcessor beanPostProcessor() {
-			return new BeanPostProcessor() {
-				@Override
-				public Object postProcessAfterInitialization(Object bean, String beanName) {
-					if (bean instanceof WebAuthnAuthenticationFilter filter) {
-						PostProcessorConfiguration.this.webauthnFilter = filter;
-					}
-					return bean;
-				}
-			};
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class DefaultWebauthnConfiguration {
@@ -374,7 +304,8 @@ public class WebAuthnConfigurerTests {
 			http
 				.formLogin(Customizer.withDefaults())
 				.webAuthn((authn) -> authn
-					.rpId("example.com")
+					.rpId("spring.io")
+					.rpName("spring")
 				);
 			// @formatter:on
 			return http.build();
@@ -382,24 +313,6 @@ public class WebAuthnConfigurerTests {

 	}

-	@Configuration
-	@EnableWebSecurity
-	static class CustomRpNameWebauthnConfiguration {
-
-		@Bean
-		UserDetailsService userDetailsService() {
-			return new InMemoryUserDetailsManager();
-		}
-
-		@Bean
-		SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-			return http.formLogin(Customizer.withDefaults())
-				.webAuthn((webauthn) -> webauthn.rpId("example.com").rpName("Test RP Name"))
-				.build();
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class NoFormLoginAndDefaultRegistrationPageConfiguration {
@@ -307,8 +307,8 @@ public class OAuth2AuthorizationCodeGrantTests {
 		RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();

 		this.mvc
-			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI)
-				.queryParams(getAuthorizationRequestParameters(registeredClient)))
+			.perform(
+					get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).params(getAuthorizationRequestParameters(registeredClient)))
 			.andExpect(status().isBadRequest())
 			.andReturn();
 	}
@@ -851,31 +851,21 @@ public class OAuth2AuthorizationCodeGrantTests {
 		this.spring.register(AuthorizationServerConfigurationCustomAuthorizationEndpoint.class).autowire();

 		RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
-		this.registeredClientRepository.save(registeredClient);
-
 		TestingAuthenticationToken principal = new TestingAuthenticationToken("principalName", "password");
-		Map<String, Object> additionalParameters = new HashMap<>();
-		additionalParameters.put(PkceParameterNames.CODE_CHALLENGE, S256_CODE_CHALLENGE);
-		additionalParameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "S256");
-		OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication = new OAuth2AuthorizationCodeRequestAuthenticationToken(
-				"https://provider.com/oauth2/authorize", registeredClient.getClientId(), principal,
-				registeredClient.getRedirectUris().iterator().next(), STATE_URL_UNENCODED, registeredClient.getScopes(),
-				additionalParameters);
 		OAuth2AuthorizationCode authorizationCode = new OAuth2AuthorizationCode("code", Instant.now(),
 				Instant.now().plus(5, ChronoUnit.MINUTES));
 		OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthenticationResult = new OAuth2AuthorizationCodeRequestAuthenticationToken(
 				"https://provider.com/oauth2/authorize", registeredClient.getClientId(), principal, authorizationCode,
 				registeredClient.getRedirectUris().iterator().next(), STATE_URL_UNENCODED,
 				registeredClient.getScopes());
-		given(authorizationRequestConverter.convert(any())).willReturn(authorizationCodeRequestAuthentication);
+		given(authorizationRequestConverter.convert(any())).willReturn(authorizationCodeRequestAuthenticationResult);
 		given(authorizationRequestAuthenticationProvider
 			.supports(eq(OAuth2AuthorizationCodeRequestAuthenticationToken.class))).willReturn(true);
 		given(authorizationRequestAuthenticationProvider.authenticate(any()))
 			.willReturn(authorizationCodeRequestAuthenticationResult);

 		this.mvc
-			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI)
-				.queryParams(getAuthorizationRequestParameters(registeredClient))
+			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).params(getAuthorizationRequestParameters(registeredClient))
 				.with(user("user")))
 			.andExpect(status().isOk());

@@ -890,7 +880,8 @@ public class OAuth2AuthorizationCodeGrantTests {
 				|| converter instanceof OAuth2AuthorizationCodeRequestAuthenticationConverter
 				|| converter instanceof OAuth2AuthorizationConsentAuthenticationConverter);

-		verify(authorizationRequestAuthenticationProvider).authenticate(eq(authorizationCodeRequestAuthentication));
+		verify(authorizationRequestAuthenticationProvider)
+			.authenticate(eq(authorizationCodeRequestAuthenticationResult));

 		@SuppressWarnings("unchecked")
 		ArgumentCaptor<List<AuthenticationProvider>> authenticationProvidersCaptor = ArgumentCaptor
@@ -45,7 +45,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
-import org.springframework.context.annotation.Primary;
 import org.springframework.http.HttpHeaders;
 import org.springframework.jdbc.core.JdbcOperations;
 import org.springframework.jdbc.core.JdbcTemplate;
@@ -159,8 +158,6 @@ public class OAuth2ClientCredentialsGrantTests {

 	private static AuthenticationFailureHandler authenticationFailureHandler;

-	private static PasswordEncoder passwordEncoder;
-
 	public final SpringTestContext spring = new SpringTestContext(this);

 	@Autowired
@@ -186,9 +183,6 @@ public class OAuth2ClientCredentialsGrantTests {
 		authenticationProvidersConsumer = mock(Consumer.class);
 		authenticationSuccessHandler = mock(AuthenticationSuccessHandler.class);
 		authenticationFailureHandler = mock(AuthenticationFailureHandler.class);
-		passwordEncoder = mock(PasswordEncoder.class);
-		given(passwordEncoder.matches(any(), any())).willReturn(true);
-		given(passwordEncoder.upgradeEncoding(any())).willReturn(false);
 		db = new EmbeddedDatabaseBuilder().generateUniqueName(true)
 			.setType(EmbeddedDatabaseType.HSQL)
 			.setScriptEncoding("UTF-8")
@@ -502,26 +496,6 @@ public class OAuth2ClientCredentialsGrantTests {
 			.andExpect(jsonPath("$.token_type").value(OAuth2AccessToken.TokenType.DPOP.getValue()));
 	}

-	@Test
-	public void requestWhenTokenRequestWithMultiplePasswordEncodersThenPrimaryPasswordEncoderUsed() throws Exception {
-		this.spring.register(AuthorizationServerConfigurationWithMultiplePasswordEncoders.class).autowire();
-
-		RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build();
-		this.registeredClientRepository.save(registeredClient);
-
-		this.mvc
-			.perform(post(DEFAULT_TOKEN_ENDPOINT_URI)
-				.param(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.CLIENT_CREDENTIALS.getValue())
-				.param(OAuth2ParameterNames.SCOPE, "scope1 scope2")
-				.header(HttpHeaders.AUTHORIZATION,
-						"Basic " + encodeBasicAuth(registeredClient.getClientId(), registeredClient.getClientSecret())))
-			.andExpect(status().isOk())
-			.andExpect(jsonPath("$.access_token").isNotEmpty())
-			.andExpect(jsonPath("$.scope").value("scope1 scope2"));
-
-		verify(passwordEncoder).matches(any(), any());
-	}
-
 	private static String generateDPoPProof(String tokenEndpointUri) {
 		// @formatter:off
 		Map<String, Object> publicJwk = TestJwks.DEFAULT_EC_JWK
@@ -684,16 +658,4 @@ public class OAuth2ClientCredentialsGrantTests {

 	}

-	@EnableWebSecurity
-	@Configuration(proxyBeanMethods = false)
-	static class AuthorizationServerConfigurationWithMultiplePasswordEncoders extends AuthorizationServerConfiguration {
-
-		@Primary
-		@Bean
-		PasswordEncoder primaryPasswordEncoder() {
-			return passwordEncoder;
-		}
-
-	}
-
 }
@@ -359,7 +359,7 @@ public class OAuth2DeviceCodeGrantTests {
 	}

 	@Test
-	public void requestWhenDeviceAuthorizationConsentRequestUnauthenticatedThenUnauthorized() throws Exception {
+	public void requestWhenDeviceAuthorizationConsentRequestUnauthenticatedThenBadRequest() throws Exception {
 		this.spring.register(AuthorizationServerConfiguration.class).autowire();

 		// @formatter:off
@@ -392,7 +392,7 @@ public class OAuth2DeviceCodeGrantTests {
 		// @formatter:off
 		this.mvc.perform(post(DEFAULT_DEVICE_VERIFICATION_ENDPOINT_URI)
 				.params(parameters))
-				.andExpect(status().isUnauthorized());
+				.andExpect(status().isBadRequest());
 		// @formatter:on
 	}

@@ -107,7 +107,7 @@ public class ServerHttpSecurityConfigurationTests {
 	}

 	@Test
-	public void loadConfigWhenReactiveUserAuthenticationServiceConfiguredThenServerHttpSecurityExists() {
+	public void loadConfigWhenReactiveUserDetailsServiceConfiguredThenServerHttpSecurityExists() {
 		this.spring
 			.register(ServerHttpSecurityConfiguration.class, ReactiveAuthenticationTestConfiguration.class,
 					WebFluxSecurityConfiguration.class)
@@ -116,16 +116,6 @@ public class ServerHttpSecurityConfigurationTests {
 		assertThat(serverHttpSecurity).isNotNull();
 	}

-	@Test
-	public void loadConfigWhenOnlyReactiveUserDetailsServiceConfiguredThenServerHttpSecurityExists() {
-		this.spring
-			.register(ServerHttpSecurityConfiguration.class, ReactiveUserDetailsServiceOnlyTestConfiguration.class,
-					WebFluxSecurityConfiguration.class)
-			.autowire();
-		ServerHttpSecurity serverHttpSecurity = this.spring.getContext().getBean(ServerHttpSecurity.class);
-		assertThat(serverHttpSecurity).isNotNull();
-	}
-
 	@Test
 	public void loadConfigWhenProxyingEnabledAndSubclassThenServerHttpSecurityExists() {
 		this.spring
@@ -591,14 +581,4 @@ public class ServerHttpSecurityConfigurationTests {

 	}

-	@Configuration(proxyBeanMethods = false)
-	static class ReactiveUserDetailsServiceOnlyTestConfiguration {
-
-		@Bean
-		static ReactiveUserDetailsService userDetailsService() {
-			return (username) -> Mono.just(PasswordEncodedUser.user());
-		}
-
-	}
-
 }
@@ -275,7 +275,7 @@ class ServerJwtDslTests {
    }

    class NullConverter: Converter<Jwt, Mono<AbstractAuthenticationToken>> {
-        override fun convert(source: Jwt): Mono<AbstractAuthenticationToken> {
+        override fun convert(source: Jwt): Mono<AbstractAuthenticationToken>? {
            return Mono.empty()
        }

@@ -24,7 +24,7 @@
 			http://www.springframework.org/schema/beans
 			https://www.springframework.org/schema/beans/spring-beans.xsd">

-	<http request-matcher="path" use-authorization-manager="false">
+	<http request-matcher="ant" use-authorization-manager="false">
 		<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
 		<http-basic/>
 	</http>
@@ -24,7 +24,7 @@
 			http://www.springframework.org/schema/beans
 			https://www.springframework.org/schema/beans/spring-beans.xsd">

-	<http request-matcher="path">
+	<http request-matcher="ant">
 		<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
 		<http-basic/>
 	</http>
@@ -27,7 +27,7 @@
 			http://www.springframework.org/schema/mvc
 			https://www.springframework.org/schema/mvc/spring-mvc.xsd">

-	<http auto-config="true" request-matcher="path" use-authorization-manager="false">
+	<http auto-config="true" request-matcher="mvc" use-authorization-manager="false">
 		<intercept-url pattern="/path" access="denyAll"/>
 		<http-basic/>
 	</http>
@@ -27,7 +27,7 @@
 			http://www.springframework.org/schema/mvc
 			https://www.springframework.org/schema/mvc/spring-mvc.xsd">

-	<http auto-config="true" request-matcher="path">
+	<http auto-config="true" request-matcher="mvc">
 		<intercept-url pattern="/path" access="denyAll"/>
 		<http-basic/>
 	</http>
@@ -27,7 +27,7 @@
 			http://www.springframework.org/schema/mvc
 			https://www.springframework.org/schema/mvc/spring-mvc.xsd">

-	<http auto-config="true" request-matcher="path" use-authorization-manager="false">
+	<http auto-config="true" request-matcher="mvc" use-authorization-manager="false">
 		<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
 		<http-basic/>
 	</http>
@@ -27,7 +27,7 @@
 			http://www.springframework.org/schema/mvc
 			https://www.springframework.org/schema/mvc/spring-mvc.xsd">

-	<http auto-config="true" request-matcher="path">
+	<http auto-config="true" request-matcher="mvc">
 		<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
 		<http-basic/>
 	</http>
@@ -100,7 +100,7 @@ public interface SecurityExpressionOperations {
 	boolean isAnonymous();

 	/**
-	 * Determines if the {@link #getAuthentication()} is authenticated
+	 * Determines ifthe {@link #getAuthentication()} is authenticated
 	 * @return true if the {@link #getAuthentication()} is authenticated, else false
 	 */
 	boolean isAuthenticated();
@@ -116,7 +116,7 @@ public abstract class SecurityExpressionRoot<T extends @Nullable Object> impleme

 	@Override
 	public final boolean hasAuthority(String authority) {
-		return isGranted(this.authorizationManagerFactory.hasAuthority(authority));
+		return isGranted(this.authorizationManagerFactory.hasAnyAuthority(authority));
 	}

 	@Override
@@ -16,7 +16,6 @@

 package org.springframework.security.authentication.dao;

-import java.util.Objects;
 import java.util.function.Supplier;

 import org.jspecify.annotations.Nullable;
@@ -44,7 +43,6 @@ import org.springframework.util.function.SingletonSupplier;
 *
 * @author Ben Alex
 * @author Rob Winch
- * @author Andrey Litvitski
 */
 public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

@@ -133,8 +131,7 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
 			throw new CompromisedPasswordException("The provided password is compromised, please change your password");
 		}
 		String existingEncodedPassword = user.getPassword();
-		boolean upgradeEncoding = existingEncodedPassword != null
-				&& !Objects.equals(this.userDetailsPasswordService, UserDetailsPasswordService.NOOP)
+		boolean upgradeEncoding = existingEncodedPassword != null && this.userDetailsPasswordService != null
 				&& this.passwordEncoder.get().upgradeEncoding(existingEncodedPassword);
 		if (upgradeEncoding) {
 			String newPassword = this.passwordEncoder.get().encode(presentedPassword);
@@ -69,11 +69,7 @@ public final class AuthoritiesAuthorizationManager implements AuthorizationManag

 	private boolean isAuthorized(Authentication authentication, Collection<String> authorities) {
 		for (GrantedAuthority grantedAuthority : getGrantedAuthorities(authentication)) {
-			String authority = grantedAuthority.getAuthority();
-			if (authority == null) {
-				continue;
-			}
-			if (authorities.contains(authority)) {
+			if (authorities.contains(grantedAuthority.getAuthority())) {
 				return true;
 			}
 		}
@@ -75,7 +75,7 @@ public class DefaultSecurityParameterNameDiscoverer extends PrioritizedParameter
 			annotationClassesToUse.add(DATA_PARAM_CLASSNAME);
 		}
 		addDiscoverer(new AnnotationParameterNameDiscoverer(annotationClassesToUse));
-		addDiscoverer(DefaultParameterNameDiscoverer.getSharedInstance());
+		addDiscoverer(new DefaultParameterNameDiscoverer());
 	}

 }
@@ -21,9 +21,6 @@ import org.junit.jupiter.api.Test;

 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.authorization.AuthorizationManager;
-import org.springframework.security.authorization.AuthorizationManagerFactory;
-import org.springframework.security.authorization.SingleResultAuthorizationManager;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.AuthorityUtils;

@@ -31,7 +28,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.verify;

 /**
 * @author Luke Taylor
@@ -178,148 +174,4 @@ public class SecurityExpressionRootTests {
 		assertThat(this.root.isAuthenticated()).isTrue();
 	}

-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void hasAuthorityDelegatesToAuthorizationManagerFactoryHasAuthority() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.hasAuthority("CUSTOM_AUTHORITY")).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.hasAuthority("CUSTOM_AUTHORITY")).isFalse();
-		verify(factory).hasAuthority("CUSTOM_AUTHORITY");
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void hasAnyAuthorityDelegatesToAuthorizationManagerFactoryHasAnyAuthority() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.hasAnyAuthority("CUSTOM_AUTHORITY")).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.hasAnyAuthority("CUSTOM_AUTHORITY")).isFalse();
-		verify(factory).hasAnyAuthority("CUSTOM_AUTHORITY");
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void hasAllAuthoritiesDelegatesToAuthorizationManagerFactoryHasAllAuthorities() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.hasAllAuthorities("A", "B")).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.hasAllAuthorities("A", "B")).isFalse();
-		verify(factory).hasAllAuthorities("A", "B");
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void hasRoleDelegatesToAuthorizationManagerFactoryHasRole() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.hasRole("CUSTOM_ROLE")).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.hasRole("CUSTOM_ROLE")).isFalse();
-		verify(factory).hasRole("CUSTOM_ROLE");
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void hasAnyRoleDelegatesToAuthorizationManagerFactoryHasAnyRole() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.hasAnyRole("A", "B")).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.hasAnyRole("A", "B")).isFalse();
-		verify(factory).hasAnyRole("A", "B");
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void hasAllRolesDelegatesToAuthorizationManagerFactoryHasAllRoles() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.hasAllRoles("A", "B")).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.hasAllRoles("A", "B")).isFalse();
-		verify(factory).hasAllRoles("A", "B");
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void permitAllDelegatesToAuthorizationManagerFactoryPermitAll() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.permitAll()).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.permitAll()).isFalse();
-		verify(factory).permitAll();
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void denyAllDelegatesToAuthorizationManagerFactoryDenyAll() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.denyAll()).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.denyAll()).isFalse();
-		verify(factory).denyAll();
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void isAnonymousDelegatesToAuthorizationManagerFactoryAnonymous() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.anonymous()).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.isAnonymous()).isFalse();
-		verify(factory).anonymous();
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void isAuthenticatedDelegatesToAuthorizationManagerFactoryAuthenticated() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.authenticated()).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.isAuthenticated()).isFalse();
-		verify(factory).authenticated();
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void isRememberMeDelegatesToAuthorizationManagerFactoryRememberMe() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.rememberMe()).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.isRememberMe()).isFalse();
-		verify(factory).rememberMe();
-	}
-
-	// gh-18486
-	@Test
-	@SuppressWarnings("unchecked")
-	public void isFullyAuthenticatedDelegatesToAuthorizationManagerFactoryFullyAuthenticated() {
-		AuthorizationManagerFactory<Object> factory = mock(AuthorizationManagerFactory.class);
-		AuthorizationManager<Object> manager = SingleResultAuthorizationManager.denyAll();
-		given(factory.fullyAuthenticated()).willReturn(manager);
-		this.root.setAuthorizationManagerFactory(factory);
-		assertThat(this.root.isFullyAuthenticated()).isFalse();
-		verify(factory).fullyAuthenticated();
-	}
-
 }
@@ -17,9 +17,7 @@
 package org.springframework.security.authorization;

 import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
-import java.util.Set;
 import java.util.function.Supplier;

 import org.junit.jupiter.api.Test;
@@ -32,13 +30,11 @@ import org.springframework.security.core.Authentication;

 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
-import static org.assertj.core.api.Assertions.assertThatNullPointerException;

 /**
 * Tests for {@link AuthoritiesAuthorizationManager}.
 *
 * @author Evgeniy Cheban
- * @author Khyojae
 */
 class AuthoritiesAuthorizationManagerTests {

@@ -87,20 +83,4 @@ class AuthoritiesAuthorizationManagerTests {
 		assertThat(manager.authorize(authentication, Collections.singleton("ROLE_USER")).isGranted()).isTrue();
 	}

-	@Test
-	// gh-18543
-	void authorizeWhenAuthorityIsNullThenDoesNotThrowNullPointerException() {
-		AuthoritiesAuthorizationManager manager = new AuthoritiesAuthorizationManager();
-
-		Authentication authentication = new TestingAuthenticationToken("user", "password",
-				Collections.singletonList(() -> null));
-
-		Collection<String> authoritiesContainsThrowsNPE = Set.of("ROLE_USER");
-
-		// must be Collection that throws NPE when .contains(null) is invoked
-		// to replicate the issue in gh-18543
-		assertThatNullPointerException().isThrownBy(() -> authoritiesContainsThrowsNPE.contains(null));
-		assertThat(manager.authorize(() -> authentication, authoritiesContainsThrowsNPE).isGranted()).isFalse();
-	}
-
 }
@@ -1,6 +1,5 @@
 plugins {
 	id 'security-nullability'
-	id 'java-test-fixtures'
 }

 apply plugin: 'io.spring.convention.spring-module'
@@ -11,8 +10,6 @@ dependencies {
 	optional 'org.bouncycastle:bcpkix-jdk18on'
 	optional libs.com.password4j.password4j

-	testFixturesImplementation "org.assertj:assertj-core"
-
 	testImplementation "org.assertj:assertj-core"
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testImplementation "org.junit.jupiter:junit-jupiter-params"
@@ -1,47 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.crypto.assertions;
-
-import org.junit.jupiter.api.Test;
-
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-
-/**
- * Tests for {@link CryptoAssertions} and {@link CryptoStringAssert}.
- */
-class CryptoAssertionsTests {
-
-	@Test
-	void doesNotDecryptToPassesWhenSupplierThrows() {
-		CryptoAssertions.assertThat((() -> {
-			throw new RuntimeException("decrypt failed");
-		})).doesNotDecryptTo("any");
-	}
-
-	@Test
-	void doesNotDecryptToPassesWhenResultDiffersFromExpected() {
-		CryptoAssertions.assertThat(() -> "other").doesNotDecryptTo("plaintext");
-	}
-
-	@Test
-	void doesNotDecryptToFailsWhenResultEqualsExpected() {
-		assertThatExceptionOfType(AssertionError.class)
-			.isThrownBy(() -> CryptoAssertions.assertThat(() -> "plaintext").doesNotDecryptTo("plaintext"))
-			.withMessageContaining("Expected supplier not to return <plaintext> but it did");
-	}
-
-}
@@ -16,7 +16,6 @@

 package org.springframework.security.crypto.bcrypt;

-import java.nio.charset.StandardCharsets;
 import java.security.SecureRandom;

 import org.junit.jupiter.api.BeforeEach;
@@ -26,7 +25,6 @@ import org.springframework.security.crypto.password.AbstractPasswordEncoderValid

 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
-import static org.assertj.core.api.Assertions.assertThatNoException;

 /**
 * @author Dave Syer
@@ -238,23 +236,4 @@ public class BCryptPasswordEncoderTests extends AbstractPasswordEncoderValidatio
 		assertThat(getEncoder().matches(password73chars, encodedPassword73chars)).isTrue();
 	}

-	/**
-	 * Fixes gh-18133
-	 * @author StringManolo
-	 */
-	@Test
-	void passwordLargerThan72BytesShouldThrowIllegalArgumentException() {
-		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
-		String singleByteChars = "a".repeat(68);
-		String password72Bytes = singleByteChars + "😀";
-		assertThat(password72Bytes.length()).isEqualTo(70);
-		assertThat(password72Bytes.getBytes(StandardCharsets.UTF_8).length).isEqualTo(72);
-		assertThatNoException().isThrownBy(() -> encoder.encode(password72Bytes));
-		String singleByteCharsTooLong = "a".repeat(69);
-		String password73Bytes = singleByteCharsTooLong + "😀";
-		assertThat(password73Bytes.getBytes(StandardCharsets.UTF_8).length).isEqualTo(73);
-		assertThatIllegalArgumentException().isThrownBy(() -> encoder.encode(password73Bytes))
-			.withMessageContaining("password cannot be more than 72 bytes");
-	}
-
 }
@@ -22,9 +22,8 @@ import java.security.interfaces.RSAPublicKey;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

-import org.springframework.security.crypto.assertions.CryptoAssertions;
-
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalStateException;

 /**
 * @author Dave Syer
@@ -87,15 +86,13 @@ public class RsaSecretEncryptorTests {
 	@Test
 	public void roundTripWithMixedAlgorithm() {
 		RsaSecretEncryptor oaep = new RsaSecretEncryptor(RsaAlgorithm.OAEP);
-		CryptoAssertions.assertThat(() -> oaep.decrypt(this.encryptor.encrypt("encryptor")))
-			.doesNotDecryptTo("encryptor");
+		assertThatIllegalStateException().isThrownBy(() -> oaep.decrypt(this.encryptor.encrypt("encryptor")));
 	}

 	@Test
 	public void roundTripWithMixedSalt() {
 		RsaSecretEncryptor other = new RsaSecretEncryptor(this.encryptor.getPublicKey(), RsaAlgorithm.DEFAULT, "salt");
-		CryptoAssertions.assertThat(() -> this.encryptor.decrypt(other.encrypt("encryptor")))
-			.doesNotDecryptTo("encryptor");
+		assertThatIllegalStateException().isThrownBy(() -> this.encryptor.decrypt(other.encrypt("encryptor")));
 	}

 	@Test
@@ -109,8 +106,7 @@ public class RsaSecretEncryptorTests {
 	public void publicKeyCannotDecrypt() {
 		RsaSecretEncryptor encryptor = new RsaSecretEncryptor(this.encryptor.getPublicKey());
 		assertThat(encryptor.canDecrypt()).as("Encryptor schould not be able to decrypt").isFalse();
-		CryptoAssertions.assertThat(() -> encryptor.decrypt(encryptor.encrypt("encryptor")))
-			.doesNotDecryptTo("encryptor");
+		assertThatIllegalStateException().isThrownBy(() -> encryptor.decrypt(encryptor.encrypt("encryptor")));
 	}

 	@Test
@@ -1,44 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.crypto.assertions;
-
-import java.util.function.Supplier;
-
-/**
- * AssertJ entry point for crypto-related assertions. Use {@link #assertThat(Supplier)} to
- * assert on a {@link Supplier}&lt;{@link String}&gt; (e.g. a decryption lambda).
- * <p>
- * Example: <pre>
- * assertThat(() -&gt; encryptor.decrypt(ciphertext)).doesNotDecryptTo("plaintext");
- * </pre>
- */
-public final class CryptoAssertions {
-
-	private CryptoAssertions() {
-	}
-
-	/**
-	 * Create assertions for the given supplier (e.g. a decryption expression).
-	 * @param actual the supplier to assert on
-	 * @return assertion object with methods like
-	 * {@link CryptoStringAssert#doesNotDecryptTo(String)}
-	 */
-	public static CryptoStringAssert assertThat(Supplier<String> actual) {
-		return new CryptoStringAssert(actual);
-	}
-
-}
@@ -1,56 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.crypto.assertions;
-
-import java.util.Objects;
-import java.util.function.Supplier;
-
-import org.assertj.core.api.AbstractObjectAssert;
-
-/**
- * AssertJ assertion for {@link Supplier}&lt;{@link String}&gt;, supporting
- * decryption-related checks such as {@link #doesNotDecryptTo(String)}.
- */
-public final class CryptoStringAssert extends AbstractObjectAssert<CryptoStringAssert, Supplier<String>> {
-
-	CryptoStringAssert(Supplier<String> actual) {
-		super(actual, CryptoStringAssert.class);
-	}
-
-	/**
-	 * Asserts that either the supplier throws an exception when invoked, or the value it
-	 * returns is not equal to the given string. Use this to assert that a decryption
-	 * attempt does not yield a specific plaintext (e.g. wrong key or tampered
-	 * ciphertext).
-	 * @param expected the value that the supplier must not return
-	 * @return this assertion for chaining
-	 */
-	public CryptoStringAssert doesNotDecryptTo(String expected) {
-		isNotNull();
-		try {
-			String result = this.actual.get();
-			if (Objects.equals(result, expected)) {
-				failWithMessage("Expected supplier not to return <%s> but it did", expected);
-			}
-		}
-		catch (Exception ex) {
-			// Exception thrown: supplier does not "decrypt to" the expected value
-		}
-		return this;
-	}
-
-}
@@ -31,7 +31,7 @@ urls:
  redirect_facility: httpd
 ui:
  bundle:
-    url: https://github.com/spring-io/antora-ui-spring/releases/download/v0.4.26/ui-bundle.zip
+    url: https://github.com/spring-io/antora-ui-spring/releases/download/v0.4.18/ui-bundle.zip
    snapshot: true
 runtime:
  log:
@@ -90,7 +90,6 @@
 **** xref:servlet/oauth2/resource-server/multitenancy.adoc[Multitenancy]
 **** xref:servlet/oauth2/resource-server/bearer-tokens.adoc[Bearer Tokens]
 **** xref:servlet/oauth2/resource-server/dpop-tokens.adoc[DPoP-bound Access Tokens]
-**** xref:servlet/oauth2/resource-server/protected-resource-metadata.adoc[Protected Resource Metadata]
 *** xref:servlet/oauth2/authorization-server/index.adoc[OAuth2 Authorization Server]
 **** xref:servlet/oauth2/authorization-server/getting-started.adoc[Getting Started]
 **** xref:servlet/oauth2/authorization-server/configuration-model.adoc[Configuration Model]
@@ -1,4 +0,0 @@
-= Kerberos Migrations
-
-For users leveraging Spring Security's Kerberos support, the Maven  and Gradle Coordinates have been changed since the support was moved from an external module into Spring Security.
-See the xref:servlet/authentication/kerberos/introduction.adoc[Keberos documentation] for the new Maven and Gradle coordinates.
@@ -1,3 +1,4 @@
+
 [[webflux-cors]]
 = CORS

@@ -74,11 +75,3 @@ fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain
 }
 ----
 ======
-
-[WARNING]
-====
-CORS is a browser-based security feature.
-By disabling CORS in Spring Security, you are not removing CORS protection from your browser.
-Instead, you are removing CORS support from Spring Security, and users will not be able to interact with your Spring backend from a cross-origin browser application.
-To fix CORS errors in your application, you must enable CORS support, and provide an appropriate configuration source.
-====
@@ -77,7 +77,7 @@ Public Clients are supported using https://tools.ietf.org/html/rfc7636[Proof Key
 If the client is running in an untrusted environment (eg. native application or web browser-based application) and therefore incapable of maintaining the confidentiality of it's credentials, PKCE will automatically be used when the following conditions are true:

 . `client-secret` is omitted (or empty)
-. `client-authentication-method` is set to `none` (`ClientAuthenticationMethod.NONE`)
+. `client-authentication-method` is set to "none" (`ClientAuthenticationMethod.NONE`)

 or

@@ -85,7 +85,7 @@ or

 [TIP]
 ====
-If the OAuth 2.0 Provider doesn't support PKCE for https://tools.ietf.org/html/rfc6749#section-2.1[Confidential Clients], you need to disable it by setting `ClientRegistration.clientSettings.requireProofKey` to `false`.
+If the OAuth 2.0 Provider supports PKCE for https://tools.ietf.org/html/rfc6749#section-2.1[Confidential Clients], you may (optionally) configure it using `DefaultServerOAuth2AuthorizationRequestResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce())`.
 ====

 [[oauth2-client-authorization-code-redirect-uri]]
@@ -68,7 +68,7 @@ The name may be used in certain scenarios, such as when displaying the name of t
 <15> `(userInfoEndpoint)authenticationMethod`: The authentication method used when sending the access token to the UserInfo Endpoint.
 The supported values are *header*, *form* and *query*.
 <16> `userNameAttributeName`: The name of the attribute returned in the UserInfo Response that references the Name or Identifier of the end-user.
-<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: If `true` or if `clientAuthenticationMethod` is `none`, then PKCE will be enabled. Defaults to `true` for `authorization_code` grant type and `false` for other grant types.
+<17> [[oauth2Client-client-registration-requireProofKey]]`requireProofKey`: If `true` or if `authorizationGrantType` is `none`, then PKCE will be enabled by default.

 A `ClientRegistration` can be initially configured using discovery of an OpenID Connect Provider's https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig[Configuration endpoint] or an Authorization Server's https://tools.ietf.org/html/rfc8414#section-3[Metadata endpoint].

@@ -39,18 +39,17 @@ This endpoint is referred to as a https://openid.net/specs/openid-connect-discov

 When this property and these dependencies are used, Resource Server automatically configures itself to validate JWT-encoded Bearer Tokens.

-It achieves this through a deterministic discovery process it launches at the first request containing a JWT:
+It achieves this through a deterministic startup process:

 . Hit the Provider Configuration or Authorization Server Metadata endpoint, processing the response for the `jwks_url` property.
 . Configure the validation strategy to query `jwks_url` for valid public keys.
 . Configure the validation strategy to validate each JWT's `iss` claim against `https://idp.example.com`.

-One benefit of deferring this process is that Resource Server startup is not coupled to the authorization server's availability.
+A consequence of this process is that the authorization server must be receiving requests in order for Resource Server to successfully start up.

 [NOTE]
 ====
-This deferral is managed by javadoc:org.springframework.security.oauth2.jwt.SupplierReactiveJwtDecoder[`SupplierReactiveJwtDecoder`].
-Consider wrapping any <<webflux-oauth2resourceserver-decoder-bean,`JwtDecoder` `@Bean`>> you declare in order to preserve this behavior.
+If the authorization server is down when Resource Server queries it (given appropriate timeouts), then startup fails.
 ====

 === Runtime Expectations
@@ -86,7 +85,7 @@ From here, consider jumping to:
 [[webflux-oauth2resourceserver-jwt-jwkseturi]]
 === Specifying the Authorization Server JWK Set Uri Directly

-If the authorization server does not support any configuration endpoints, or if Resource Server must be able to initialize independently from the authorization server, you can supply `jwk-set-uri` as well:
+If the authorization server does not support any configuration endpoints, or if Resource Server must be able to start up independently from the authorization server, you can supply `jwk-set-uri` as well:

 [source,yaml]
 ----
@@ -320,7 +320,7 @@ If you have trouble working out where a session is being created, you can add so
 [[appendix-faq-forbidden-csrf]]
 === I get a 403 Forbidden when performing a POST. What is wrong?

-If an HTTP 403 Forbidden error is returned for HTTP POST, but it works for HTTP GET, the issue is most likely related to xref:features/exploits/csrf.adoc#csrf[CSRF]. Either provide the CSRF Token or disable CSRF protection (the latter is not recommended).
+If an HTTP 403 Forbidden error is returned for HTTP POST, but it works for HTTP GET, the issue is most likely related to https://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#csrf[CSRF]. Either provide the CSRF Token or disable CSRF protection (the latter is not recommended).

 [[appendix-faq-no-security-on-forward]]
 === I am forwarding a request to another URL by using the RequestDispatcher, but my security constraints are not being applied.
@@ -414,7 +414,7 @@ If you build your project with Maven, adding the appropriate Spring Security mod
 Any that are marked as "`optional`" in the Spring Security `pom.xml` files have to be added to your own `pom.xml` file if you need them.

 [[appendix-faq-unboundid-deps]]
-=== What dependencies are needed to run an embedded UnboundID LDAP server?
+=== What dependences are needed to run an embedded UnboundID LDAP server?

 You need to add the following dependency to your project:

@@ -137,8 +137,7 @@ fun method(authentication: Authentication?): String {
 will always return "not anonymous", even for anonymous requests.
 The reason is that Spring MVC resolves the parameter using `HttpServletRequest#getPrincipal`, which is `null` when the request is anonymous.

-If you'd like to obtain the `Authentication` in anonymous requests, use
-xref:servlet/integrations/mvc.adoc#mvc-current-security-context[`@CurrentSecurityContext`] instead:
+If you'd like to obtain the `Authentication` in anonymous requests, use `@CurrentSecurityContext` instead:

 .Use CurrentSecurityContext for Anonymous requests
 [tabs]
@@ -97,11 +97,7 @@ val authorities = authentication.authorities
 ----
 ======

-In Spring MVC, you can resolve the current principal with
-xref:servlet/integrations/mvc.adoc#mvc-authentication-principal[`@AuthenticationPrincipal`]
-and the full `SecurityContext` with
-xref:servlet/integrations/mvc.adoc#mvc-current-security-context[`@CurrentSecurityContext`].
-For Servlet API access, use `HttpServletRequest#getRemoteUser`.
+// FIXME: Add links to and relevant description of HttpServletRequest.getRemoteUser() and @CurrentSecurityContext @AuthenticationPrincipal

 By default, `SecurityContextHolder` uses a `ThreadLocal` to store these details, which means that the `SecurityContext` is always available to methods in the same thread, even if the `SecurityContext` is not explicitly passed around as an argument to those methods.
 Using a `ThreadLocal` in this way is quite safe if you take care to clear the thread after the present principal's request is processed.
@@ -3,38 +3,3 @@

 Spring Security Kerberos {spring-security-version} is built and tested with JDK 17,
 Spring Security {spring-security-version} and Spring Framework {spring-core-version}.
-
-The dependency coordinates changed with Spring Security 7:
-
-[tabs]
-======
-Maven::
-+
-.pom.xml
-[source,xml,subs="verbatim,attributes"]
----
-<dependencies>
-	<!-- ... other dependency elements ... -->
-	<dependency>
-		<groupId>org.springframework.security</groupId>
-		<artifactId>spring-security-kerberos-core</artifactId>
-	</dependency>
-	<dependency>
-		<groupId>org.springframework.security</groupId>
-		<artifactId>spring-security-kerberos-web</artifactId>
-	</dependency>
-</dependencies>
----
-
-Gradle::
-+
-.build.gradle
-[source,groovy]
-[subs="verbatim,attributes"]
----
-dependencies {
-	implementation "org.springframework.security:spring-security-kerberos-core"
-	implementation "org.springframework.security:spring-security-kerberos-web"
-}
----
-======
@@ -259,7 +259,7 @@ Java::
 +
 [source,java,role="primary"]
 ----
-HeaderWriterLogoutHandler clearSiteData = new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(Directive.ALL));
+HeaderWriterLogoutHandler clearSiteData = new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(Directives.ALL));
 http
    .logout((logout) -> logout.addLogoutHandler(clearSiteData))
 ----
@@ -268,7 +268,7 @@ Kotlin::
 +
 [source,kotlin,role="secondary"]
 ----
-val clearSiteData = HeaderWriterLogoutHandler(ClearSiteDataHeaderWriter(Directive.ALL))
+val clearSiteData = HeaderWriterLogoutHandler(ClearSiteDataHeaderWriter(Directives.ALL))
 http {
    logout {
        addLogoutHandler(clearSiteData)
@@ -12,7 +12,7 @@ OWASP places factors into the following categories:
 == `FactorGrantedAuthority`

 At the time of authentication, Spring Security's authentication mechanisms add a javadoc:org.springframework.security.core.authority.FactorGrantedAuthority[].
-For example, when a user authenticates using a password a `FactorGrantedAuthority` with the `authority` of `FactorGrantedAuthority.PASSWORD_AUTHORITY` is automatically added to the `Authentication`.
+For example, when a user authenticates using a password a `FactorGrantedAuthority` with the `authority` of `FactorGrantedAuthority.PASSWORD_AUTHORITY` is automatically added to the `Authentiation`.
 In order to require MFA with Spring Security you must:

 - Specify an authorization rule that requires multiple factors
@@ -51,7 +51,7 @@ include-code::./UseAuthorizationManagerFactoryConfiguration[tag=authorizationMan
 [[selective-mfa]]
 == Selectively Requiring MFA

-We have demonstrated how to configure an entire application to require MFA by using xref:./mfa.adoc#emfa[``@EnableMultiFactorAuthentication``s] `authorities` property.
+We have demonstrated how to configure an entire application to require MFA by using xref:./mfa.adoc#emfa[`@EnableMultiFactorAuthentication`]s `authorities` property.
 However, there are times that an application only wants parts of the application to require MFA.
 Consider the following requirements:

@@ -118,7 +118,7 @@ To enable the MFA rules globally, we can publish an `AuthorizationManagerFactory

 include-code::./AdminMfaAuthorizationManagerConfiguration[tag=authorizationManagerFactory,indent=0]
 <1> Inject the custom `AuthorizationManager` as the javadoc:org.springframework.security.authorization.DefaultAuthorizationManagerFactory#setAdditionalAuthorization(org.springframework.security.authorization.AuthorizationManager)[DefaultAuthorization.additionalAuthorization].
-This instructs `DefaultAuthorizationManagerFactory` that any authorization rule should apply our custom `AuthorizationManager` along with any authorization requirements defined by the application (e.g. `hasRole("ADMIN")`).
+This instructs `DefaultAuthorizationManagerFactory` that any authorization rule should apply our custom `AuthorizationManager` along with any authorization requirements defined by the application (e.g. `hasRole("ADMIN")).
 <2> Publish `DefaultAuthorizationManagerFactory` as a Bean, so it is used globally

 This should feel very similar to our previous example in xref:./mfa.adoc#authorization-manager-factory[].
@@ -153,11 +153,10 @@ Next we can define an `AuthorizationManagerFactory` that uses the `RequiredAutho

 include-code::./RequiredAuthoritiesAuthorizationManagerConfiguration[tag=authorizationManagerFactory,indent=0]
 <1> Inject the `RequiredAuthoritiesAuthorizationManager` as the javadoc:org.springframework.security.authorization.DefaultAuthorizationManagerFactory#setAdditionalAuthorization(org.springframework.security.authorization.AuthorizationManager)[DefaultAuthorization.additionalAuthorization].
-This instructs `DefaultAuthorizationManagerFactory` that any authorization rule should apply `RequiredAuthoritiesAuthorizationManager` along with any authorization requirements defined by the application (e.g. `hasRole("ADMIN")`).
+This instructs `DefaultAuthorizationManagerFactory` that any authorization rule should apply `RequiredAuthoritiesAuthorizationManager` along with any authorization requirements defined by the application (e.g. `hasRole("ADMIN")).
 <2> Publish `DefaultAuthorizationManagerFactory` as a Bean, so it is used globally

 We can now define our authorization rules which are combined with `RequiredAuthoritiesAuthorizationManager`.
-
 include-code::./RequiredAuthoritiesAuthorizationManagerConfiguration[tag=httpSecurity,indent=0]
 <1> URLs that begin with `/admin/**` require `ROLE_ADMIN`.
 If the username is `admin`, then `FACTOR_OTT` and `FACTOR_PASSWORD` are also required.
@@ -168,7 +167,7 @@ Our example uses an in memory mapping of usernames to the additional required au
 For more dynamic use cases that can be determined by the username, a custom implementation of javadoc:org.springframework.security.authorization.RequiredAuthoritiesRepository[] can be created.
 Possible examples would be looking up if a user has enabled MFA in an explicit setting, determining if a user has registered a passkey, etc.

-For cases that need to determine MFA based upon the `Authentication`, a custom `AuthorizationManger` can be used as demonstrated in xref:./mfa.adoc#programmatic-mfa[].
+For cases that need to determine MFA based upon the `Authentication`, a custom `AuthorizationManger` can be used as demonstrated in xref:./mfa.adoc#programmatic-mfa[]


 [[hasallauthorities]]
@@ -197,7 +196,7 @@ Can you imagine what it would be like to declare hundreds of rules like this?
 What's more that it becomes difficult to express more complicated authorization rules.
 For example, how would you require two factors and either `ROLE_ADMIN` or `ROLE_USER`?

-The answer to these questions, as we have already seen, is to use xref:./mfa.adoc#emfa[]
+The answer to these questions, as we have already seen, is to use xref:./mfa.adoc#egmfa[]

 [[re-authentication]]
 == Re-authentication
@@ -212,7 +211,7 @@ By default, this application has two authentication mechanisms that it allows, m
 If there is a set of endpoints that require a specific factor, we can specify that in `authorizeHttpRequests` as follows:

 include-code::./RequireOttConfiguration[tag=httpSecurity,indent=0]
-<1> States that all `/profile/**` endpoints require one-time-token login to be authorized
+<1> - States that all `/profile/**` endpoints require one-time-token login to be authorized

 Given the above configuration, users can log in with any mechanism that you support.
 And, if they want to visit the profile page, then Spring Security will redirect them to the One-Time-Token Login page to obtain it.
@@ -10,7 +10,7 @@ After the credential is registered, it can be used to authenticate by xref:servl
 [[passkeys-dependencies]]
 == Required Dependencies

-To get started, add the `spring-security-webauthn` dependency to your project.
+To get started, add the `webauthn4j-core` dependency to your project.

 [NOTE]
 ====
@@ -26,7 +26,12 @@ Maven::
 ----
 <dependency>
    <groupId>org.springframework.security</groupId>
-    <artifactId>spring-security-webauthn</artifactId>
+    <artifactId>spring-security-web</artifactId>
+</dependency>
+<dependency>
+    <groupId>com.webauthn4j</groupId>
+    <artifactId>webauthn4j-core</artifactId>
+    <version>{webauthn4j-core-version}</version>
 </dependency>
 ----

@@ -34,8 +39,9 @@ Gradle::
 +
 [source,groovy,role="secondary",subs="verbatim,attributes"]
 ----
-dependencies {
-    implementation "org.springframework.security:spring-security-webauthn"
+depenendencies {
+    implementation "org.springframework.security:spring-security-web"
+    implementation "com.webauthn4j:webauthn4j-core:{webauthn4j-core-version}"
 }
 ----
 ======
@@ -59,6 +65,7 @@ SecurityFilterChain filterChain(HttpSecurity http) {
 		// ...
 		.formLogin(withDefaults())
 		.webAuthn((webAuthn) -> webAuthn
+			.rpName("Spring Security Relying Party")
 			.rpId("example.com")
 			.allowedOrigins("https://example.com")
 			// optional properties
@@ -89,6 +96,7 @@ open fun filterChain(http: HttpSecurity): SecurityFilterChain {
 	// ...
 	http {
 		webAuthn {
+			rpName = "Spring Security Relying Party"
 			rpId = "example.com"
 			allowedOrigins = setOf("https://example.com")
 			// optional properties
@@ -24,7 +24,7 @@ The `RequestCache` is typically a `NullRequestCache` that does not save the requ

 [NOTE]
 ====
-The default HTTP Basic Auth Provider will suppress both Response body and `WWW-Authenticate` header in the 401 response when the request was made with a `X-Requested-With: XMLHttpRequest` header.
+The default HTTP Basic Auth Provider will suppress both Response body and `WWW-Authenticate` header in the 401 response when the request was made with a `X-Requested-By: XMLHttpRequest` header.
 This allows frontends to implement their own authentication code, instead of triggering the browser login dialog.
 To override, implement your own javadoc:org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint[].
 ====
@@ -38,7 +38,7 @@ Gradle::
 +
 [source,groovy,role="secondary"]
 ----
-dependencies {
+depenendencies {
    implementation "org.springframework.boot:spring-boot-starter-data-ldap"
    implementation "org.springframework.security:spring-security-ldap"
 }
@@ -150,7 +150,7 @@ Gradle::
 +
 [source,groovy,role="secondary",subs="verbatim,attributes"]
 ----
-dependencies {
+depenendencies {
 	runtimeOnly "com.unboundid:unboundid-ldapsdk:{unboundid-ldapsdk-version}"
 }
 ----
@@ -97,7 +97,6 @@ This design allows any number of remember-me implementation strategies.
 We have seen earlier that Spring Security provides two implementations.
 We look at each of these in turn.

-[[token-based-remember-me-services]]
 === TokenBasedRememberMeServices
 This implementation supports the simpler approach described in <<remember-me-hash-token>>.
 `TokenBasedRememberMeServices` generates a `RememberMeAuthenticationToken`, which is processed by `RememberMeAuthenticationProvider`.
@@ -111,11 +110,105 @@ If no `algorithmName` is present, the default matching algorithm will be used, w
 You can specify different algorithms for signature encoding and for signature matching, this allows users to safely upgrade to a different encoding algorithm while still able to verify old ones if there is no `algorithmName` present.
 To do that you can specify your customized `TokenBasedRememberMeServices` as a Bean and use it in the configuration.

-include-code::./CustomAlgorithmRememberMeServicesConfiguration[tag=snippet,indent=0]
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Bean
+SecurityFilterChain securityFilterChain(HttpSecurity http, RememberMeServices rememberMeServices) throws Exception {
+	http
+			.authorizeHttpRequests((authorize) -> authorize
+					.anyRequest().authenticated()
+			)
+			.rememberMe((remember) -> remember
+				.rememberMeServices(rememberMeServices)
+			);
+	return http.build();
+}
+
+@Bean
+RememberMeServices rememberMeServices(UserDetailsService userDetailsService) {
+	RememberMeTokenAlgorithm encodingAlgorithm = RememberMeTokenAlgorithm.SHA256;
+	TokenBasedRememberMeServices rememberMe = new TokenBasedRememberMeServices(myKey, userDetailsService, encodingAlgorithm);
+	rememberMe.setMatchingAlgorithm(RememberMeTokenAlgorithm.MD5);
+	return rememberMe;
+}
+----
+
+XML::
+
+[source,xml,role="secondary"]
+----
+<http>
+  <remember-me services-ref="rememberMeServices"/>
+</http>
+
+<bean id="rememberMeServices" class=
+"org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
+    <property name="userDetailsService" ref="myUserDetailsService"/>
+    <property name="key" value="springRocks"/>
+    <property name="matchingAlgorithm" value="MD5"/>
+    <property name="encodingAlgorithm" value="SHA256"/>
+</bean>
+----
+======

 The following beans are required in an application context to enable remember-me services:

-include-code::./DefaultAlgorithmRememberMeServicesConfiguration[tag=snippet,indent=0]
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Bean
+RememberMeAuthenticationFilter rememberMeFilter() {
+    RememberMeAuthenticationFilter rememberMeFilter = new RememberMeAuthenticationFilter();
+    rememberMeFilter.setRememberMeServices(rememberMeServices());
+    rememberMeFilter.setAuthenticationManager(theAuthenticationManager);
+    return rememberMeFilter;
+}
+
+@Bean
+TokenBasedRememberMeServices rememberMeServices() {
+    TokenBasedRememberMeServices rememberMeServices = new TokenBasedRememberMeServices();
+    rememberMeServices.setUserDetailsService(myUserDetailsService);
+    rememberMeServices.setKey("springRocks");
+    return rememberMeServices;
+}
+
+@Bean
+RememberMeAuthenticationProvider rememberMeAuthenticationProvider() {
+    RememberMeAuthenticationProvider rememberMeAuthenticationProvider = new RememberMeAuthenticationProvider();
+    rememberMeAuthenticationProvider.setKey("springRocks");
+    return rememberMeAuthenticationProvider;
+}
+----
+
+XML::
+
+[source,xml,role="secondary"]
+----
+<bean id="rememberMeFilter" class=
+"org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
+<property name="rememberMeServices" ref="rememberMeServices"/>
+<property name="authenticationManager" ref="theAuthenticationManager" />
+</bean>
+
+<bean id="rememberMeServices" class=
+"org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
+<property name="userDetailsService" ref="myUserDetailsService"/>
+<property name="key" value="springRocks"/>
+</bean>
+
+<bean id="rememberMeAuthenticationProvider" class=
+"org.springframework.security.authentication.RememberMeAuthenticationProvider">
+<property name="key" value="springRocks"/>
+</bean>
+----
+======

 Remember to add your `RememberMeServices` implementation to your `UsernamePasswordAuthenticationFilter.setRememberMeServices()` property, include the `RememberMeAuthenticationProvider` in your `AuthenticationManager.setProviders()` list, and add `RememberMeAuthenticationFilter` into your `FilterChainProxy` (typically immediately after your `UsernamePasswordAuthenticationFilter`).

@@ -107,7 +107,7 @@ default void verify(Supplier<Authentication> authentication, Object secureObject
 }
 ----

-The ``AuthorizationManager``'s `authorize` method is passed all the relevant information it needs in order to make an authorization decision.
+The ``AuthorizationManager``'s `check` method is passed all the relevant information it needs in order to make an authorization decision.
 In particular, passing the secure `Object` enables those arguments contained in the actual secure object invocation to be inspected.
 For example, let's assume the secure object was a `MethodInvocation`.
 It would be easy to query the `MethodInvocation` for any `Customer` argument, and then implement some sort of security logic in the `AuthorizationManager` to ensure the principal is permitted to operate on that customer.
@@ -639,7 +639,7 @@ This is because Spring Security requires all URIs to be absolute (minus the cont

 [TIP]
 =====
-There are several other components that create request matchers for you like {spring-boot-api-url}org/springframework/boot/security/autoconfigure/web/servlet/PathRequest.html[`PathRequest#toStaticResources#atCommonLocations`]
+There are several other components that create request matchers for you like {spring-boot-api-url}org/springframework/boot/autoconfigure/security/servlet/PathRequest.html[`PathRequest#toStaticResources#atCommonLocations`]
 =====

 [[match-by-custom]]
@@ -118,7 +118,7 @@ A given invocation to `MyCustomerService#readCustomer` may look something like t
 image::{figures}/methodsecurity.png[]

 1. Spring AOP invokes its proxy method for `readCustomer`. Among the proxy's other advisors, it invokes an javadoc:org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor[] that matches <<annotation-method-pointcuts,the `@PreAuthorize` pointcut>>
-2. The interceptor invokes javadoc:org.springframework.security.authorization.method.PreAuthorizeAuthorizationManager[`PreAuthorizeAuthorizationManager#authorize`]
+2. The interceptor invokes javadoc:org.springframework.security.authorization.method.PreAuthorizeAuthorizationManager[`PreAuthorizeAuthorizationManager#check`]
 3. The authorization manager uses a `MethodSecurityExpressionHandler` to parse the annotation's <<authorization-expressions,SpEL expression>> and constructs a corresponding `EvaluationContext` from a `MethodSecurityExpressionRoot` containing xref:servlet/authentication/architecture.adoc#servlet-authentication-authentication[a `Supplier<Authentication>`] and `MethodInvocation`.
 4. The interceptor uses this context to evaluate the expression; specifically, it reads xref:servlet/authentication/architecture.adoc#servlet-authentication-authentication[the `Authentication`] from the `Supplier` and checks whether it has `permission:read` in its collection of xref:servlet/authorization/architecture.adoc#authz-authorities[authorities]
 5. If the evaluation passes, then Spring AOP proceeds to invoke the method.
@@ -493,14 +493,14 @@ public class MyCustomDsl extends AbstractHttpConfigurer<MyCustomDsl, HttpSecurit
 	private boolean flag;

 	@Override
-	public void init(HttpSecurity http) {
+	public void init(HttpSecurity http) throws Exception {
 		// any method that adds another configurer
 		// must be done in the init method
-		http.csrf(csrf -> csrf.disable());
+		http.csrf().disable();
 	}

 	@Override
-	public void configure(HttpSecurity http) {
+	public void configure(HttpSecurity http) throws Exception {
 		ApplicationContext context = http.getSharedObject(ApplicationContext.class);

 		// here we lookup from the ApplicationContext. You can also just create a new instance.
--- a/Show More
+++ b/Show More