Fix Formatting and Style

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Merge branch '7.0.x' into dependabot/gradle/7.1.x/io-spring-javaformat-0.0.48
2026-09-06 01:09:48 +00:00 · 2026-09-04 11:53:48 -06:00 · 2026-09-04 10:42:43 -06:00 · 2026-09-04 10:26:18 -06:00 · 2026-09-04 09:24:19 -07:00 · 2026-09-04 09:24:19 -07:00
1124 changed files with 8300 additions and 3565 deletions
@@ -1,17 +0,0 @@
-name: Merge Dependabot PR
-
-on:
-  pull_request:
-    branches:
-      - main
-      - '*.x'
-      - 'docs-build'
-
-run-name: Merge Dependabot PR ${{ github.ref_name }}
-
-jobs:
-  merge-dependabot-pr:
-    permissions: write-all
-    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
-    with:
-      mergeArguments: --auto --rebase
@@ -14,7 +14,7 @@ permissions:
 jobs:
  snapshot-test:
    name: Test Against Snapshots
-    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
    strategy:
      matrix:
        include:
@@ -31,6 +31,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -17,7 +17,7 @@ permissions:
 jobs:
  build:
    name: Build
-    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
@@ -30,7 +30,7 @@ jobs:
  deploy-artifacts:
    name: Deploy Artifacts
    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
    with:
      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
      default-publish-milestones-central: true
@@ -39,31 +39,18 @@ jobs:
  deploy-schema:
    name: Deploy Schema
    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
    with:
      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
      java-version: 25
    secrets: inherit
-  perform-release:
-    name: Perform Release
-    needs: [ deploy-artifacts, deploy-schema ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    with:
-      should-perform-release: ${{ needs.deploy-artifacts.outputs.artifacts-deployed }}
-      project-version: ${{ needs.deploy-artifacts.outputs.project-version }}
-      milestone-repo-url: https://repo1.maven.org/maven2
-      release-repo-url: https://repo1.maven.org/maven2
-      artifact-path: org/springframework/security/spring-security-core
-      slack-announcing-id: spring-security-announcing
-      java-version: 25
-    secrets: inherit
  send-notification:
    name: Send Notification
-    needs: [ perform-release ]
+    needs: [ deploy-artifacts, deploy-schema ]
    if: ${{ !success() }}
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -15,24 +15,24 @@ jobs:
      issues: write
    steps:
    - name: Checkout
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Compute Version
      id: compute-version
-      uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
+      uses: spring-io/spring-release-actions/compute-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
    - name: Get Today's Release Version
      id: todays-release
-      uses: spring-io/spring-release-actions/get-todays-release-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
+      uses: spring-io/spring-release-actions/get-todays-release-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
      with:
        snapshot-version: ${{ steps.compute-version.outputs.version }}
        milestone-repository: ${{ github.repository }}
        milestone-token: ${{ secrets.GITHUB_TOKEN }}
    - name: Compute Next Version
      id: next-version
-      uses: spring-io/spring-release-actions/compute-next-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
+      uses: spring-io/spring-release-actions/compute-next-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
      with:
        version: ${{ steps.todays-release.outputs.release-version }}
    - name: Schedule Next Milestone
-      uses: spring-io/spring-release-actions/schedule-milestone@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
+      uses: spring-io/spring-release-actions/schedule-milestone@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
      with:
        version: ${{ steps.next-version.outputs.version }}
        version-date: ${{ steps.next-version.outputs.version-date }}
@@ -17,7 +17,7 @@ jobs:
    if: github.repository_owner == 'spring-projects'
    steps:
    - name: Checkout
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        ref: docs-build
        fetch-depth: 1
@@ -1,27 +0,0 @@
-name: Finalize Release
-
-on:
-  workflow_dispatch: # Manual trigger
-    inputs:
-      version:
-        description: The Spring Security release to finalize (e.g. 7.0.0-RC2)
-        required: true
-
-env:
-  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-
-permissions:
-  contents: read
-
-jobs:
-  perform-release:
-    name: Perform Release
-    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    with:
-      should-perform-release: true
-      project-version: ${{ inputs.version }}
-      milestone-repo-url: https://repo1.maven.org/maven2
-      release-repo-url: https://repo1.maven.org/maven2
-      artifact-path: org/springframework/security/spring-security-core
-      slack-announcing-id: spring-security-announcing
-    secrets: inherit
@@ -20,9 +20,9 @@ jobs:
          git config --global user.name 'github-actions[bot]'
          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          java-version: '25'
          distribution: 'temurin'
@@ -1,35 +0,0 @@
-name: Check Milestone
-on:
-  milestone:
-    types: [created, opened, edited]
-env:
-  DUE_ON: ${{ github.event.milestone.due_on }}
-  TITLE: ${{ github.event.milestone.title }}
-permissions:
-  contents: read
-jobs:
-  spring-releasetrain-checks:    
-    name: Check DueOn is on a Release Date
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    permissions:
-      contents: none
-    steps:
-    - name: Print Milestone Being Checked
-      run: echo "Validating DueOn '$DUE_ON' for milestone '$TITLE'"
-    - name: Validate DueOn
-      if: env.DUE_ON != ''
-      run: |
-        export TOOL_VERSION=0.1.1
-        wget "https://repo.maven.apache.org/maven2/io/spring/releasetrain/spring-release-train-tools/$TOOL_VERSION/spring-release-train-tools-$TOOL_VERSION.jar"
-        java -cp "spring-release-train-tools-$TOOL_VERSION.jar" io.spring.releasetrain.CheckMilestoneDueOnMain --dueOn "$DUE_ON" --expectedDayOfWeek MONDAY --expectedMondayCount 3
-  send-notification:
-    name: Send Notification
-    needs: [ spring-releasetrain-checks ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'spring-projects/spring-security' }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up gradle
        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
        with:
@@ -24,7 +24,7 @@ jobs:
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'spring-projects/spring-security' }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up gradle
        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
        with:
@@ -46,6 +46,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,30 @@
+name: Release Announcements - Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: The version to publish
+        required: true
+        type: string
+
+permissions:
+  actions: write
+  contents: read
+  issues: write
+
+jobs:
+  deploy-schema:
+    name: Deploy Schema
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      should-deploy-schema: true
+    secrets: inherit
+  publish-release-announcements:
+    name: Publish Release Announcements
+    needs: [ deploy-schema ]
+    if: ${{ !github.event.repository.fork }}
+    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit
@@ -0,0 +1,24 @@
+name: Release Announcements - Stage
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: The version to stage
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  stage-release-announcements:
+    name: Stage Release Announcements
+    if: ${{ !github.event.repository.fork }}
+    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      version: ${{ inputs.version || github.ref_name }}
+    secrets: inherit
@@ -1,24 +0,0 @@
-name: Release Scheduler
-on:
-  schedule:
-  - cron: '15 15 * * MON' # Every Monday at 3:15pm UTC
-  workflow_dispatch:
-permissions: read-all
-jobs:
-  dispatch_scheduled_releases:
-    name: Dispatch scheduled releases
-    if: github.repository_owner == 'spring-projects'
-    strategy:
-      matrix:
-        # List of active maintenance branches.
-        branch: [ main, 7.0.x, 6.5.x, 6.4.x, 6.3.x ]
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      with:
-        fetch-depth: 1
-    - name: Dispatch
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run update-scheduled-release-version.yml -r ${{ matrix.branch }}
@@ -1,23 +0,0 @@
-name: Update Scheduled Release Version
-
-on:
-  workflow_dispatch: # Manual trigger only. Triggered by release-scheduler.yml on main.
-
-permissions:
-  contents: read
-
-jobs:
-  update-scheduled-release-version:
-    name: Update Scheduled Release Version
-    uses: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    secrets: inherit
-  send-notification:
-    name: Send Notification
-    needs: [ update-scheduled-release-version ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -90,7 +90,7 @@ public class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocat
 	}

 	/**
-	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136
+	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136.
 	 * @return
 	 */
 	private ExpressionParser getParser() {
@@ -30,6 +30,9 @@ import org.springframework.security.access.prepost.PostInvocationAuthorizationAd
 import org.springframework.security.core.Authentication;

 /**
+ * A {@link PostInvocationAuthorizationAdvice} that applies {@code PostFilter} and
+ * {@code PostAuthorize} expressions.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,6 +23,8 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PostInvocationAttribute;

 /**
+ * A {@link PostInvocationAttribute} based on filter and authorize expressions.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,6 +23,8 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PreInvocationAttribute;

 /**
+ * A {@link PreInvocationAttribute} based on parsed {@link Expression}s.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -59,12 +59,12 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	private @Nullable ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();

 	/**
-	 * Map from RegisteredMethod to ConfigAttribute list
+	 * Map from RegisteredMethod to ConfigAttribute list.
 	 */
 	protected final Map<RegisteredMethod, List<ConfigAttribute>> methodMap = new HashMap<>();

 	/**
-	 * Map from RegisteredMethod to name pattern used for registration
+	 * Map from RegisteredMethod to name pattern used for registration.
 	 */
 	private final Map<RegisteredMethod, String> nameMap = new HashMap<>();

@@ -72,7 +72,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
-	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a
+	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a.
 	 * @param methodMap map of method names to <tt>ConfigAttribute</tt>s.
 	 */
 	public MapBasedMethodSecurityMetadataSource(Map<String, List<ConfigAttribute>> methodMap) {
@@ -236,6 +236,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
+	 * Returns the size of the method map.
 	 * @return map size (for unit tests and diagnostics)
 	 */
 	public int getMethodMapSize() {
@@ -41,7 +41,7 @@ import org.springframework.security.core.parameters.AnnotationParameterNameDisco
 public @interface P {

 	/**
-	 * The parameter name
+	 * The parameter name.
 	 * @return
 	 */
 	String value();
@@ -74,7 +74,7 @@ public class PrePostAdviceReactiveMethodInterceptor implements MethodInterceptor
 	private static final int RETURN_TYPE_METHOD_PARAMETER_INDEX = -1;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param attributeSource the {@link MethodSecurityMetadataSource} to use
 	 * @param preInvocationAdvice the {@link PreInvocationAuthorizationAdvice} to use
 	 * @param postInvocationAdvice the {@link PostInvocationAuthorizationAdvice} to use
@@ -22,6 +22,9 @@ import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.authorization.AuthorizationManager;

 /**
+ * A factory for creating {@link PreInvocationAttribute}s and
+ * {@link PostInvocationAttribute}s.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @see org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor
@@ -19,7 +19,7 @@ package org.springframework.security.messaging.access.expression;
 import org.springframework.expression.EvaluationContext;

 /**
- * Allows post processing the {@link EvaluationContext}
+ * Allows post processing the {@link EvaluationContext}.
 *
 * <p>
 * This API is intentionally kept package scope as it may evolve over time.
@@ -46,7 +46,7 @@ class MessageExpressionConfigAttribute implements ConfigAttribute, EvaluationCon
 	private final MessageMatcher<Object> matcher;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param authorizeExpression the {@link Expression} to use. Cannot be null
 	 * @param matcher the {@link MessageMatcher} used to match the messages.
 	 */
@@ -48,7 +48,7 @@ public final class ChannelSecurityInterceptor extends AbstractSecurityIntercepto
 	private final MessageSecurityMetadataSource metadataSource;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param metadataSource the MessageSecurityMetadataSource to use. Cannot be null.
 	 *
 	 * @see DefaultMessageSecurityMetadataSource
@@ -20,7 +20,7 @@ import org.springframework.messaging.Message;
 import org.springframework.security.access.SecurityMetadataSource;

 /**
- * A {@link SecurityMetadataSource} that is used for securing {@link Message}
+ * A {@link SecurityMetadataSource} that is used for securing {@link Message}.
 *
 * @author Rob Winch
 * @since 4.0
@@ -32,6 +32,8 @@ import org.springframework.security.web.RedirectStrategy;
 import org.springframework.util.Assert;

 /**
+ * A {@link ChannelEntryPoint} that retries the request on a different scheme and port.
+ *
 * @author Luke Taylor
 * @deprecated please use
 * {@link org.springframework.security.web.transport.HttpsRedirectFilter} and its
@@ -45,12 +47,12 @@ public abstract class AbstractRetryEntryPoint implements ChannelEntryPoint {
 	private PortMapper portMapper = new PortMapperImpl();

 	/**
-	 * The scheme ("http://" or "https://")
+	 * The scheme ("http://" or "https://").
 	 */
 	private final String scheme;

 	/**
-	 * The standard port for the scheme (80 for http, 443 for https)
+	 * The standard port for the scheme (80 for http, 443 for https).
 	 */
 	private final int standardPort;

@@ -28,6 +28,8 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;

 /**
+ * The default implementation of {@link SecurityExpressionHandler} for web security.
+ *
 * @author Luke Taylor
 * @author Eddú Meléndez
 * @author Steve Riesenberg
@@ -54,7 +54,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	private boolean observeOncePerRequest = false;

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead)
+	 * Not used (we rely on IoC container lifecycle services instead).
 	 * @param arg0 ignored
 	 *
 	 */
@@ -63,7 +63,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	}

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead)
+	 * Not used (we rely on IoC container lifecycle services instead).
 	 */
 	@Override
 	public void destroy() {
@@ -141,7 +141,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	private AclClassIdUtils aclClassIdUtils;

 	/**
-	 * Constructor accepting mandatory arguments
+	 * Constructor accepting mandatory arguments.
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -152,7 +152,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	}

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -565,7 +565,7 @@ public class BasicLookupStrategy implements LookupStrategy {

 		/**
 		 * Accepts the current <code>ResultSet</code> row, and converts it into an
-		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>
+		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>.
 		 * @param acls the Map we should add the converted Acl to
 		 * @param rs the ResultSet focused on a current row
 		 * @throws SQLException if something goes wrong converting values
@@ -479,6 +479,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	}

 	/**
+	 * Sets whether the database enforces foreign key constraints.
 	 * @param foreignKeysInDatabase if false this class will perform additional FK
 	 * constrain checking, which may cause deadlocks (the default is true, so deadlocks
 	 * are avoided but the database is expected to enforce FKs)
@@ -15,7 +15,7 @@
 */

 /**
- * JDBC-based persistence of ACL information
+ * JDBC-based persistence of ACL information.
 */
@NullMarked
 package org.springframework.security.acls.jdbc;
@@ -37,6 +37,7 @@ import org.jspecify.annotations.Nullable;
 public interface ObjectIdentity extends Serializable {

 	/**
+	 * Compares this <tt>ObjectIdentity</tt> to the given object for equality.
 	 * @param obj to be compared
 	 * @return <tt>true</tt> if the objects are equal, <tt>false</tt> otherwise
 	 * @see Object#equals(Object)
@@ -67,6 +68,7 @@ public interface ObjectIdentity extends Serializable {
 	String getType();

 	/**
+	 * Returns a hash code representation of the <tt>ObjectIdentity</tt>.
 	 * @return a hash code representation of the <tt>ObjectIdentity</tt>
 	 * @see Object#hashCode()
 	 */
@@ -31,6 +31,8 @@ import java.io.Serializable;
 public interface ObjectIdentityGenerator {

 	/**
+	 * Creates an {@link ObjectIdentity} using the supplied identifier and type
+	 * information.
 	 * @param id the identifier of the domain object, not null
 	 * @param type the type of the object (often a class name), not null
 	 * @return the identity constructed using the supplied identifier and type
@@ -18,7 +18,7 @@ package org.springframework.security.acls.model;

 /**
 * Strategy interface that provides the ability to determine which {@link ObjectIdentity}
- * will be returned for a particular domain object
+ * will be returned for a particular domain object.
 *
 * @author Ben Alex
 */
@@ -14,6 +14,16 @@ repositories {
 	gradlePluginPortal()
 	mavenCentral()
 	maven { url = 'https://repo.spring.io/snapshot' }
+	if (System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL") != null) {
+		maven {
+			name = "Release Train"
+			url = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL")
+			credentials {
+				username = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME")
+				password = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD")
+			}
+		}
+	}
 }

 sourceSets {
@@ -43,6 +43,16 @@ class RepositoryConventionPlugin implements Plugin<Project> {
 				}
 			}
 			mavenCentral()
+			if (System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL") != null) {
+				maven {
+					name = "Release Train"
+					url = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL")
+					credentials {
+						username = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME")
+						password = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD")
+					}
+				}
+			}
 			if (isSnapshot) {
 				maven {
 					name = 'artifactory-snapshot'
@@ -22,6 +22,12 @@ public class MavenPublishingConventionsPlugin implements Plugin<Project> {
 			@Override
 			public void execute(MavenPublishPlugin mavenPublish) {
 				PublishingExtension publishing = project.getExtensions().getByType(PublishingExtension.class);
+				if (project.hasProperty("deploymentRepository")) {
+					publishing.getRepositories().maven((mavenRepository) -> {
+						mavenRepository.setUrl(project.property("deploymentRepository"));
+						mavenRepository.setName("deployment");
+					});
+				}
 				publishing.getPublications().withType(MavenPublication.class)
 						.all((mavenPublication) -> MavenPublishingConventionsPlugin.this.customizePom(mavenPublication.getPom(), project));
 				MavenPublishingConventionsPlugin.this.customizeJavaPlugin(project);
@@ -72,7 +72,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * Private constructor for Jackson Deserialization support
+	 * Private constructor for Jackson Deserialization support.
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -108,7 +108,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	protected CasAuthenticationToken(Builder<?> builder) {
 		super(builder);
 		Assert.isTrue(!"".equals(builder.principal), "principal cannot be null or empty");
-		Assert.notNull(!"".equals(builder.credentials), "credentials cannot be null or empty");
+		Assert.isTrue(!"".equals(builder.credentials), "credentials cannot be null or empty");
 		Assert.notNull(builder.userDetails, "userDetails cannot be null");
 		Assert.notNull(builder.assertion, "assertion cannot be null");
 		this.keyHash = builder.keyHash;
@@ -182,7 +182,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * A builder of {@link CasAuthenticationToken} instances
+	 * A builder of {@link CasAuthenticationToken} instances.
 	 *
 	 * @since 7.0
 	 */
@@ -208,7 +208,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this key
+		 * Use this key.
 		 * @param key the key to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -232,7 +232,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link UserDetails}
+		 * Use this {@link UserDetails}.
 		 * @param userDetails the {@link UserDetails} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -242,7 +242,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link Assertion}
+		 * Use this {@link Assertion}.
 		 * @param assertion the {@link Assertion} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -121,7 +121,7 @@ public class CasServiceTicketAuthenticationToken extends AbstractAuthenticationT
 	}

 	/**
-	 * A builder of {@link CasServiceTicketAuthenticationToken} instances
+	 * A builder of {@link CasServiceTicketAuthenticationToken} instances.
 	 *
 	 * @since 7.0
 	 */
@@ -32,6 +32,7 @@ import org.jspecify.annotations.Nullable;
 public final class NullStatelessTicketCache implements StatelessTicketCache {

 	/**
+	 * Always returns {@code null} since tickets are not stored.
 	 * @return null since we are not storing any tickets.
 	 */
 	@Override
@@ -20,9 +20,11 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -36,14 +38,14 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,9 +19,11 @@ package org.springframework.security.cas.jackson;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -35,14 +37,14 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,9 +19,11 @@ package org.springframework.security.cas.jackson;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -38,13 +40,13 @@ import org.springframework.security.core.userdetails.UserDetails;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
-		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
+@JsonTypeInfo(use = Id.CLASS)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
+		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -20,10 +20,13 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -49,15 +52,15 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,10 +19,13 @@ package org.springframework.security.cas.jackson2;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -47,15 +50,15 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,10 +19,13 @@ package org.springframework.security.cas.jackson2;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -55,14 +58,14 @@ import org.springframework.security.core.userdetails.UserDetails;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
-		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
+@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
+		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
@JsonIgnoreProperties(ignoreUnknown = true)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -155,7 +155,7 @@ public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, In
 	}

 	/**
-	 * Sets the {@link RedirectStrategy} to use
+	 * Sets the {@link RedirectStrategy} to use.
 	 * @param redirectStrategy the {@link RedirectStrategy} to use
 	 * @since 6.3
 	 */
@@ -69,7 +69,7 @@ public final class CasGatewayAuthenticationRedirectFilter extends GenericFilterB
 	private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

 	/**
-	 * Constructs a new instance of this class
+	 * Constructs a new instance of this class.
 	 * @param serviceProperties the {@link ServiceProperties}
 	 */
 	public CasGatewayAuthenticationRedirectFilter(String casLoginUrl, ServiceProperties serviceProperties) {
@@ -44,7 +44,7 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
 	private final String serviceUrl;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param request the current {@link HttpServletRequest} to obtain the
 	 * {@link #getServiceUrl()} from.
 	 * @param artifactPattern the {@link Pattern} that will be used to clean up the query
@@ -53,7 +53,7 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
-	 * Creates an implementation that uses the specified artifactParameterName
+	 * Creates an implementation that uses the specified artifactParameterName.
 	 * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
 	 * @param artifactParameterName the artifactParameterName that is removed from the
 	 * current URL. The result becomes the service url. Cannot be null and cannot be an
@@ -66,6 +66,7 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
+	 * Builds the {@code ServiceAuthenticationDetails} from the given request.
 	 * @param context the {@code HttpServletRequest} object.
 	 * @return the {@code ServiceAuthenticationDetails} containing information about the
 	 * current request
@@ -34,6 +34,7 @@ import org.springframework.security.core.userdetails.UserDetails;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.assertj.core.api.Assertions.assertThatNoException;

 /**
 * Tests {@link CasAuthenticationToken}.
@@ -182,4 +183,38 @@ public class CasAuthenticationTokenTests {
 		assertThat(authorities).containsExactlyInAnyOrder("FACTOR_ONE", "FACTOR_TWO");
 	}

+	@Test
+	public void toBuilderWhenPrincipalIsEmpty() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().principal(null).build());
+		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().principal("").build());
+	}
+
+	@Test
+	public void toBuilderWhenPrincipalIsNotEmpty() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		assertThatNoException().isThrownBy(() -> token.toBuilder().principal("principal").build());
+	}
+
+	@Test
+	public void toBuilderWhenCredentialsIsEmpty() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().credentials(null).build());
+		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().credentials("").build());
+	}
+
+	@Test
+	public void toBuilderWhenCredentialsIsNotEmpty() {
+		final Assertion assertion = new AssertionImpl("test");
+		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
+				makeUserDetails(), assertion);
+		assertThatNoException().isThrownBy(() -> token.toBuilder().credentials("credentials").build());
+	}
+
 }
@@ -25,6 +25,8 @@ import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;

 /**
+ * Test configurations for namespace-based LDAP {@code AuthenticationProvider} setup.
+ *
 * @author Rob Winch
 *
 */
@@ -50,6 +50,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for anonymous authentication over RSocket.
+ *
 * @author Andrey Litvitski
 */
@ContextConfiguration
@@ -50,6 +50,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for securing RSocket requests and responses.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -60,6 +60,8 @@ import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;

 /**
+ * Integration tests for RSocket security observations.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -50,6 +50,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for RSocket security combined with WebFlux security.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -59,6 +59,8 @@ import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;

 /**
+ * Integration tests for RSocket JWT authentication.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -53,6 +53,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for connecting to an {@link RSocketMessageHandler} secured server.
+ *
 * @author Rob Winch
 * @author Luis Felipe Vega
 * @author Jesús Ascama Arias
@@ -55,6 +55,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for securing an {@link RSocketMessageHandler}.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -55,6 +55,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for securing RSocket requests using simple authentication metadata.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -32,6 +32,8 @@ import org.springframework.test.util.ReflectionTestUtils;
 import static org.assertj.core.api.Assertions.assertThat;

 /**
+ * Tests for the {@code ldap-server} XML namespace element.
+ *
 * @author Luke Taylor
 * @author Rob Winch
 */
@@ -39,6 +39,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;

 /**
+ * Tests for the {@code ldap-user-service} bean definition parser.
+ *
 * @author Luke Taylor
 * @author Rob Winch
 * @author Eddú Meléndez
@@ -31,7 +31,7 @@ public abstract class BeanIds {

 	/**
 	 * The "global" AuthenticationManager instance, registered by the
-	 * &lt;authentication-manager&gt; element
+	 * &lt;authentication-manager&gt; element.
 	 */
 	public static final String AUTHENTICATION_MANAGER = PREFIX + "authenticationManager";

@@ -25,6 +25,9 @@ import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.config.debug.SecurityDebugBeanFactoryPostProcessor;

 /**
+ * Parses the {@code debug} element to register a
+ * {@link SecurityDebugBeanFactoryPostProcessor}.
+ *
 * @author Luke Taylor
 */
 public class DebugBeanDefinitionParser implements BeanDefinitionParser {
@@ -187,7 +187,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * Gets the shared objects
+	 * Gets the shared objects.
 	 * @return the shared Objects
 	 */
 	public Map<Class<?>, Object> getSharedObjects() {
@@ -315,7 +315,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui

 	/**
 	 * Executes the build using the {@link SecurityConfigurer}'s that have been applied
-	 * using the following steps:
+	 * using the following steps:.
 	 *
 	 * <ul>
 	 * <li>Invokes {@link #beforeInit()} for any subclass to hook into</li>
@@ -406,7 +406,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * The build state for the application
+	 * The build state for the application.
 	 *
 	 * @author Rob Winch
 	 * @since 3.2
@@ -414,7 +414,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	private enum BuildState {

 		/**
-		 * This is the state before the {@link SecurityBuilder#build()} is invoked
+		 * This is the state before the {@link SecurityBuilder#build()} is invoked.
 		 */
 		UNBUILT(0),

@@ -455,7 +455,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		}

 		/**
-		 * Determines if the state is CONFIGURING or later
+		 * Determines if the state is CONFIGURING or later.
 		 * @return
 		 */
 		public boolean isConfigured() {
@@ -17,7 +17,7 @@
 package org.springframework.security.config.annotation;

 /**
- * Interface for building an Object
+ * Interface for building an Object.
 *
 * @param <O> The type of the Object being built
 * @author Rob Winch
@@ -115,7 +115,7 @@ public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>>
 		}

 		/**
-		 * Adds an {@link ObjectPostProcessor} to use
+		 * Adds an {@link ObjectPostProcessor} to use.
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} to add
 		 * @return true if the {@link ObjectPostProcessor} was added, else false
 		 */
@@ -22,7 +22,7 @@ import org.springframework.security.authentication.ProviderManager;
 import org.springframework.security.config.annotation.SecurityBuilder;

 /**
- * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}
+ * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}.
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @author Rob Winch
@@ -66,7 +66,7 @@ public class AuthenticationManagerBuilder
 	private AuthenticationEventPublisher eventPublisher;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 	 */
 	public AuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor) {
@@ -92,7 +92,7 @@ public class AuthenticationManagerBuilder
 	}

 	/**
-	 * Sets the {@link AuthenticationEventPublisher}
+	 * Sets the {@link AuthenticationEventPublisher}.
 	 * @param eventPublisher the {@link AuthenticationEventPublisher} to use
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
 	 */
@@ -103,6 +103,7 @@ public class AuthenticationManagerBuilder
 	}

 	/**
+	 * Sets whether the {@link AuthenticationManager} should clear the credentials.
 	 * @param eraseCredentials true if {@link AuthenticationManager} should clear the
 	 * credentials from the {@link Authentication} object after authenticating
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
@@ -54,7 +54,7 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.util.Assert;

 /**
- * Exports the authentication {@link Configuration}
+ * Exports the authentication {@link Configuration}.
 *
 * @author Rob Winch
 * @author Ngoc Nhan
@@ -265,7 +265,7 @@ public class AuthenticationConfiguration {
 		private PasswordEncoder defaultPasswordEncoder;

 		/**
-		 * Creates a new instance
+		 * Creates a new instance.
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 		 */
 		DefaultPasswordEncoderAuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
@@ -42,6 +42,7 @@ class InitializeAuthenticationProviderBeanManagerConfigurer extends GlobalAuthen
 	private final ApplicationContext context;

 	/**
+	 * Creates a new instance.
 	 * @param context the ApplicationContext to look up beans.
 	 */
 	InitializeAuthenticationProviderBeanManagerConfigurer(ApplicationContext context) {
@@ -49,6 +49,7 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 	private final ApplicationContext context;

 	/**
+	 * Creates a new instance using the given {@link ApplicationContext}.
 	 * @param context
 	 */
 	InitializeUserDetailsBeanManagerConfigurer(ApplicationContext context) {
@@ -112,6 +113,8 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 		}

 		/**
+		 * Returns a bean of the requested class if there's just a single registered
+		 * component, null otherwise.
 		 * @return a bean of the requested class if there's just a single registered
 		 * component, null otherwise.
 		 */
@@ -17,6 +17,7 @@
 package org.springframework.security.config.annotation.authentication.configurers.ldap;

 import java.io.IOException;
+import java.net.InetAddress;
 import java.net.ServerSocket;

 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
@@ -135,7 +136,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 	/**
 	 * Gets the {@link LdapAuthoritiesPopulator} and defaults to
-	 * {@link DefaultLdapAuthoritiesPopulator}
+	 * {@link DefaultLdapAuthoritiesPopulator}.
 	 * @return the {@link LdapAuthoritiesPopulator}
 	 */
 	private LdapAuthoritiesPopulator getLdapAuthoritiesPopulator() {
@@ -184,7 +185,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates the {@link LdapAuthenticator} to use
+	 * Creates the {@link LdapAuthenticator} to use.
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link LdapAuthenticator} to use
 	 */
@@ -202,7 +203,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates {@link PasswordComparisonAuthenticator}
+	 * Creates {@link PasswordComparisonAuthenticator}.
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return
 	 */
@@ -217,7 +218,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates a {@link BindAuthenticator}
+	 * Creates a {@link BindAuthenticator}.
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link BindAuthenticator} to use
 	 */
@@ -394,6 +395,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
+	 * Enables password-based comparison for authentication.
 	 * @return the {@link PasswordCompareConfigurer} for further customizations
 	 */
 	public PasswordCompareConfigurer passwordCompare() {
@@ -402,7 +404,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Sets up Password based comparison
+	 * Sets up Password based comparison.
 	 *
 	 * @author Rob Winch
 	 */
@@ -433,7 +435,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Allows obtaining a reference to the
-		 * {@link LdapAuthenticationProviderConfigurer} for further customizations
+		 * {@link LdapAuthenticationProviderConfigurer} for further customizations.
 		 * @return attribute in the directory which contains the user password
 		 */
 		public LdapAuthenticationProviderConfigurer<B> and() {
@@ -546,7 +548,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Gets the {@link LdapAuthenticationProviderConfigurer} for further
-		 * customizations
+		 * customizations.
 		 * @return the {@link LdapAuthenticationProviderConfigurer} for further
 		 * customizations
 		 */
@@ -590,7 +592,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 		}

 		private int getDefaultPort() {
-			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
+			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
 				return serverSocket.getLocalPort();
 			}
 			catch (IOException ex) {
@@ -35,7 +35,7 @@ public class InMemoryUserDetailsManagerConfigurer<B extends ProviderManagerBuild
 		extends UserDetailsManagerConfigurer<B, InMemoryUserDetailsManagerConfigurer<B>> {

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 */
 	public InMemoryUserDetailsManagerConfigurer() {
 		super(new InMemoryUserDetailsManager(new ArrayList<>()));
@@ -140,7 +140,7 @@ public class JdbcUserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B
 	}

 	/**
-	 * Defines the {@link UserCache} to use
+	 * Defines the {@link UserCache} to use.
 	 * @param userCache the {@link UserCache} to use
 	 * @return the {@link JdbcUserDetailsManagerConfigurer} for further customizations
 	 */
@@ -112,7 +112,7 @@ public class UserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>, C
 		private final C builder;

 		/**
-		 * Creates a new instance
+		 * Creates a new instance.
 		 * @param builder the builder to return
 		 */
 		private UserDetailsBuilder(C builder) {
@@ -25,7 +25,7 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}
+ * Allows configuring a {@link DaoAuthenticationProvider}.
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @param <C> the type of {@link AbstractDaoAuthenticationConfigurer} this is
@@ -41,7 +41,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana
 	private final U userDetailsService;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param userDetailsService
 	 */
 	AbstractDaoAuthenticationConfigurer(U userDetailsService) {
@@ -88,7 +88,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana

 	/**
 	 * Gets the {@link UserDetailsService} that is used with the
-	 * {@link DaoAuthenticationProvider}
+	 * {@link DaoAuthenticationProvider}.
 	 * @return the {@link UserDetailsService} that is used with the
 	 * {@link DaoAuthenticationProvider}
 	 */
@@ -21,7 +21,7 @@ import org.springframework.security.config.annotation.authentication.ProviderMan
 import org.springframework.security.core.userdetails.UserDetailsService;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}
+ * Allows configuring a {@link DaoAuthenticationProvider}.
 *
 * @param <B> The type of {@link ProviderManagerBuilder} this is
 * @param <U> The type of {@link UserDetailsService} that is being used
@@ -32,7 +32,7 @@ public class DaoAuthenticationConfigurer<B extends ProviderManagerBuilder<B>, U
 		extends AbstractDaoAuthenticationConfigurer<B, DaoAuthenticationConfigurer<B, U>, U> {

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param userDetailsService
 	 */
 	public DaoAuthenticationConfigurer(U userDetailsService) {
@@ -34,7 +34,7 @@ public abstract class UserDetailsAwareConfigurer<B extends ProviderManagerBuilde
 		extends SecurityConfigurerAdapter<AuthenticationManager, B> {

 	/**
-	 * Gets the {@link UserDetailsService} or null if it is not available
+	 * Gets the {@link UserDetailsService} or null if it is not available.
 	 * @return the {@link UserDetailsService} or null if it is not available
 	 */
 	public abstract U getUserDetailsService();
@@ -35,7 +35,7 @@ public class UserDetailsServiceConfigurer<B extends ProviderManagerBuilder<B>, C
 		extends AbstractDaoAuthenticationConfigurer<B, C, U> {

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param userDetailsService the {@link UserDetailsService} that should be used
 	 */
 	public UserDetailsServiceConfigurer(U userDetailsService) {
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-present the original author or authors.
+ * Copyright 2004-present the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -28,6 +28,8 @@ import org.springframework.core.Ordered;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;

 /**
+ * Enables Spring Security reactive method security.
+ *
 * @author Rob Winch
 * @since 5.0
 */
@@ -39,6 +39,9 @@ import org.springframework.util.ClassUtils;
@Deprecated
 final class GlobalMethodSecuritySelector implements ImportSelector {

+	private static final boolean isAccessPresent = ClassUtils.isPresent(
+			"org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor", null);
+
 	@Override
 	public String[] selectImports(AnnotationMetadata importingClassMetadata) {
 		Class<EnableGlobalMethodSecurity> annoType = EnableGlobalMethodSecurity.class;
@@ -59,16 +62,26 @@ final class GlobalMethodSecuritySelector implements ImportSelector {
 		boolean jsr250Enabled = attributes.getBoolean("jsr250Enabled");
 		List<String> classNames = new ArrayList<>(4);
 		if (isProxy) {
+			assertAccessModulePresent();
 			classNames.add(MethodSecurityMetadataSourceAdvisorRegistrar.class.getName());
 		}
 		classNames.add(autoProxyClassName);
 		if (!skipMethodSecurityConfiguration) {
+			assertAccessModulePresent();
 			classNames.add(GlobalMethodSecurityConfiguration.class.getName());
 		}
 		if (jsr250Enabled) {
+			assertAccessModulePresent();
 			classNames.add(Jsr250MetadataSourceConfiguration.class.getName());
 		}
 		return classNames.toArray(new String[0]);
 	}

+	private static void assertAccessModulePresent() {
+		Assert.state(isAccessPresent,
+				() -> "@EnableGlobalMethodSecurity requires the spring-security-access dependency on the "
+						+ "classpath. Please add spring-security-access, or migrate to @EnableMethodSecurity "
+						+ "which does not require it.");
+	}
+
 }
@@ -39,6 +39,8 @@ import org.springframework.security.access.prepost.PrePostAnnotationSecurityMeta
 import org.springframework.security.config.core.GrantedAuthorityDefaults;

 /**
+ * Configures the infrastructure beans for reactive method security.
+ *
 * @author Rob Winch
 * @author Tadaya Tsuyukubo
 * @since 5.0
@@ -26,15 +26,20 @@ import org.springframework.context.annotation.AutoProxyRegistrar;
 import org.springframework.context.annotation.ImportSelector;
 import org.springframework.core.type.AnnotationMetadata;
 import org.springframework.lang.NonNull;
+import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;

 /**
+ * Selects the imports to register for {@link EnableReactiveMethodSecurity}.
+ *
 * @author Rob Winch
 * @author Evgeniy Cheban
 * @since 5.0
 */
 class ReactiveMethodSecuritySelector implements ImportSelector {

+	private static final String METHOD_SECURITY_METADATA_SOURCE_ADVISOR = "org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor";
+
 	private static final boolean isDataPresent = ClassUtils
 		.isPresent("org.springframework.security.data.aot.hint.AuthorizeReturnObjectDataHintsRegistrar", null);

@@ -56,6 +61,11 @@ class ReactiveMethodSecuritySelector implements ImportSelector {
 			imports.add(ReactiveAuthorizationManagerMethodSecurityConfiguration.class.getName());
 		}
 		else {
+			Assert.state(
+					ClassUtils.isPresent(METHOD_SECURITY_METADATA_SOURCE_ADVISOR, ClassUtils.getDefaultClassLoader()),
+					() -> "@EnableReactiveMethodSecurity(useAuthorizationManager = false) requires the "
+							+ "spring-security-access dependency on the classpath. Please add spring-security-access, "
+							+ "or use the default useAuthorizationManager = true which does not require it.");
 			imports.add(ReactiveMethodSecurityConfiguration.class.getName());
 		}
 		if (isDataPresent) {
@@ -154,7 +154,7 @@ public class RSocketSecurity {
 	/**
 	 * Adds support for validating a username and password using <a href=
 	 * "https://github.com/rsocket/rsocket/blob/5920ed374d008abb712cb1fd7c9d91778b2f4a68/Extensions/Security/Simple.md">Simple
-	 * Authentication</a>
+	 * Authentication</a>.
 	 * @param simple a customizer
 	 * @return RSocketSecurity for additional configuration
 	 * @since 5.3
@@ -168,7 +168,7 @@ public class RSocketSecurity {
 	}

 	/**
-	 * Adds anonymous authentication
+	 * Adds anonymous authentication.
 	 * @param anonymous a customizer
 	 * @return this instance
 	 * @since 7.0
@@ -265,6 +265,9 @@ public class RSocketSecurity {
 	}

 	/**
+	 * Specifies the {@link ReactiveAuthenticationManager} to use for simple
+	 * authentication.
+	 *
 	 * @since 5.3
 	 */
 	public final class SimpleAuthenticationSpec {
@@ -286,7 +289,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		protected AuthenticationPayloadInterceptor build() {
+		AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setAuthenticationConverter(new AuthenticationPayloadExchangeConverter());
@@ -304,7 +307,7 @@ public class RSocketSecurity {
 			this.parent = parent;
 		}

-		protected AnonymousPayloadInterceptor build() {
+		AnonymousPayloadInterceptor build() {
 			AnonymousPayloadInterceptor result = new AnonymousPayloadInterceptor("anonymousUser");
 			result.setOrder(PayloadInterceptorOrder.ANONYMOUS.getOrder());
 			return result;
@@ -335,7 +338,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		protected AuthenticationPayloadInterceptor build() {
+		AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setOrder(PayloadInterceptorOrder.AUTHENTICATION.getOrder());
@@ -368,7 +371,7 @@ public class RSocketSecurity {
 			return RSocketSecurity.this.authenticationManager;
 		}

-		protected List<AuthenticationPayloadInterceptor> build() {
+		List<AuthenticationPayloadInterceptor> build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor legacy = new AuthenticationPayloadInterceptor(manager);
 			legacy.setAuthenticationConverter(new BearerPayloadExchangeConverter());
@@ -393,7 +396,7 @@ public class RSocketSecurity {
 		/**
 		 * Matches if
 		 * {@link org.springframework.security.rsocket.api.PayloadExchangeType#isRequest()}
-		 * is true, else not a match
+		 * is true, else not a match.
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyRequest() {
@@ -401,7 +404,7 @@ public class RSocketSecurity {
 		}

 		/**
-		 * Always matches
+		 * Always matches.
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyExchange() {
@@ -30,6 +30,8 @@ import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
+ * {@link Configuration} for RSocket security infrastructure beans.
+ *
 * @author Rob Winch
 * @since 5.2
 */
@@ -26,6 +26,8 @@ import org.springframework.security.rsocket.core.SecuritySocketAcceptorIntercept
 import org.springframework.security.rsocket.util.matcher.PayloadExchangeMatcher.MatchResult;

 /**
+ * {@link Configuration} that exposes a {@link SecuritySocketAcceptorInterceptor} bean.
+ *
 * @author Rob Winch
 * @since 5.2
 */
@@ -61,7 +61,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	}

 	/**
-	 * Gets the {@link ApplicationContext}
+	 * Gets the {@link ApplicationContext}.
 	 * @return the {@link ApplicationContext}
 	 */
 	protected final ApplicationContext getApplicationContext() {
@@ -111,7 +111,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {

 	/**
 	 * Associates a list of {@link RequestMatcher} instances with the
-	 * {@link AbstractRequestMatcherRegistry}
+	 * {@link AbstractRequestMatcherRegistry}.
 	 * @param requestMatchers the {@link RequestMatcher} instances
 	 * @return the object that is chained after creating the {@link RequestMatcher}
 	 */
@@ -203,6 +203,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	 * If a specific {@link RequestMatcher} must be specified, use
 	 * {@link #requestMatchers(RequestMatcher...)} instead
 	 * </p>
+	 * .
 	 * @param method the {@link HttpMethod} to use or {@code null} for any
 	 * {@link HttpMethod}.
 	 * @return the object that is chained after creating the {@link RequestMatcher}.
@@ -53,6 +53,9 @@ import org.springframework.security.web.session.SessionManagementFilter;
 import org.springframework.web.filter.CorsFilter;

 /**
+ * A builder for a {@link DefaultSecurityFilterChain} that allows configuring and ordering
+ * the standard Spring Security {@link Filter} instances.
+ *
 * @param <H>
 * @author Rob Winch
 */
@@ -89,14 +92,14 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>>
 	<C> C getSharedObject(Class<C> sharedType);

 	/**
-	 * Allows adding an additional {@link AuthenticationProvider} to be used
+	 * Allows adding an additional {@link AuthenticationProvider} to be used.
 	 * @param authenticationProvider the {@link AuthenticationProvider} to be added
 	 * @return the {@link HttpSecurity} for further customizations
 	 */
 	H authenticationProvider(AuthenticationProvider authenticationProvider);

 	/**
-	 * Allows adding an additional {@link UserDetailsService} to be used
+	 * Allows adding an additional {@link UserDetailsService} to be used.
 	 * @param userDetailsService the {@link UserDetailsService} to be added
 	 * @return the {@link HttpSecurity} for further customizations
 	 */
@@ -159,7 +159,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	private AuthenticationManager authenticationManager;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} that should be used
 	 * @param authenticationBuilder the {@link AuthenticationManagerBuilder} to use for
 	 * additional updates
@@ -2092,7 +2092,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	}

 	/**
-	 * Allows mapping HTTP requests that this {@link HttpSecurity} will be used for
+	 * Allows mapping HTTP requests that this {@link HttpSecurity} will be used for.
 	 *
 	 * @author Rob Winch
 	 * @since 3.2
@@ -144,7 +144,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	private ServletContext servletContext;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} to use
 	 * @see WebSecurityConfiguration
 	 */
@@ -279,7 +279,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	}

 	/**
-	 * Executes the Runnable immediately after the build takes place
+	 * Executes the Runnable immediately after the build takes place.
 	 * @param postBuildAction
 	 * @return the {@link WebSecurity} for further customizations
 	 */
@@ -290,7 +290,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,

 	/**
 	 * Sets the handler to handle
-	 * {@link org.springframework.security.web.firewall.RequestRejectedException}
+	 * {@link org.springframework.security.web.firewall.RequestRejectedException}.
 	 * @param requestRejectedHandler
 	 * @return the {@link WebSecurity} for further customizations
 	 * @since 5.7
@@ -379,9 +379,8 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 			}
 			if (filter instanceof AuthorizationFilter authorization) {
 				AuthorizationManager<HttpServletRequest> authorizationManager = authorization.getAuthorizationManager();
-				builder.add(securityFilterChain::matches,
-						(authentication, context) -> (AuthorizationDecision) authorizationManager
-							.authorize(authentication, context.getRequest()));
+				builder.add(securityFilterChain::matches, (authentication, context) -> authorizationManager
+					.authorize(authentication, context.getRequest()));
 				mappings = true;
 			}
 		}
@@ -32,7 +32,7 @@ import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.util.ClassUtils;

 /**
- * A filter chain validator for filter chains built by {@link WebSecurity}
+ * A filter chain validator for filter chains built by {@link WebSecurity}.
 *
 * @author Josh Cummings
 * @author Max Batischev
@@ -30,7 +30,7 @@ import org.springframework.security.web.SecurityFilterChain;
 /**
 * Add this annotation to an {@code @Configuration} class to have the Spring Security
 * configuration defined in any {@link WebSecurityConfigurer} or more likely by exposing a
- * {@link SecurityFilterChain} bean:
+ * {@link SecurityFilterChain} bean:.
 *
 * <pre class="code">
 * &#064;Configuration
@@ -256,7 +256,7 @@ class HttpSecurityConfiguration {
 		private PasswordEncoder defaultPasswordEncoder;

 		/**
-		 * Creates a new instance
+		 * Creates a new instance.
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 		 */
 		DefaultPasswordEncoderAuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
@@ -101,6 +101,8 @@ final class OAuth2ClientConfiguration {
 	}

 	/**
+	 * Configures the infrastructure beans for the {@code OAuth2AuthorizedClientManager}.
+	 *
 	 * @author Joe Grandja
 	 * @since 6.2.0
 	 */
@@ -25,7 +25,7 @@ import org.springframework.util.ClassUtils;
 import org.springframework.util.StringUtils;

 /**
- * Used by {@link EnableWebSecurity} to conditionally import:
+ * Used by {@link EnableWebSecurity} to conditionally import:.
 *
 * <ul>
 * <li>{@link OAuth2ClientConfiguration} when the {@code spring-security-oauth2-client}
@@ -200,7 +200,7 @@ class SecurityReactorContextConfiguration {
 	}

 	/**
-	 * A map that computes each value when {@link #get} is invoked
+	 * A map that computes each value when {@link #get} is invoked.
 	 */
 	static class LoadingMap<K, V> implements Map<K, V> {

@@ -118,14 +118,14 @@ class WebMvcSecurityConfiguration implements WebMvcConfigurer, ApplicationContex
 	static class CompositeFilterChainProxy extends FilterChainProxy {

 		/**
-		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}
+		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}.
 		 */
 		private final Filter doFilterDelegate;

 		private final FilterChainProxy springSecurityFilterChain;

 		/**
-		 * Creates a new instance
+		 * Creates a new instance.
 		 * @param filters the Filters to delegate to. One of which must be
 		 * FilterChainProxy.
 		 */
@@ -197,7 +197,7 @@ class WebMvcSecurityConfiguration implements WebMvcConfigurer, ApplicationContex
 		}

 		/**
-		 * Creates the Filter to delegate to for doFilter
+		 * Creates the Filter to delegate to for doFilter.
 		 * @param filters the Filters to delegate to.
 		 * @return the Filter for doFilter
 		 */
@@ -208,7 +208,7 @@ class WebMvcSecurityConfiguration implements WebMvcConfigurer, ApplicationContex
 		}

 		/**
-		 * Find the FilterChainProxy in a List of Filter
+		 * Find the FilterChainProxy in a List of Filter.
 		 * @param filters
 		 * @return non-null FilterChainProxy
 		 * @throws IllegalStateException if the FilterChainProxy cannot be found
@@ -106,7 +106,7 @@ public class WebSecurityConfiguration implements ImportAware {
 	}

 	/**
-	 * Creates the Spring Security Filter Chain
+	 * Creates the Spring Security Filter Chain.
 	 * @return the {@link Filter} that represents the security filter chain
 	 * @throws Exception
 	 */
@@ -133,7 +133,7 @@ public class WebSecurityConfiguration implements ImportAware {

 	/**
 	 * Creates the {@link WebInvocationPrivilegeEvaluator} that is necessary to evaluate
-	 * privileges for a given web URI
+	 * privileges for a given web URI.
 	 * @return the {@link WebInvocationPrivilegeEvaluator}
 	 */
 	@Bean
@@ -290,14 +290,14 @@ public class WebSecurityConfiguration implements ImportAware {
 	static class CompositeFilterChainProxy extends FilterChainProxy {

 		/**
-		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}
+		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}.
 		 */
 		private final Filter doFilterDelegate;

 		private final FilterChainProxy springSecurityFilterChain;

 		/**
-		 * Creates a new instance
+		 * Creates a new instance.
 		 * @param filters the Filters to delegate to. One of which must be
 		 * FilterChainProxy.
 		 */
@@ -369,7 +369,7 @@ public class WebSecurityConfiguration implements ImportAware {
 		}

 		/**
-		 * Creates the Filter to delegate to for doFilter
+		 * Creates the Filter to delegate to for doFilter.
 		 * @param filters the Filters to delegate to.
 		 * @return the Filter for doFilter
 		 */
@@ -380,7 +380,7 @@ public class WebSecurityConfiguration implements ImportAware {
 		}

 		/**
-		 * Find the FilterChainProxy in a List of Filter
+		 * Find the FilterChainProxy in a List of Filter.
 		 * @param filters
 		 * @return non-null FilterChainProxy
 		 * @throws IllegalStateException if the FilterChainProxy cannot be found
--- a/Show More
+++ b/Show More