Fix Formatting and Style

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>

.github/actions/release-train-build/action.yml

@@ -1,7 +0,0 @@
-name: Build Release
-runs:
-  using: composite
-  steps:
-    - name: Build Release
-      shell: bash
-      run:  ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository publishAllPublicationsToDeploymentRepository

.github/actions/release-train-test/action.yml

@@ -1,7 +0,0 @@
-name: Test Release
-runs:
-  using: composite
-  steps:
-    - name: Test Release
-      shell: bash
-      run:  ./gradlew build

.github/dependabot.yml

@@ -4,52 +4,6 @@ registries:
     type: maven-repository
     url: https://build.shibboleth.net/maven/releases
 updates:
-  # 6.5.x
-  - package-ecosystem: gradle
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-      - 'in: build'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-  - package-ecosystem: npm
-    target-branch: 6.5.x
-    directory: /docs
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
 
   # 7.0.x
   - package-ecosystem: gradle
@@ -103,6 +57,57 @@ updates:
       - 'type: dependency-upgrade'
       - 'in: build'
 
+  # 7.1.x
+  - package-ecosystem: gradle
+    target-branch: 7.1.x
+    directory: /
+    schedule:
+      interval: daily
+      time: '03:00'
+      timezone: Etc/UTC
+    labels:
+      - 'type: dependency-upgrade'
+      - 'in: build'
+    registries:
+      - shibboleth
+    ignore:
+      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: org.python:jython
+      - dependency-name: org.apache.directory.server:*
+      - dependency-name: org.apache.directory.shared:*
+      - dependency-name: org.junit:junit-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: org.mockito:mockito-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: com.gradle.enterprise
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+  - package-ecosystem: npm
+    target-branch: 7.1.x
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
+  - package-ecosystem: github-actions
+    target-branch: 7.1.x
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
+
   # main
   - package-ecosystem: gradle
     target-branch: main

.github/workflow-generator.yml

@@ -1,17 +0,0 @@
-workflow:
-  generator:
-    project:
-      java:
-        versions:
-          primary: 25
-    workflows:
-      release-train:
-        build:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-        test:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-

.github/workflows/auto-merge-dependabot.yml

@@ -0,0 +1,16 @@
+name: Merge Dependabot PR
+
+on:
+  pull_request:
+    branches:
+      - main
+      - 'docs-build'
+
+run-name: Merge Dependabot PR ${{ github.ref_name }}
+
+jobs:
+  merge-dependabot-pr:
+    permissions: write-all
+    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
+    with:
+      mergeArguments: --auto --rebase

.github/workflows/check-snapshots.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch: # Manual trigger
+
+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
+permissions:
+  contents: read
+
+jobs:
+  snapshot-test:
+    name: Test Against Snapshots
+    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    strategy:
+      matrix:
+        include:
+          - java-version: 25
+            toolchain: 25
+    with:
+      java-version: ${{ matrix.java-version }}
+      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot,https://oss.sonatype.org/content/repositories/snapshots -PisOverrideVersionCatalog -PtestToolchain=${{ matrix.toolchain }} -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.+ -PspringDataVersion=2025.+ -PmicrometerVersion=1.+ --stacktrace
+    secrets: inherit
+  send-notification:
+    name: Send Notification
+    needs: [ snapshot-test ]
+    if: ${{ !success() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/clean_build_artifacts.yml

@@ -0,0 +1,23 @@
+name: Clean build artifacts
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
+    steps:
+      - name: Delete artifacts in cron job
+        env:
+          GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+        run: |
+          echo "Running clean build artifacts logic"
+          output=$(curl -X GET -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts | grep '"id"' | cut -d : -f2 | sed 's/,*$//g')
+          echo Output is $output
+          for id in $output; do curl -X DELETE -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts/$id; done;

.github/workflows/codeql.yml

@@ -0,0 +1,17 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
+    - cron: '0 5 * * *'
+permissions: read-all
+jobs:
+  codeql-analysis-call:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@e415dadd0910c901e7a7fabd67bbb355b2324500 # 1

.github/workflows/continuous-integration-workflow.yml

@@ -8,46 +8,49 @@ on:
     - cron: '0 10 * * *' # Once per day at 10am UTC
   workflow_dispatch: # Manual trigger
 
+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
 permissions:
   contents: read
 
 jobs:
   build:
     name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build.yml@workflows/v1
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest ]
+        jdk: [ 25 ]
     with:
-      java-version: '25'
+      runs-on: ${{ matrix.os }}
+      java-version: ${{ matrix.jdk }}
+      distribution: temurin
     secrets: inherit
-  test:
-    name: Test Against Snapshots
-    uses: spring-projects/spring-security-commercial/.github/workflows/test.yml@workflows/v1
-    with:
-      java-version: '25'
-      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PtestToolchain=25 -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.0.+ -PspringDataVersion=2026.0.+ -PmicrometerVersion=1.17.+ --stacktrace
-    secrets: inherit
-  compute-version:
-    name: Compute Version
-    runs-on: ubuntu-latest
-    outputs:
-      snapshot: ${{ steps.project-version.outputs.snapshot }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
-      - id: project-version
-        name: Extract Project Version
-        uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
   deploy-artifacts:
     name: Deploy Artifacts
-    needs: [ build, test, compute-version ]
+    needs: [ build ]
-    if: needs.compute-version.outputs.snapshot == 'true'
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    uses: spring-projects/spring-security-commercial/.github/workflows/deploy-artifacts.yml@workflows/v1
+    with:
+      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
+      default-publish-milestones-central: true
+      java-version: 25
+    secrets: inherit
+  deploy-schema:
+    name: Deploy Schema
+    needs: [ build ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
+      java-version: 25
     secrets: inherit
   send-notification:
     name: Send Notification
-    needs: [ deploy-artifacts ]
+    needs: [ deploy-artifacts, deploy-schema ]
     if: ${{ !success() }}
     runs-on: ubuntu-latest
     steps:
       - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
         with:
           webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/defer-issues.yml

@@ -0,0 +1,76 @@
+name: Defer Issues
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  defer-issues:
+    name: Defer Issues
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'spring-projects'
+    permissions:
+      issues: write
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Compute Version
+      id: compute-version
+      uses: spring-io/spring-release-actions/compute-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+    - name: Get Today's Release Version
+      id: todays-release
+      uses: spring-io/spring-release-actions/get-todays-release-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      with:
+        snapshot-version: ${{ steps.compute-version.outputs.version }}
+        milestone-repository: ${{ github.repository }}
+        milestone-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Compute Next Version
+      id: next-version
+      uses: spring-io/spring-release-actions/compute-next-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      with:
+        version: ${{ steps.todays-release.outputs.release-version }}
+    - name: Schedule Next Milestone
+      uses: spring-io/spring-release-actions/schedule-milestone@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      with:
+        version: ${{ steps.next-version.outputs.version }}
+        version-date: ${{ steps.next-version.outputs.version-date }}
+        repository: ${{ github.repository }}
+        token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Move Open Issues to Next Milestone
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        CURRENT_MILESTONE: ${{ steps.todays-release.outputs.release-version }}
+        NEXT_MILESTONE: ${{ steps.next-version.outputs.version }}
+      run: |
+        current_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
+          --jq ".[] | select(.title == \"$CURRENT_MILESTONE\") | .number")
+        if [ -z "$current_milestone_number" ]; then
+          echo "No milestone found for $CURRENT_MILESTONE"
+          exit 0
+        fi
+        next_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
+          --jq ".[] | select(.title == \"$NEXT_MILESTONE\") | .number")
+        if [ -z "$next_milestone_number" ]; then
+          echo "No milestone found for $NEXT_MILESTONE"
+          exit 1
+        fi
+        echo "Moving open issues from milestone '$CURRENT_MILESTONE' (#$current_milestone_number) to '$NEXT_MILESTONE' (#$next_milestone_number)"
+        page=1
+        while true; do
+          issues=$(gh api "repos/${{ github.repository }}/issues?milestone=$current_milestone_number&state=open&per_page=100&page=$page" \
+            --jq '.[].number')
+          if [ -z "$issues" ]; then
+            break
+          fi
+          for issue in $issues; do
+            echo "Moving issue/PR #$issue to milestone $NEXT_MILESTONE"
+            gh api repos/${{ github.repository }}/issues/$issue \
+              --method PATCH \
+              --field milestone=$next_milestone_number \
+              --silent
+          done
+          page=$((page + 1))
+        done
+        echo "Done."

.github/workflows/dependabot-pr-build-workflow.yml

@@ -1,10 +0,0 @@
-name: Dependabot PR Build
-
-on: pull_request_target
-
-jobs:
-  build:
-    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    secrets: inherit

.github/workflows/deploy-docs.yml

@@ -0,0 +1,33 @@
+name: Deploy Docs
+on:
+  push:
+    branches-ignore:
+      - "gh-pages"
+      - "dependabot/**"
+    tags: '**'
+  repository_dispatch:
+    types: request-build-reference # legacy
+  #schedule:
+  #- cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+permissions: read-all
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'spring-projects'
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: docs-build
+        fetch-depth: 1
+    - name: Dispatch (partial build)
+      if: github.ref_type == 'branch'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
+    - name: Dispatch (full build)
+      if: github.ref_type == 'tag'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)

.github/workflows/gradle-wrapper-upgrade-execution.yml

@@ -0,0 +1,34 @@
+name: Execute Gradle Wrapper Upgrade
+
+on:
+  schedule:
+    - cron:  '0 2 * * *' # 2am UTC
+  workflow_dispatch:
+permissions:
+  pull-requests: write
+jobs:
+  upgrade_wrapper:
+    name: Execution
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Git configuration
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config --global url."https://unused-username:${TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up JDK 25
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Set up Gradle
+        uses: gradle/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+      - name: Upgrade Wrappers
+        run: ./gradlew clean upgradeGradleWrapperAll --continue -Porg.gradle.java.installations.auto-download=false
+        env:
+          WRAPPER_UPGRADE_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/merge-dependabot-pr.yml

@@ -1,63 +0,0 @@
-name: Merge Dependabot PR
-
-on: pull_request_target
-
-run-name: Merge Dependabot PR ${{ github.ref_name }}
-
-permissions: write-all
-
-jobs:
-  merge-dependabot-pr:
-    name: Merge Dependabot PR
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security-commercial' }}
-    steps:
-
-      - uses: actions/checkout@v5
-        with:
-          show-progress: false
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Set Milestone to Dependabot Pull Request
-        id: set-milestone
-        run: |
-          if test -f pom.xml
-          then
-            CURRENT_VERSION=$(mvn help:evaluate -Dexpression="project.version" -q -DforceStdout)
-          else
-            CURRENT_VERSION=$(cat gradle.properties | sed -n '/^version=/ { s/^version=//;p }')
-          fi
-          export CANDIDATE_VERSION=${CURRENT_VERSION/-SNAPSHOT}
-          MILESTONE=$(gh api repos/$GITHUB_REPOSITORY/milestones --jq 'map(select(.due_on != null and (.title | startswith(env.CANDIDATE_VERSION)))) | .[0] | .title')
-
-          if [ -z $MILESTONE ]
-          then
-            gh run cancel ${{ github.run_id }}
-            echo "::warning title=Cannot merge::No scheduled milestone for $CURRENT_VERSION version"
-          else
-            gh pr edit ${{ github.event.pull_request.number }} --milestone $MILESTONE
-            echo mergeEnabled=true >> $GITHUB_OUTPUT
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Merge Dependabot pull request
-        if: steps.set-milestone.outputs.mergeEnabled
-        run: gh pr merge ${{ github.event.pull_request.number }} --auto --rebase
-        env:
-          GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-  send-notification:
-    name: Send Notification
-    needs: [ merge-dependabot-pr ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/pr-build-workflow.yml

@@ -8,6 +8,44 @@ permissions:
 jobs:
   build:
     name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
+    runs-on: ubuntu-latest
-    if: ${{ github.actor != 'dependabot[bot]' }}
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Build with Gradle
+        run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue --scan
+  generate-docs:
+    name: Generate Docs
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Run Antora
+        run: ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
+      - name: Upload Docs
+        id: upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: docs
+          path: docs/build/site
+          overwrite: true
+  send-notification:
+    name: Send Notification
+    needs: [ build, generate-docs ]
+    if: ${{ failure() && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/release-announcements-publish.yml

@@ -0,0 +1,30 @@
+name: Release Announcements - Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: The version to publish
+        required: true
+        type: string
+
+permissions:
+  actions: write
+  contents: read
+  issues: write
+
+jobs:
+  deploy-schema:
+    name: Deploy Schema
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      should-deploy-schema: true
+    secrets: inherit
+  publish-release-announcements:
+    name: Publish Release Announcements
+    needs: [ deploy-schema ]
+    if: ${{ !github.event.repository.fork }}
+    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit

.github/workflows/release-announcements-stage.yml

@@ -0,0 +1,24 @@
+name: Release Announcements - Stage
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: The version to stage
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  stage-release-announcements:
+    name: Stage Release Announcements
+    if: ${{ !github.event.repository.fork }}
+    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      version: ${{ inputs.version || github.ref_name }}
+    secrets: inherit

.github/workflows/release-train-build.yml

@@ -1,92 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Build"
-run-name: "${{ inputs.callback-ref }} – Build"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  build-release:
-    name: "Build Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "25"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Build Release"
-      id: "build-release"
-      uses: "./.github/actions/release-train-build"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Upload Deployment Repository"
-      id: "upload-deployment-repository"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "deployment-repository"
-        path: "deployment-repository/**"
-    - name: "Upload Deployment Spec"
-      id: "upload-deployment-spec"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        archive: "false"
-        if-no-files-found: "ignore"
-        name: "deployment-spec"
-        path: ".github/actions/release-train-build/deployment-spec.yml"
-    - name: "Save Build System Caches"
-      id: "save-build-system-caches"
-      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
-        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/release-train-join.yml

@@ -1,55 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Join"
-run-name: "${{ inputs.release-train }} – Join"
-"on":
-  workflow_dispatch:
-    inputs:
-      deployment-destination:
-        description: "Destination to which the release should be deployed"
-        options:
-        - "Maven Central"
-        - "Spring Enterprise"
-        required: true
-        type: "choice"
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  join-release-train:
-    name: "Join Release Train"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Join Release Train"
-      id: "join-release-train"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run join \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code

.github/workflows/release-train-leave.yml

@@ -1,46 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Leave"
-run-name: "${{ inputs.release-train }} – Leave"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  leave:
-    name: "Leave"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Leave"
-      id: "leave"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run leave \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code

.github/workflows/release-train-ready.yml

@@ -1,47 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Ready"
-run-name: "${{ inputs.release-train }} – Ready"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  ready:
-    name: "Ready"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Ready"
-      id: "ready"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run ready \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code

.github/workflows/release-train-retry.yml

@@ -1,34 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Retry"
-run-name: "${{ inputs.release-train }} – Retry"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  trigger-retry:
-    name: "Trigger Retry"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Trigger Retry"
-      id: "trigger-retry"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run retry \
-        --repo ${{ inputs.release-train-repository }} \
-        --ref ${{ inputs.release-train }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }}

.github/workflows/release-train-test.yml

@@ -1,83 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Test"
-run-name: "${{ inputs.callback-ref }} – Test"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  test-release:
-    name: "Test Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry test failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "25"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Restore Build System Caches"
-      id: "restore-build-system-caches"
-      uses: "actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Test Release"
-      id: "test-release"
-      uses: "./.github/actions/release-train-test"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'tested' || 'test-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    - name: "Upload Build System Reports"
-      id: "upload-build-system-reports"
-      if: "${{ failure() }}"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "build-system-reports"
-        path: "**/build/reports"

.github/workflows/update-antora-ui-spring.yml

@@ -0,0 +1,37 @@
+name: Update Antora UI Spring
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: write
+
+jobs:
+  update-antora-ui-spring:
+    name: Update on Supported Branches
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        branch: [ '6.5.x', '7.0.x', '7.1.x', 'main' ]
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
+        name: Update
+        with:
+          docs-branch: ${{ matrix.branch }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          antora-file-path: 'docs/antora-playbook.yml'
+  update-antora-ui-spring-docs-build:
+    name: Update on docs-build
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
+        name: Update
+        with:
+          docs-branch: 'docs-build'
+          token: ${{ secrets.GITHUB_TOKEN }}

build.gradle

@@ -27,7 +27,6 @@ apply plugin: 'org.jetbrains.kotlin.jvm'
 apply plugin: 'org.springframework.security.versions.verify-dependencies-versions'
 apply plugin: 'org.springframework.security.check-expected-branch-version'
 apply plugin: 'io.spring.security.release'
-apply from: 'commercial-settings.gradle'
 
 group = 'org.springframework.security'
 description = 'Spring Security'
@@ -42,12 +41,10 @@ repositories {
 }
 
 springRelease {
-	repositoryOwner = "spring-projects"
-	repositoryName = "spring-security-commercial"
 	weekOfMonth = 3
 	dayOfWeek = 1
-	referenceDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/index.html"
+	referenceDocUrl = "https://docs.spring.io/spring-security/reference/{version}/index.html"
-	apiDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/api/java/index.html"
+	apiDocUrl = "https://docs.spring.io/spring-security/reference/{version}/api/java/index.html"
 	replaceSnapshotVersionInReferenceDocUrl = true
 }
 
@@ -75,6 +72,12 @@ allprojects {
 	}
 }
 
+develocity {
+	buildScan {
+		termsOfUseUrl = 'https://gradle.com/help/legal-terms-of-use'
+		termsOfUseAgree = 'yes'
+	}
+}
 
 nohttp {
 	source.exclude "buildSrc/build/**", "**/build/**", "**/target/**", "javascript/.gradle/**", "javascript/package-lock.json", "javascript/node_modules/**", "javascript/build/**", "javascript/dist/**"

buildSrc/build.gradle

@@ -13,16 +13,7 @@ java {
 repositories {
 	gradlePluginPortal()
 	mavenCentral()
-	if (project.hasProperty("artifactoryUsername") && project.hasProperty("artifactoryPassword")) {
+	maven { url = 'https://repo.spring.io/snapshot' }
-		maven {
-			name "spring-commercial-release"
-			url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
-			credentials {
-				username project.artifactoryUsername
-				password project.artifactoryPassword
-			}
-		}
-	}
 	if (System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL") != null) {
 		maven {
 			name = "Release Train"

commercial-settings.gradle

@@ -1,27 +0,0 @@
-subprojects {
-	repositories {
-		mavenCentral()
-		def repoUsername = project.findProperty("artifactoryUsername") ?: System.getenv("COMMERCIAL_REPO_USERNAME")
-		def repoPassword = project.findProperty("artifactoryPassword") ?: System.getenv("COMMERCIAL_REPO_PASSWORD")
-		if (repoUsername && repoPassword) {
-			maven {
-				name "spring-commercial-release"
-				url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
-				credentials {
-					username repoUsername
-					password repoPassword
-				}
-			}
-			if ("$version".endsWith("-SNAPSHOT")) {
-				maven {
-					name "spring-commercial-snapshot"
-					url "https://usw1.packages.broadcom.com/spring-enterprise-maven-dev-local"
-					credentials {
-						username repoUsername
-						password repoPassword
-					}
-				}
-			}
-		}
-	}
-}

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -94,7 +94,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 	public BeanDefinition parse(Element element, ParserContext pc) {
 		if (!namespaceMatchesVersion(element)) {
 			pc.getReaderContext()
-				.fatal("You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd",
+				.fatal("You cannot use any XSD older than spring-security-7.2.xsd. Either change to spring-security.xsd or spring-security-7.2.xsd",
 						element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
@@ -219,7 +219,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 
 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-7\\.1.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-7\\.2.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}

config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java

@@ -32,6 +32,7 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.ImportAware;
 import org.springframework.context.annotation.Role;
 import org.springframework.core.type.AnnotationMetadata;
+import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -127,6 +128,11 @@ final class PrePostMethodSecurityConfiguration implements ImportAware, Applicati
 		this.expressionHandler.setAuthorizationManagerFactory(authorizationManagerFactory);
 	}
 
+	@Autowired(required = false)
+	void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
+		this.expressionHandler.setPermissionEvaluator(permissionEvaluator);
+	}
+
 	@Autowired(required = false)
 	void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
 		this.preFilterMethodInterceptor.setTemplateDefaults(templateDefaults);

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutHandler.java

@@ -63,6 +63,7 @@ public final class OidcBackChannelLogoutHandler implements LogoutHandler {
 
 	private final OidcSessionRegistry sessionRegistry;
 
+	@SuppressWarnings("removal")
 	private RestOperations restOperations = new RestTemplate();
 
 	private String logoutUri = "{baseUrl}/logout/connect/back-channel/{registrationId}";

config/src/main/java/org/springframework/security/config/http/CorsBeanDefinitionParser.java

@@ -47,6 +47,10 @@ public class CorsBeanDefinitionParser {
 		if (StringUtils.hasText(filterRef)) {
 			return new RuntimeBeanReference(filterRef);
 		}
+		String configurationSourceRef = element.getAttribute(ATT_SOURCE);
+		if (!StringUtils.hasText(configurationSourceRef)) {
+			return new RootBeanDefinition(CorsFilterFactoryBean.class);
+		}
 		BeanMetadataElement configurationSource = getSource(element, parserContext);
 		if (configurationSource == null) {
 			throw new BeanCreationException("Could not create CorsFilter");

config/src/main/java/org/springframework/security/config/http/CorsFilterFactoryBean.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.config.http;
+
+import jakarta.servlet.Filter;
+
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.FactoryBean;
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.lang.Nullable;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.PreFlightRequestHandler;
+import org.springframework.web.filter.CorsFilter;
+import org.springframework.web.filter.PreFlightRequestFilter;
+
+class CorsFilterFactoryBean implements FactoryBean<Filter>, ApplicationContextAware {
+
+	private static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector";
+
+	private ApplicationContext context;
+
+	@Override
+	public Filter getObject() {
+		if (this.context.containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {
+			CorsConfigurationSource source = this.context.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
+					CorsConfigurationSource.class);
+			return new CorsFilter(source);
+		}
+		String[] preFlightRequestHandlerNames = this.context.getBeanNamesForType(PreFlightRequestHandler.class);
+		if (preFlightRequestHandlerNames.length == 1) {
+			PreFlightRequestHandler handler = this.context.getBean(PreFlightRequestHandler.class);
+			return new PreFlightRequestFilter(handler);
+		}
+		throw new NoSuchBeanDefinitionException(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
+				"A Bean named " + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + " of type "
+						+ CorsConfigurationSource.class.getName()
+						+ " is required to use <cors>. Please ensure Spring Security & Spring "
+						+ "MVC are configured in a shared ApplicationContext.");
+	}
+
+	@Nullable
+	@Override
+	public Class<?> getObjectType() {
+		return Filter.class;
+	}
+
+	@Override
+	public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
+		this.context = applicationContext;
+	}
+
+}

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

@@ -297,6 +297,7 @@ import org.springframework.web.util.pattern.PathPatternParser;
  * @author Ankur Pathak
  * @author Alexey Nesterov
  * @author Yanming Zhou
+ * @author Iain Henderson
  * @since 5.0
  */
 public class ServerHttpSecurity {
@@ -4138,6 +4139,8 @@ public class ServerHttpSecurity {
 
 		private ServerAuthenticationFailureHandler authenticationFailureHandler;
 
+		private ServerAuthenticationSuccessHandler authenticationSuccessHandler;
+
 		private ServerAccessDeniedHandler accessDeniedHandler = new BearerTokenServerAccessDeniedHandler();
 
 		private ServerAuthenticationConverter bearerTokenConverter = new ServerBearerTokenAuthenticationConverter();
@@ -4186,6 +4189,20 @@ public class ServerHttpSecurity {
 			return this;
 		}
 
+		/**
+		 * Configures the {@link ServerAuthenticationSuccessHandler} to use. The default
+		 * is {@link WebFilterChainServerAuthenticationSuccessHandler}
+		 * @param authenticationSuccessHandler the
+		 * {@link ServerAuthenticationSuccessHandler} to use
+		 * @return the {@link OAuth2ClientSpec} to customize
+		 * @since 7.2
+		 */
+		public OAuth2ResourceServerSpec authenticationSuccessHandler(
+				ServerAuthenticationSuccessHandler authenticationSuccessHandler) {
+			this.authenticationSuccessHandler = authenticationSuccessHandler;
+			return this;
+		}
+
 		/**
 		 * Configures the {@link ServerAuthenticationConverter} to use for requests
 		 * authenticating with
@@ -4254,6 +4271,7 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(this.authenticationManagerResolver);
 				oauth2.setServerAuthenticationConverter(this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
+				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 			else if (this.jwt != null) {
@@ -4313,6 +4331,13 @@ public class ServerHttpSecurity {
 			return new ServerAuthenticationEntryPointFailureHandler(this.entryPoint);
 		}
 
+		private ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
+			if (this.authenticationSuccessHandler != null) {
+				return this.authenticationSuccessHandler;
+			}
+			return new WebFilterChainServerAuthenticationSuccessHandler();
+		}
+
 		/**
 		 * Configures JWT Resource Server Support
 		 */
@@ -4387,6 +4412,7 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(authenticationManager);
 				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
+				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 
@@ -4519,6 +4545,7 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(authenticationManager);
 				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
+				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 

config/src/main/kotlin/org/springframework/security/config/web/server/ServerOAuth2ResourceServerDsl.kt

@@ -20,6 +20,7 @@ import org.springframework.security.authentication.ReactiveAuthenticationManager
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint
 import org.springframework.security.web.server.authentication.ServerAuthenticationConverter
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler
+import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler
 import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler
 import org.springframework.web.server.ServerWebExchange
 
@@ -35,6 +36,8 @@ import org.springframework.web.server.ServerWebExchange
  * @property bearerTokenConverter the [ServerAuthenticationConverter] to use for requests authenticating with
  * Bearer Tokens.
  * @property authenticationManagerResolver the [ReactiveAuthenticationManagerResolver] to use.
+ * @property authenticationSuccessHandler the [ServerAuthenticationSuccessHandler] to use after
+ * authentication success.
  */
 @ServerSecurityMarker
 class ServerOAuth2ResourceServerDsl {
@@ -43,6 +46,7 @@ class ServerOAuth2ResourceServerDsl {
     var authenticationEntryPoint: ServerAuthenticationEntryPoint? = null
     var bearerTokenConverter: ServerAuthenticationConverter? = null
     var authenticationManagerResolver: ReactiveAuthenticationManagerResolver<ServerWebExchange>? = null
+    var authenticationSuccessHandler: ServerAuthenticationSuccessHandler? = null
 
     private var jwt: ((ServerHttpSecurity.OAuth2ResourceServerSpec.JwtSpec) -> Unit)? = null
     private var opaqueToken: ((ServerHttpSecurity.OAuth2ResourceServerSpec.OpaqueTokenSpec) -> Unit)? = null
@@ -115,6 +119,7 @@ class ServerOAuth2ResourceServerDsl {
             authenticationEntryPoint?.also { oauth2ResourceServer.authenticationEntryPoint(authenticationEntryPoint) }
             bearerTokenConverter?.also { oauth2ResourceServer.bearerTokenConverter(bearerTokenConverter) }
             authenticationManagerResolver?.also { oauth2ResourceServer.authenticationManagerResolver(authenticationManagerResolver!!) }
+            authenticationSuccessHandler?.also { oauth2ResourceServer.authenticationSuccessHandler(authenticationSuccessHandler) }
             jwt?.also { oauth2ResourceServer.jwt(jwt) }
             opaqueToken?.also { oauth2ResourceServer.opaqueToken(opaqueToken) }
         }

config/src/main/resources/META-INF/spring.schemas

@@ -14,9 +14,9 @@
 # limitations under the License.
 #
 
-http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.1.xsd
+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.2.xsd
-http\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.1.xsd
+http\://www.springframework.org/schema/security/spring-security-7.2.xsd=org/springframework/security/config/spring-security-7.2.xsd
-http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.0.xsd
+http\://www.springframework.org/schema/security/spring-security-7.1.xsd=org/springframework/security/config/spring-security-7.1.xsd
 http\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.0.xsd
 http\://www.springframework.org/schema/security/spring-security-6.5.xsd=org/springframework/security/config/spring-security-6.5.xsd
 http\://www.springframework.org/schema/security/spring-security-6.4.xsd=org/springframework/security/config/spring-security-6.4.xsd
@@ -44,7 +44,8 @@ http\://www.springframework.org/schema/security/spring-security-2.0.xsd=org/spri
 http\://www.springframework.org/schema/security/spring-security-2.0.1.xsd=org/springframework/security/config/spring-security-2.0.1.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.2.xsd=org/springframework/security/config/spring-security-2.0.2.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.4.xsd=org/springframework/security/config/spring-security-2.0.4.xsd
-https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.1.xsd
+https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.2.xsd
+https\://www.springframework.org/schema/security/spring-security-7.2.xsd=org/springframework/security/config/spring-security-7.2.xsd
 https\://www.springframework.org/schema/security/spring-security-7.1.xsd=org/springframework/security/config/spring-security-7.1.xsd
 https\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.0.xsd
 https\://www.springframework.org/schema/security/spring-security-6.5.xsd=org/springframework/security/config/spring-security-6.5.xsd

config/src/test/java/org/springframework/security/config/MockSecurityContextHolderStrategy.java

@@ -25,12 +25,12 @@ public class MockSecurityContextHolderStrategy implements SecurityContextHolderS
 	private SecurityContext context;
 
 	@Override
-	public void clearContext() {
+	public synchronized void clearContext() {
 		this.context = null;
 	}
 
 	@Override
-	public SecurityContext getContext() {
+	public synchronized SecurityContext getContext() {
 		if (this.context == null) {
 			this.context = createEmptyContext();
 		}
@@ -38,7 +38,7 @@ public class MockSecurityContextHolderStrategy implements SecurityContextHolderS
 	}
 
 	@Override
-	public void setContext(SecurityContext context) {
+	public synchronized void setContext(SecurityContext context) {
 		this.context = context;
 	}
 

config/src/test/java/org/springframework/security/config/SecurityNamespaceHandlerTests.java

@@ -114,7 +114,7 @@ public class SecurityNamespaceHandlerTests {
 					"<user-service id='us'><user name='bob' password='bobspassword' authorities='ROLE_A' /></user-service>",
 					"3.0.3", null))
 			.withMessageContaining(
-					"You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd");
+					"You cannot use any XSD older than spring-security-7.2.xsd. Either change to spring-security.xsd or spring-security-7.2.xsd");
 	}
 
 	// SEC-1868

config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java

@@ -1527,13 +1527,13 @@ public class PrePostMethodSecurityConfigurationTests {
 
 	}
 
+	@Configuration
 	@EnableMethodSecurity
 	static class CustomPermissionEvaluatorConfig {
 
 		@Bean
-		MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
+		PermissionEvaluator permissionEvaluator() {
-			DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
+			return new PermissionEvaluator() {
-			expressionHandler.setPermissionEvaluator(new PermissionEvaluator() {
 				@Override
 				public boolean hasPermission(Authentication authentication, Object targetDomainObject,
 						Object permission) {
@@ -1545,8 +1545,7 @@ public class PrePostMethodSecurityConfigurationTests {
 						Object permission) {
 					throw new UnsupportedOperationException();
 				}
-			});
+			};
-			return expressionHandler;
 		}
 
 	}

config/src/test/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurerTests.java

@@ -20,6 +20,7 @@ import java.util.Arrays;
 import java.util.Collections;
 
 import com.google.common.net.HttpHeaders;
+import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 
@@ -75,6 +76,15 @@ public class CorsConfigurerTests {
 							+ "or are publishing a `CorsConfigurationSource` bean.");
 	}
 
+	// FIXME: Spring Framework 7.1 removed HandlerMappingIntrospector, so there is no
+	// longer a CorsConfigurationSource derivable from implicit @CrossOrigin/MVC config,
+	// and PreFlightRequestFilter (the replacement) is a no-op for non-preflight
+	// requests. Per https://github.com/spring-projects/spring-framework/issues/36481,
+	// relying on implicit config for a plain request's CORS headers was "never an
+	// intended way of using HandlerMappingIntrospector" and is not coming back; decide
+	// whether to update this test to require an explicit CorsConfigurationSource bean
+	// (matching the reactive stack's always-explicit model), then re-enable.
+	@Disabled
 	@Test
 	public void getWhenCrossOriginAnnotationThenRespondsWithCorsHeaders() throws Exception {
 		this.spring.register(MvcCorsConfig.class).autowire();
@@ -95,6 +105,9 @@ public class CorsConfigurerTests {
 			.andExpect(header().exists("X-Content-Type-Options"));
 	}
 
+	// FIXME: see FIXME on getWhenCrossOriginAnnotationThenRespondsWithCorsHeaders above;
+	// same root cause (Framework 7.1 removed HandlerMappingIntrospector).
+	@Disabled
 	@Test
 	public void getWhenDefaultsInLambdaAndCrossOriginAnnotationThenRespondsWithCorsHeaders() throws Exception {
 		this.spring.register(MvcCorsInLambdaConfig.class).autowire();

config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java

@@ -182,6 +182,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
  * @author Josh Cummings
  * @author Evgeniy Cheban
  */
+@SuppressWarnings("removal")
 @ExtendWith(SpringTestContextExtension.class)
 public class OAuth2ResourceServerConfigurerTests {
 

config/src/test/java/org/springframework/security/config/doc/XsdDocumentedTests.java

@@ -65,7 +65,7 @@ public class XsdDocumentedTests {
 
 	String schema31xDocumentLocation = "org/springframework/security/config/spring-security-3.1.xsd";
 
-	String schemaDocumentLocation = "org/springframework/security/config/spring-security-7.1.xsd";
+	String schemaDocumentLocation = "org/springframework/security/config/spring-security-7.2.xsd";
 
 	XmlSupport xml = new XmlSupport();
 
@@ -151,8 +151,8 @@ public class XsdDocumentedTests {
 				.list((dir, name) -> name.endsWith(".xsd"));
 		// @formatter:on
 		assertThat(schemas.length)
-			.withFailMessage("the count is equal to 29, if not then schemaDocument needs updating")
+			.withFailMessage("the count is equal to 30, if not then schemaDocument needs updating")
-			.isEqualTo(29);
+			.isEqualTo(30);
 	}
 
 	/**

config/src/test/java/org/springframework/security/config/http/HttpCorsConfigTests.java

@@ -18,6 +18,9 @@ package org.springframework.security.config.http;
 
 import java.util.Arrays;
 
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 
@@ -35,6 +38,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.PreFlightRequestHandler;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -67,6 +71,14 @@ public class HttpCorsConfigTests {
 					"Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext");
 	}
 
+	// FIXME: Spring Framework 7.1 removed HandlerMappingIntrospector, which this test's
+	// implicit (no configuration-source-ref) <cors/> scenario relied on to add CORS
+	// headers to a plain, non-preflight request before authorization runs. Per
+	// https://github.com/spring-projects/spring-framework/issues/36481, this was "never
+	// an intended way of using HandlerMappingIntrospector" and is not coming back;
+	// decide whether to update this test's expectations (e.g. require an explicit
+	// CorsConfigurationSource bean) or remove the assertion, then re-enable.
+	@Disabled
 	@Test
 	public void getWhenUsingCorsThenDoesSpringSecurityCorsHandshake() throws Exception {
 		this.spring.configLocations(this.xml("WithCors")).autowire();
@@ -106,6 +118,19 @@ public class HttpCorsConfigTests {
 		// @formatter:on
 	}
 
+	@Test
+	public void optionsWhenUsingPreFlightRequestHandlerThenHandlesPreFlightRequest() throws Exception {
+		this.spring.configLocations(this.xml("WithPreFlightRequestHandler")).autowire();
+		// @formatter:off
+		this.mvc.perform(get("/").with(this.approved()))
+				.andExpect(header().doesNotExist("X-Pre-Flight"))
+				.andExpect(status().isIAmATeapot());
+		this.mvc.perform(options("/").with(this.preflight()))
+				.andExpect(status().isOk())
+				.andExpect(header().exists("X-Pre-Flight"));
+		// @formatter:on
+	}
+
 	private String xml(String configName) {
 		return CONFIG_LOCATION_PREFIX + "-" + configName + ".xml";
 	}
@@ -158,4 +183,13 @@ public class HttpCorsConfigTests {
 
 	}
 
+	static class MyPreFlightRequestHandler implements PreFlightRequestHandler {
+
+		@Override
+		public void handlePreFlight(HttpServletRequest request, HttpServletResponse response) {
+			response.addHeader("X-Pre-Flight", "Handled");
+		}
+
+	}
+
 }

config/src/test/java/org/springframework/security/config/http/OAuth2ResourceServerBeanDefinitionParserTests.java

@@ -124,6 +124,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 /**
  * @author Josh Cummings
  */
+@SuppressWarnings("removal")
 @ExtendWith({ SpringExtension.class, SpringTestContextExtension.class })
 @SecurityTestExecutionListeners
 public class OAuth2ResourceServerBeanDefinitionParserTests {

config/src/test/java/org/springframework/security/config/web/server/OAuth2ResourceServerSpecTests.java

@@ -73,9 +73,11 @@ import org.springframework.security.oauth2.server.resource.authentication.Reacti
 import org.springframework.security.oauth2.server.resource.authentication.ReactiveJwtAuthenticationConverterAdapter;
 import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter;
 import org.springframework.security.web.server.SecurityWebFilterChain;
+import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.security.web.server.authentication.HttpStatusServerEntryPoint;
 import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler;
+import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -371,6 +373,79 @@ public class OAuth2ResourceServerSpecTests {
 		verify(handler).onAuthenticationFailure(any(), any());
 	}
 
+	@Test
+	public void getWhenUsingCustomAuthenticationSuccessHandlerThenUsesIsAccordingly() {
+		this.spring.register(CustomAuthenticationSuccessHandlerAuthenticationManagerResolverConfig.class).autowire();
+		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
+			.getBean(ServerAuthenticationSuccessHandler.class);
+		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
+			.getBean(ReactiveAuthenticationManager.class);
+		given(authenticationManager.authenticate(any()))
+			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
+		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
+			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
+			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
+		});
+		// @formatter:off
+		this.client.get()
+				.headers((headers) -> headers.setBearerAuth(this.messageReadToken))
+				.exchange()
+				.expectStatus().isUnauthorized();
+		// @formatter:on
+		verify(handler).onAuthenticationSuccess(any(), any());
+	}
+
+	@Test
+	public void getWhenUsingCustomAuthenticationSuccessHandlerWithJwtThenUsesIsAccordingly() {
+		this.spring.register(CustomAuthenticationSuccessHandlerJwtConfig.class).autowire();
+		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
+			.getBean(ServerAuthenticationSuccessHandler.class);
+		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
+			.getBean(ReactiveAuthenticationManager.class);
+		given(authenticationManager.authenticate(any()))
+			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
+		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
+			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
+			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
+		});
+		// @formatter:off
+		this.client.get()
+				.headers((headers) -> headers.setBearerAuth(this.messageReadToken))
+				.exchange()
+				.expectStatus().isUnauthorized();
+		// @formatter:on
+		verify(handler).onAuthenticationSuccess(any(), any());
+	}
+
+	@Test
+	public void getWhenUsingCustomAuthenticationSuccessHandlerWIthOpaqueTokenThenUsesIsAccordingly() {
+		this.spring.register(CustomAuthenticationSuccessHandlerOpaqueTokenConfig.class, RootController.class)
+			.autowire();
+		this.spring.getContext()
+			.getBean(MockWebServer.class)
+			.setDispatcher(requiresAuth(this.clientId, this.clientSecret, this.active));
+		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
+			.getBean(ServerAuthenticationSuccessHandler.class);
+		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
+			.getBean(ReactiveAuthenticationManager.class);
+		given(authenticationManager.authenticate(any()))
+			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
+		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
+			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
+			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
+		});
+		// @formatter:off
+		this.client.get()
+				.headers((headers) -> headers
+						.setBearerAuth(this.messageReadToken)
+				)
+				.exchange()
+				.expectStatus().isOk();
+		// @formatter:on
+
+		verify(handler).onAuthenticationSuccess(any(), any());
+	}
+
 	@Test
 	public void postWhenSignedThenReturnsOk() {
 		this.spring.register(PublicKeyConfig.class, RootController.class).autowire();
@@ -950,6 +1025,111 @@ public class OAuth2ResourceServerSpecTests {
 
 	}
 
+	@Configuration
+	@EnableWebFlux
+	@EnableWebFluxSecurity
+	static class CustomAuthenticationSuccessHandlerAuthenticationManagerResolverConfig {
+
+		@Bean
+		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
+			// @formatter:off
+			http
+					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
+					.oauth2ResourceServer((oauth2) -> oauth2
+							.authenticationSuccessHandler(authenticationSuccessHandler())
+							.authenticationManagerResolver((exchange) -> Mono.just(authenticationManager()))
+					);
+			// @formatter:on
+			return http.build();
+		}
+
+		@Bean
+		ReactiveAuthenticationManager authenticationManager() {
+			return mock(ReactiveAuthenticationManager.class);
+		}
+
+		@Bean
+		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
+			return mock(ServerAuthenticationSuccessHandler.class);
+		}
+
+	}
+
+	@Configuration
+	@EnableWebFlux
+	@EnableWebFluxSecurity
+	static class CustomAuthenticationSuccessHandlerJwtConfig {
+
+		@Bean
+		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
+			// @formatter:off
+			http
+					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
+					.oauth2ResourceServer((oauth2) -> oauth2
+							.authenticationSuccessHandler(authenticationSuccessHandler())
+							.jwt((jwt) -> jwt.authenticationManager(authenticationManager()))
+					);
+			// @formatter:on
+			return http.build();
+		}
+
+		@Bean
+		ReactiveAuthenticationManager authenticationManager() {
+			return mock(ReactiveAuthenticationManager.class);
+		}
+
+		@Bean
+		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
+			return mock(ServerAuthenticationSuccessHandler.class);
+		}
+
+	}
+
+	@Configuration
+	@EnableWebFlux
+	@EnableWebFluxSecurity
+	static class CustomAuthenticationSuccessHandlerOpaqueTokenConfig {
+
+		private MockWebServer mockWebServer = new MockWebServer();
+
+		@Bean
+		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
+			String introspectionUri = mockWebServer().url("/introspect").toString();
+			// @formatter:off
+			http
+					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
+					.oauth2ResourceServer((oauth2) -> oauth2
+							.authenticationSuccessHandler(authenticationSuccessHandler())
+							.opaqueToken((opaqueToken) -> opaqueToken
+									.introspectionUri(introspectionUri)
+									.introspectionClientCredentials("client", "secret"))
+					);
+			// @formatter:on
+			return http.build();
+		}
+
+		@Bean
+		ReactiveAuthenticationManager authenticationManager() {
+			return mock(ReactiveAuthenticationManager.class);
+		}
+
+		@Bean
+		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
+			return mock(ServerAuthenticationSuccessHandler.class);
+		}
+
+		@Bean
+		MockWebServer mockWebServer() {
+			return this.mockWebServer;
+		}
+
+		@PreDestroy
+		void shutdown() throws IOException {
+			this.mockWebServer.shutdown();
+		}
+
+	}
+
 	@EnableWebFlux
 	@EnableWebFluxSecurity
 	static class CustomBearerTokenServerAuthenticationConverter {

config/src/test/kotlin/org/springframework/security/config/web/server/ServerOAuth2ResourceServerDslTests.kt

@@ -17,6 +17,7 @@
 package org.springframework.security.config.web.server
 
 import io.mockk.every
+import io.mockk.mockk
 import io.mockk.mockkObject
 import io.mockk.verify
 import org.junit.jupiter.api.Test
@@ -37,6 +38,7 @@ import org.springframework.security.web.server.SecurityWebFilterChain
 import org.springframework.security.web.server.WebFilterExchange
 import org.springframework.security.web.server.authentication.HttpStatusServerEntryPoint
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler
+import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler
 import org.springframework.test.web.reactive.server.WebTestClient
 import org.springframework.web.reactive.config.EnableWebFlux
@@ -183,6 +185,46 @@ class ServerOAuth2ResourceServerDslTests {
 
     }
 
+    @Test
+    fun `request when custom authentication success handler then success handler used`() {
+        this.spring.register(AuthenticationSuccessHandlerConfig::class.java).autowire()
+        every {
+            AuthenticationSuccessHandlerConfig.SUCCESS_HANDLER.onAuthenticationSuccess(any(), any())
+        } returns Mono.empty()
+
+        this.client.get()
+            .uri("/")
+            .headers { it.setBearerAuth(validJwt) }
+            .exchange()
+
+        verify(exactly = 1) { AuthenticationSuccessHandlerConfig.SUCCESS_HANDLER.onAuthenticationSuccess(any(), any()) }
+    }
+
+    @Configuration
+    @EnableWebFluxSecurity
+    @EnableWebFlux
+    open class AuthenticationSuccessHandlerConfig {
+
+        companion object {
+            val SUCCESS_HANDLER: ServerAuthenticationSuccessHandler = mockk()
+        }
+
+        @Bean
+        open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+            return http {
+                authorizeExchange {
+                    authorize(anyExchange, authenticated)
+                }
+                oauth2ResourceServer {
+                    authenticationSuccessHandler = SUCCESS_HANDLER
+                    jwt {
+                        publicKey = publicKey()
+                    }
+                }
+            }
+        }
+    }
+
     @Test
     fun `request when custom bearer token converter configured then custom converter used`() {
         this.spring.register(BearerTokenConverterConfig::class.java).autowire()

config/src/test/resources/org/springframework/security/config/http/HttpCorsConfigTests-WithPreFlightRequestHandler.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2004-present the original author or authors.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~       https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<b:beans xmlns:b="http://www.springframework.org/schema/beans"
+		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		xmlns="http://www.springframework.org/schema/security"
+		xsi:schemaLocation="
+			http://www.springframework.org/schema/security
+			https://www.springframework.org/schema/security/spring-security.xsd
+			http://www.springframework.org/schema/beans
+			https://www.springframework.org/schema/beans/spring-beans.xsd">
+
+	<http entry-point-ref="ep">
+		<intercept-url pattern="/**" access="authenticated"/>
+		<cors/>
+	</http>
+
+	<b:bean name="ep" class="org.springframework.security.web.authentication.HttpStatusEntryPoint">
+		<b:constructor-arg value="I_AM_A_TEAPOT"/>
+	</b:bean>
+
+	<b:bean name="preFlightRequestHandler"
+			class="org.springframework.security.config.http.HttpCorsConfigTests.MyPreFlightRequestHandler"/>
+
+	<b:import resource="userservice.xml"/>
+</b:beans>