JAVA-27657 | Replacing deprecated WebSecurityConfigurerAdapter

spring-security-modules/spring-security-saml/src/main/java/com/baeldung/saml/config/WebSecurityConfig.java

@@ -10,11 +10,9 @@ import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.saml.*;
 import org.springframework.security.saml.key.KeyManager;
 import org.springframework.security.saml.metadata.*;
@@ -31,7 +29,7 @@ import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 @Configuration
 @EnableWebSecurity
 @EnableGlobalMethodSecurity(securedEnabled = true)
-public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+public class WebSecurityConfig {
 
     @Value("${saml.sp}")
     private String samlAudience;
@@ -55,8 +53,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Bean
     public SAMLDiscovery samlDiscovery() {
-        SAMLDiscovery idpDiscovery = new SAMLDiscovery();
-        return idpDiscovery;
+        return new SAMLDiscovery();
     }
 
     @Autowired
@@ -78,19 +75,19 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
     }
 
     @Bean
-    public SAMLProcessingFilter samlWebSSOProcessingFilter() throws Exception {
+    public SAMLProcessingFilter samlWebSSOProcessingFilter(AuthenticationManager authenticationManager) {
         SAMLProcessingFilter samlWebSSOProcessingFilter = new SAMLProcessingFilter();
-        samlWebSSOProcessingFilter.setAuthenticationManager(authenticationManager());
+        samlWebSSOProcessingFilter.setAuthenticationManager(authenticationManager);
         samlWebSSOProcessingFilter.setAuthenticationSuccessHandler(samlAuthSuccessHandler);
         samlWebSSOProcessingFilter.setAuthenticationFailureHandler(samlAuthFailureHandler);
         return samlWebSSOProcessingFilter;
     }
 
     @Bean
-    public FilterChainProxy samlFilter() throws Exception {
+    public FilterChainProxy samlFilter(SAMLProcessingFilter samlProcessingFilter) throws Exception {
         List<SecurityFilterChain> chains = new ArrayList<>();
         chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"),
-            samlWebSSOProcessingFilter()));
+            samlProcessingFilter));
         chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/discovery/**"),
             samlDiscovery()));
         chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/login/**"),
@@ -102,19 +99,13 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
         return new FilterChainProxy(chains);
     }
 
-    @Bean
-    @Override
-    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return super.authenticationManagerBean();
-    }
-
     @Bean
     public MetadataGeneratorFilter metadataGeneratorFilter() {
         return new MetadataGeneratorFilter(metadataGenerator());
     }
 
-    @Override
-    protected void configure(HttpSecurity http) throws Exception {
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http, SAMLProcessingFilter samlProcessingFilter) throws Exception {
         http
         .csrf()
         .disable();
@@ -125,8 +116,8 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
         http
         .addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
-        .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class)
-        .addFilterBefore(samlFilter(), CsrfFilter.class);
+        .addFilterAfter(samlProcessingFilter, BasicAuthenticationFilter.class)
+        .addFilterBefore(samlProcessingFilter, CsrfFilter.class);
 
         http
         .authorizeRequests()
@@ -142,11 +133,10 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 e.printStackTrace();
             }
         });
-    }
 
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-        auth.authenticationProvider(samlAuthenticationProvider);
+        http.authenticationProvider(samlAuthenticationProvider);
+
+        return http.build();
     }
 
 }