When the filter is exposed as a bean (directly or through a
registration bean), it's picked up by the auto-configuration of
MockMvc. This causes a problem as MockMvc does not call init on a
filter before it's used and WebSocketUpgradeFilter fails with a
NullPointerException if its doFilter method is called when its init
method has not been called.
This commit reworks the WebSocket auto-configuration to use a
ServletContextInitalizer to register WebSocketUpgradeFilter rather
than a FilterRegistrationBean. This ensure that the filter is still
registered at the required position in the chain (last filter before
the servlet) while also preventing it from being registered with the
auto-configured MockMvc in tests.
Closes gh-37660
This commit correct a mistake where AuthenticationManager was used
instead of ReactiveAuthenticationManager. It also expands the
conditions so that WebFlux security will be enabled when the user
has defined their own SecurityWebFilterChain. In such a situation
no other security-related beans may be needed to use WebFlux
security as things may have been configured directly using the DSL.
Closes gh-37504
This commit introduces `spring.jms.listener.session-transacted` property
in order to enable explicit configuration of `sessionTransacted` on the
`DefaultMessageListenerContainer`.
Prior to this commit, `sessionTransacted` would be configured implicitly
based on presence of `JtaTransactionManager`.
See gh-37473
Previously auto-configuration of a user details service (imperative
or reactive) would only back off on the presence of certain beans.
This led to situations where the im-memory service was
auto-configured and the default password was logged even though
another authentication mechanism was in use.
This commit updates the auto-configuration so that it backs off
when depending on Spring Security's OAuth2 Client and OAuth2
Resource Server modules. In the imperative case it will also back
off when depending on the SAML 2 provider.
Closes gh-35338
If there's no authentication manager bean or no bean from which
one can be created, Spring Security's reactive support may fail to
bootstrap due to a null authentication manager.
This commit causes the auto-configuration that enables WebFlux
security to back off in the absence of an AuthenticationManager bean
and a ReactiveUserDetailsService (from which Spring Security can
create an AuthenticationManager) bean. Other reactive security
auto-configuration that can configure things such that WebFlux security
can be bootstrapped without an AuthenticationManager has been updated
to enable WebFlux security rather than relying on another
auto-configuration class to do so.
Fixes gh-37504
Phillip Webb
Andy Wilkinson
Johnny Lim
Scott Frederick
csk8167
shin-mallang
Sreekara Reddy
Gary Russell
Vedran Pavic
Michael Simons