Skip to content

Commit 9c35798

Browse files
jzheauxjzheaux
committed
Merge branch '6.5.x'
2 parents e61544c + 211b1b7 commit 9c35798

File tree

7 files changed

+495
-66
lines changed

7 files changed

+495
-66
lines changed

‎docs/modules/ROOT/pages/migration-7/acl.adoc

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
= ACL
2+
3+
== Favor `AclPermissionEvaluator`
4+
5+
`AclEntryVoter`, `AclEntryAfterInvocationProvider`, and `AclPermissionEvaluator` provide the same service, plugged into different Spring Security APIs. Now that `AccessDecisionVoter` and `AfterInvocationProvider` are both deprecated, the corresponding ACL plugins are obsolete.
6+
7+
As such, begin using `AclPermissionEvaluator` before updating to Spring Security 7.

‎docs/modules/ROOT/pages/migration-7/authentication.adoc

-66
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,2 @@
11
= Authentication Changes
22

3-
== Opaque Token Credentials Will Be Encoded For You
4-
5-
In order to comply more closely with the Introspection RFC, Spring Security's opaque token support will encode the client id and secret before creating the authorization header.
6-
This change means you will no longer have to encode the client id and secret yourself.
7-
8-
If your client id or secret contain URL-unsafe characters, then you can prepare yourself for this change by doing the following:
9-
10-
=== Replace Usage of `introspectionClientCredentials`
11-
12-
Since Spring Security can now do the encoding for you, replace xref:servlet/oauth2/resource-server/opaque-token.adoc#oauth2resourceserver-opaque-introspectionuri-dsl[using `introspectionClientCredentials`] with publishing the following `@Bean`:
13-
14-
[tabs]
15-
======
16-
Java::
17-
+
18-
[source,java,role="primary"]
19-
----
20-
@Bean
21-
OpaqueTokenIntrospector introspector() {
22-
return SpringOpaqueTokenIntrospector.withIntrospectionUri(introspectionUri)
23-
.clientId(unencodedClientId).clientSecret(unencodedClientSecret).build();
24-
}
25-
----
26-
27-
Kotlin::
28-
+
29-
[source,kotlin,role="secondary"]
30-
----
31-
@Bean
32-
fun introspector(): OpaqueTokenIntrospector {
33-
return SpringOpaqueTokenIntrospector.withIntrospectionUri(introspectionUri)
34-
.clientId(unencodedClientId).clientSecret(unencodedClientSecret).build()
35-
}
36-
----
37-
======
38-
39-
The above will be the default in 7.0.
40-
41-
If this setting gives you trouble or you cannot apply it for now, you can use the `RestOperations` constructor instead:
42-
43-
[tabs]
44-
======
45-
Java::
46-
+
47-
[source,java,role="primary"]
48-
----
49-
@Bean
50-
OpaqueTokenIntrospector introspector() {
51-
RestTemplate rest = new RestTemplate();
52-
rest.addInterceptor(new BasicAuthenticationInterceptor(encodedClientId, encodedClientSecret));
53-
return new SpringOpaqueTokenIntrospector(introspectionUri, rest);
54-
}
55-
----
56-
57-
Kotlin::
58-
+
59-
[source,kotlin,role="secondary"]
60-
----
61-
@Bean
62-
fun introspector(): OpaqueTokenIntrospector {
63-
val rest = RestTemplate()
64-
rest.addInterceptor(BasicAuthenticationInterceptor(encodedClientId, encodedClientSecret))
65-
return SpringOpaqueTokenIntrospector(introspectionUri, rest)
66-
}
67-
----
68-
======

‎docs/modules/ROOT/pages/migration-7/authorization.adoc

+79
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,82 @@ public void doSomething(Long id) {
2222

2323
You must compile with `-parameters` to ensure that the parameter names are available at runtime.
2424
For more information about this, please visit the https://github.com/spring-projects/spring-framework/wiki/Upgrading-to-Spring-Framework-6.x#core-container[Upgrading to Spring Framework 6.1 page].
25+
26+
=== Favor `AnnotationTemplateExpressionDefaults` over `PrePostTemplateDefaults`
27+
28+
In Spring Security 7, `AnnotationTemplateExpressionDefaults` will be included by default.
29+
30+
If you are customizing `PrePostTemplateDefaults` or simply want to see how your application responds to `AnnotationTemplateExpressionDefaults`, you can publish an `AnnotationTemplateExpressionDefaults` bean instead of a `PrePostTemplateDefaults` method:
31+
32+
[tabs]
33+
======
34+
Java::
35+
+
36+
[source,java,role="primary"]
37+
----
38+
@Bean
39+
static AnnotationTemplateExpressionDefaults templateExpressionDefaults() {
40+
return new AnnotationTemplateExpressionDefaults();
41+
}
42+
----
43+
44+
Kotlin::
45+
+
46+
[source,kotlin,role="secondary"]
47+
----
48+
companion object {
49+
@Bean
50+
fun templateExpressionDefaults() = AnnotationTemplateExpressionDefaults()
51+
}
52+
----
53+
54+
Xml::
55+
+
56+
[source,xml,role="secondary"]
57+
----
58+
<b:bean id="templateExpressionDefaults" class="org.springframework.security.core.annotation.AnnotationTemplateExpressionDefaults"/>
59+
----
60+
======
61+
62+
==== I Am Publishing an AuthorizationAdvisor Bean
63+
64+
If you are publishing an `AuthorizationAdvisor` bean, like `AuthorizationManagerBeforeMethodInterceptor`, `AuthorizationManagerAfterMethodInterceptor`, `PreFilterAuthorizationMethodInterceptor`, or `PostFilterAuthorizationMethodInterceptor`, you can do the same by calling `setTemplateDefaults` with an `AnnotationTemplateExpressionDefaults` instance instead:
65+
66+
[tabs]
67+
======
68+
Java::
69+
+
70+
[source,java,role="primary"]
71+
----
72+
@Bean
73+
@Role(BeanDescription.ROLE_INFRASTRUCTURE)
74+
static Advisor preFilter() {
75+
PreFilterAuthorizationMethodInterceptor interceptor = new PreFilterAuthorizationMethodInterceptor();
76+
interceptor.setTemplateDefaults(new AnnotationTemplateExpressionDefaults());
77+
return interceptor;
78+
}
79+
----
80+
81+
Kotlin::
82+
+
83+
[source,kotlin,role="secondary"]
84+
----
85+
companion object {
86+
@Bean
87+
@Role(BeanDescription.ROLE_INFRASTRUCTURE)
88+
fun preFilter(): Advisor {
89+
val interceptor = PreFilterAuthorizationMethodInterceptor()
90+
interceptor.setTemplateDefaults(AnnotationTemplateExpressionDefaults)
91+
return interceptor
92+
}
93+
}
94+
----
95+
======
96+
97+
=== Publish `AuthorizationAdvisor` instances instead of adding them in a `Customizer<AuthorizationAdvisorProxyFactory>`
98+
99+
While the ability to customize the `AuthorizationAdvisorProxyFactory` instance will remain in Spring Security 7, the ability to add advisors will be removed in favor of picking up published `AuthorizationAdvisor` beans.
100+
101+
If you are not calling `AuthorizationAdvisorProxyFactory#setAdvisors` or `AuthorizationAdvisorProxyFactory#addAdvisor`, you need do nothing.
102+
103+
If you are, publish the `AuthorizationAdvisor` bean instead and Spring Security will pick it up and apply it automatically.

‎docs/modules/ROOT/pages/migration-7/configuration.adoc

+57
Original file line numberDiff line numberDiff line change
@@ -123,3 +123,60 @@ In versions prior to 6.2, if you had a xref:servlet/configuration/java.adoc#jc-c
123123
However, starting from version 6.2, this method is deprecated and will be removed in 7.0 because it will no longer be possible to chain configurations using `.and()` once `.and()` is removed (see https://github.com/spring-projects/spring-security/issues/13067).
124124
Instead, it is recommended to use the new `.with(...)` method.
125125
For more information about how to use `.with(...)` please refer to the xref:servlet/configuration/java.adoc#jc-custom-dsls[Custom DSLs section].
126+
127+
== Use `dispatcherTypeMatchers` instead of `shouldFilterAllDispatcherTypes`
128+
129+
If you are permitting the ERROR dispatch, you may be using `shouldFilterAllDispatcherTypes(false)` in the `auhorizeHttpRequests` DSL:
130+
131+
[tabs]
132+
======
133+
Java::
134+
+
135+
[source,java,role="primary"]
136+
----
137+
http
138+
.authorizeHttpRequests((authorize) -> authorize
139+
.shouldFilterAllDispatcherTypes(false)
140+
// ...
141+
)
142+
----
143+
144+
Kotlin::
145+
+
146+
[source,kotlin,role="secondary"]
147+
----
148+
http {
149+
authorizeHttpRequests {
150+
shouldFilterAllDispatcherTypes = false
151+
// ...
152+
}
153+
}
154+
----
155+
======
156+
157+
In preparation for 7, change this to use `dispatcherTypeMatchers`:
158+
159+
[tabs]
160+
======
161+
Java::
162+
+
163+
[source,java,role="primary"]
164+
----
165+
http
166+
.authorizHttpRequests((authorize) -> authorize
167+
.dispatcherTypeMatchers(DispatcherType.ERROR).permitAll()
168+
// ...
169+
)
170+
----
171+
172+
Kotlin::
173+
+
174+
[source,kotlin,role="secondary"]
175+
----
176+
http {
177+
authorizeHttpRequests {
178+
authorize(new DispatcherTypeRequestMatcher(DispatcherType.ERROR), permitAll())
179+
}
180+
}
181+
----
182+
======

‎docs/modules/ROOT/pages/migration-7/oauth2.adoc

+67
Original file line numberDiff line numberDiff line change
@@ -170,3 +170,70 @@ fun jwtDecoder(): JwtDecoder {
170170
<2> - specify the list of validators you need, excluding `JwtTypeValidator`
171171

172172
For additional guidance, please see the xref:servlet/oauth2/resource-server/jwt.adoc#oauth2resourceserver-jwt-validation[JwtDecoder Validators] section in the reference.
173+
174+
== Opaque Token Credentials Will Be Encoded For You
175+
176+
In order to comply more closely with the Introspection RFC, Spring Security's opaque token support will encode the client id and secret before creating the authorization header.
177+
This change means you will no longer have to encode the client id and secret yourself.
178+
179+
If your client id or secret contain URL-unsafe characters, then you can prepare yourself for this change by doing the following:
180+
181+
=== Replace Usage of `introspectionClientCredentials`
182+
183+
Since Spring Security can now do the encoding for you, replace xref:servlet/oauth2/resource-server/opaque-token.adoc#oauth2resourceserver-opaque-introspectionuri-dsl[using `introspectionClientCredentials`] with publishing the following `@Bean`:
184+
185+
[tabs]
186+
======
187+
Java::
188+
+
189+
[source,java,role="primary"]
190+
----
191+
@Bean
192+
OpaqueTokenIntrospector introspector() {
193+
return SpringOpaqueTokenIntrospector.withIntrospectionUri(introspectionUri)
194+
.clientId(unencodedClientId).clientSecret(unencodedClientSecret).build();
195+
}
196+
----
197+
198+
Kotlin::
199+
+
200+
[source,kotlin,role="secondary"]
201+
----
202+
@Bean
203+
fun introspector(): OpaqueTokenIntrospector {
204+
return SpringOpaqueTokenIntrospector.withIntrospectionUri(introspectionUri)
205+
.clientId(unencodedClientId).clientSecret(unencodedClientSecret).build()
206+
}
207+
----
208+
======
209+
210+
The above will be the default in 7.0.
211+
212+
If this setting gives you trouble or you cannot apply it for now, you can use the `RestOperations` constructor instead:
213+
214+
[tabs]
215+
======
216+
Java::
217+
+
218+
[source,java,role="primary"]
219+
----
220+
@Bean
221+
OpaqueTokenIntrospector introspector() {
222+
RestTemplate rest = new RestTemplate();
223+
rest.addInterceptor(new BasicAuthenticationInterceptor(encodedClientId, encodedClientSecret));
224+
return new SpringOpaqueTokenIntrospector(introspectionUri, rest);
225+
}
226+
----
227+
228+
Kotlin::
229+
+
230+
[source,kotlin,role="secondary"]
231+
----
232+
@Bean
233+
fun introspector(): OpaqueTokenIntrospector {
234+
val rest = RestTemplate()
235+
rest.addInterceptor(BasicAuthenticationInterceptor(encodedClientId, encodedClientSecret))
236+
return SpringOpaqueTokenIntrospector(introspectionUri, rest)
237+
}
238+
----
239+
======

0 commit comments

Comments
 (0)