Cannot use XML configuration for Spring Security

[masrawi]

modifying the sample „spring-boot-sample-actuator“ by adding xml security Context file config:

@ImportResource({ "classpath:securityContext.xml" })
@Configuration
@EnableAutoConfiguration
@EnableConfigurationProperties
@ComponentScan
public class SampleActuatorApplication {

    public static void main(String[] args) throws Exception {
        SpringApplication.run(SampleActuatorApplication.class, args);
    }

}

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"   
    xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd    
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <!--security:http  authentication-manager-ref="authenticationManager" use-expressions="true" pattern="/api/**" create-session="stateless">
        <security:intercept-url pattern='/**' access="hasRole('admin')" />
        <security:http-basic />
    </security:http-->

    <security:http authentication-manager-ref="authenticationManager" use-expressions="true" realm="Protected API" >
        <security:intercept-url pattern="/html/login.html" access="permitAll" />
        <security:intercept-url pattern="/**" access="hasRole('admin')" />        
        <security:form-login login-page="/html/login.html"/>
        <security:logout logout-url="/logout" logout-success-url="/html/login.html?logout_successful=1" />      
    </security:http>    
    <security:authentication-manager id="authenticationManager">
        <security:authentication-provider>
            <security:user-service>
                <security:user name="admin" password="admin" authorities="admin,user" />
                <security:user name="root" password="root" authorities="admin,user,reports" />
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>
</beans>  

throws the following exception when trying ssh -p 2000 root@localhost

java.lang.ClassCastException: org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter cannot be cast to org.springframework.security.web.FilterInvocation
    at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:18)
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62)
    at org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.authenticate(CrshAutoConfiguration.java:303)
    at org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.authenticate(CrshAutoConfiguration.java:271)
    at org.crsh.ssh.term.SSHLifeCycle.genericAuthenticate(SSHLifeCycle.java:215)
    at org.crsh.ssh.term.SSHLifeCycle.access$000(SSHLifeCycle.java:44)
    at org.crsh.ssh.term.SSHLifeCycle$1.authenticate(SSHLifeCycle.java:162)
    at org.apache.sshd.server.auth.UserAuthKeyboardInteractive.checkPassword(UserAuthKeyboardInteractive.java:75)
    at org.apache.sshd.server.auth.UserAuthKeyboardInteractive.doAuth(UserAuthKeyboardInteractive.java:68)
    at org.apache.sshd.server.auth.AbstractUserAuth.next(AbstractUserAuth.java:53)
    at org.apache.sshd.server.session.ServerUserAuthService.process(ServerUserAuthService.java:160)
    at org.apache.sshd.common.session.AbstractSession.doHandleMessage(AbstractSession.java:399)
    at org.apache.sshd.common.session.AbstractSession.handleMessage(AbstractSession.java:295)
    at org.apache.sshd.common.session.AbstractSession.decode(AbstractSession.java:720)
    at org.apache.sshd.common.session.AbstractSession.messageReceived(AbstractSession.java:277)
    at org.apache.sshd.common.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:54)
    at org.apache.sshd.common.io.nio2.Nio2Session$1.completed(Nio2Session.java:188)
    at org.apache.sshd.common.io.nio2.Nio2Session$1.completed(Nio2Session.java:174)
    at sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:126)
    at sun.nio.ch.Invoker$2.run(Invoker.java:218)
    at sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:112)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)

trying to add

<security:http  authentication-manager-ref="authenticationManager" use-expressions="true" pattern="/api/**" create-session="stateless">
        <security:intercept-url pattern='/**' access="hasRole('admin')" />
        <security:http-basic />
    </security:http>

will prevent the app from starting in the first place with

Caused by: org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1

[dsyer]

Yuo can't mix XML and @Configuration with Spring Security. If you need to use XML for some reason then you need to disable the @Condiguration by excluding it in the @EnableAutoConfiguration (i.e. exclude=SecurityAutoConfiguration.class for starters)

[masrawi]

thanks for the prompt feedback :-)

if I change it to @EnableAutoConfiguration(exclude = { SecurityAutoConfiguration.class })
I get

2014-06-18 12:48:04.939 ERROR 6454 --- [           main] o.s.boot.SpringApplication               : Application startup failed

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration$ManagementWebSecurityConfigurerAdapter': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:292)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1185)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:703)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:120)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:683)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:313)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:944)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:933)
    at sample.actuator.SampleActuatorApplication.main(SampleActuatorApplication.java:35)
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:596)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:289)
    ... 16 common frames omitted
Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.raiseNoSuchBeanDefinitionException(DefaultListableBeanFactory.java:1103)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:963)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:858)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:553)
    ... 18 common frames omitted

Exception in thread "main" org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration$ManagementWebSecurityConfigurerAdapter': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:292)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1185)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:703)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:120)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:683)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:313)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:944)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:933)
    at sample.actuator.SampleActuatorApplication.main(SampleActuatorApplication.java:35)
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:596)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:289)
    ... 16 more
Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.raiseNoSuchBeanDefinitionException(DefaultListableBeanFactory.java:1103)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:963)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:858)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:553)
    ... 18 more

is there anything I should do?

[dsyer]

Looks like you need to exclude some more stuff (starting with ManagementSecurityAutoConfiguration). It depends what you have on the classpath.

[masrawi]

tried with

@EnableAutoConfiguration(exclude = { SecurityAutoConfiguration.class,
        ManagementSecurityAutoConfiguration.class,
        FallbackWebSecurityAutoConfiguration.class, SecurityAutoConfiguration.class })

but getting the first error on authentication

java.lang.ClassCastException: org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter cannot be cast to org.springframework.security.web.FilterInvocation
    at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:18)

[masrawi]

after some debugging I think the problem is not really the xml files but rather when an AccessDecisionManager is registered. switching from xml to java Configuration will result in the same error:

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public AccessDecisionManager defaultAccessDecisionManager() {
        List<AccessDecisionVoter> voters = new ArrayList<AccessDecisionVoter>();
        voters.add(new WebExpressionVoter());
        AccessDecisionManager result = new AffirmativeBased(voters);

        return result;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/", "/home").permitAll().anyRequest()
        .authenticated();
        http.formLogin().loginPage("/login").permitAll().and().logout().permitAll();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
    }
}
``

[cdupuis]

With your setup you only have AccessDecisionManagers for web requests (WebExpressionVoter). That leads to the above stracktrace.

To work around this switch to one of the other authentication methods for shell access.

We do have to think about how to support access decisions for the shell going forward.

[masrawi]

my application is a web application that also exposes rest services. so far this is what I am using:

<security:http  authentication-manager-ref="authenticationManager" use-expressions="true" pattern="/api/**" create-session="stateless">
        <security:intercept-url pattern='/**' access="hasRole('admin')" />
        <security:http-basic />
    </security:http>    
    <security:http authentication-manager-ref="authenticationManager" use-expressions="true" realm="Protected API" >
        <security:intercept-url pattern="/html/login.html" access="permitAll" />
        <security:intercept-url pattern="/**" access="hasRole('admin')" />        
        <security:form-login login-page="/html/login.html"/>
        <security:logout logout-url="/logout" logout-success-url="/html/login.html?logout_successful=1" />      
    </security:http>    
    <security:authentication-manager id="authenticationManager" >
        <security:authentication-provider>
            <security:user-service>
                <security:user name="admin" password="admin" authorities="admin,user" />
                <security:user name="root" password="root" authorities="admin,user,reports" />
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>

it is working without the remote shell starter. now having looked at the shell starter we thought it is pretty cool. the question is: is it possible to achieve this xml with the shell starter at this point or is it possible to rewrite it in java config ( any help appreciated) ?

[cdupuis]

It certainly should be possible. Try with the following properties in your application.properties:

shell.auth: simple
shell.auth.simple.user.name: admin
shell.auth.simple.user.password: admin

Let me know if that works.

[masrawi]

no it is not working. If you want to test it: I am using the the sample spring-boot-sample-actuator with only the xml configuration I provided

[cdupuis]

You're right. With the xml, I get the following exception now:

2014-06-18 16:43:45.021 ERROR 40464 --- [           main] o.s.boot.SpringApplication               : Application startup failed

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shellAuthenticationManager': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.access.AccessDecisionManager org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.accessDecisionManager; nested exception is org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:292)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1185)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:703)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:120)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:683)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:313)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:944)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:933)
    at sample.actuator.SampleActuatorApplication.main(SampleActuatorApplication.java:39)
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.access.AccessDecisionManager org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.accessDecisionManager; nested exception is org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:508)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:289)
    ... 16 common frames omitted
Caused by: org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:970)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:858)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:480)
    ... 18 common frames omitted

[cdupuis]

I made a small change with which it now works in my tests. Could you please test against master or a new snapshot?

[masrawi]

using 1.1.2.BUILD-SNAPSHOT
with the xml file:

<security:http  authentication-manager-ref="authenticationManager" use-expressions="true" pattern="/api/**" create-session="stateless">
        <security:intercept-url pattern='/**' access="hasRole('admin')" />
        <security:http-basic />
    </security:http>    
    <security:http authentication-manager-ref="authenticationManager" use-expressions="true" realm="Protected API" >
        <security:intercept-url pattern="/html/login.html" access="permitAll" />
        <security:intercept-url pattern="/**" access="hasRole('admin')" />        
        <security:form-login login-page="/html/login.html"/>
        <security:logout logout-url="/logout" logout-success-url="/html/login.html?logout_successful=1" />      
    </security:http>    
    <security:authentication-manager id="authenticationManager">
        <security:authentication-provider>
            <security:user-service>
                <security:user name="admin" password="admin" authorities="admin,user" />
                <security:user name="root" password="root" authorities="admin,user,reports" />
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>

I get upon startup:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shellAuthenticationManager': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.access.AccessDecisionManager org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.accessDecisionManager; nested exception is org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:292)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1185)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:703)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:120)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:683)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:313)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:944)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:933)
    at sample.actuator.SampleActuatorApplication.main(SampleActuatorApplication.java:39)
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.access.AccessDecisionManager org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.accessDecisionManager; nested exception is org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:508)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:289)
    ... 16 common frames omitted
Caused by: org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:970)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:858)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:480)
    ... 18 common frames omitted

Exception in thread "main" org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shellAuthenticationManager': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.access.AccessDecisionManager org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.accessDecisionManager; nested exception is org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:292)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1185)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:703)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:120)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:683)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:313)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:944)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:933)
    at sample.actuator.SampleActuatorApplication.main(SampleActuatorApplication.java:39)
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.access.AccessDecisionManager org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.accessDecisionManager; nested exception is org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:508)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:289)
    ... 16 more
Caused by: org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type [org.springframework.security.access.AccessDecisionManager] is defined: expected single matching bean but found 2: org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.access.vote.AffirmativeBased#1
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:970)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:858)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:480)
    ... 18 more

if I use:

<!--security:http  authentication-manager-ref="authenticationManager" use-expressions="true" pattern="/api/**" create-session="stateless">
        <security:intercept-url pattern='/**' access="hasRole('admin')" />
        <security:http-basic />
    </security:http-->  
    <security:http authentication-manager-ref="authenticationManager" use-expressions="true" realm="Protected API" >
        <security:intercept-url pattern="/html/login.html" access="permitAll" />
        <security:intercept-url pattern="/**" access="hasRole('admin')" />        
        <security:form-login login-page="/html/login.html"/>
        <security:logout logout-url="/logout" logout-success-url="/html/login.html?logout_successful=1" />      
    </security:http>    
    <security:authentication-manager id="authenticationManager">
        <security:authentication-provider>
            <security:user-service>
                <security:user name="admin" password="admin" authorities="admin,user" />
                <security:user name="root" password="root" authorities="admin,user,reports" />
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>

the application starts but upon authentication I get:

java.lang.ClassCastException: org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter cannot be cast to org.springframework.security.web.FilterInvocation
    at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:18)
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62)
    at org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.authenticate(CrshAutoConfiguration.java:303)
    at org.springframework.boot.actuate.autoconfigure.CrshAutoConfiguration$AuthenticationManagerAdapter.authenticate(CrshAutoConfiguration.java:271)
    at org.crsh.ssh.term.SSHLifeCycle.genericAuthenticate(SSHLifeCycle.java:215)
    at org.crsh.ssh.term.SSHLifeCycle.access$000(SSHLifeCycle.java:44)
    at org.crsh.ssh.term.SSHLifeCycle$1.authenticate(SSHLifeCycle.java:162)
    at org.apache.sshd.server.auth.UserAuthKeyboardInteractive.checkPassword(UserAuthKeyboardInteractive.java:75)
    at org.apache.sshd.server.auth.UserAuthKeyboardInteractive.doAuth(UserAuthKeyboardInteractive.java:68)
    at org.apache.sshd.server.auth.AbstractUserAuth.next(AbstractUserAuth.java:53)
    at org.apache.sshd.server.session.ServerUserAuthService.process(ServerUserAuthService.java:160)
    at org.apache.sshd.common.session.AbstractSession.doHandleMessage(AbstractSession.java:399)
    at org.apache.sshd.common.session.AbstractSession.handleMessage(AbstractSession.java:295)
    at org.apache.sshd.common.session.AbstractSession.decode(AbstractSession.java:720)
    at org.apache.sshd.common.session.AbstractSession.messageReceived(AbstractSession.java:277)
    at org.apache.sshd.common.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:54)
    at org.apache.sshd.common.io.nio2.Nio2Session$1.completed(Nio2Session.java:188)
    at org.apache.sshd.common.io.nio2.Nio2Session$1.completed(Nio2Session.java:174)
    at sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:126)
    at sun.nio.ch.Invoker$2.run(Invoker.java:218)
    at sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:112)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)