Skip to content

Allow Saml2LoginConfiguration to be "unconfigured" #18530

@fhanik

Description

@fhanik

If a RelyingPartyRegistrationRepository.class bean is detected, Spring Boot will automatically configure a WebSecurityConfigurerAdapter through the org.springframework.boot.autoconfigure.security.saml2.Saml2LoginConfiguration class.

If a developer wants to provide their own WebSecurityConfigurerAdapter the only option today is to create a secondary one, and override the @Order to become first in queue.

Expected Behavior

If a user provides a WebSecurityConfigurerAdapter, there is no need for Spring Boot to do it.

@mbhave FYI

PS. One possible solution, as we discussed, is to have a @ConditionalOnMissingBean like OAuth2WebSecurityConfiguration

@Configuration(proxyBeanMethods = false)
@ConditionalOnBean(ClientRegistrationRepository.class)
class OAuth2WebSecurityConfiguration {
...
	@Configuration(proxyBeanMethods = false)
	@ConditionalOnMissingBean(WebSecurityConfigurerAdapter.class)
	static class OAuth2WebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
...

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions