vendredi 17 avril 2015

Spring Security Java Config: Configuring AuthenticationManagerBuilder with GlobalAuthenticationConfigurerAdapter fails

I'm not sure how to implement subclasses of GlobalAuthenticationConfigurerAdapter. According to the documentation of the SecurityConfigurer interface, the implementation of init(SecurityBuilder) should NOT set properties on the passed SecurityBuilder object. Instead this should be done in the configure(SecurityBuilder) method. So I tried the following implementation:



@Configuration
protected static class AuthenticationConfiguration extends GlobalAuthenticationConfigurerAdapter {

@Autowired
private WebUserDetailsService userDetailsService;

@Autowired
private WebUserPasswordEncoder passwordEncoder;

@Override
public void configure (AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(this.userDetailsService).passwordEncoder(this.passwordEncoder);
}

}


This configuration fails during startup due to the following check in the frameworks AbstractConfiguredSecurityBuilder:



if(buildState.isConfigured()) {
throw new IllegalStateException("Cannot apply "+configurer+" to already built object");
}


BuildState.isConfigured() has the following (suprising) implementation:



public boolean isConfigured() {
return order >= CONFIGURING.order;
}


It actually checks, if the build is currently in the CONFIGURING phase (as stated in javadoc), but not if it already is configured (that would be the BUILT state, I guess), as the method name suggests.


So my question is: Is this expected behavior or is it a bug in the Java Configuration? All other examples I find on the web usually configure the builder in the init() method, so maybe I just don't understand the documentation correctly?


Edit: Using Spring Security 3.2.6


Thanks!


Aucun commentaire:

Enregistrer un commentaire