Migrating from Spring Security 3.x to 4.x (Java Configuration)

@Deprecated
public AclImpl(ObjectIdentity objectIdentity, Serializable id,
			AclAuthorizationStrategy aclAuthorizationStrategy,
			AuditLogger auditLogger, Acl parentAcl,
			List<Sid> loadedSids, boolean entriesInheriting, Sid owner) {
		...
}

new AclImpl(objectIdentity, id, aclAuthorizationStrategy, auditLogger,
								parentAcl, loadedSids, entriesInheriting, owner);

PermissionGrantingStrategy permissionGrantingStrategy =
	new DefaultPermissionGrantingStrategy(auditLogger);
new AclImpl(objectIdentity, id, aclAuthorizationStrategy, permissionGrantingStrategy,
						parentAcl, loadedSids, entriesInheriting, owner);

@Deprecated
public EhCacheBasedAclCache(Ehcache cache) {
	...
}

new EhCacheBasedAclCache(ehCache);

PermissionGrantingStrategy permissionGrantingStrategy =
				new DefaultPermissionGrantingStrategy(auditLogger);
AclAuthorizationStrategy aclAuthorizationStrategy =
		new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_ACL_ADMIN"));
new EhCacheBasedAclCache(ehCache, permissionGrantingStrategy, aclAuthorizationStrategy);

@Deprecated
public ServiceAuthenticationDetailsSource() {
	...
}

@Deprecated
public ServiceAuthenticationDetailsSource(final String artifactParameterName) {
	...
}

new ServiceAuthenticationDetailsSource();

new ServiceAuthenticationDetailsSource(artifactId);

new ServiceAuthenticationDetailsSource(serviceProperties);

new ServiceAuthenticationDetailsSource(serviceProperties, artifactId);

List<ConfigAttribute> attrs =
		SecurityConfig.createSingleAttributeList("ROLE_USER");

List<ConfigAttribute> attrs =
		SecurityConfig.createList("ROLE_USER");

@Bean
public AuthenticationManager authenticationManager(List<AuthenticationProvider> providers) {
	return new ProviderManager(providers);
}

@Bean
public AuthenticationProvider authenticationProvider(UserDetailsServiceWrapper userDetailsService) {
	DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
	provider.setUserDetailsService(userDetailsService);
	return provider;
}

@Bean
public UserDetailsServiceWrapper userDetailsServiceWrapper(RoleHierarchy roleHierarchy) {
	UserDetailsServiceWrapper wrapper = new UserDetailsServiceWrapper();
	wrapper.setRoleHierarchy(roleHierarchy);
	wrapper.setUserDetailsService(userDetailsService());
	return wrapper;
}

@Bean
public AuthenticationManager authenticationManager(List<AuthenticationProvider> providers) {
	return new ProviderManager(providers);
}

@Bean
public AuthenticationProvider authenticationProvider(UserDetailsService userDetailsService, GrantedAuthoritiesMapper authoritiesMapper) {
	DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
	provider.setUserDetailsService(userDetailsService);
	provider.setAuthoritiesMapper(authoritiesMapper);
	return provider;
}

@Bean
public RoleHierarchyAuthoritiesMapper roleHierarchyAuthoritiesMapper(RoleHierarchy roleHierarchy) {
	return new RoleHierarchyAuthoritiesMapper(roleHierarchy);
}

UserDetailsWrapper authenticate = new UserDetailsWrapper(userDetails, roleHiearchy);

Collection<GrantedAuthority> allAuthorities =
		roleHiearchy.getReachableGrantedAuthorities(userDetails.getAuthorities());
UserDetails authenticate =
		new User(userDetails.getUsername(), userDetails.getPassword(), allAuthorities);

AffirmativeBased adm = new AffirmativeBased();
adm.setDecisionVoters(voters);

AffirmativeBased adm = new AffirmativeBased(voters);

public AccountExpiredException(String msg, Object extraInformation) {
...
}

new LockedException("Message", userDetails);

new LockedException("Message");

AnonymousAuthenticationProvider provider = new AnonymousAuthenticationProvider();
provider.setKey(key);

AnonymousAuthenticationProvider provider = new AnonymousAuthenticationProvider(key);

AuthenticationDetailsSourceImpl source = new AuthenticationDetailsSourceImpl();
source.setClazz(CustomWebAuthenticationDetails.class);

public class CustomWebAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest, WebAuthenticationDetails> {

	public WebAuthenticationDetails buildDetails(HttpServletRequest context) {
		return new CustomWebAuthenticationDetails(context);
	}
}

ProviderManager provider = new ProviderManager();
provider.setParent(parent);
provider.setProviders(providers);
provider.setClearExtraInformation(true);

ProviderManager provider = new ProviderManager(providers, parent);

RememberMeAuthenticationProvider provider = new RememberMeAuthenticationProvider();
provider.setKey(key);

RememberMeAuthenticationProvider provider = new RememberMeAuthenticationProvider(key);

new GrantedAuthorityImpl(role);

new SimpleGrantedAuthority(role);

InMemoryDaoImpl uds = new InMemoryDaoImpl();
uds.setUserProperties(properties);

InMemoryUserDetailsManager uds = new InMemoryUserDetailsManager(properties);

new OpenID4JavaConsumer(attributes);

Map<String, List<OpenIDAttribute>> regexMap = new HashMap<String,List<OpenIDAttribute>>();
regexMap.put(".*", attributes);
RegexBasedAxFetchListFactory factory = new RegexBasedAxFetchListFactory(regexMap);
new OpenID4JavaConsumer(factory);

FilterChainProxy filter = new FilterChainProxy();
filter.setFilterChainMap(filterChainMap);

FilterChainProxy filter = new FilterChainProxy(securityFilterChains);

FilterChainProxy securityFilterChain = ...
Map<RequestMatcher,List<Filter>> mappings = securityFilterChain.getFilterChainMap();
for(Map.Entry<RequestMatcher, List<Filter>> entry : mappings.entrySet()) {
	RequestMatcher matcher = entry.getKey();
	boolean matches = matcher.matches(request);
	List<Filter> filters = entry.getValue();
}

FilterChainProxy securityFilterChain = ...
List<SecurityFilterChain> mappings = securityFilterChain.getFilterChains();
for(SecurityFilterChain entry : mappings) {
	boolean matches = entry.matches(request);
	List<Filter> filters = entry.getFilters();
}

ExceptionTranslationFilter filter = new ExceptionTranslationFilter();
filter.setAuthenticationEntryPoint(entryPoint);
filter.setRequestCache(requestCache);

ExceptionTranslationFilter filter = new ExceptionTranslationFilter(entryPoint, requestCache);

protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
						Authentication authResult) throws IOException, ServletException {
}

protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
						FilterChain chain, Authentication authResult) throws IOException, ServletException {
}

AnonymousAuthenticationFilter filter = new AnonymousAuthenticationFilter();
filter.setKey(key);
filter.setUserAttribute(attrs);

AnonymousAuthenticationFilter filter =
		new AnonymousAuthenticationFilter(key,attrs.getPassword(),attrs.getAuthorities());

LoginUrlAuthenticationEntryPoint entryPoint = new LoginUrlAuthenticationEntryPoint();
entryPoint.setLoginFormUrl("/login");

LoginUrlAuthenticationEntryPoint entryPoint = new LoginUrlAuthenticationEntryPoint(loginFormUrl);

public class SubclassPreAuthenticatedGrantedAuthoritiesUserDetailsService extends PreAuthenticatedGrantedAuthoritiesUserDetailsService {

	@Override
	protected UserDetails createuserDetails(Authentication token,
			Collection<? extends GrantedAuthority> authorities) {
		// customize
	}
}

public class SubclassPreAuthenticatedGrantedAuthoritiesUserDetailsService extends PreAuthenticatedGrantedAuthoritiesUserDetailsService {

	@Override
	protected UserDetails createUserDetails(Authentication token,
			Collection<? extends GrantedAuthority> authorities) {
		// customize
	}
}

PersistentTokenBasedRememberMeServices services = new PersistentTokenBasedRememberMeServices();
services.setKey(key);
services.setUserDetailsService(userDetailsService);
services.setTokenRepository(tokenRepository);

PersistentTokenBasedRememberMeServices services =
		new PersistentTokenBasedRememberMeServices(key, userDetailsService, tokenRepository);

RememberMeAuthenticationFilter filter = new RememberMeAuthenticationFilter();
filter.setAuthenticationManager(authenticationManager);
filter.setRememberMeServices(rememberMeServices);

RememberMeAuthenticationFilter filter =
		new RememberMeAuthenticationFilter(authenticationManager,rememberMeServices);

TokenBasedRememberMeServices services = new TokenBasedRememberMeServices();
services.setKey(key);
services.setUserDetailsService(userDetailsService);

TokenBasedRememberMeServices services =
		new TokenBasedRememberMeServices(key, userDetailsService);

ConcurrentSessionControlStrategy strategy = new ConcurrentSessionControlStrategy(sessionRegistry);

List<SessionAuthenticationStrategy> delegates = new ArrayList<SessionAuthenticationStrategy>();
delegates.add(new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry));
delegates.add(new SessionFixationProtectionStrategy());
delegates.add(new RegisterSessionAuthenticationStrategy(sessionRegistry));
CompositeSessionAuthenticationStrategy strategy = new CompositeSessionAuthenticationStrategy(delegates);

SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();
strategy.setRetainedAttributes(attrsToRetain);

public class AttrsSessionFixationProtectionStrategy extends SessionFixationProtectionStrategy {
	private final Collection<String> attrsToRetain;

	public AttrsSessionFixationProtectionStrategy(
			Collection<String> attrsToRetain) {
		this.attrsToRetain = attrsToRetain;
	}

	@Override
	protected Map<String, Object> extractAttributes(HttpSession session) {
		Map<String,Object> attrs = new HashMap<String, Object>();
		for(String attr : attrsToRetain) {
			attrs.put(attr, session.getAttribute(attr));
		}
		return attrs;
	}

}

SessionFixationProtectionStrategy strategy = new AttrsSessionFixationProtectionStrategy(attrsToRetain);

BasicAuthenticationFilter filter = new BasicAuthenticationFilter();
filter.setAuthenticationManager(authenticationManager);
filter.setAuthenticationEntryPoint(entryPoint);
filter.setIgnoreFailure(true);

BasicAuthenticationFilter filter =
		new BasicAuthenticationFilter(authenticationManager,entryPoint);

SecurityContextPersistenceFilter filter = new SecurityContextPersistenceFilter();
filter.setSecurityContextRepository(securityContextRepository);

SecurityContextPersistenceFilter filter = new SecurityContextPersistenceFilter(securityContextRepository);

RequestCacheAwareFilter filter = new RequestCacheAwareFilter();
filter.setRequestCache(requestCache);

RequestCacheAwareFilter filter = new RequestCacheAwareFilter(requestCache);

ConcurrentSessionFilter filter = new ConcurrentSessionFilter();
filter.setSessionRegistry(sessionRegistry);
filter.setExpiredUrl("/expired");

ConcurrentSessionFilter filter = new ConcurrentSessionFilter(sessionRegistry,"/expired");

SessionManagementFilter filter = new SessionManagementFilter(securityContextRepository);
filter.setSessionAuthenticationStrategy(sessionAuthenticationStrategy);

SessionManagementFilter filter = new SessionManagementFilter(securityContextRepository, sessionAuthenticationStrategy);

WebSecurityExpressionHandler handler = ...

SecurityExpressionHandler<FilterInvocation> handler = ...

public class CustomWebSecurityExpressionHandler implements WebSecurityExpressionHandler {
	...
}

public class CustomWebSecurityExpressionHandler implements SecurityExpressionHandler<FilterInvocation> {
	...
}

import org.springframework.security.web.bind.annotation.AuthenticationPrincipal;

// ...

@RequestMapping("/messages/inbox")
public ModelAndView findMessagesForUser(@AuthenticationPrincipal CustomUser customUser) {

	// .. find messags for this user and return them ...
}

import org.springframework.security.core.annotation.AuthenticationPrincipal;

// ...

@RequestMapping("/messages/inbox")
public ModelAndView findMessagesForUser(@AuthenticationPrincipal CustomUser customUser) {

	// .. find messags for this user and return them ...
}

http
	// ...
	.headers()
		.addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN));

X-Frame-Options: SAMEORIGIN

Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

http
	// ...
	.headers()
		// do not use any default headers unless explicitly listed
		.defaultsDisabled()
		.frameOptions()
				.sameOrigin();

X-Frame-Options: SAMEORIGIN

http
	// ...
	.headers()
		.cacheControl()
		.frameOptions();

http
	// ...
	.headers()
		// do not use any default headers unless explicitly listed
		.defaultsDisabled()
		.cacheControl().and()
		.frameOptions();