org.springframework.boot.autoconfigure.security

Class SecurityAutoConfiguration

java.lang.Object

org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration

@Configuration
@EnableConfigurationProperties
@ConditionalOnClass(value=)
@ConditionalOnMissingBean(value=)
public class SecurityAutoConfiguration
extends Object

Auto-configuration for security of a web application or service. By default everything is secured with HTTP Basic authentication except the explicitly ignored paths (defaults to /css/**, /js/**, /images/**, /**/favicon.ico ). Many aspects of the behavior can be controller with SecurityProperties via externalized application properties (or via an bean definition of that type to set the defaults). The user details for authentication are just placeholders (username=user, password=password) but can easily be customized by providing a bean definition of type AuthenticationManager. Also provides audit logging of authentication events.

Some common simple customizations:

• Switch off security completely and permanently: remove Spring Security from the classpath or exclude this configuration.
• Switch off security temporarily (e.g. for a dev environment): set security.basic.enabled: false
• Customize the user details: add an AuthenticationManager bean
• Add form login for user facing resources: add a WebSecurityConfigurerAdapter and use HttpSecurity#formLogin()

Author:

Dave Syer

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected static class	SecurityAutoConfiguration.ApplicationWebSecurityConfigurerAdapter
protected static class	SecurityAutoConfiguration.DefaultWebSecurityConfiguration
protected static class	SecurityAutoConfiguration.WebMvcSecurityConfigurationConditions

Constructor Summary

Constructors

Constructor and Description
SecurityAutoConfiguration()

Method Summary

Methods

Modifier and Type	Method and Description
AuthenticationEventPublisher	authenticationEventPublisher()
static void	configureHeaders( configurer, SecurityProperties.Headers headers)
static List<String>	getIgnored(SecurityProperties security)
	ignoredPathsWebSecurityConfigurerAdapter()
SecurityProperties	securityProperties()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecurityAutoConfiguration

public SecurityAutoConfiguration()

Method Detail

securityProperties

@Bean(name="org.springframework.autoconfigure.security.SecurityProperties")
@ConditionalOnMissingBean
public SecurityProperties securityProperties()

authenticationEventPublisher

@Bean
@ConditionalOnMissingBean
public AuthenticationEventPublisher authenticationEventPublisher()

ignoredPathsWebSecurityConfigurerAdapter

@Bean
@ConditionalOnMissingBean(value=org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.IgnoredPathsWebSecurityConfigurerAdapter.class)
@ConditionalOnBean(value=)
public  ignoredPathsWebSecurityConfigurerAdapter()

configureHeaders

public static void configureHeaders( configurer,
                    SecurityProperties.Headers headers)
                             throws Exception

Throws:

Exception

getIgnored

public static List<String> getIgnored(SecurityProperties security)