-
Notifications
You must be signed in to change notification settings - Fork 6k
ServerHttpSecurity can't set multiple authentication managers #5660
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Labels
in: config
An issue in spring-security-config
status: backported
An issue that has been backported to maintenance branches
type: bug
A general bug
Milestone
Comments
ttddyy
added a commit
to ttddyy/spring-security
that referenced
this issue
Jun 28, 2019
Prior to this change, "HttpBasicSpec#authenticationManager" and "FormLoginSpec#authenticationManager" were always overridden by "ServerHttpSecurity#authenticationManager". This commit makes sure override only happens when custom authentication manager was not specified. Fixes: spring-projectsgh-5660
rwinch
pushed a commit
that referenced
this issue
Jun 28, 2019
Prior to this change, "HttpBasicSpec#authenticationManager" and "FormLoginSpec#authenticationManager" were always overridden by "ServerHttpSecurity#authenticationManager". This commit makes sure override only happens when custom authentication manager was not specified. Fixes: gh-5660
rwinch
added a commit
that referenced
this issue
Jun 28, 2019
Prior to this change, "HttpBasicSpec#authenticationManager" and "FormLoginSpec#authenticationManager" were always overridden by "ServerHttpSecurity#authenticationManager". This commit makes sure override only happens when custom authentication manager was not specified. Fixes: gh-5660
kostya05983
pushed a commit
to kostya05983/spring-security
that referenced
this issue
Aug 26, 2019
Prior to this change, "HttpBasicSpec#authenticationManager" and "FormLoginSpec#authenticationManager" were always overridden by "ServerHttpSecurity#authenticationManager". This commit makes sure override only happens when custom authentication manager was not specified. Fixes: spring-projectsgh-5660
what is authenticationManager1 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
in: config
An issue in spring-security-config
status: backported
An issue that has been backported to maintenance branches
type: bug
A general bug
Summary
The documentation seems to support allowing different authentication managers for different authentication specs (HttpBasicSpec and FormLoginSpec). However, those seem to always be overwritten when the .build() method is called:
HttpBasicSpec overwritten
FormLoginSpec overwritten
Actual Behavior
HttpBasicSpec and FormLoginSpec can not use different AuthenticationManagers
Expected Behavior
HttpBasicSpec and FormLoginSpec should be able to use different AuthenticationManagers
Configuration
Version
spring-security 5.0.6.RELEASE
The problematic code referenced in the summary appears to still exist in the master branch.
Sample
N/A
The text was updated successfully, but these errors were encountered: