Skip actuator security autoconfig if resource server autoconfig is active

[sdoxsee]

I had a working Spring Boot 2.1.0 OAuth2 resource server application (with autoconfig based on https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#boot-features-security-oauth2-server) but wanted to add the actuator. What happened was that the actuator security configuration autoconfiguration occurred before the OAuth2ResourceServerAutoconfiguration resulting in my endpoints becoming Basic-protected rather than OAuth2-protected.

I noticed that actuator security configuration was skipped if OAuth2 client autoconfiguration exists and figured that since resource server was new in 2.1.x that adding detection for its security configuration was missed (didn't see any tests for that level of detail...nor the right way to add tests for these "composed starter" cases).

I realize that this OAuth2-protects ALL the actuator endpoints (including the normally open health and info endpoints) but, without autoconfiguration detecting and creating a hybrid security config, this seemed to be this simplest logical solution and was more in line with the docs:

If Spring Security is on the classpath and no other WebSecurityConfigurerAdapter is present, all actuators other than /health and /info are secured by Spring Boot auto-configuration. If you define a custom WebSecurityConfigurerAdapter, Spring Boot auto-configuration will back off and you will be in full control of actuator access rules.

https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#boot-features-security-actuator

[pivotal-issuemaster]

@sdoxsee Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-issuemaster]

@sdoxsee Thank you for signing the Contributor License Agreement!

[snicoll]

@mbhave since you've triaged this one I was wondering if there wasn't a test missing there. Thoughts?

[mbhave]

I had the same thought but it didn't look like we write explicit tests for@AutoConfigureBefore. That being said, it would be good to test this.

@sdoxsee Would you mind updating the PR with a test that adds ReactiveOAuth2ResourceServerAutoConfiguration to the contextRunner in ManagementWebSecurityAutoConfigurationTests and checks that the endpoints are then protected by OAuth?

[sdoxsee]

@mbhave I'll give it a try when I have a chance over the next couple of weeks. Thanks

[mbhave]

@sdoxsee Thanks, no worries if you can't get to it. I can add the tests as part of the merge.

[sdoxsee]

@mbhave Please let me know if you think this needs better/more tests. Thanks!

[mbhave]

Thanks @sdoxsee. I left a comment on the commit. Let me know what you think.

[sdoxsee]

@mbhave Thanks for your suggestion. Pushed a commit to address it. Happy New Year!

[mbhave]

Thanks @sdoxsee. This is now merged on master along with this polish commit.

[sdoxsee]

Awesome. Thanks @mbhave