Security cleanup

[rwinch]

My one concern is this seems like the changes I made may impact #1556 but I did not see any tests for that issue, so I'm not sure if I broke anything there.

cc @dsyer

[rwinch]

@dsyer @philwebb I'd really like this to make the next milestone if possible. Any chance you can take a look?

PS: The build passed for me locally. It looks like Travis said it was taking too long and the build might be hung.

[philwebb]

Looks like both commits in this PR have been merged already.

[mikemosseri]

This actually broke the ability to not use the default in memory auth. The change on this line from configure to init (e42fa79#diff-9fddf220548c41d170820f76c509875aR137).

This change causes auth.isConfigured to always be false even when there is another configuration. This is due to the AuthenticationManagerBuilder.performBuild not being called until init is complete. When the method was configure, the user defined security would be used and configured prior.

[dsyer]

I'm still using custom user details in a bunch of projects that seem to work. Can you open a new issue, please, anyway, and attach a sample project if possible? The spring-boit-issues project is a good place to send sample projects as pull requests.

[mikemosseri]

Yes, will try to. Look at your startup in your projects. You will see that it now shows:

org.springframework.boot.autoconfigure.security.AuthenticationManagerConfiguration#147 - Using default security password: ad3ece3e-f4bd-4f3f-b71c-403bf510260d

[rwinch]

@mikemosseri Thanks for the report. This sounds like a duplicate of #2567

EDIT I was able to reproduce it so that the logging occurred, but it appears that both the custom authentication and the generated credentials work. Can you please follow up on that ticket?

[mikemosseri]

@rwinch Yes, it is thanks. I couldn't find something similar earlier.

[rwinch]

@michaelbrand Did you see my EDIT? Specifically can you follow up on that ticket as to if both custom and generated credentials work? If so, I can push my fixes and perhaps you can verify against the latest snapshot. Thanks!