Polish Spring Security Samples

[rwinch]

Fixes gh-2589

[wilkinsona]

This will switch off all of Boot's web security configuration as SpringBootWebSecurityConfiguration is @ConditionalOnMissingBean(WebSecurityConfiguration.class). Doesn't that mean that "and keep the default for everything else" is no longer true?

[rwinch]

This is already not true because this WebSecurityConfigurerAdapter will be invoked (rather than the ones configure by Spring Boot) regardless of if @EnableWebSecurity.

Admittedly, it does give you slightly different results since the ignored patterns are no longer used. However, the intent is to address:

The name of the configureGlobal method is not important. However, it is important to only configure AuthenticationManagerBuilder in a class annotated with either @EnableWebSecurity, @EnableGlobalMethodSecurity, or @EnableGlobalAuthentication. Doing otherwise has unpredictable results.

The reason for this is because we need to ensure any classes that are configuring AuthenticationManagerBuilder are instantiated before we build the AuthenticationManager. In practice, this is done using EnableGlobalAuthenticationAutowiredConfigurer which eagerly initializes beans that are annotated (or meta-annotated) with @EnableGlobalAuthentication.

These instructions are likely a big part of the reason users experience ordering issues with Spring Security and Spring Boot.

[wilkinsona]

@rwinch Any thoughts on my comments?

[snicoll]

@rwinch ping

[philwebb]

We're going to revisit security entirely in 2.0.