Spring boot: disable security auto configuration

Question

I have multipart web project. Web Admin part contains:

compile('org.springframework.boot:spring-boot-starter-web') compile("org.springframework.boot:spring-boot-starter-thymeleaf") compile("org.springframework.boot:spring-boot-starter-jetty") compile("org.springframework.boot:spring-boot-starter-actuator")

Main project build file contains:

compile group: 'org.springframework', name: "spring-webmvc", version: springVersion compile(group: 'org.springframework.security', name: "spring-security-web", version: springSecurityVersion) { exclude(module: 'spring-jdbc') }

Spring Boot application file:

@SpringBootApplication(exclude = {SecurityAutoConfiguration.class}) public class WebAdminApplication { public static void main(String[] args) { SpringApplication.run(WebAdminApplication.class, args); } }

But when I'm doing http request to my admin part I'm getting user and password in my AuthenticationProvider:

auth.getPrincipal() -> user auth.getCredentials() -> caeebd3a-307b-4edf-8f2f-833fad9ebc00

How I can disable auto security?

What do you want to disable exactly? If you do not include spring-security as a dependency, spring-boot will not not autoconfigure it for you. If you want a different configuration, you need to configure it by yourself. — Gergely Bacso
– Gergely Bacso, Commented Nov 11, 2015 at 17:15

Rahul Maurya · Accepted Answer · 2019-05-28 18:30:15Z

Even I was facing the same issue. So, I added below code.

Case 1: If you have NOT activated 'ACTUATOR': @SpringBootApplication(exclude = { SecurityAutoConfiguration.class })
Case 2: If you have activated 'ACTUATOR': @SpringBootApplication(exclude = { org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration.class, org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration.class})

Amit Portnoy · Accepted Answer · 2016-06-27 14:42:54Z

if you look at spring boot's spring.factories (release 1.3.5 at the time of writing), you can see security has 4 autoconfigure classes:

org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration,\ org.springframework.boot.autoconfigure.security.SecurityFilterAutoConfiguration,\ org.springframework.boot.autoconfigure.security.FallbackWebSecurityAutoConfiguration,\ org.springframework.boot.autoconfigure.security.oauth2.OAuth2AutoConfiguration,\

You probably want to also disable SecurityFilterAutoConfiguration (or all 4 of them)

Collectives™ on Stack Overflow

Spring boot: disable security auto configuration

2 Answers 2

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Related