Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clarify how to switch off security autoconfiguration

Browse Source 
The fact that the web security and the authentication manager are
controlled separately should hopefully now be clearer.

Fixes gh-3292
This commit is contained in:
Dave Syer
2015-11-02 10:44:54 +00:00
parent cc3f673874
commit cfb12fc7c2
3 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -1860,10 +1860,14 @@ properties are externalized via
The default security configuration is implemented in `SecurityAutoConfiguration` and in
the classes imported from there (`SpringBootWebSecurityConfiguration` for web security
and `AuthenticationManagerConfiguration` for authentication configuration which is also
relevant in non-web applications). To switch off the Boot default configuration
completely in a web application you can add a bean with `@EnableWebSecurity`. To customize
relevant in non-web applications). To switch off the default web security configuration
completely you can add a bean with `@EnableWebSecurity` (this does not disable the
authentication manager configuration). To customize
it you normally use external properties and beans of type `WebSecurityConfigurerAdapter`
(e.g. to add form-based login). There are several secure applications in the
(e.g. to add form-based login). To also switch off the authentication manager configuration
you can add a bean of type `AuthenticationManager`, or else configure the
global `AuthenticationManager` by `@Autowiring` an `AuthenticationManagerBuilder` into
a method in one of your `@Configuration` classes. There are several secure applications in the
{github-code}/spring-boot-samples/[Spring Boot samples] to get you started with common
use cases.