Rework security autoconfiguration

This commit combines security autoconfigurations for
management endpoints and the rest of the application. By default,
if Spring Security is on the classpath, it turns on @EnableWebSecurity.
In the presence of another WebSecurityConfigurerAdapter this backs off
completely. A default AuthenticationManager is also provided with a user
and generated password. This can be turned off by specifying a bean of
type AuthenticationManager, AuthenticationProvider or UserDetailsService.

Closes gh-7958

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/ExampleController.java

@@ -0,0 +1,26 @@
+package sample.actuator.customsecurity;
+
+import java.util.Date;
+import java.util.Map;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+public class ExampleController {
+
+	@GetMapping("/")
+	public String home(Map<String, Object> model) {
+		model.put("message", "Hello World");
+		model.put("title", "Hello Home");
+		model.put("date", new Date());
+		return "home";
+	}
+
+	@RequestMapping("/foo")
+	public String foo() {
+		throw new RuntimeException("Expected exception in controller");
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/SampleActuatorCustomSecurityApplication.java

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2012-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.actuator.customsecurity;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class SampleActuatorCustomSecurityApplication {
+
+	public static void main(String[] args) throws Exception {
+		SpringApplication.run(SampleActuatorCustomSecurityApplication.class, args);
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/SecurityConfiguration.java

@@ -0,0 +1,40 @@
+package sample.actuator.customsecurity;
+
+import org.springframework.boot.autoconfigure.security.SpringBootSecurity;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@Configuration
+public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
+
+	private SpringBootSecurity bootSecurity;
+
+	public SecurityConfiguration(SpringBootSecurity bootSecurity) {
+		this.bootSecurity = bootSecurity;
+	}
+
+	@Override
+	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+		auth.inMemoryAuthentication()
+				.withUser("user").password("password").authorities("ROLE_USER").and()
+				.withUser("admin").password("admin").authorities("ROLE_ACTUATOR", "ROLE_USER");
+	}
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		http.authorizeRequests()
+				.requestMatchers(this.bootSecurity.endpointIds("status", "info")).permitAll()
+				.requestMatchers(this.bootSecurity.endpointIds(SpringBootSecurity.ALL_ENDPOINTS)).hasRole("ACTUATOR")
+				.requestMatchers(this.bootSecurity.staticResources()).permitAll()
+				.antMatchers("/foo").permitAll()
+				.antMatchers("/**").hasRole("USER")
+				.and()
+			.cors()
+				.and()
+			.httpBasic();
+	}
+
+}

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/resources/application.properties

@@ -0,0 +1 @@
+endpoints.all.web.enabled=true

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/resources/templates/error.ftl

@@ -0,0 +1,32 @@
+<#import "/spring.ftl" as spring />
+<!DOCTYPE html>
+<html>
+<head>
+<title>Error</title>
+<#assign home><@spring.url relativeUrl="/"/></#assign>
+<#assign bootstrap><@spring.url relativeUrl="/css/bootstrap.min.css"/></#assign>
+<link rel="stylesheet" href="${bootstrap}" />
+</head>
+<body>
+	<div class="container">
+		<div class="navbar">
+			<div class="navbar-inner">
+				<a class="brand" href="http://freemarker.org/"> FreeMarker -
+					Plain </a>
+				<ul class="nav">
+					<li><a href="${home}"> Home </a></li>
+				</ul>
+			</div>
+		</div>
+		<h1>Error Page</h1>
+		<div id="created">${timestamp?datetime}</div>
+		<div>
+			There was an unexpected error (type=${error}, status=${status}).
+		</div>
+		<div>${message}</div>
+		<div>
+			Please contact the operator with the above information.
+		</div>
+	</div>
+</body>
+</html>

spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/resources/templates/home.ftl

@@ -0,0 +1,26 @@
+<#import "/spring.ftl" as spring />
+<!DOCTYPE html>
+<html>
+<head>
+<title>${title}</title>
+<#assign home><@spring.url relativeUrl="/"/></#assign>
+<#assign bootstrap><@spring.url relativeUrl="/css/bootstrap.min.css"/></#assign>
+<link rel="stylesheet" href="${bootstrap}" />
+</head>
+<body>
+	<div class="container">
+		<div class="navbar">
+			<div class="navbar-inner">
+				<a class="brand" href="http://freemarker.org/"> FreeMarker -
+					Plain </a>
+				<ul class="nav">
+					<li><a href="${home}"> Home </a></li>
+				</ul>
+			</div>
+		</div>
+		<h1>${title}</h1>
+		<div>${message}</div>
+		<div id="created">${date?datetime}</div>
+	</div>
+</body>
+</html>