Rework security autoconfiguration

This commit combines security autoconfigurations for
management endpoints and the rest of the application. By default,
if Spring Security is on the classpath, it turns on @EnableWebSecurity.
In the presence of another WebSecurityConfigurerAdapter this backs off
completely. A default AuthenticationManager is also provided with a user
and generated password. This can be turned off by specifying a bean of
type AuthenticationManager, AuthenticationProvider or UserDetailsService.

Closes gh-7958

spring-boot-samples/spring-boot-sample-secure-oauth2-actuator/src/main/java/sample/secure/oauth2/actuator/ActuatorSecurityConfiguration.java

@@ -0,0 +1,29 @@
+package sample.secure.oauth2.actuator;
+
+import org.springframework.boot.autoconfigure.security.SpringBootSecurity;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+/**
+ * Basic auth security for actuator endpoints.
+ *
+ * @author Madhura Bhave
+ */
+@Configuration
+public class ActuatorSecurityConfiguration extends WebSecurityConfigurerAdapter {
+
+	private final SpringBootSecurity springBootSecurity;
+
+	public ActuatorSecurityConfiguration(SpringBootSecurity springBootSecurity) {
+		this.springBootSecurity = springBootSecurity;
+	}
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		http.requestMatcher(this.springBootSecurity.endpointIds(SpringBootSecurity.ALL_ENDPOINTS))
+				.authorizeRequests().antMatchers("/**").authenticated()
+				.and()
+			.httpBasic();
+	}
+}

spring-boot-samples/spring-boot-sample-secure-oauth2-actuator/src/main/java/sample/secure/oauth2/actuator/SampleSecureOAuth2ActuatorApplication.java

@@ -20,7 +20,11 @@ import java.util.UUID;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -34,6 +38,13 @@ public class SampleSecureOAuth2ActuatorApplication {
 		return new Message("Hello World");
 	}
 
+	@Bean
+	public UserDetailsService userDetailsService() throws Exception {
+		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
+		manager.createUser(User.withUsername("user").password("password").roles("USER").build());
+		return manager;
+	}
+
 	public static void main(String[] args) {
 		SpringApplication.run(SampleSecureOAuth2ActuatorApplication.class, args);
 	}

spring-boot-samples/spring-boot-sample-secure-oauth2-actuator/src/main/resources/application.properties

@@ -1,6 +1,5 @@
 server.port=8081
-security.basic.enabled=true
-security.user.password=password
+endpoints.all.web.enabled=true
 security.oauth2.resource.id=service
 security.oauth2.resource.userInfoUri=http://localhost:8080/user
 logging.level.org.springframework.security=DEBUG