SEC-2215: ServletApiConfigurer populates properties on SecurityContextHolderAwareRequestFilter

Previously ServletApiConfigurer left the following properties null:
authenticationManager, logoutHandlers, and authenticationEntryPoint

config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurer.java

@@ -132,7 +132,7 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>
      * @param http the {@link HttpSecurity} used to look up shared {@link AuthenticationEntryPoint}
      * @return the {@link AuthenticationEntryPoint} to use
      */
-    private AuthenticationEntryPoint getEntryPoint(H http) {
+    AuthenticationEntryPoint getEntryPoint(H http) {
         AuthenticationEntryPoint entryPoint = this.authenticationEntryPoint;
         if(entryPoint == null) {
             AuthenticationEntryPoint sharedEntryPoint = http.getSharedObject(AuthenticationEntryPoint.class);

config/src/main/java/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.java

@@ -16,6 +16,7 @@
 package org.springframework.security.config.annotation.web.configurers;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 
 import javax.servlet.http.HttpSession;
@@ -224,6 +225,14 @@ public final class LogoutConfigurer<H extends HttpSecurityBuilder<H>> extends Ab
         return logoutSuccessUrl;
     }
 
+    /**
+     * Gets the {@link LogoutHandler} instances that will be used.
+     * @return the {@link LogoutHandler} instances. Cannot be null.
+     */
+    List<LogoutHandler> getLogoutHandlers() {
+        return logoutHandlers;
+    }
+
     /**
      * Creates the {@link LogoutFilter} using the {@link LogoutHandler}
      * instances, the {@link #logoutSuccessHandler(LogoutSuccessHandler)} and

config/src/main/java/org/springframework/security/config/annotation/web/configurers/ServletApiConfigurer.java

@@ -15,12 +15,16 @@
  */
 package org.springframework.security.config.annotation.web.configurers;
 
+import java.util.List;
+
 import javax.servlet.http.HttpServletRequest;
 
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
 import org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter;
 
 /**
@@ -67,9 +71,16 @@ public final class ServletApiConfigurer<H extends HttpSecurityBuilder<H>> extend
     }
 
     @Override
-    public void configure(H builder)
-            throws Exception {
+    @SuppressWarnings("unchecked")
+    public void configure(H http) throws Exception {
+        securityContextRequestFilter.setAuthenticationManager(http.getAuthenticationManager());
+        ExceptionHandlingConfigurer<H> exceptionConf = http.getConfigurer(ExceptionHandlingConfigurer.class);
+        AuthenticationEntryPoint authenticationEntryPoint = exceptionConf == null ? null : exceptionConf.getEntryPoint(http);
+        securityContextRequestFilter.setAuthenticationEntryPoint(authenticationEntryPoint);
+        LogoutConfigurer<H> logoutConf = http.getConfigurer(LogoutConfigurer.class);
+        List<LogoutHandler> logoutHandlers = logoutConf == null ? null : logoutConf.getLogoutHandlers();
+        securityContextRequestFilter.setLogoutHandlers(logoutHandlers);
         securityContextRequestFilter = postProcess(securityContextRequestFilter);
-        builder.addFilter(securityContextRequestFilter);
+        http.addFilter(securityContextRequestFilter);
     }
 }