SEC-2447: Fix AuthenticationManagerBuilder ordering issues

2014-02-06 17:01:53 -06:00
parent c42e13c966
commit 6c35c33abe
21 changed files with 994 additions and 68 deletions
--- a/config/src/test/groovy/org/springframework/security/config/annotation/authentication/AuthenticationManagerBuilderTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/authentication/AuthenticationManagerBuilderTests.groovy
@@ -87,4 +87,37 @@ class AuthenticationManagerBuilderTests extends BaseSpringSpec {
                    .withUser("admin").password("password").roles("USER","ADMIN")
        }
    }
+
+    def "isConfigured with AuthenticationProvider"() {
+        setup:
+            ObjectPostProcessor opp = Mock()
+            AuthenticationProvider provider = Mock()
+            AuthenticationManagerBuilder auth = new AuthenticationManagerBuilder(opp)
+        when:
+            auth
+                .authenticationProvider(provider)
+        then:
+            auth.isConfigured()
+    }
+
+    def "isConfigured with parent"() {
+        setup:
+            ObjectPostProcessor opp = Mock()
+            AuthenticationManager parent = Mock()
+            AuthenticationManagerBuilder auth = new AuthenticationManagerBuilder(opp)
+        when:
+            auth
+                .parentAuthenticationManager(parent)
+        then:
+            auth.isConfigured()
+    }
+
+    def "isConfigured not configured"() {
+        setup:
+            ObjectPostProcessor opp = Mock()
+        when:
+            AuthenticationManagerBuilder auth = new AuthenticationManagerBuilder(opp)
+        then:
+            auth.isConfigured() == false
+    }
 }
--- a/config/src/test/groovy/org/springframework/security/config/annotation/authentication/configuration/AuthenticationConfigurationTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/authentication/configuration/AuthenticationConfigurationTests.groovy
@@ -0,0 +1,295 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.authentication.configuration;
+
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.context.annotation.Import
+import org.springframework.core.Ordered
+import org.springframework.core.annotation.Order
+import org.springframework.security.access.annotation.Secured
+import org.springframework.security.authentication.AuthenticationManager
+import org.springframework.security.authentication.TestingAuthenticationToken
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.config.annotation.BaseSpringSpec
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
+import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter
+import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
+import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity
+import org.springframework.security.core.AuthenticationException
+import org.springframework.security.core.authority.AuthorityUtils
+import org.springframework.security.core.context.SecurityContextHolder
+import org.springframework.security.core.userdetails.User
+import org.springframework.security.provisioning.InMemoryUserDetailsManager
+
+class AuthenticationConfigurationTests extends BaseSpringSpec {
+
+    def "Ordering Autowired on EnableGlobalMethodSecurity"() {
+        setup:
+            SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER"))
+        when:
+            loadConfig(GlobalMethodSecurityAutowiredConfigAndServicesConfig)
+        then:
+            context.getBean(Service).run()
+    }
+
+    @Configuration
+    @Import([GlobalMethodSecurityAutowiredConfig,ServicesConfig])
+    static class GlobalMethodSecurityAutowiredConfigAndServicesConfig {}
+
+    @Configuration
+    @EnableGlobalMethodSecurity(securedEnabled = true)
+    static class GlobalMethodSecurityAutowiredConfig {
+        @Autowired
+        public void configureGlobal(AuthenticationManagerBuilder auth) {
+            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
+        }
+    }
+
+    def "Ordering Autowired on EnableWebSecurity"() {
+        setup:
+            SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER"))
+        when:
+            loadConfig(GlobalMethodSecurityConfigAndServicesConfig)
+        then:
+            context.getBean(Service).run()
+    }
+
+    @Configuration
+    @Import([GlobalMethodSecurityConfig,WebSecurityConfig,ServicesConfig])
+    static class GlobalMethodSecurityConfigAndServicesConfig {}
+
+    @Configuration
+    @EnableGlobalMethodSecurity(securedEnabled = true)
+    static class GlobalMethodSecurityConfig {}
+
+    @Configuration
+    @EnableWebSecurity
+    static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+        @Autowired
+        public void configureGlobal(AuthenticationManagerBuilder auth) {
+            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
+        }
+    }
+
+    //
+
+    def "Ordering Autowired on EnableWebMvcSecurity"() {
+        setup:
+            SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER"))
+        when:
+            loadConfig(GlobalMethodSecurityMvcSecurityAndServicesConfig)
+        then:
+            context.getBean(Service).run()
+    }
+
+    @Configuration
+    @Import([GlobalMethodSecurityConfig,WebMvcSecurityConfig,ServicesConfig])
+    static class GlobalMethodSecurityMvcSecurityAndServicesConfig {}
+
+    @Configuration
+    @EnableWebMvcSecurity
+    static class WebMvcSecurityConfig extends WebSecurityConfigurerAdapter {
+        @Autowired
+        public void configureGlobal(AuthenticationManagerBuilder auth) {
+            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
+        }
+    }
+
+    //
+
+    def "no authentication getAuthenticationManager falls back to null"() {
+        when:
+            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
+        then:
+            context.getBean(AuthenticationConfiguration).authenticationManager == null
+    }
+
+    def "QuiesentGlobalAuthenticationConfiguererAdapter falls back to null"() {
+        when:
+            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,QuiesentGlobalAuthenticationConfiguererAdapter)
+        then:
+            context.getBean(AuthenticationConfiguration).authenticationManager == null
+    }
+
+    @Configuration
+    static class QuiesentGlobalAuthenticationConfiguererAdapter extends GlobalAuthenticationConfigurerAdapter {}
+
+    //
+
+    def "GlobalAuthenticationConfiguererAdapterImpl configures authentication successfully"() {
+        setup:
+            def token = new UsernamePasswordAuthenticationToken("user", "password")
+        when:
+            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,GlobalAuthenticationConfiguererAdapterImpl)
+        then:
+            context.getBean(AuthenticationConfiguration).authenticationManager.authenticate(token)?.name == "user"
+    }
+
+    @Configuration
+    static class GlobalAuthenticationConfiguererAdapterImpl extends GlobalAuthenticationConfigurerAdapter {
+        public void init(AuthenticationManagerBuilder auth) throws Exception {
+            auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
+        }
+    }
+
+    //
+
+    def "AuthenticationManagerBean configures authentication successfully"() {
+        setup:
+            def token = new UsernamePasswordAuthenticationToken("user", "password")
+            def auth = new UsernamePasswordAuthenticationToken("user", "password", AuthorityUtils.createAuthorityList("ROLE_USER"))
+            AuthenticationManagerBeanConfig.AM = Mock(AuthenticationManager)
+            1 * AuthenticationManagerBeanConfig.AM.authenticate(token) >> auth
+        when:
+            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,AuthenticationManagerBeanConfig)
+        then:
+            context.getBean(AuthenticationConfiguration).authenticationManager.authenticate(token).name == auth.name
+    }
+
+    @Configuration
+    static class AuthenticationManagerBeanConfig {
+        static AuthenticationManager AM
+        @Bean
+        public AuthenticationManager authenticationManager() {
+            AM
+        }
+    }
+
+    //
+
+    @Configuration
+    static class ServicesConfig {
+        @Bean
+        public Service service() {
+            return new ServiceImpl()
+        }
+    }
+
+    static interface Service {
+        public void run();
+    }
+
+    static class ServiceImpl implements Service {
+        @Secured("ROLE_USER")
+        public void run() {}
+    }
+
+    //
+
+    def "GlobalAuthenticationConfigurerAdapter are ordered"() {
+        setup:
+            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
+            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
+            config.setGlobalAuthenticationConfigurers([new LowestOrderGlobalAuthenticationConfigurerAdapter(), new HighestOrderGlobalAuthenticationConfigurerAdapter(), new DefaultOrderGlobalAuthenticationConfigurerAdapter()])
+        when:
+            config.getAuthenticationManager()
+        then:
+            DefaultOrderGlobalAuthenticationConfigurerAdapter.inits == [HighestOrderGlobalAuthenticationConfigurerAdapter,DefaultOrderGlobalAuthenticationConfigurerAdapter,LowestOrderGlobalAuthenticationConfigurerAdapter]
+            DefaultOrderGlobalAuthenticationConfigurerAdapter.configs == [HighestOrderGlobalAuthenticationConfigurerAdapter,DefaultOrderGlobalAuthenticationConfigurerAdapter,LowestOrderGlobalAuthenticationConfigurerAdapter]
+
+    }
+
+    static class DefaultOrderGlobalAuthenticationConfigurerAdapter extends GlobalAuthenticationConfigurerAdapter {
+        static List inits = []
+        static List configs = []
+
+        public void init(AuthenticationManagerBuilder auth) throws Exception {
+            inits.add(getClass())
+        }
+
+        public void configure(AuthenticationManagerBuilder auth) throws Exception {
+            configs.add(getClass())
+        }
+    }
+
+    @Order(Ordered.LOWEST_PRECEDENCE)
+    static class LowestOrderGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {}
+
+    @Order(Ordered.HIGHEST_PRECEDENCE)
+    static class HighestOrderGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {}
+
+    //
+
+    def "Spring Boot not triggered when already configured"() {
+        setup:
+            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
+            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
+            config.setGlobalAuthenticationConfigurers([new ConfiguresInMemoryConfigurerAdapter(), new BootGlobalAuthenticationConfigurerAdapter()])
+            AuthenticationManager authenticationManager = config.authenticationManager
+        when:
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password"))
+        then:
+            noExceptionThrown()
+        when:
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("boot","password"))
+        then:
+            thrown(AuthenticationException)
+    }
+
+
+    def "Spring Boot is triggered when not already configured"() {
+        setup:
+            loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration)
+            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
+            config.setGlobalAuthenticationConfigurers([new BootGlobalAuthenticationConfigurerAdapter()])
+            AuthenticationManager authenticationManager = config.authenticationManager
+        when:
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("boot","password"))
+        then:
+            noExceptionThrown()
+    }
+
+    static class ConfiguresInMemoryConfigurerAdapter extends GlobalAuthenticationConfigurerAdapter {
+
+        public void init(AuthenticationManagerBuilder auth) throws Exception {
+            auth
+                .inMemoryAuthentication()
+                    .withUser("user").password("password").roles("USER")
+        }
+    }
+
+    @Order(Ordered.LOWEST_PRECEDENCE)
+    static class BootGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {
+        public void init(AuthenticationManagerBuilder auth) throws Exception {
+            auth.apply(new DefaultBootGlobalAuthenticationConfigurerAdapter())
+        }
+    }
+
+    static class DefaultBootGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {
+        @Override
+        public void configure(AuthenticationManagerBuilder auth) throws Exception {
+            if(auth.isConfigured()) {
+                return;
+            }
+
+            User user = new User("boot","password", AuthorityUtils.createAuthorityList("ROLE_USER"))
+
+            List<User> users = Arrays.asList(user);
+            InMemoryUserDetailsManager inMemory = new InMemoryUserDetailsManager(users);
+
+            DaoAuthenticationProvider provider = new DaoAuthenticationProvider()
+            provider.userDetailsService = inMemory
+
+            auth.authenticationProvider(provider)
+        }
+    }
+}
--- a/config/src/test/groovy/org/springframework/security/config/annotation/issue50/ApplicationConfig.java
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/issue50/ApplicationConfig.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.issue50;
+
+import javax.sql.DataSource;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder;
+import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType;
+import org.springframework.orm.jpa.JpaTransactionManager;
+import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;
+import org.springframework.orm.jpa.vendor.Database;
+import org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter;
+import org.springframework.security.config.annotation.issue50.domain.User;
+import org.springframework.transaction.PlatformTransactionManager;
+import org.springframework.transaction.annotation.EnableTransactionManagement;
+
+/**
+ * @author Rob Winch
+ *
+ */
+@Configuration
+@EnableJpaRepositories("org.springframework.security.config.annotation.issue50.repo")
+@EnableTransactionManagement
+public class ApplicationConfig {
+    @Bean
+    public DataSource dataSource() {
+        EmbeddedDatabaseBuilder builder = new EmbeddedDatabaseBuilder();
+        return builder.setType(EmbeddedDatabaseType.HSQL).build();
+    }
+
+    @Bean
+    public LocalContainerEntityManagerFactoryBean entityManagerFactory() {
+        HibernateJpaVendorAdapter vendorAdapter = new HibernateJpaVendorAdapter();
+        vendorAdapter.setDatabase(Database.HSQL);
+        vendorAdapter.setGenerateDdl(true);
+        vendorAdapter.setShowSql(true);
+
+        LocalContainerEntityManagerFactoryBean factory = new LocalContainerEntityManagerFactoryBean();
+        factory.setJpaVendorAdapter(vendorAdapter);
+        factory.setPackagesToScan(User.class.getPackage().getName());
+        factory.setDataSource(dataSource());
+
+        return factory;
+    }
+
+    @Bean
+    public PlatformTransactionManager transactionManager() {
+        JpaTransactionManager txManager = new JpaTransactionManager();
+        txManager.setEntityManagerFactory(entityManagerFactory().getObject());
+        return txManager;
+    }
+}
--- a/config/src/test/groovy/org/springframework/security/config/annotation/issue50/Issue50Tests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/issue50/Issue50Tests.groovy
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.issue50;
+
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.security.access.AccessDeniedException
+import org.springframework.security.authentication.AuthenticationManager
+import org.springframework.security.authentication.BadCredentialsException
+import org.springframework.security.authentication.TestingAuthenticationToken
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
+import org.springframework.security.config.annotation.issue50.domain.User
+import org.springframework.security.config.annotation.issue50.repo.UserRepository
+import org.springframework.security.core.Authentication
+import org.springframework.security.core.context.SecurityContextHolder
+import org.springframework.security.core.userdetails.UsernameNotFoundException
+import org.springframework.security.web.FilterChainProxy
+import org.springframework.test.context.ContextConfiguration
+import org.springframework.transaction.annotation.Transactional
+
+import spock.lang.Specification
+
+/**
+ * @author Rob Winch
+ *
+ */
+@ContextConfiguration(classes=[ApplicationConfig,SecurityConfig])
+@Transactional
+class Issue50Tests extends Specification {
+    @Autowired
+    private FilterChainProxy springSecurityFilterChain
+    @Autowired
+    private AuthenticationManager authenticationManager
+    @Autowired
+    private UserRepository userRepo
+
+    def setup() {
+        SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_ADMIN")
+    }
+
+    def cleanup() {
+        SecurityContextHolder.clearContext()
+    }
+
+    // https://github.com/SpringSource/spring-security-javaconfig/issues/50
+    def "#50 - GlobalMethodSecurityConfiguration should load AuthenticationManager lazily"() {
+        when:
+        "Configuration Loads"
+        then: "GlobalMethodSecurityConfiguration loads AuthenticationManager lazily"
+        noExceptionThrown()
+    }
+
+    def "AuthenticationManager will not authenticate missing user"() {
+        when:
+        authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "password"))
+        then:
+        thrown(UsernameNotFoundException)
+    }
+
+    def "AuthenticationManager will not authenticate with invalid password"() {
+        when:
+        User user = new User(username:"test",password:"password")
+        userRepo.save(user)
+        authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , "invalid"))
+        then:
+        thrown(BadCredentialsException)
+    }
+
+    def "AuthenticationManager can be used to authenticate a user"() {
+        when:
+        User user = new User(username:"test",password:"password")
+        userRepo.save(user)
+        Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password))
+        then:
+        result.principal == user.username
+    }
+
+    def "Global Method Security is enabled and works"() {
+        setup:
+        SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_USER")
+        when:
+        User user = new User(username:"denied",password:"password")
+        userRepo.save(user)
+        Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password))
+        then:
+        thrown(AccessDeniedException)
+    }
+}
--- a/config/src/test/groovy/org/springframework/security/config/annotation/issue50/SecurityConfig.java
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/issue50/SecurityConfig.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.issue50;
+
+import org.spockframework.util.Assert;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.issue50.domain.User;
+import org.springframework.security.config.annotation.issue50.repo.UserRepository;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+
+/**
+ * @author Rob Winch
+ *
+ */
+@EnableWebSecurity
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+@Configuration
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+    @Autowired
+    private UserRepository myUserRepository;
+
+    @Override
+    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+        auth
+            .authenticationProvider(authenticationProvider());
+    }
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http
+            .authorizeRequests()
+                .antMatchers("/*").permitAll();
+    }
+
+    @Bean
+    @Override
+    public AuthenticationManager authenticationManagerBean()
+            throws Exception {
+        return super.authenticationManagerBean();
+    }
+
+    @Bean
+    public AuthenticationProvider authenticationProvider() {
+        Assert.notNull(myUserRepository);
+        return new AuthenticationProvider() {
+            public boolean supports(Class<?> authentication) {
+                return true;
+            }
+            public Authentication authenticate(Authentication authentication)
+                    throws AuthenticationException {
+                Object principal = authentication.getPrincipal();
+                String username = String.valueOf(principal);
+                User user = myUserRepository.findByUsername(username);
+                if(user == null) {
+                    throw new UsernameNotFoundException("No user for principal "+principal);
+                }
+                if(!authentication.getCredentials().equals(user.getPassword())) {
+                    throw new BadCredentialsException("Invalid password");
+                }
+                return new TestingAuthenticationToken(principal, null, "ROLE_USER");
+            }
+        };
+    }
+}
--- a/config/src/test/groovy/org/springframework/security/config/annotation/issue50/domain/User.java
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/issue50/domain/User.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.issue50.domain;
+
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+
+/**
+ * @author Rob Winch
+ *
+ */
+@Entity
+public class User {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private Long id;
+
+    private String username;
+
+    private String password;
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+}
--- a/config/src/test/groovy/org/springframework/security/config/annotation/issue50/repo/UserRepository.java
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/issue50/repo/UserRepository.java
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.issue50.repo;
+
+import org.springframework.data.repository.CrudRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.config.annotation.issue50.domain.User;
+
+/**
+ * @author Rob Winch
+ *
+ */
+public interface UserRepository extends CrudRepository<User, String> {
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    User findByUsername(String username);
+}
--- a/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/Issue55Tests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/Issue55Tests.groovy
@@ -19,6 +19,7 @@ import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.core.annotation.Order;
 import org.springframework.security.authentication.AuthenticationManager
+import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -36,11 +37,13 @@ import org.springframework.stereotype.Component
 class Issue55Tests extends BaseSpringSpec {

    def "WebSecurityConfigurerAdapter defaults to @Autowired"() {
+        setup:
+            TestingAuthenticationToken token = new TestingAuthenticationToken("test", "this")
        when:
-        loadConfig(WebSecurityConfigurerAdapterDefaultsAuthManagerConfig)
+            loadConfig(WebSecurityConfigurerAdapterDefaultsAuthManagerConfig)
        then:
-        context.getBean(FilterChainProxy)
-        findFilter(FilterSecurityInterceptor).authenticationManager.parent.class == CustomAuthenticationManager
+            context.getBean(FilterChainProxy)
+            findFilter(FilterSecurityInterceptor).authenticationManager.authenticate(token) == CustomAuthenticationManager.RESULT
     }

    @Configuration
@@ -66,12 +69,14 @@ class Issue55Tests extends BaseSpringSpec {
    }

    def "multi http WebSecurityConfigurerAdapter defaults to @Autowired"() {
+        setup:
+            TestingAuthenticationToken token = new TestingAuthenticationToken("test", "this")
        when:
-        loadConfig(MultiWebSecurityConfigurerAdapterDefaultsAuthManagerConfig)
+            loadConfig(MultiWebSecurityConfigurerAdapterDefaultsAuthManagerConfig)
        then:
-        context.getBean(FilterChainProxy)
-        findFilter(FilterSecurityInterceptor).authenticationManager.parent.class == CustomAuthenticationManager
-        findFilter(FilterSecurityInterceptor,1).authenticationManager.parent.class == CustomAuthenticationManager
+            context.getBean(FilterChainProxy)
+            findFilter(FilterSecurityInterceptor).authenticationManager.authenticate(token) == CustomAuthenticationManager.RESULT
+            findFilter(FilterSecurityInterceptor,1).authenticationManager.authenticate(token) == CustomAuthenticationManager.RESULT
     }

    @Configuration
@@ -107,8 +112,9 @@ class Issue55Tests extends BaseSpringSpec {
    }

    static class CustomAuthenticationManager implements AuthenticationManager {
+        static Authentication RESULT = new TestingAuthenticationToken("test", "this","ROLE_USER")
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
-            return null;
+            return RESULT;
        }
    }
 }