SEC-2455: form-login@login-processing-url & logout@logout-url use matchers

Remove the deprecation warnings of using setFilterProcessingUrl by invoking
the matcher methods instead.

config/src/test/groovy/org/springframework/security/config/http/FormLoginConfigTests.groovy

@@ -6,6 +6,8 @@ import org.springframework.security.web.access.ExceptionTranslationFilter
 import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.util.ReflectionUtils;
 
 /**
  *
@@ -102,4 +104,18 @@ class FormLoginConfigTests extends AbstractHttpConfigTests {
         apf.usernameParameter == 'xname';
         apf.passwordParameter == 'xpass'
     }
+
+    def 'SEC-2455: http@login-processing-url'() {
+        when:
+            xml.http {
+                'form-login'('login-processing-url':'/authenticate')
+            }
+            createAppContext()
+
+            def apf = getFilter(UsernamePasswordAuthenticationFilter);
+
+        then:
+            apf.filterProcessesUrl == null // SEC-2455 setFilterProcessesUrl was not invoked
+            FieldUtils.getFieldValue(apf,'requiresAuthenticationRequestMatcher.filterProcessesUrl') == '/authenticate'
+    }
 }

config/src/test/groovy/org/springframework/security/config/http/LogoutConfigTests.groovy

@@ -0,0 +1,25 @@
+package org.springframework.security.config.http
+
+import org.springframework.security.util.FieldUtils
+import org.springframework.security.web.authentication.logout.LogoutFilter
+
+/**
+ *
+ * @author Rob Winch
+ */
+class LogoutConfigTests extends AbstractHttpConfigTests {
+
+    def 'SEC-2455: logout@logout-url'() {
+        when:
+            httpAutoConfig {
+                'logout'('logout-url':'/logout')
+            }
+            createAppContext()
+
+            def lf = getFilter(LogoutFilter);
+
+        then:
+            lf.filterProcessesUrl == null // SEC-2455 setFilterProcessesUrl was not invoked
+            FieldUtils.getFieldValue(lf,'logoutRequestMatcher.filterProcessesUrl') == '/logout'
+    }
+}