SEC-1152: Changes to add anonymous filter to default namespace configuration and added enabled flag to allow overriding of the behaviour.

config/src/main/java/org/springframework/security/config/HttpSecurityBeanDefinitionParser.java

@@ -204,7 +204,8 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
         boolean autoConfig = "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
 
         Element anonymousElt = DomUtils.getChildElementByTagName(element, Elements.ANONYMOUS);
-        if (anonymousElt != null || autoConfig) {
+
+        if (anonymousElt == null || !"false".equals(anonymousElt.getAttribute("enabled"))) {
             new AnonymousBeanDefinitionParser().parse(anonymousElt, parserContext);
         }
 

config/src/main/resources/org/springframework/security/config/spring-security-3.0.rnc

@@ -429,6 +429,10 @@ anonymous.attlist &=
 anonymous.attlist &=
     ## The granted authority that should be assigned to the anonymous request. Commonly this is used to assign the anonymous request particular roles, which can subsequently be used in authorization decisions. If unset, defaults to "ROLE_ANONYMOUS".
     attribute granted-authority {xsd:token}?
+anonymous.attlist &=
+    ## With the default namespace setup, the anonymous "authentication" facility is automatically enabled. You can disable it using this property. 
+    attribute enabled {boolean}?
+
 
 port-mappings = 
     ## Defines the list of mappings between http and https ports for use in redirects