From 5086cf6c8baed0445ac6aa9792d841db54eb46a1 Mon Sep 17 00:00:00 2001
From: Chris Bono <chris.bono@gmail.com>
Date: Thu, 20 Oct 2022 23:22:48 -0500
Subject: [PATCH] [SB3 Update] Account for breaking changes in latest
 spring-security

---
 ...ppStarterWebSecurityAutoConfiguration.java | 60 +++++++++----------
 1 file changed, 28 insertions(+), 32 deletions(-)

diff --git a/applications/stream-applications-core/stream-applications-security-common/src/main/java/org/springframework/cloud/stream/app/security/common/AppStarterWebSecurityAutoConfiguration.java b/applications/stream-applications-core/stream-applications-security-common/src/main/java/org/springframework/cloud/stream/app/security/common/AppStarterWebSecurityAutoConfiguration.java
index cf44932a..ba8ea6e2 100644
--- a/applications/stream-applications-core/stream-applications-security-common/src/main/java/org/springframework/cloud/stream/app/security/common/AppStarterWebSecurityAutoConfiguration.java
+++ b/applications/stream-applications-core/stream-applications-security-common/src/main/java/org/springframework/cloud/stream/app/security/common/AppStarterWebSecurityAutoConfiguration.java
@@ -37,10 +37,10 @@ import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.StringUtils;
 
@@ -53,8 +53,8 @@ import org.springframework.util.StringUtils;
  */
 @Conditional(OnHttpCsrfOrSecurityDisabled.class)
 @AutoConfiguration
-@ConditionalOnClass(WebSecurityConfigurerAdapter.class)
-@ConditionalOnMissingBean(WebSecurityConfigurerAdapter.class)
+@ConditionalOnClass(SecurityFilterChain.class)
+@ConditionalOnMissingBean(SecurityFilterChain.class)
 @ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)
 @AutoConfigureBefore({ ManagementWebSecurityAutoConfiguration.class, SecurityAutoConfiguration.class })
 @EnableConfigurationProperties(AppStarterWebSecurityAutoConfigurationProperties.class)
@@ -96,37 +96,33 @@ public class AppStarterWebSecurityAutoConfiguration {
 	}
 
 	@Bean
-	WebSecurityConfigurerAdapter appStarterWebSecurityConfigurerAdapter(
-			AppStarterWebSecurityAutoConfigurationProperties securityProperties) {
+	SecurityFilterChain appStarterWebSecurityFilterChain(HttpSecurity http,
+			AppStarterWebSecurityAutoConfigurationProperties securityProperties) throws Exception {
 
-		return new WebSecurityConfigurerAdapter() {
-			@Override
-			protected void configure(HttpSecurity http) throws Exception {
-				if (!securityProperties.isCsrfEnabled()) {
-					http.csrf().disable();
-				}
-				else {
-					/*
-					 * See https://stackoverflow.com/questions/51079564/spring-security-antmatchers-not-being-
-					 * applied-on-post-requests-and-only-works-wi/51088555
-					 */
-					http.csrf().ignoringRequestMatchers(MethodAwareEndpointRequest.toAnyEndpoint(HttpMethod.POST));
-				}
-				if (securityProperties.isEnabled()) {
-					http.authorizeRequests()
-							.requestMatchers(MethodAwareEndpointRequest.toAnyEndpoint(HttpMethod.POST)).hasRole("ADMIN")
-							.requestMatchers(EndpointRequest.toLinks()).permitAll()
-							.requestMatchers(EndpointRequest.to("health", "info", "bindings")).permitAll()
-							.requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated()
-							.and().formLogin().and().httpBasic();
-				}
-				else {
-					http.authorizeRequests().anyRequest().permitAll();
-
-				}
-			}
-		};
+		if (!securityProperties.isCsrfEnabled()) {
+			http.csrf().disable();
+		}
+		else {
+			/*
+			 * See https://stackoverflow.com/questions/51079564/spring-security-antmatchers-not-being-
+			 * applied-on-post-requests-and-only-works-wi/51088555
+			 */
+			http.csrf().ignoringRequestMatchers(MethodAwareEndpointRequest.toAnyEndpoint(HttpMethod.POST));
+		}
+		if (securityProperties.isEnabled()) {
+			http.authorizeHttpRequests()
+					.requestMatchers(MethodAwareEndpointRequest.toAnyEndpoint(HttpMethod.POST)).hasRole("ADMIN")
+					.requestMatchers(EndpointRequest.toLinks()).permitAll()
+					.requestMatchers(EndpointRequest.to("health", "info", "bindings")).permitAll()
+					.requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated()
+					.and().formLogin().and().httpBasic();
+		}
+		else {
+			http.authorizeHttpRequests().anyRequest().permitAll();
+		}
+		return http.build();
 	}
+
 	/**
 	 * Extends {@link EndpointRequest} to allow HTTP methods to be specified on the request matcher.
 	 */