Merge branch '2.0.x'

Author: mbhave

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/reactive/ReactiveSecurityAutoConfiguration.java

@@ -16,22 +16,40 @@
 
 package org.springframework.boot.autoconfigure.security.reactive;
 
+import reactor.core.publisher.Flux;
+
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
 import org.springframework.boot.autoconfigure.security.SecurityProperties;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Import;
+import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
+import org.springframework.security.web.server.WebFilterChainProxy;
 
 /**
  * {@link EnableAutoConfiguration Auto-configuration} for Spring Security in a reactive
- * application.
+ * application. Switches on {@link EnableWebFluxSecurity} for a reactive web application
+ * if this annotation has not been added by the user. It delegates to Spring Security's
+ * content-negotiation mechanism for authentication. This configuration also backs off if
+ * a bean of type {@link WebFilterChainProxy} has been configured in any other way.
  *
  * @author Madhura Bhave
  * @since 2.0.0
  */
 @Configuration
 @EnableConfigurationProperties(SecurityProperties.class)
-@Import(WebFluxSecurityConfiguration.class)
+@ConditionalOnClass({ Flux.class, EnableWebFluxSecurity.class,
+		WebFilterChainProxy.class })
 public class ReactiveSecurityAutoConfiguration {
 
+	@Configuration
+	@ConditionalOnMissingBean(WebFilterChainProxy.class)
+	@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.REACTIVE)
+	@EnableWebFluxSecurity
+	static class EnableWebFluxSecurityConfiguration {
+
+	}
+
 }

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/reactive/WebFluxSecurityConfiguration.java

@@ -20,9 +20,12 @@
 
 import org.springframework.boot.autoconfigure.AutoConfigurations;
 import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.security.web.server.WebFilterChainProxy;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
 
 /**
  * Tests for {@link ReactiveSecurityAutoConfiguration}.
@@ -34,17 +37,33 @@ public class ReactiveSecurityAutoConfigurationTests {
 	private ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner();
 
 	@Test
-	public void importsConfigurationThatEnablesWebFluxSecurity() {
+	public void backsOffWhenWebFilterChainProxyBeanPresent() {
+		this.contextRunner
+				.withConfiguration(
+						AutoConfigurations.of(ReactiveSecurityAutoConfiguration.class))
+				.withUserConfiguration(WebFilterChainProxyConfiguration.class)
+				.run((context) -> assertThat(context)
+						.hasSingleBean(WebFilterChainProxy.class));
+	}
+
+	@Test
+	public void enablesWebFluxSecurity() {
 		this.contextRunner
 				.withConfiguration(
 						AutoConfigurations.of(ReactiveSecurityAutoConfiguration.class,
 								ReactiveUserDetailsServiceAutoConfiguration.class))
-				.run((context) -> {
-					assertThat(context).getBean(WebFilterChainProxy.class).isNotNull();
-					assertThat(context).getBean(WebFluxSecurityConfiguration.class)
-							.isNotNull();
-					assertThat(context).getBean(WebFilterChainProxy.class).isNotNull();
-				});
+				.run((context) -> assertThat(context).getBean(WebFilterChainProxy.class)
+						.isNotNull());
+	}
+
+	@Configuration
+	static class WebFilterChainProxyConfiguration {
+
+		@Bean
+		public WebFilterChainProxy webFilterChainProxy() {
+			return mock(WebFilterChainProxy.class);
+		}
+
 	}
 
 }