Make RequestMatcherDelegatingAuthorizationManager Post-Processable

Closes gh-15978
spring-projects · Oct 23, 2024 · bf6b163 · bf6b163
1 parent e9bbe31
commit bf6b163
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/...framework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java b/...framework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java
@@ -171,7 +171,8 @@ private AuthorizationManager<HttpServletRequest> createAuthorizationManager() {
 			Assert.state(this.mappingCount > 0,
 					"At least one mapping is required (for example, authorizeHttpRequests().anyRequest().authenticated())");
 			ObservationRegistry registry = getObservationRegistry();
-			RequestMatcherDelegatingAuthorizationManager manager = postProcess(this.managerBuilder.build());
+			AuthorizationManager<HttpServletRequest> manager = postProcess(
+					(AuthorizationManager<HttpServletRequest>) this.managerBuilder.build());
 			if (registry.isNoop()) {
 				return manager;
 			}

diff --git a/...work/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurerTests.java b/...work/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurerTests.java
@@ -153,6 +153,7 @@ public void configureWhenObjectPostProcessorRegisteredThenInvokedOnAuthorization
 		this.spring.register(ObjectPostProcessorConfig.class).autowire();
 		ObjectPostProcessor objectPostProcessor = this.spring.getContext().getBean(ObjectPostProcessor.class);
 		verify(objectPostProcessor).postProcess(any(RequestMatcherDelegatingAuthorizationManager.class));
+		verify(objectPostProcessor).postProcess(any(AuthorizationManager.class));
 		verify(objectPostProcessor).postProcess(any(AuthorizationFilter.class));
 	}