There's a window where the deny-all turbo filter has been removed but
Logback has not yet been configured. If any logging that would have
reached an appender is performed in this window, unwanted status
messages will be logged. This window can be closed by ensuring that
the turbo filter is in place while Logback is being configured.
Closes gh-34505
* gh-37500:
Polish "Add properties for JmsTemplate session's ack mode and transacted flag"
Add properties for JmsTemplate session's ack mode and transacted flag
Closes gh-37500
Previously auto-configuration of a user details service (imperative
or reactive) would only back off on the presence of certain beans.
This led to situations where the im-memory service was
auto-configured and the default password was logged even though
another authentication mechanism was in use.
This commit updates the auto-configuration so that it backs off
when depending on Spring Security's OAuth2 Client and OAuth2
Resource Server modules. In the imperative case it will also back
off when depending on the SAML 2 provider.
Closes gh-35338
If there's no authentication manager bean or no bean from which
one can be created, Spring Security's reactive support may fail to
bootstrap due to a null authentication manager.
This commit causes the auto-configuration that enables WebFlux
security to back off in the absence of an AuthenticationManager bean
and a ReactiveUserDetailsService (from which Spring Security can
create an AuthenticationManager) bean. Other reactive security
auto-configuration that can configure things such that WebFlux security
can be bootstrapped without an AuthenticationManager has been updated
to enable WebFlux security rather than relying on another
auto-configuration class to do so.
Fixes gh-37504
Andy Wilkinson
Vedran Pavic
Michael Simons
Chris Bono
Scott Frederick
dependabot[bot]
Moritz Halbritter
Sushant Kumar Singh