Rewriting a Spring security deprecated, AuthenticationManager / HttpSecurity

Question

I've read some examples and docs on Spring security which i managed to rewrite a deprecated function on the SecurityFilterchain.

https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/config/annotation/SecurityConfigurerAdapter.html#and()

However in another function below im facing issue on not knowing how i can rewrite it in a lambda based configuration and would need help to rewrite this.

  @Bean
    public AuthenticationManager authenticationManager(HttpSecurity http) throws Exception {
    
       return http.getSharedObject(AuthenticationManagerBuilder.class)
               .userDetailsService(customUserDetailService)
               .passwordEncoder(passwordEncoder())
               .and().build();
    
    }

Answer 1

You could rewrite AuthenticationManager Bean as next one it is going to work as expected.

  @Bean
  public AuthenticationManager authenticationManager(HttpSecurity http) throws Exception {

        AuthenticationManagerBuilder authManagerBuilder =  http.getSharedObject(AuthenticationManagerBuilder.class);
        authManagerBuilder.userDetailsService(customUserDetailService)
            .passwordEncoder(passwordEncoder());
        return authManagerBuilder.build();        
      }

More details about it and some references you will be able to find spring-security-without-the-websecurityconfigureradapter post.

Answer 2

Instead of using AuthenticationManagerBuilder, please publish the UserDetailsService and PasswordEncoder beans separately like so:

@Bean
UserDetailsService customUserDetailsService() {
    // ... construct
}

@Bean
PasswordEncoder passwordEncoder() {
    // ... construct
}

In your case, given that you are fine with the AuthenticationProvider defaults in AuthenticationManager, there is no need to construct one directly as you are doing.