Spring boot: disable security auto configuration

Question

I have multipart web project. Web Admin part contains:

compile('org.springframework.boot:spring-boot-starter-web')
compile("org.springframework.boot:spring-boot-starter-thymeleaf")
compile("org.springframework.boot:spring-boot-starter-jetty")
compile("org.springframework.boot:spring-boot-starter-actuator")

Main project build file contains:

compile group: 'org.springframework', name: "spring-webmvc", version: springVersion
compile(group: 'org.springframework.security', name: "spring-security-web", version: springSecurityVersion) { exclude(module: 'spring-jdbc') }

Spring Boot application file:

@SpringBootApplication(exclude = {SecurityAutoConfiguration.class})
public class WebAdminApplication {

    public static void main(String[] args) {
        SpringApplication.run(WebAdminApplication.class, args);
    }
}

But when I'm doing http request to my admin part I'm getting user and password in my AuthenticationProvider:

auth.getPrincipal() -> user
auth.getCredentials() -> caeebd3a-307b-4edf-8f2f-833fad9ebc00

How I can disable auto security?

Answer 1

Even I was facing the same issue. So, I added below code.

• Case 1: If you have NOT activated 'ACTUATOR': @SpringBootApplication(exclude = { SecurityAutoConfiguration.class })

• Case 2: If you have activated 'ACTUATOR': @SpringBootApplication(exclude = { org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration.class, org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration.class})

Answer 2

if you look at spring boot's spring.factories (release 1.3.5 at the time of writing), you can see security has 4 autoconfigure classes:

org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration,\
org.springframework.boot.autoconfigure.security.SecurityFilterAutoConfiguration,\
org.springframework.boot.autoconfigure.security.FallbackWebSecurityAutoConfiguration,\
org.springframework.boot.autoconfigure.security.oauth2.OAuth2AutoConfiguration,\

You probably want to also disable SecurityFilterAutoConfiguration (or all 4 of them)