Spring boot Security Disable security

Question

When I use security.basic.enabled=false to disable security on a Spring Boot project that has the following dependencies:

    <dependency>         <groupId>org.springframework.boot</groupId>         <artifactId>spring-boot-starter-web</artifactId>     </dependency>     <dependency>         <groupId>org.springframework.boot</groupId>         <artifactId>spring-boot-starter-security</artifactId>     </dependency>     <dependency>         <groupId>org.springframework.boot</groupId>         <artifactId>spring-boot-starter-actuator</artifactId>     </dependency>     <dependency>         <groupId>com.oracle</groupId>         <artifactId>ojdbc6</artifactId>     </dependency>     <dependency>         <groupId>org.springframework.boot</groupId>         <artifactId>spring-boot-starter-tomcat</artifactId>         <scope>provided</scope>     </dependency>     <dependency>         <groupId>org.springframework.boot</groupId>         <artifactId>spring-boot-starter-test</artifactId>         <scope>test</scope>     </dependency> 

I see the following Exception:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration$ManagementWebSecurityConfigurerAdapter': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {} 

In order to fix this exception I had to add the property - management.security.enabled=false . My understanding is that when the actuator is in the classpath, both security.basic.enabled=false and management.security.enabled=false should be set to disable the security.

Could someone please let me know if my understanding is wrong?

Answer 1

In case you have spring-boot-actuator in your package, you should add the following

@EnableAutoConfiguration(exclude = {         org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class,         org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration.class}) 

With older Spring-boot, the class was called ManagementSecurityAutoConfiguration.

In newer versions this has changed to

@SpringBootApplication(exclude = {         org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration.class,         org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration.class}         ) 

UPDATE

If for reactive application you are having the same issue, you can exclude the following classes

@SpringBootApplication(exclude = {ReactiveSecurityAutoConfiguration.class, ReactiveManagementWebSecurityAutoConfiguration.class }) 

Answer 2

What also seems to work fine is creating a file application-dev.properties that contains:

security.basic.enabled=false management.security.enabled=false 

If you then start your Spring Boot app with the dev profile, you don't need to log on.