Spring Security 7.0

When upgrading to Spring Security 7.0, refer to What’s New in Spring Security 7.0, the Spring Security 7.0 migration guide, and the Preparing for 7.0 guide in the Spring Security 6.5 documentation for newly introduced APIs, deprecated APIs, and breaking changes. Spring Security 7.0 is the release line for Spring Boot 4.0, and the Spring Boot 4.0 upgrade recipe chains this recipe.

The io.arconia.rewrite.spring.security7.UpgradeSpringSecurity_7_0 recipe automates the mechanical changes introduced in Spring Security 7.0. You can use it to update your project to the latest Spring Security 7.0.x release.

The recipe will:

  • Upgrade all org.springframework.security dependencies to the 7.0.x release line, which now includes Spring Authorization Server.

  • Move the Spring Security Kerberos artifacts, which became part of Spring Security, from the org.springframework.security.kerberos group to the org.springframework.security group. The packages are unchanged.

  • Add the spring-security-access module to projects that use the legacy Access API, such as access decision managers, voters, security metadata sources, and the filter and method security interceptors, which moved out of the core, web, ACL, and messaging modules. Add the spring-security-webauthn module to projects that use the WebAuthn support, which moved out of the web module.

  • For Spring Security Core: rename the check method of AuthorizationManager and ReactiveAuthorizationManager to authorize, on callers and implementations alike, and replace PrePostTemplateDefaults with AnnotationTemplateExpressionDefaults.

  • For Spring Security Config: move ObjectPostProcessor out of the annotation package, and replace @EnableWebMvcSecurity with @EnableWebSecurity.

  • For OAuth2 Client: replace the removed Default token response clients for the authorization code, client credentials, JWT bearer, refresh token, and token exchange grants with their RestClient successors. Code that customized the removed clients through their request entity converter or RestOperations setters needs to move to the parameters converter and RestClient setters of the new clients.

  • For OAuth2 Resource Server: move BearerTokenAuthenticationToken and BearerTokenAuthenticationFilter to their authentication subpackages, and replace the Nimbus opaque token introspectors with the Spring ones, which share the same constructors.

  • For SAML2 Service Provider: replace the removed OpenSAML 4 components, and the un-numbered ones that wrapped them, with their OpenSAML 5 equivalents, raise explicitly declared OpenSAML dependencies to the 5.x line, and rename the asserting party details accessors on RelyingPartyRegistration and its builder to the asserting party metadata ones.

  • For CAS: move ServiceAuthenticationDetails out of the web package.

Some changes in Spring Security 7.0 are deliberately not automated. The pre-lambda configuration style is gone: and() and the no-argument configurer methods on HttpSecurity were removed, so chained configuration must be rewritten with the Lambda DSL. authorizeRequests was removed in favor of authorizeHttpRequests, whose registry has no string access or hasIpAddress methods, so those rules need an authorization manager instead. AntPathRequestMatcher and MvcRequestMatcher were removed in favor of PathPatternRequestMatcher, whose patterns only allow ** at the end. The password grant, the OAuth2 request entity converters, the Jackson 2 security modules, the Base64 codec, PortResolver, LazyCsrfTokenRepository, the WebSocket message broker configurer, and the ApacheDS embedded server were removed or superseded by differently shaped APIs. Behavior also changed for JWT type validation, login redirects, SAML logout responses, SAML GET requests, and the JWK Set fetch timeouts, so review the guides above for the parts that apply to your application.

See its entry in the Recipe Catalog for the full list of recipes this upgrade applies, each with its options and a before/after example.

Run the Recipe

You can apply this recipe with any OpenRewrite-compatible tool. The tabs below show three of them: the Arconia CLI, the OpenRewrite Gradle plugin, and the OpenRewrite Maven plugin. See Running Recipes for a comparison of when to pick each one.

  • Arconia CLI

  • Gradle

  • Maven

arconia rewrite run --recipe-name io.arconia.rewrite.spring.security7.UpgradeSpringSecurity_7_0

First, create an init.gradle file in your project root with the following content.

initscript {
    repositories {
        gradlePluginPortal()
    }
    dependencies {
        classpath("org.openrewrite:plugin:latest.release")
    }
}

rootProject {
    plugins.apply(org.openrewrite.gradle.RewritePlugin)
    dependencies {
        rewrite("io.arconia.migrations:rewrite-spring:latest.release")
    }

    // Remove when project repositories are disabled
    afterEvaluate {
        if (repositories.isEmpty()) {
            repositories {
                mavenCentral()
            }
        }
    }

    configurations.named("rewrite") {
        canBeConsumed = false
    }
}

Then, run the following command.

./gradlew rewriteRun \
    --init-script init.gradle \
    --no-parallel \
    -DactiveRecipe=io.arconia.rewrite.spring.security7.UpgradeSpringSecurity_7_0

You can remove the init.gradle file afterwards.

./mvnw -U org.openrewrite.maven:rewrite-maven-plugin:run \
  -Drewrite.recipeArtifactCoordinates=io.arconia.migrations:rewrite-spring:LATEST \
  -Drewrite.activeRecipes=io.arconia.rewrite.spring.security7.UpgradeSpringSecurity_7_0