When I use security.basic.enabled=false to disable security on a Spring Boot project that has the following dependencies:

                   
            
             org.springframework.boot
                    
            
             spring-boot-starter-web
                
               
                   
            
             org.springframework.boot
                    
            
             spring-boot-starter-security
                
               
                   
            
             org.springframework.boot
                    
            
             spring-boot-starter-actuator
                
               
                   
            
             com.oracle
                    
            
             ojdbc6
                
               
                   
            
             org.springframework.boot
                    
            
             spring-boot-starter-tomcat
                    
            
             provided
                
               
                   
            
             org.springframework.boot
                    
            
             spring-boot-starter-test
                    
            
             test
                
           

I see the following Exception:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration$ManagementWebSecurityConfigurerAdapter': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}

In order to fix this exception I had to add the property - management.security.enabled=false . My understanding is that when the actuator is in the classpath, both security.basic.enabled=false and management.security.enabled=false should be set to disable the security.

Could someone please let me know if my understanding is wrong?

 

4,591122845

asked  May 27 '14 at 16:03 1631211

1

Why do you need security on your classpath if you just want to disable everything? Anyway, your stack trace is incomplete so there is no way to know what was preventing the app from starting. I would expect it would start, but the actuator endpoints should stay secure until you explicitly open them up. –  May 27 '14 at 17:41

@DaveSyer I would like to disable security temporarily and also my application code refers security jars to work. –  Feb 19 '15 at 21:36

You still haven't posted enough information to see why the app isn't starting. A full stack trace would be a start. –  Feb 20 '15 at 8:41

1

@DaveSyer One reason would be a microservice managing spring-sec-oauth2 ClientDetails. You'll have a transitive import of spring-security but maybe don't want basic auth in your service. – Oct 23 '15 at 15:52

4 Answers

33

In case you have spring-boot-actuator in your package, you should add the following

@EnableAutoConfiguration(exclude = {        org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class,        org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration.class})

With older Spring-boot, the class was called ManagementSecurityAutoConfiguration.

2,15711439

answered  Dec 9 '14 at 22:07 468613

3

In Spring boot 1.3 the name seems to have changed to ManagementWebSecurityAutoConfiguration. –  Nov 25 '15 at 15:12

Thanks @James for pointing out, I have mentioned this in the answer now. –  Dec 17 '15 at 9:25

 

19

What also seems to work fine is creating a file application-dev.properties that contains:

security.basic.enabled=falsemanagement.security.enabled=false

If you then start your Spring Boot app with the dev profile, you don't need to log on.

answered  Dec 8 '15 at 7:48 6,59743988

18

If you need security as a dependency but don't want Spring Boot to configure it for you, you can use this exclusion:

@EnableAutoConfiguration(exclude = {         org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class     })

answered  Aug 5 '14 at 12:33 1,18211223

Work perfectly for me. FYI - My app depends on security jars but I would like to temporarily disable security –  Feb 19 '15 at 21:42

3	In order to avoid security you can use annotations. Use this annotation on top of configure class: @EnableWebSecurity For example: @EnableWebSecurity@Configurationpublic class AuthFilter{ // configured method }