Steve Riesenberg comments

Results 276 comments of


                                            Steve Riesenberg

WebClient client cert auth broken by spring-security:6.0.0-M6 (worked in 6.0.0-M5)

Thanks @marcusdacoregio. @jkjome it seems you’re experiencing symptoms of a new default in 6.0, but I’d like to understand the scenario as well. I’m less familiar with dispatcher types in...

WebClient client cert auth broken by spring-security:6.0.0-M6 (worked in 6.0.0-M5)

Thanks @jkjome. At this point, if you could at least share the your client code, mainly the entire controller and the Spring Security configuration, that would be helpful. I also...

WebClient client cert auth broken by spring-security:6.0.0-M6 (worked in 6.0.0-M5)

Thanks @jkjome. After looking at the provided sample and creating a simple parallel example of my own, I believe I have partially reproduced it without Client-Cert auth. I can reproduce...

Document how to publish an `AuthenticationManager` `@Bean` without `WebSecurityConfigurerAdapter`

**Note:** We should also enhance the deprecation notice in 5.7/5.8 to include a hint of where to get the same information. Perhaps a link to this reference documentation, or a...

No introduction to CachingUserDetailsService in the documentation

@linghengqian, thanks for the suggestion. I think many don't know of this class, and personally I have always used Spring's `@Cacheable` annotation for this case. However, the class has been...

No introduction to CachingUserDetailsService in the documentation

@linghengqian, no problem, thanks for the update.

No introduction to CachingUserDetailsService in the documentation

Sure!

Abstracts the method createAuthenticationToken

Thanks for the PR, @kcl-co! Just a heads up we are focused on releasing 5.8 and 6.0, and so may be delayed on a review.

Missing JSON session support for "impersonate" (SwitchUserGrantedAuthority)

Hi @markusheiden, thanks for opening. I'm wondering whether you have tried registering your own mixin(s) as a workaround for having the mixin in the framework itself? I would not expect...

Wrong name of the filter in the SecurityContextHolderFilter diagram

Thanks @underground-hill. There is a new property introduced in 5.7, `http.securityContext().requireExplicitSave(true)` that will align you with what is coming in 6.0. In 5.7 it's defaulted to `false`, I believe, and...