Spring boot Security Disable security

Question

When I use security.basic.enabled=false to disable security on a Spring Boot project that has the following dependencies:

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
        <groupId>com.oracle</groupId>
        <artifactId>ojdbc6</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-tomcat</artifactId>
        <scope>provided</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>

I see the following Exception:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration$ManagementWebSecurityConfigurerAdapter': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}

In order to fix this exception I had to add the property - management.security.enabled=false . My understanding is that when the actuator is in the classpath, both security.basic.enabled=false and management.security.enabled=false should be set to disable the security.

Could someone please let me know if my understanding is wrong?

Why do you need security on your classpath if you just want to disable everything? Anyway, your stack trace is incomplete so there is no way to know what was preventing the app from starting. I would expect it would start, but the actuator endpoints should stay secure until you explicitly open them up. – Dave Syer May 27 '14 at 17:41 — Dave Syer, May 27 '14 at 17:41
@DaveSyer I would like to disable security temporarily and also my application code refers security jars to work. – Stackee007 Feb 19 '15 at 21:36 — Stackee007, Feb 19 '15 at 21:36
You still haven't posted enough information to see why the app isn't starting. A full stack trace would be a start. – Dave Syer Feb 20 '15 at 8:41 — Dave Syer, Feb 20 '15 at 8:41
@DaveSyer One reason would be a microservice managing spring-sec-oauth2 ClientDetails. You'll have a transitive import of spring-security but maybe don't want basic auth in your service. – Dirk LachowskiOct 23 '15 at 15:52 — Dirk Lachowski, Oct 23 '15 at 15:52

Captain Man · Answer 1 · 2017-03-03 20:59:33Z

In case you have spring-boot-actuator in your package, you should add the following

@EnableAutoConfiguration(exclude = {
        org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class,
        org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration.class})

With older Spring-boot, the class was called ManagementSecurityAutoConfiguration.

In Spring boot 1.3 the name seems to have changed to ManagementWebSecurityAutoConfiguration. – James Nov 25 '15 at 15:12 — James, Nov 25 '15 at 15:12
Thanks @James for pointing out, I have mentioned this in the answer now. – Varesh Dec 17 '15 at 9:25 — Varesh, Dec 17 '15 at 9:25

Wim Deblauwe · Answer 2 · 2015-12-08 07:48:41Z

What also seems to work fine is creating a file application-dev.properties that contains:

security.basic.enabled=false
management.security.enabled=false

If you then start your Spring Boot app with the dev profile, you don't need to log on.

gyoder · Answer 3 · 2015-07-31 17:28:19Z

If you need security as a dependency but don't want Spring Boot to configure it for you, you can use this exclusion:

    @EnableAutoConfiguration(exclude = { 
        org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class 
    })

Work perfectly for me. FYI - My app depends on security jars but I would like to temporarily disable security – Stackee007 Feb 19 '15 at 21:42 — Stackee007, Feb 19 '15 at 21:42

score 3down vote · Answer 4

In order to avoid security you can use annotations. Use this annotation on top of configure class:

@EnableWebSecurity

For example:

@EnableWebSecurity
@Configuration
public class AuthFilter{
   // configured method 
}

Spring boot Security Disable security

4 Answers