Closed
Description
Summary
The documentation seems to support allowing different authentication managers for different authentication specs (HttpBasicSpec and FormLoginSpec). However, those seem to always be overwritten when the .build() method is called:
HttpBasicSpec overwritten
FormLoginSpec overwritten
Actual Behavior
HttpBasicSpec and FormLoginSpec can not use different AuthenticationManagers
Expected Behavior
HttpBasicSpec and FormLoginSpec should be able to use different AuthenticationManagers
Configuration
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
http
// ...
.httpBasic()
.authenticationManager(authenticationManager1)
.and()
.formLogin()
.authenticationManager(authenticationManager2);
return http.build();
}
Version
spring-security 5.0.6.RELEASE
The problematic code referenced in the summary appears to still exist in the master branch.
Sample
N/A