Not possible to disable security with @ConditionalOnProperty anymore

Overall - I really like/prefer the new 2.0 security integration. The only issue is how can security be enabled/disabled via configuration.

In 1.5.x - security could be enabled / disabled via property. Unfortunately @ConditionalOnProperty seems to keep class available , so the new SpringBootWebSecurityConfiguration, @ConditionalOnClass(WebSecurityConfigurerAdapter.class) seems to find it any way, and configures default settings (http basic, everything protected, etc).

While debugging - I removed the @Configuration from MySecurityConfiguration , and security was not applied. So if there is some conditional way to @Import the file - that might also work.

Suggestions appreciated, Peter

Works in 1.5.x:

@Configuration
@ConditionalOnProperty ( "my.security.enabled" )
public class MySecurityConfiguration extends WebSecurityConfigurerAdapter {
     <working config>
}

Workaround for 2.x: Add an additional configuration with ! property, and ignore all

@Configuration
@ConditionalOnProperty (  name = "my.security.enabled", havingValue = "false" )
public class MySecurityDisabledConfiguration extends WebSecurityConfigurerAdapter {

	public void configure ( WebSecurity web ) throws Exception {
		web.ignoring().anyRequest() ;

	}
}

Spring default handler:

@ConditionalOnClass(WebSecurityConfigurerAdapter.class)
@ConditionalOnMissingBean(WebSecurityConfigurerAdapter.class)
@ConditionalOnWebApplication(type = Type.SERVLET)
public class SpringBootWebSecurityConfiguration {

	@Configuration
	@Order(SecurityProperties.BASIC_AUTH_ORDER)
	static class DefaultConfigurerAdapter extends WebSecurityConfigurerAdapter {

	}

}

[peterdnight]

Thanks for suggestions and links. After playing with the exclude option - desired behavior is occurring. I switched to the following convention, to enable security to be completely configuration driven using a single property. I was concerned that there would be potential for ordering issues - but my unit tests are all passing.

• Disable Security on the entire application by default:

@SpringBootApplication ( exclude = {SecurityAutoConfiguration.class} )
@Import(MySecurityConfiguration.class)
public class MyApplication{
 }

Then in my security configuration:

@Configuration
@ConditionalOnProperty (  "my.security.enabled" )
@Import ( SecurityAutoConfiguration.class 
public class MySecurityConfiguration extends WebSecurityConfigurerAdapter {

}

[thephw]

FWIW, worked a similar solution using profiles for configuring secure and insecure profiles.

The secure profile loads OAUTH2 config from environment variables for real operation. The insecure profile skips auth for integration tests with an external service.

Put it all in a demo repo here: https://github.com/deftinc/spring_azure_ad_profile/