Spring boot Security Disable security

When I use security.basic.enabled=false to disable security on a Spring Boot project that has the following dependencies: <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-actuator</artifactId> </dependency> <dependency> <groupId>com.oracle</groupId> <artifactId>ojdbc6</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-tomcat</artifactId> <scope>provided</scope> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-test</artifactId> <scope>test</scope> </dependency> I see the following Exception: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration$ManagementWebSecurityConfigurerAdapter': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor); nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.config.annotation.ObjectPostProcessor] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {} In order to fix this exception I had to add the property - management.security.enabled=false . My understanding is that when the actuator is in the classpath, both security.basic.enabled=false and management.security.enabled=false should be set to disable the security. Could someone please let me know if my understanding is wrong? spring-security  spring-boot share improve this question edited Apr 25 '16 at 17:46 approxiblue 4,591122845 asked  May 27 '14 at 16:03 user3600073 1631211

1   Why do you need security on your classpath if you just want to disable everything? Anyway, your stack trace is incomplete so there is no way to know what was preventing the app from starting. I would expect it would start, but the actuator endpoints should stay secure until you explicitly open them up. – Dave Syer May 27 '14 at 17:41 @DaveSyer I would like to disable security temporarily and also my application code refers security jars to work. – Stackee007 Feb 19 '15 at 21:36 You still haven't posted enough information to see why the app isn't starting. A full stack trace would be a start. – Dave Syer Feb 20 '15 at 8:41 1   @DaveSyer One reason would be a microservice managing spring-sec-oauth2 ClientDetails. You'll have a transitive import of spring-security but maybe don't want basic auth in your service. – Dirk LachowskiOct 23 '15 at 15:52 add a comment

4 Answers

active oldest votes

up vote 33down vote

In case you have spring-boot-actuator in your package, you should add the following @EnableAutoConfiguration(exclude = { org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class, org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration.class}) With older Spring-boot, the class was called ManagementSecurityAutoConfiguration. share improve this answer edited Mar 3 at 20:59 Captain Man 2,15711439 answered  Dec 9 '14 at 22:07 Varesh 468613

3   In Spring boot 1.3 the name seems to have changed to ManagementWebSecurityAutoConfiguration. – James Nov 25 '15 at 15:12 Thanks @James for pointing out, I have mentioned this in the answer now. – Varesh Dec 17 '15 at 9:25 add a comment

 

up vote 19down vote	What also seems to work fine is creating a file application-dev.properties that contains: security.basic.enabled=false management.security.enabled=false If you then start your Spring Boot app with the dev profile, you don't need to log on. share improve this answer answered  Dec 8 '15 at 7:48 Wim Deblauwe 6,59743988
	add a comment

up vote 18down vote	If you need security as a dependency but don't want Spring Boot to configure it for you, you can use this exclusion: @EnableAutoConfiguration(exclude = { org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class }) share improve this answer edited Jul 31 '15 at 17:28     answered  Aug 5 '14 at 12:33 gyoder 1,18211223
	Work perfectly for me. FYI - My app depends on security jars but I would like to temporarily disable security – Stackee007 Feb 19 '15 at 21:42 add a comment

up vote 3down vote

In order to avoid security you can use annotations. Use this annotation on top of configure class: @EnableWebSecurity For example: @EnableWebSecurity @Configuration public class AuthFilter{ // configured method }