弃用WebSecurityConfigurer后，如何获取AuthenticationManager？

在使用AbstractHttpConfigurer的场景下，要暴露AuthenticationManager作为Bean，可通过以下两种可行方案实现：

方法一：在AbstractHttpConfigurer子类中封装配置并暴露Bean #

// 自定义AbstractHttpConfigurer子类
public class CustomSecurityConfig extends AbstractHttpConfigurer<CustomSecurityConfig, HttpSecurity> {

    @Override
    public void init(HttpSecurity http) throws Exception {
        // 初始化配置，比如设置认证基础规则
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        // 获取AuthenticationManagerBuilder
        AuthenticationManagerBuilder auth = http.getSharedObject(AuthenticationManagerBuilder.class);
        // 配置用户认证逻辑（示例为内存用户，可替换为数据库等实现）
        auth.inMemoryAuthentication()
                .withUser("user")
                .password("{noop}password")
                .roles("USER");
        
        // 构建AuthenticationManager并存入共享对象
        AuthenticationManager authenticationManager = auth.build();
        http.setSharedObject(AuthenticationManager.class, authenticationManager);
    }

    // 静态方法方便在SecurityFilterChain中引入
    public static CustomSecurityConfig customSecurityConfig() {
        return new CustomSecurityConfig();
    }
}

// 配置SecurityFilterChain的类
@Configuration
public class SecurityFilterChainConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.apply(CustomSecurityConfig.customSecurityConfig());
        
        // 其他HttpSecurity配置，比如授权规则
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(Customizer.withDefaults());
        
        return http.build();
    }

    // 暴露AuthenticationManager Bean供其他组件注入
    @Bean
    public AuthenticationManager authenticationManager(HttpSecurity http) throws Exception {
        return http.getSharedObject(AuthenticationManager.class);
    }
}

方法二：直接通过AuthenticationConfiguration注册Bean #

如果不需要在AbstractHttpConfigurer中封装认证逻辑，可直接在配置类中创建AuthenticationManager Bean：

@Configuration
public class SecurityConfig {

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        // 引入自定义AbstractHttpConfigurer实现
        http.apply(new CustomSecurityConfig());
        
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(Customizer.withDefaults());
        
        return http.build();
    }
}

说明 #

• 方法一中，通过HttpSecurity的getSharedObject获取AuthenticationManagerBuilder，配置完成后构建AuthenticationManager存入共享对象，最后在配置类中取出并暴露为Bean。
• 方法二更简洁，直接利用AuthenticationConfiguration获取AuthenticationManager，前提是已通过AbstractHttpConfigurer或其他方式配置了用户认证提供者（如UserDetailsService）。

内容的提问来源于stack exchange，提问作者ArtistS