CAS 7.0.0-RC9中org.apereo.cas.web.security相关类变更疑问

问题背景 #

正在将CAS从org.apereo.cas:6.6.14迁移至7.0.0-RC9（正式版发布后将切换至正式版）。在v7.0.0-RC5之前，org.apereo.cas.web.security包属于org.apereo.cas:cas-server-webapp-config依赖，但该依赖未更新到RC5之后的版本。混用cas-server-webapp-config:7.0.0-RC5与其他RC9版本组件时，触发编译错误：

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.10.1:compile (default-compile) on project eessi-cas-server: Compilation failure: Compilation failure: 
[ERROR] /path/to/my/project/src/main/java/org/apereo/cas/custom/config/MyCasOverlayConfiguration.java:[4,25] error: cannot find symbol
[ERROR]   symbol:   class ProtocolEndpointWebSecurityConfigurer
[ERROR]   location: package org.apereo.cas.web

原6.6.14版本中构建SecurityFilterChain的代码依赖CasWebSecurityConfigurerAdapter及ProtocolEndpointWebSecurityConfigurer：

@Primary
@Bean
public SecurityFilterChain casWebSecurityConfigurerAdapter(
        final HttpSecurity http,
        final ObjectProvider<PathMappedEndpoints> pathMappedEndpoints,
        final List<ProtocolEndpointWebSecurityConfigurer> configurersList,
        final SecurityProperties securityProperties,
        final CasConfigurationProperties casProperties,
        final org.springframework.security.web.context.SecurityContextRepository securityContextRepository,
        final WebEndpointProperties webEndpointProperties)throws Exception {
    CasWebSecurityConfigurerAdapter adapter = new CasWebSecurityConfigurerAdapter( 
        casProperties, securityProperties, 
    webEndpointProperties, pathMappedEndpoints, ProtocolEndpointWebSecurityConfigurer, configurersList);
    return adapter.configureHttpSecurity(http).build();
}

使用Maven 3.9.5和OpenJDK 21.0编译时触发上述错误，推测原因是ProtocolEndpointWebSecurityConfigurer在RC6+版本中被移除、包路径迁移，或CAS的SecurityFilterChain构建机制发生了变更。

解决方案：适配CAS 7.x的安全配置模式 #

CAS 7.x（从RC6开始）对Spring Security集成逻辑做了重构，原有的CasWebSecurityConfigurerAdapter和ProtocolEndpointWebSecurityConfigurer已被废弃移除，需调整代码适配新API：

1. 替换SecurityFilterChain构建代码 #

使用CAS 7.x提供的CasSecurityFilterChainConfigurer替代旧实现：

@Primary
@Bean
public SecurityFilterChain casWebSecurityFilterChain(final HttpSecurity http,
                                                     final CasConfigurationProperties casProperties,
                                                     final SecurityProperties securityProperties,
                                                     final WebEndpointProperties webEndpointProperties,
                                                     final ObjectProvider<PathMappedEndpoints> pathMappedEndpoints,
                                                     final List<CasSecurityConfigurer> securityConfigurers) throws Exception {
    return http.apply(new CasSecurityFilterChainConfigurer(casProperties, securityProperties, webEndpointProperties, pathMappedEndpoints))
            .withConfigurers(securityConfigurers)
            .configure()
            .build();
}

2. 统一依赖版本 #

确保所有CAS相关依赖版本统一为7.0.0-RC9，无需单独引入cas-server-webapp-config——该模块的功能已合并至cas-server-core-web-api等核心模块中。

核心变更说明 #

• CAS 7.x重构了Spring Security集成逻辑，CasWebSecurityConfigurerAdapter被废弃并移除
• ProtocolEndpointWebSecurityConfigurer的职责拆分至多个CasSecurityConfigurer实现类，通过自动装配注入配置流程
• 安全配置核心逻辑迁移至核心模块，旧的cas-server-webapp-config模块不再维护

内容的提问来源于stack exchange，提问作者wotanii