Spring Boot项目升级Spring Security至6.0遇WebSecurityConfigurerAdapter弃用问题

在Spring Security 6.0中，WebSecurityConfigurerAdapter已被彻底移除，取而代之的是组件式配置——通过定义SecurityFilterChain和AuthenticationManager的Bean来实现认证授权逻辑。以下是几种可靠的获取AuthenticationManager的方式：

方式一：通过AuthenticationConfiguration直接获取 #

这种方式最简单，Spring会自动整合你配置的UserDetailsService、PasswordEncoder等组件，生成符合预期的AuthenticationManager：

import org.springframework.context.annotation.Bean;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.stereotype.Component;

@Component
public class SecurityBeansConfig {
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }
}

方式二：手动构建AuthenticationManager #

如果需要自定义认证逻辑（比如添加多种认证Provider），可以手动实例化ProviderManager并配置所需的AuthenticationProvider：

import org.springframework.context.annotation.Bean;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

@Component
public class SecurityBeansConfig {
    @Bean
    public AuthenticationManager authenticationManager(UserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
        // 基于用户详情的认证Provider
        DaoAuthenticationProvider daoAuthProvider = new DaoAuthenticationProvider();
        daoAuthProvider.setUserDetailsService(userDetailsService);
        daoAuthProvider.setPasswordEncoder(passwordEncoder);

        // 可添加多个Provider，比如OAuth2、LDAP等
        return new ProviderManager(daoAuthProvider);
    }
}

配合SecurityFilterChain使用 #

无论采用哪种方式获取AuthenticationManager，都需要同时配置SecurityFilterChain来定义请求的认证规则（替代原有的configure(HttpSecurity)方法）：

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.stereotype.Component;

@Component
public class SecurityFilterChainConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll() // 公开路径
                .anyRequest().authenticated() // 其他路径需认证
            )
            .formLogin(form -> form // 表单登录配置
                .loginPage("/login")
                .permitAll()
            )
            .logout(logout -> logout.permitAll());

        return http.build();
    }
}

关于AuthenticationManagerBuilder的注意事项 #

你之前尝试注入AuthenticationManagerBuilder报错，是因为在6.0版本中，AuthenticationManagerBuilder不再推荐直接注入使用。它通常是在SecurityFilterChain的配置lambda中，通过http.getSharedObject(AuthenticationManagerBuilder.class)来获取并配置，或者直接通过上述两种方式构建AuthenticationManagerBean，Spring会自动将其纳入安全上下文。

内容的提问来源于stack exchange，提问作者Toutatis_Gc