Spring Security无WebSecurityConfigurerAdapter时配置两个AuthenticationProviders

替代WebSecurityConfigurerAdapter的配置方式，核心是通过自定义AuthenticationManager Bean结合SecurityFilterChain实现和原有逻辑一致的效果，具体代码如下：

@Configuration
public class SecurityConfig {

    private final AuthenticationProvider inMemoryAuthenticationProvider;
    private final AuthenticationProvider ldapAuthenticationProvider;
    private final UserDetailsService userDetailsService;

    // 通过构造器注入所需组件
    public SecurityConfig(AuthenticationProvider inMemoryAuthenticationProvider,
                          AuthenticationProvider ldapAuthenticationProvider,
                          UserDetailsService userDetailsService) {
        this.inMemoryAuthenticationProvider = inMemoryAuthenticationProvider;
        this.ldapAuthenticationProvider = ldapAuthenticationProvider;
        this.userDetailsService = userDetailsService;
    }

    // 自定义AuthenticationManager，对应原configure(AuthenticationManagerBuilder)逻辑
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        AuthenticationManagerBuilder authBuilder = authConfig.getAuthenticationManagerBuilder();
        // 添加两个自定义AuthenticationProvider
        authBuilder.authenticationProvider(inMemoryAuthenticationProvider);
        authBuilder.authenticationProvider(ldapAuthenticationProvider);
        // 指定UserDetailsService
        authBuilder.userDetailsService(userDetailsService);
        return authBuilder.build();
    }

    // 配置安全过滤链，可根据业务需求添加登录、授权等规则
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll()); // 示例：启用表单登录并允许所有人访问登录页
        return http.build();
    }
}

补充说明 #

• 如果你已经将inMemoryAuthenticationProvider、ldapAuthenticationProvider和userDetailsService注册为Spring Bean，Spring Security默认会自动识别并加入认证流程；但上述方式可以明确控制Provider的添加顺序，完全对齐原有configure(AuthenticationManagerBuilder)的配置逻辑。
• 若无需自定义认证顺序或额外配置，也可以直接将AuthenticationProvider作为Bean注入容器，Spring Security会自动将它们纳入AuthenticationManager的认证体系。

内容的提问来源于stack exchange，提问作者Simon Martinelli