Spring Boot 2.7.4中WebSecurityConfigurerAdapter弃用后authenticationManagerBean的替代方案

在Spring Boot 2.7+版本中，WebSecurityConfigurerAdapter被弃用后，要替代authenticationManagerBean()方法暴露AuthenticationManager为Spring Bean，可通过以下两种方式实现：

方式一：通过AuthenticationConfiguration获取并注册Bean #

直接注入AuthenticationConfiguration，调用其getAuthenticationManager()方法获取实例并注册为Bean，适用于无需自定义认证逻辑的场景：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        // 配置HttpSecurity规则，如授权、登录方式等
        http.authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll());
        return http.build();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }
}

方式二：通过AuthenticationManagerBuilder自定义构建 #

如果需要自定义用户认证逻辑（比如指定自定义UserDetailsService、密码编码器），可通过AuthenticationManagerBuilder构建AuthenticationManager并注册：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final UserDetailsService userDetailsService;
    private final PasswordEncoder passwordEncoder;

    public SecurityConfig(UserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
        this.userDetailsService = userDetailsService;
        this.passwordEncoder = passwordEncoder;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        // 配置HttpSecurity规则
        http.authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll());
        return http.build();
    }

    @Bean
    public AuthenticationManager authenticationManager(HttpSecurity http) throws Exception {
        AuthenticationManagerBuilder authBuilder = http.getSharedObject(AuthenticationManagerBuilder.class);
        authBuilder.userDetailsService(userDetailsService)
                   .passwordEncoder(passwordEncoder);
        return authBuilder.build();
    }
}

以上两种方式都能实现原authenticationManagerBean()的核心功能——将AuthenticationManager暴露为Spring Bean，供其他组件注入使用，同时契合Spring Security当前推荐的基于组件的配置模式。

内容的提问来源于stack exchange，提问作者Anas Elgarhy