diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfiguration.java index 1bff8f5dcb3..8a4d6f46b62 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfiguration.java @@ -255,7 +255,9 @@ private ReactiveAuthenticationManager authenticationManager() { if (this.passwordEncoder != null) { manager.setPasswordEncoder(this.passwordEncoder); } - manager.setUserDetailsPasswordService(this.userDetailsPasswordService); + if (this.userDetailsPasswordService != null) { + manager.setUserDetailsPasswordService(this.userDetailsPasswordService); + } manager.setCompromisedPasswordChecker(this.compromisedPasswordChecker); return this.postProcessor.postProcess(manager); } diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfigurationTests.java index b68736ced46..9cce78f2514 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfigurationTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfigurationTests.java @@ -107,7 +107,7 @@ void setup(ApplicationContext context) { } @Test - public void loadConfigWhenReactiveUserDetailsServiceConfiguredThenServerHttpSecurityExists() { + public void loadConfigWhenReactiveUserDetailsAndPasswordServiceConfiguredThenServerHttpSecurityExists() { this.spring .register(ServerHttpSecurityConfiguration.class, ReactiveAuthenticationTestConfiguration.class, WebFluxSecurityConfiguration.class) @@ -116,6 +116,16 @@ public void loadConfigWhenReactiveUserDetailsServiceConfiguredThenServerHttpSecu assertThat(serverHttpSecurity).isNotNull(); } + @Test + public void loadConfigWhenOnlyReactiveUserDetailsServiceConfiguredThenServerHttpSecurityExists() { + this.spring + .register(ServerHttpSecurityConfiguration.class, ReactiveUserDetailsServiceOnlyTestConfiguration.class, + WebFluxSecurityConfiguration.class) + .autowire(); + ServerHttpSecurity serverHttpSecurity = this.spring.getContext().getBean(ServerHttpSecurity.class); + assertThat(serverHttpSecurity).isNotNull(); + } + @Test public void loadConfigWhenProxyingEnabledAndSubclassThenServerHttpSecurityExists() { this.spring @@ -581,4 +591,14 @@ static Customizer httpSecurityCustomizer0() { } + @Configuration + static class ReactiveUserDetailsServiceOnlyTestConfiguration { + + @Bean + static ReactiveUserDetailsService userDetailsService() { + return (username) -> Mono.just(PasswordEncodedUser.user()); + } + + } + }