Is @Autowired required on configureGlobal(..) when using @EnableWebSecurity?

Question

In this example there is an @Autowired annotation on the configureGlobal method:

    @EnableWebSecurity
    public class MultiHttpSecurityConfig {
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) {
          auth
              .inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER").and()
                  .withUser("admin").password("password").roles("USER", "ADMIN");
      }

Is that necessary or does Spring automatically inject the AuthenticationBuilder on methods annotated with @EnableWebSecurity??

The code snippet is pulled from when-to-use-spring-securitys-antmatcher

score 2 · Accepted Answer · edited Aug 21 '17 at 03:29

According to Spring documentation @EnableWebSecurity is an annotation that only switches off the default web application security configuration in order to let you add some custom features like the configureGlobal.

configureGlobal should be @Autowired in order to get the AuthenticationManagerBuilder bean and define the authentication type for the application.

In conclusion @EnableWebSecurity doesn't inject beans, it only provides a way to customize the web security application.

@EnableWebSecurity

Is @Autowired required on configureGlobal(..) when using @EnableWebSecurity?

1 Answers1