So most of the answers to this question recommend either:
- excluding some auto-configuration
- setting up a user and/or password
However excluding auto-configuration is hardly ever the answer. And if your application does not have any users the second solution is not great either.
Instead we should work with Spring Boot.
The log message is generated by UserDetailsServiceAutoConfiguration
to let us know Spring Boot put in a sensible default. And looking at the source and documentation for UserDetailsServiceAutoConfiguration
we see:
/**
* {@link EnableAutoConfiguration Auto-configuration} for a Spring Security in-memory
* {@link AuthenticationManager}. Adds an {@link InMemoryUserDetailsManager} with a
* default user and generated password. This can be disabled by providing a bean of type
* {@link AuthenticationManager}, {@link AuthenticationProvider} or
* {@link UserDetailsService}.
*
* @author Dave Syer
* @author Rob Winch
* @author Madhura Bhave
* @since 2.0.0
*/
@Configuration(proxyBeanMethods = false)
@ConditionalOnClass(AuthenticationManager.class)
@ConditionalOnBean(ObjectPostProcessor.class)
@ConditionalOnMissingBean(
value = { AuthenticationManager.class, AuthenticationProvider.class, UserDetailsService.class,
AuthenticationManagerResolver.class },
type = { "org.springframework.security.oauth2.jwt.JwtDecoder",
"org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector",
"org.springframework.security.oauth2.client.registration.ClientRegistrationRepository" })
public class UserDetailsServiceAutoConfiguration {
We can see that the UserDetailsServiceAutoConfiguration
is disabled when any of these beans are provided: AuthenticationManager
, AuthenticationProvider
, UserDetailsService
, or AuthenticationManagerResolver
.
This means that when tell Spring Boot how we want to authenticate our users, Spring Boot will not auto-configure a sensible default. Since we don't want to authenticate any users we can provide:
@Configuration
public class ApplicationConfiguration {
@Bean
public AuthenticationManager noopAuthenticationManager() {
return authentication -> {
throw new AuthenticationServiceException("Authentication is disabled");
};
}
}