WebSecurityConfigurerAdapter ClassNotFoundException after upgrade to 1.2.0

[ikolomiets]

My Spring boot application is very simple restful web app. After upgrade to 1.2.0.RELEASE it fails to start (mvn spring-boot:run):

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'handlerMapping' defined in org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.web.servlet.HandlerMapping]: Factory method 'handlerMapping' threw exception; nested exception is java.lang.NoClassDefFoundError: org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:602) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:762) [spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757) [spring-context-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480) [spring-context-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:109) [spring-boot-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcAutoConfiguration.createChildManagementContext(EndpointWebMvcAutoConfiguration.java:216) [spring-boot-actuator-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcAutoConfiguration.afterSingletonsInstantiated(EndpointWebMvcAutoConfiguration.java:140) [spring-boot-actuator-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:782) [spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757) [spring-context-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480) [spring-context-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:109) [spring-boot-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:691) [spring-boot-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:321) [spring-boot-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:961) [spring-boot-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:950) [spring-boot-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at com.ps.sb.restfulrepo.Application.main(Application.java:14) [classes/:na]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.7.0_72]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) ~[na:1.7.0_72]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.7.0_72]
    at java.lang.reflect.Method.invoke(Method.java:606) ~[na:1.7.0_72]
    at org.springframework.boot.maven.RunMojo$LaunchRunner.run(RunMojo.java:408) [spring-boot-maven-plugin-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at java.lang.Thread.run(Thread.java:745) [na:1.7.0_72]
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.web.servlet.HandlerMapping]: Factory method 'handlerMapping' threw exception; nested exception is java.lang.NoClassDefFoundError: org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:591) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    ... 29 common frames omitted
Caused by: java.lang.NoClassDefFoundError: org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter
    at java.lang.ClassLoader.defineClass1(Native Method) ~[na:1.7.0_72]
    at java.lang.ClassLoader.defineClass(ClassLoader.java:800) ~[na:1.7.0_72]
    at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142) ~[na:1.7.0_72]
    at java.net.URLClassLoader.defineClass(URLClassLoader.java:449) ~[na:1.7.0_72]
    at java.net.URLClassLoader.access$100(URLClassLoader.java:71) ~[na:1.7.0_72]
    at java.net.URLClassLoader$1.run(URLClassLoader.java:361) ~[na:1.7.0_72]
    at java.net.URLClassLoader$1.run(URLClassLoader.java:355) ~[na:1.7.0_72]
    at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_72]
    at java.net.URLClassLoader.findClass(URLClassLoader.java:354) ~[na:1.7.0_72]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:425) ~[na:1.7.0_72]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:358) ~[na:1.7.0_72]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration.injectIntoSecurityFilter(EndpointWebMvcChildContextConfiguration.java:157) ~[spring-boot-actuator-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration.handlerMapping(EndpointWebMvcChildContextConfiguration.java:144) ~[spring-boot-actuator-1.2.0.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration$$EnhancerBySpringCGLIB$$96c02f4a.CGLIB$handlerMapping$1(<generated>) ~[spring-core-4.1.3.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration$$EnhancerBySpringCGLIB$$96c02f4a$$FastClassBySpringCGLIB$$486f9427.invoke(<generated>) ~[spring-core-4.1.3.RELEASE.jar:1.2.0.RELEASE]
    at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228) ~[spring-core-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:309) ~[spring-context-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration$$EnhancerBySpringCGLIB$$96c02f4a.handlerMapping(<generated>) ~[spring-core-4.1.3.RELEASE.jar:1.2.0.RELEASE]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.7.0_72]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) ~[na:1.7.0_72]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.7.0_72]
    at java.lang.reflect.Method.invoke(Method.java:606) ~[na:1.7.0_72]
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162) ~[spring-beans-4.1.3.RELEASE.jar:4.1.3.RELEASE]
    ... 30 common frames omitted
Caused by: java.lang.ClassNotFoundException: org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
    at java.net.URLClassLoader$1.run(URLClassLoader.java:366) ~[na:1.7.0_72]
    at java.net.URLClassLoader$1.run(URLClassLoader.java:355) ~[na:1.7.0_72]
    at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_72]
    at java.net.URLClassLoader.findClass(URLClassLoader.java:354) ~[na:1.7.0_72]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:425) ~[na:1.7.0_72]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:358) ~[na:1.7.0_72]
    ... 53 common frames omitted

What would be quick fix to pom.xml to inlcude proper dependency? Thank you!

[tleveque23]

Same problem here. Is there a workaround?

[ikolomiets]

I figured why Spring Boot 1.2.0 now requests Spring Security - my application.properties had setting for "management.port" and "management.address" that caused Actuator(?) to enable management endpoints which are secured by default in 1.2.0.

[ikolomiets]

@tleveque23 To satisfy dependency on Spring Security simply add

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

But be prepared that this can make protected (that is require authentication) previously unprotected web endpoints.

[tleveque23]

And if you put:

security.basic.enabled=false
management.security.enabled=false

in your properties file, it works has before.
But I still think it is a bug. Or at least it is a bug in the release note! Because there is nothing about that in it.

[snicoll]

injectIntoSecurityFilter in EndpointWebMvcChildContextConfiguration assumes that Spring Security is in the classpath (3c1e48c)