Regarding <https://github.com/spring-projects/spri...

# spring

[Jonas Bark]

Regarding https://github.com/spring-projects/spring-fu/issues/16: We're trying to use the spring-security module but as we're using the functional approach using spring-fu there's no way to use @EnableWebFluxSecurity annotation.
Is that correct? Is there a way support both, functional and annotation based processing?
The functional approach worked great so far so it would be a real bummer if there's no way to make it work right now.

[sdeleuze]

Currently there is no way out of the box

[sdeleuze]

It is technically possible if using an annotation aware appContext I think

[sdeleuze]

What feature of Spring Security do you need ?

[Jonas Bark]

that would be oauth2

[sdeleuze]

I am deep in Coroutines support no no time for me to implement it right now, but if you want to dig into it, I can give you some hints to enable int manually. Also if you want using this hints contribute a first part of the DSL, feel free to do so via a PR.

[sdeleuze]

So I you have a look to https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/web/reactive/EnableWebFluxSecurity.java

[sdeleuze]

You will see it just imports ServerHttpSecurityConfiguration, WebFluxSecurityConfiguration.class and
ReactiveOAuth2ClientImportSelector

[sdeleuze]

So what could be probably done

[sdeleuze]

Is using functional bean registration to register beans using these classes like I do in https://github.com/spring-projects/spring-fu/blob/master/autoconfigure-adapter/src/main/java/org/springframework/boot/autoconfigure/mustache/MustacheInitializer.java for example

[sdeleuze]

You should register one bean per @Bean

[sdeleuze]

If you want to do it in a nice way

[sdeleuze]

Create a security-adapter similar to autoconfigure-adapter to implement this logic.

[sdeleuze]

Then add DSLs is Jafu/Kofu

[sdeleuze]

Yiu can also do tat quick and dirty directly in your app if you don't have the time to contribute

[sdeleuze]

But external contribution for that would be awesome 😉

[sdeleuze]

On Kofu DSL side the idea is to express Spring Security DSL in a more Kotlin DSL way

[Jonas Bark]

alright, sounds like a project for this weekend, thanks for the information!
Could you also give me one or two hints regarding your "annotation aware appContext"?

[sdeleuze]

Awesome 🙂 I don't think you need "annotation aware appContext" if you do it that way, or if you do let me know that could be a bug on Security side.

[Jonas Bark]

got it. I'll report back when I made some progress 🙂

[sdeleuze]

Let me just check something, we can maybe use Boot Security integration there

[sdeleuze]

Boot mostly delegates Spring Security via https://github.com/spring-projects/spring-boot/blob/master/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/reactive/ReactiveSecurityAutoConfiguration.java and SecurityProperties does not bring much added value so the way I suggested looks like ok.

I you follow what I did in autoconfigure-adapter as a pattern that should work IMO.

[sdeleuze]

Thanks a lot for at least trying, I really appreciate.

[Jonas Bark]

soooo... looking at
https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfiguration.java
how would I handle the autowired fields? I haven't been able to find a similar case in spring-fu

[sdeleuze]

Good question, seems not straightforward, I am going to ask to Spring Security team.

[sdeleuze]

I have raised https://github.com/spring-projects/spring-security/issues/6624

[Jonas Bark]

Thanks!

[sdeleuze]

@Jonas Bark The issue has been fixed on Spring Security master, see https://github.com/spring-projects/spring-security/commit/5aacd0c9550e87360fde3ddd71f02c6d0029ff4f. Are you still interesting to work on the security { } DSL?

[Jonas Bark]

I saw it, I'll try it soon 🙂 and yes, I'm still interested but I'm unsure about when I find the time for it
are you at the Spring I/O conference in two weeks?

[sdeleuze]

Yes, I will

[Jonas Bark]

I started work here: https://github.com/feilfeilundfeil/spring-fu/tree/spring-security
it already works as a POC - I'll try to think of what configurations we can expose to the Kotlin DSL

[Jonas Bark]

we can have a small discussion at Spring I/O to push this forward 👍

[sdeleuze]

Joe Grandja from Spring Security will be there as well

[sdeleuze]

On DSL side, feel free to expose an idiomatic Kotlin DSL. I think the Java DSL had to take some shortcut because it was design before lambdas

[sdeleuze]

If you face issues mapping both please let me know

[Jonas Bark]

alright, will do!

[sdeleuze]

Thanks a lot for you contribution, that's a really key topic to move forward.