WildFly deployment with Spring Security generates WARNING on startup

[vpavic]

I've ran into this upgrading from RC1 to RC2. It is basically the issue to one reported in #11891, which wasn't fully fixed.

The cause is presumably the same as import of WebFluxSecurityConfiguration in ReactiveSecurityAutoConfiguration isn't guarded by a condition, and in turn import of ServerHttpSecurityConfiguration (which implements WebFluxConfigurer) as well.

11:46:30,994 WARN  [org.jboss.modules] (ServerService Thread Pool -- 65) Failed to define class org.springframework.security.config.annotation.web.reactive.ServerHttpSecurityConfiguration in Module "deployment.kaas.war:main" from Service Module Loader: java.lang.NoClassDefFoundError: Failed to link org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfiguration (Module "deployment.kaas.war:main" from Service Module Loader): org/springframework/web/reactive/config/WebFluxConfigurer
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
	at org.jboss.modules.ModuleClassLoader.defineClass(ModuleClassLoader.java:446)
	at org.jboss.modules.ModuleClassLoader.loadClassLocal(ModuleClassLoader.java:274)
	at org.jboss.modules.ModuleClassLoader$1.loadClassLocal(ModuleClassLoader.java:78)
	at org.jboss.modules.Module.loadModuleClass(Module.java:606)
	at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:190)
	at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:363)
	at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:351)
	at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:93)
	at java.lang.Class.forName0(Native Method)
	at java.lang.Class.forName(Class.java:348)
	at sun.reflect.generics.factory.CoreReflectionFactory.makeNamedType(CoreReflectionFactory.java:114)
	at sun.reflect.generics.visitor.Reifier.visitClassTypeSignature(Reifier.java:125)
	at sun.reflect.generics.tree.ClassTypeSignature.accept(ClassTypeSignature.java:49)
	at sun.reflect.annotation.AnnotationParser.parseSig(AnnotationParser.java:439)
	at sun.reflect.annotation.AnnotationParser.parseClassValue(AnnotationParser.java:420)
	at sun.reflect.annotation.AnnotationParser.parseClassArray(AnnotationParser.java:724)
	at sun.reflect.annotation.AnnotationParser.parseArray(AnnotationParser.java:531)
	at sun.reflect.annotation.AnnotationParser.parseMemberValue(AnnotationParser.java:355)
	at sun.reflect.annotation.AnnotationParser.parseAnnotation2(AnnotationParser.java:286)
	at sun.reflect.annotation.AnnotationParser.parseAnnotations2(AnnotationParser.java:120)
	at sun.reflect.annotation.AnnotationParser.parseAnnotations(AnnotationParser.java:72)
	at java.lang.Class.createAnnotationData(Class.java:3521)
	at java.lang.Class.annotationData(Class.java:3510)
	at java.lang.Class.getAnnotations(Class.java:3446)
	at org.springframework.core.annotation.AnnotationUtils.getAnnotations(AnnotationUtils.java:237)
	at org.springframework.core.type.classreading.AnnotationAttributesReadingVisitor.visitEnd(AnnotationAttributesReadingVisitor.java:77)
	at org.springframework.asm.ClassReader.readAnnotationValues(ClassReader.java:2020)
	at org.springframework.asm.ClassReader.accept(ClassReader.java:676)
	at org.springframework.asm.ClassReader.accept(ClassReader.java:527)
	at org.springframework.core.type.classreading.SimpleMetadataReader.<init>(SimpleMetadataReader.java:65)
	at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:103)
	at org.springframework.boot.type.classreading.ConcurrentReferenceCachingMetadataReaderFactory.createMetadataReader(ConcurrentReferenceCachingMetadataReaderFactory.java:88)
	at org.springframework.boot.type.classreading.ConcurrentReferenceCachingMetadataReaderFactory.getMetadataReader(ConcurrentReferenceCachingMetadataReaderFactory.java:75)
	at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:81)
	at org.springframework.context.annotation.ConfigurationClassParser.asSourceClass(ConfigurationClassParser.java:699)
	at org.springframework.context.annotation.ConfigurationClassParser$SourceClass.getRelated(ConfigurationClassParser.java:929)
	at org.springframework.context.annotation.ConfigurationClassParser$SourceClass.getAnnotationAttributes(ConfigurationClassParser.java:910)
	at org.springframework.context.annotation.ConfigurationClassParser.collectImports(ConfigurationClassParser.java:532)
	at org.springframework.context.annotation.ConfigurationClassParser.getImports(ConfigurationClassParser.java:505)
	at org.springframework.context.annotation.ConfigurationClassParser.doProcessConfigurationClass(ConfigurationClassParser.java:296)
	at org.springframework.context.annotation.ConfigurationClassParser.processConfigurationClass(ConfigurationClassParser.java:241)
	at org.springframework.context.annotation.ConfigurationClassParser.processImports(ConfigurationClassParser.java:606)
	at org.springframework.context.annotation.ConfigurationClassParser.processDeferredImportSelectors(ConfigurationClassParser.java:548)
	at org.springframework.context.annotation.ConfigurationClassParser.parse(ConfigurationClassParser.java:184)
	at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:316)
	at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:233)
	at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanDefinitionRegistryPostProcessors(PostProcessorRegistrationDelegate.java:273)
	at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:93)
	at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:693)
	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:531)
	at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:140)
	at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:752)
	at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:388)
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:327)
	at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.run(SpringBootServletInitializer.java:155)
	at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.createRootApplicationContext(SpringBootServletInitializer.java:135)
	at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.onStartup(SpringBootServletInitializer.java:87)
	at org.springframework.web.SpringServletContainerInitializer.onStartup(SpringServletContainerInitializer.java:172)
	at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:186)
	at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:171)
	at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
	at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
	at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
	at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
	at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
	at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
	at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
	at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)
	at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:234)
	at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
	at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at java.lang.Thread.run(Thread.java:748)
	at org.jboss.threads.JBossThread.run(JBossThread.java:320)

[wilkinsona]

This is a different problem to #11891. In #11891, the warning was being logged during condition evaluation. In this issue, the warning is being logged during configuration class processing (after condition evaluation, I think).

While the import of WebFluxSecurityConfiguration isn't protected by a condition, WebFluxSecurityConfiguration itself is conditional. It's conditional on being a reactive web application so I'd expect it to have been skipped.

As things stand, I'm not exactly sure what's going on.

[vpavic]

I've just tested the snapshots, and can confirm that the log warning is gone. Thanks.

[wilkinsona]

Thank you

[hohwille]

I am still getting exactly this stacktrace in JBoss EAP 7.1 with spring-boot 2.0.9.RELEASE and spring-security-config-5.0.12.RELEASE.
Could someone explain how this can happen if this issue claims to have this fixed since version 2.0.0 of spring-boot? Also how could spring-boot fix this if org.springframework.security.config.annotation.web.reactive.ServerHttpSecurityConfiguration comes from spring-security and implements org.springframework.web.reactive.config.WebFluxConfigurer that is missing as dependency forcing this error?
How can I workaround this error as such stacktrace can not be accepted as normal behaviour for an application? As these config classes are not public, I can not exclude them in my spring boot application to disable the auto-config.
However, when I add dependency to web reactive to get away the error, the behaviour of spring-boot changes and that is causing another bug giving me the error "CSRF Token has been associated to this client" on REST communication - see e.g.:
https://stackoverflow.com/questions/54408961/disable-authentication-and-csrf-for-a-given-path-in-spring-weblux
raphaelDL/spring-webflux-security-jwt#8
hantsy/spring-reactive-sample#7

Should I file another bug in spring-security?

[wilkinsona]

Could someone explain how this can happen if this issue claims to have this fixed since version 2.0.0 of spring-boot?

We may have accidentally introduced a regression or you may be experiencing a subtly different problem.

Also how could spring-boot fix this

The problem was with how Spring Boot was referencing Spring Security classes, not with Spring Security itself.

How can I workaround this error

Without knowing exactly what problem you are experiencing, we can't suggest a workaround. If the problem's similar to the one fixed in this issue, there may not be one unfortunately.

Should I file another bug in spring-security?

A new Spring Boot issue would be better. Please open one, providing a small sample that reproduces the failure and we can investigate.

[hohwille]

So I did the full analysis:
The reason was that during bootstrapping JBoss is loading all classes of all JARs. This lets it hit ServerHttpSecurityConfiguration what used to implement WebFluxConfigurer that comes from an optional dependency. Therefore loading the class ServerHttpSecurityConfiguration caused the NoClassDefFoundError obviously.

As the problem has already been fixed in spring-security-config, I just point to the fix:
spring-projects/spring-security@06d3b60#diff-ab2365d562d8d29cc81ea146e08041e3
So I assume I have to do several updates of spring-boot and spring-security to get away from the error.

[hohwille]

I can confirm the error goes away with these dependency versions:

    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>5.2.1.RELEASE</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>5.2.1.RELEASE</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
      <version>5.2.1.RELEASE</version>
    </dependency>