Cfrgtkky

I'm working on a Spring Boot application that uses OAuth2 to realize SSO.
Right now I'm using the @ConditionalOnProperty annotation on my security configuration to disable OAuth2 when needed:

@Configuration

@ConditionalOnProperty("some.property")

@Order(SecurityProperties.BASIC_AUTH_ORDER-3)

@EnableOAuth2Sso

public class SecurityConfigurationOAuth2 extends WebSecurityConfigurerAdapter {

I also have a second security configuration that is beeing used when OAuth is disabled:

@Configuration

@Order(SecurityProperties.BASIC_AUTH_ORDER-2)

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

So far this is working but I don't like having two almost identical configurations. The only thing that needs to be disabled/enabled by a property is the @EnableOAuth2Sso annotation.


Is there another way to achieve this?

If it really is only the @EnableOAuth2Sso annotation that has to be enabled/disabled, is there any reason you can't just create another configuration which only has that annotation plus a @ConditionalOnProperty or @Profile?

Although not tested, you may be able to have a nested configuration class that is strictly meant for the conditional annotation like this:

@Configuration

@Order(SecurityProperties.BASIC_AUTH_ORDER-3)

public class SecurityConfigurationOAuth2 extends WebSecurityConfigurerAdapter {

  @Configuration

  @ConditionalOnProperty("some.property")  // Or use a profile

  @EnableOAuth2Sso

  static class EnableSSOConfig {

  }

  ....

}