Spring-security: AuthenticationSuccessEvent not published for oauth2Login()

[mbhave]

On running the OAuth2 Sample, there was no AuthenticationSuccessEvent since the ProviderManager seems to be using a NullEventPublisher.

[philwebb]

/cc @ismarslomic

[ismarslomic]

*FailureEvents are published though. So the issue is related to *SuccessEvents only

[jgrandja]

An AuthenticationManagerBuilder @Bean is registered via AuthenticationConfiguration.authenticationManagerBuilder(). It's also associated with the AuthenticationEventPublisher registered in the context using AuthenticationManagerBuilder.authenticationEventPublisher().

However, WebSecurityConfigurerAdapter.setApplicationContext() initializes 2 instances of AuthenticationManagerBuilder, but does not associate it with the AuthenticationEventPublisher registered in the context.

We need to ensure that the initialization and association of the AuthenticationEventPublisher (registered in the context) is consistent between AuthenticationConfiguration and WebSecurityConfigurerAdapter.

[ismarslomic]

@jgrandja thanks! I will gladly retest and report back, when you have a fix. Any idea on how complex and time consuming it will be? Just so I know if I should wait for a fix, or go ahead and use something else for Audit logging.

Edit: workarounds are also welcome :)

[jgrandja]

@ismarslomic The fix has been applied to master and backported to 5.1.2 and 5.0.10.

[ismarslomic]

After retest (with 5.1.2.BUILD-SNAPSHOT): I can confirm AuthenticationSuccessEvents er being published, and I can also find AUTHENTICATION_SUCCESS events at Actuator endpoint /auditevents. Thanks a lot for quick fix!