Spring Cloud Data Flow 1.3.0.M2 released

Releases | Glenn Renfro | September 18, 2017 | ...

We are pleased to announce the 1.3.0. M2 release of the Spring Cloud Data Flow and its associated ecosystem of projects.

Local Server: Getting Started Guide.

Dashboard / Flo

In this second installment of 1.3 release of Dashboard/Flo, we have addressed the core functionalities backing the streaming and task/batch operations.

Continuing the Angular4 based infrastructure upgrades, the streaming and task/batch workflows now include the modern look and feel and are packed with usability improvements as well.

Documentation, test-coverage, and webpack bundle-analyzer have gone through significant…

Announcing First Release Candidate of Reactor Core 3.1

Releases | Simon Baslé | September 18, 2017 | ...

On behalf of the Reactor team, it is my pleasure to announce that reactor-core 3.1.0.RC1 has been released ?. This is a big last step towards GA release of 3.1 at the end of the month, the long term support version that will back Spring 5!

It is also complemented by various releases, all tied together in the Bismuth-M4 Release Train and BOM:

  • reactor-test, reactor-extra, reactor-adapter and reactor-logback all made the cut to 3.1.0.RC1
  • reactor-netty has seen significant updates and bug fixes in the new 0.7.0.M2 milestone
  • reactor-kafka has been released in its 1.0.0.M4 milestone

In order to get this release, the best way is to use the BOM, as described in the reference guide here. Make sure to read the part about milestones (transposing it to Bismuth-M4

Introducing Spring Shell 2.0M1!

Releases | Eric Bottard | September 18, 2017 | ...

We are pleased to announce the first release milestone of Spring Shell 2.x!

Two years in the making, Spring Shell 2 is a complete rewrite of Spring Shell, leveraging newer components (such as JLine 3) and applying better modularization. Spring Shell 2 is also built with Spring Boot in mind, making use of auto configuration and other boot features.

The internal architecture now uses a pluggable model to discover what methods to turn into commands, how to parse user input into argument values and how to handle return values. This is very similar to the approach taken by Spring MVC for example and allows extensions of the framework in ways that were not previously possible. Users of Spring Shell would typically not care though, only dealing with the new "standard" command API

Spring Session MongoDB 2.0.0.M3 released

Engineering | Greg L. Turnquist | September 15, 2017 | ...

Dear Spring Community,

Spring Session MongoDB 2.0.0.M3 is released. It is based on:

In this release, several new features have been added to simplify using it with your Spring WebFlux application.

public class SpringWebFluxConfig {


All you must do is apply the @EnableMongoWebSession to any of your Spring configuration classes to activate session support with MongoDB. Additionally, you must provide a ReactorMongoOperations Spring bean, but if you’re using Spring Boot’s spring-boot-starter-data-mongodb-reactive

Spring Security 5.0.0 M4 Released

Releases | Rob Winch | September 15, 2017 | ...

On behalf of the community, I’m pleased to announce the release of Spring Security 5.0.0 M4. This release includes bug fixes, new features, and is based off of Spring Framework 5.0.0 RC4. You can find complete details in the changelog. The highlights of the release include:

OAuth2 / OIDC

OAuth2 Login Java Config

There are a number of improvements to the HttpSecurity.oauth2Login() DSL.

You can now configure the Token Endpoint with a custom implementation of an AuthorizationGrantTokenExchanger or SecurityTokenRepository<AccessToken>, as follows:

protected void configure(HttpSecurity http) throws Exception {

We’ve also added the capability of customizing the request paths for the Authorization Endpoint and Redirection Endpoint:

protected void configure(HttpSecurity http) throws Exception {
        .requestMatcher(new AntPathRequestMatcher("/custom-path/{clientAlias}"))
        .requestMatcher(new AntPathRequestMatcher("/custom-path/callback/{clientAlias}"));

As with all AbstractAuthenticationProcessingFilter 's in Spring Security, you can also set a custom AuthenticationSuccessHandler and AuthenticationFailureHandler:

protected void configure(HttpSecurity http) throws Exception {

Security Token Repository

We’ve introduced the SecurityTokenRepository<T extends SecurityToken> abstraction, which is responsible for the persistence of SecurityToken 's.

The initial implementation InMemoryAccessTokenRepository provides the persistence of AccessToken 's. In an upcoming release we’ll also provide an implementation that supports the persistence of Refresh Token’s.

ID Token and Claims

A couple of minor improvements were introduced to the IdToken along with some final implementation details for JwtClaimAccessor, StandardClaimAccessor and IdTokenClaimAccessor, which provide convenient access to claims in their associated constructs, for example, Jwt, IdToken, UserInfo.

Authorization Request Improvements

We’ve added the capability for an AuthorizationRequestRepository to persist the Authorization Request to a Cookie. The current default implementation persists in the HttpSession, however, a custom implementation may be provided to persist to a Cookie instead.

Support was also added for URI variables configured in the redirect-uri for the AuthorizationCodeRequestRedirectFilter.

OAuth2 Client Properties

There were a couple of minor updates to the properties for configuring an OAuth 2.0 Client. The configuration below outlines the current structure. You will notice that there is support for configuring multiple clients, for example, google, github, okta, etc.

        client-id: your-app-client-id
        client-secret: your-app-client-secret
        client-authentication-method: basic
        authorization-grant-type: authorization_code
        redirect-uri: "{scheme}://{serverName}:{serverPort}{contextPath}/oauth2/authorize/code/{clientAlias}"
        scope: openid, profile, email, address, phone
        authorization-uri: "https://accounts.google.com/o/oauth2/v2/auth"
        token-uri: "https://www.googleapis.com/oauth2/v4/token"
        user-info-uri: "https://www.googleapis.com/oauth2/v3/userinfo"
        user-name-attribute-name: "sub"
        jwk-set-uri: "https://www.googleapis.com/oauth2/v3/certs"
        client-name: Google
        client-alias: google

A complete example for using the new Spring Security OAuth 2.0 / OpenID Connect 1.0 login feature can be found in the Spring Security samples at oauth2login. The guide will walk you through the steps for setting up the sample application for OAuth 2.0 login using an external OAuth 2.0 or OpenID Connect 1.0 Provider.

Reactive Security

Reactive Method Security

Spring Security’s Reactive support now includes method security by leveraging Reactor’s Context. The highlights are below, but you can find a complete example of it in action in samples/javaconfig/hellowebflux-method

The first step is to use @EnableReactiveMethodSecurity to enable support for @PreAuthorize and @PostAuthorize annotations. This step ensures that the objects are properly proxied.

public class SecurityConfig {

The next step is to create a service that is annotated with @PreAuthorize or @PostAuthorize. For example:

public Mono<String> findMessage() {

Spring Security’s WebFlux support will then ensure that the Reactor Context will be populated with the current user which is used to determine if access is granted or denied.

Spring Security’s standard @WithMockUser and related annotations has been updated to work with Reactive Method Security. For example:

// ...
public class HelloWorldMessageServiceTests {
  HelloWorldMessageService messages;

@Test public void messagesWhenNotAuthenticatedThenDenied() { StepVerifier.create(this.messages.findMessage()) .expectError(AccessDeniedException.class) .verify(); }

@Test @WithMockUser public void messagesWhenUserThenDenied() { StepVerifier.create(this.messages.findMessage()) .expectError(AccessDeniedException.class) .verify(); }

@Test @WithMockUser(roles = "ADMIN") public void messagesWhenAdminThenOk() { StepVerifier.create(this.messages.findMessage()) .expectNext("Hello World!") .verifyComplete(); } }

The test support also works nicely with TestWebClient. For example:

// ...
public class HelloWebfluxMethodApplicationTests {
  ApplicationContext context;

WebTestClient rest;

@Before public void setup() { this.rest…

Spring Session 2.0.0 M4

Releases | Rob Winch | September 15, 2017 | ...

On behalf of the community I’m pleased to announce the release of Spring Session 2.0.0.M4. This release is focused primarily on refining WebFlux support. The highlights are:

Simplified WebFlux Configuration

Configuring Spring Session for WebFlux is simplified to be:

public class HelloWebfluxSessionConfig {

  public MapReactorSessionRepository reactorSessionRepository() {
    return new MapReactorSessionRepository(new ConcurrentHashMap<>());

You can also switch the strategy for resolving session id’s by simply adding a WebSessionIdResolver Bean. For example, to switch from using cookies to resolve the session id to using headers, you can use Spring Framework’s new HeaderWebSessionIdResolver

Spring Boot 2.0.0 M4 Available Now

Releases | Stéphane Nicoll | September 15, 2017 | ...

Hot on the heels of the latest Spring Framework 5 release candidate, Spring Boot 2.0 M4 is now available from our milestone repository. This release closes 150 issues and pull requests and is a major step towards 2.0 GA. Thanks to all that contributed!

This milestone provides a host of minor tweaks and enhancements along with three major changes:

For a complete list of changes, and upgrade instructions, see the Spring Boot 2.0.0.M4 Release Notes on the WIKI. We are a bit behind with regards to updating the reference documentation, so please consider using the snapshot version

Security changes in Spring Boot 2.0 M4

Engineering | Madhura Bhave | September 15, 2017 | ...

Milestone 4 of Spring Boot 2.0 brings important changes to the security auto-configuration provided by Spring Boot.

Problem Statement

Until Spring Boot 1.x, the default auto-configuration secured all of the application endpoints using basic authentication. If actuator was on the classpath, there was a separate security configuration that applied to the actuator endpoints. The way these two auto-configurations would turn on and off was completely independent. Because of this, users wanting to provide custom security found themselves fighting ordering issues with WebSecurityConfigurerAdapters.

Additionally, for actuator endpoints, the effects of the management.security.enabled

Spring Cloud Stream Ditmars/1.3 Release Candidate Announcement

Releases | Gary Russell | September 14, 2017 | ...

We are pleased to announce that the release candidate Spring Cloud Stream Ditmars.RC1 is available for use in the Spring Milestone repository. The release notes include relevant information about version compatibility with Spring Boot, Spring Cloud, Spring AMQP, and Spring for Apache Kafka.

Kafka Streams for Apache Kafka

This release targets the promotion of Kafka Streams for Apache Kafka support as a top-level project in the Apache Kafka binder implementation. With Kafka Streams for Apache Kafka positioned as a first-class citizen, developers can now build Spring Cloud Stream applications by…

Get the Spring newsletter

Thank you!

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all