带有 WebFlux 用户禁用功能的 Spring Security 5.1.5 不起作用

Question

I am trying to implement a Web Application using Spring WebFlux Framework and MongoDB. Everything is working as expected, but even though the enabled property is set to false in the database, It's still allowing me to log in successfully. Which should not be the case. My Security Config is as below -

@Configuration
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class WebfluxSecurityConfig {

    @Autowired
    private Constants constants;
    @Autowired
    private UserRepository userRepo;

    @Bean
    public ReactiveUserDetailsService userDetailsService(UserRepository users) {
         return (username) -> users.findByUsername(username)
                    .map(u -> new UserAuth(u.getUserId()
                            , u.getUsername()
                            , u.getPassword()
                            , u.isEnabled()
                            , !u.isAccountExpired()
                            , !u.isCredentialsExpired()
                            , !u.isAccountLocked()
                            , UserAuth.getGrantedAuthorities(u.getRoles().toArray(new String[0]))
                            , StringUtils.isEmpty(u.getAuthSalt()) ? u.getUsername() : u.getAuthSalt()
                        )
                    );
    }

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain3(ServerHttpSecurity http) {
         http
          .authorizeExchange()
              .pathMatchers("/web/**").authenticated()
              .pathMatchers("/**").permitAll()
          .and().formLogin()
                .loginPage("/login")
          .and().logout()
                .logoutUrl("/logout");

         return http.build();
    }
}

User entry in mongodb is -

{
    "_id": "5d149e3b3c1206008cf56af9",
    "username": "admin",
    "password": "{noop}admin",
    "firstName": "Admin",
    "lastName": "1",
    "email": "admin@eightfolds.in",
    "enabled": false,
    "accountLocked": true,
    "roles": ["ADMIN"]
}

Can anyone please help me to understand what I am doing wrong.

Still not able to figure out.

Answer 1

Thank you for reporting this.
Your configuration has nothing wrong with it. The behaviour of checking whether a user account is disabled is not yet part of WebFlux.
I have created an issue on the spring-security GitHub repo to add this functionality.