Describe the bug After making the changes described in Spring Security without the WebSecurityConfigurerAdapter, specifically replacing the configuration class that extends WebSecurityConfigurerAdapter with a configuration class that declares a bean of type SecurityFilterChain, classes annotated with @WebMvcTest no longer auto-configure Spring Security.

As a temporary fix I've included @ImportAutoConfiguration(classes = SecurityConfig.class) pointing to the SecurityConfig.class that contains the SecurityFilterChain bean declaration

To Reproduce 1. Configure Spring Security with a SecurityFilterChain bean using an oauth2 provider 2. Configure the HttpSecurity to set the default AuthenticationEntryPoint to alway return a 401 (instead of the default redirect to the form login page) with .defaultAuthenticationEntryPointFor(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED), AnyRequestMatcher.INSTANCE)) 3. Write a @WebMvcTest test class to test the error response of an unauthenticated request to a secured endpoint 4. Observer that the response is a 302 and not the expected 401 (since the request was redirected to the form login page) 5. Run the application and test the same endpoint - observe that the response is 401 6. Further - placing a breakpoint at the beginning of the commence method in DelegatingAuthenticationEntryPoint when running the test can confirm that the HttpStatusEntryPoint that was configured is not included in the list of entryPoints

Expected behavior @WebMvcTest or @AutoConfigureMockMvc should include beans of type SecurityFilterChain in auto-configuration

Sample No sample

Comment From: adase11

May be better suited for Spring Boot

Comment From: adase11

Closing in favor of https://github.com/spring-projects/spring-boot/issues/31162