Summary

The documentation seems to support allowing different authentication managers for different authentication specs (HttpBasicSpec and FormLoginSpec). However, those seem to always be overwritten when the .build() method is called:

HttpBasicSpec overwritten FormLoginSpec overwritten

Actual Behavior

HttpBasicSpec and FormLoginSpec can not use different AuthenticationManagers

Expected Behavior

HttpBasicSpec and FormLoginSpec should be able to use different AuthenticationManagers

Configuration

    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
            // ...
            .httpBasic()
                    .authenticationManager(authenticationManager1)
            .and()
            .formLogin()
                    .authenticationManager(authenticationManager2);
        return http.build();
    }

Version

spring-security 5.0.6.RELEASE

The problematic code referenced in the summary appears to still exist in the master branch.

Sample

N/A

Comment From: srinivasmkoppal

what is authenticationManager1