Support for AuthorizationManager Spring Security API

[thaarbach]

As mentioned in https://docs.spring.io/spring-security/reference/whats-new.html#_authorization the AccessDecisionManager is deprecated an will be removed in futher versions of Spring Security.

Is there a plan to support newer Versions of Spring Security?

An AccessDecisionManager and it dependency like AccessDecisionVoter etc. are used in SecurityFlowExecutionListener.

[rstoyanchev]

Yes we'll have a 3.0.1 release to ensure support for current versions of upstream projects. If you have a proposal for specific changes, a pull request would be much appreciated.

[rstoyanchev]

SecurityFlowExecutionListener now uses AuthorityAuthorizationManager by default. This can be customized by providing an Function<SecurityRule, AuthorizationManager<Object>> to the listener.

AccessDecisionsManager related methods are deprecated, but it is still possible to use those by providing a decision manager to the listener (global), or by overriding the createAccessDecisionManager method (per SecurityRule).