spring-projects / spring-projects/spring-boot

Add support for initializing the schema that Spring Security supports

Open
#51,751 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: blocked type: enhancement
Dominant language
Java
Stars
81.5k
Forks
42.7k
Avg merge
2d 4h
Merged PRs (30d)
65

Description

Hi team,
I've been working extensively with Spring Security recently. Countless parts of Spring Security store state—by default in memory - but many SPIs also provide SQL-backed implementations. It would be great if we could standardize these implementations and expose a consistent initialize-schema property for them.

Examples include:

  • JdbcUserDetailsManager: Stores users and their authorities in SQL (a core part of Spring Security for years).
  • JdbcRegisteredClientRepository: Stores OAuth2 Authorization Server client definitions.
  • JdbcOAuth2AuthorizationConsentService: Manages user consent for granted scopes.
  • JdbcOAuth2AuthorizationService: Stores active OAuth2 authorizations.

We often discuss stateless APIs, but state always exists somewhere—frequently within the security context. Right now, we lack a seamless, out-of-the-box (OOTB) experience for handling that state cleanly in Spring Boot.

Feature Request: Could we collaborate to make the necessary updates in Spring Security so Spring Boot can, in turn, provide first-class auto-configuration and configuration properties (spring.security.*.initialize-schema) for these SQL-backed components?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the named JDBC components: JdbcUserDetailsManager, JdbcRegisteredClientRepository, JdbcOAuth2AuthorizationConsentService, and JdbcOAuth2AuthorizationService. Trace how their SQL-backed state is currently initialized and how Spring Boot configuration properties could cover them. Done should provide a consistent initialize-schema experience for these components and the requested spring.security.* properties.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
backend, database, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.