SEC-2496: Provide documentation explaining how to migrate from XML configuration to JavaConfig configuration

Gerrit Hübbers (Migrated from SEC-2496) said:

I am in the process of migrating my application' usage of Spring Security's XML configuration to JavaConfig configuration.

From my experience, this migration is not trivial, and therefore the Spring Security documentation could have an additional section explaining how to migrate. Questions at StackOverflow seem to support my hypothesis that there is missing documentation.

In my particular case, issues I ran into during migration include:

• with XML configuration, <remember-me .../> creates a RememberMeServices bean automatically. JavaConfig configuration requires explicit RememberMeServices and PersistentTokenRepository beans creation besides additional configuration inside configure(HttpSecurity http) with http.userDetailsService( userDetailsService() ).rememberMe().rememberMeServices( rememberMeServices() ).
• XML configuration automatically creates a RequestCache bean. JavaConfig configuration requires explicit RequestCache bean creation besides additional configuration inside configure(HttpSecurity http).
• Out-of-the-box, the XML configuration did not require to consider CSRF-related aspects. Out-of-the-box, JavaConfig configuration does require to consider CSRF-related aspects - e.g., when migrating, in order to have my application to work as before, in WebSecurityConfigurerAdapter.configure(HttpSecurity http), I had to explicitly disable CSRF with http.csrf().disable().
• The springSecurityFilterChain bean seems to be created in both XML configuration and JavaConfig configuration.

For a documentation migration section, my idea is to provide a full-fledged XML configuration example, then show a 1:1 corresponding JavaConfig configuration.

Additionally, the documentation could contain subsection for each available Spring Security XML namespace element, and then show the corresponding required JavaConfig-based configuration.

Start by reviewing the existing Spring Security documentation and the configuration entry points named in the issue, especially configure(HttpSecurity http) and WebSecurityConfigurerAdapter. Document an XML-to-JavaConfig migration covering remember-me, RequestCache, CSRF, and springSecurityFilterChain, then add mappings for the XML namespace elements. Done means the migration steps and corresponding configuration are clear and complete.