Target Class in AbstractMethodSecurityMetadataSource is proxy

Summary

Custom Metadata Source receive the Spring proxy instead of the real class.

Actual Behavior

1. Create custom Metadata Source:

public class CustomSecurityMetadataSource extends AbstractMethodSecurityMetadataSource {
    public Collection<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) {
        System.out.println("Proxy class: " + targetClass.getClass());

        return Collections.emptyList();
    }

    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }
}

2. Register custom source:

@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends GlobalMethodSecurityConfiguration {
    @Override
    public MethodSecurityMetadataSource customMethodSecurityMetadataSource() {
        return new RepositorySecurityMetadataSource();
    }
}

3. Run the app and notice the output for certain classes. The Spring Data Repositories, specifically have the Spring Proxy instead of the repository interface.

Expected Behavior

Same steps as above, the targetClass received should be the Spring Data Repository interface instead of the Spring Proxy.

Version

I tested this on version 5.0.0.M5 as well as the latest snapshot, it occurs in both versions.

Sample

A sample showing this is available at:
https://github.com/miguelocarvajal/target-class-proxy

Running this Spring Boot sample shows the target class proxy instead of the Data Repository I am expecting.

Start with AbstractMethodSecurityMetadataSource and the customMethodSecurityMetadataSource entry point described in the issue, then reproduce the behavior using the linked target-class-proxy sample. Done means the metadata source receives the Spring Data Repository interface rather than the Spring proxy.