Support method security annotations for both synchronous and reactive methods in the same app.

Summary

I'd like the ability to use method security annotations (e.g. @PreAuthorize) on both synchronous and reactive methods within the same application.

@EnableGlobalMethodSecurity enables method security annotations (e.g. @PreAuthorize) to be used on synchronous methods. When checks are performed, the SecurityContext is read from SecurityContextHolder.

@EnableReactiveMethodSecurity enables method security annotations to be used on reactive methods (those that return a Publisher). When checks are performed, the SecurityContext is read from ReactiveSecurityContextHolder.

However, currently it is not possible to use both @EnableGlobalMethodSecurity and @EnableReactiveMethodSecurity within the same application.

In my use case, I have a WebFlux application that serves most requests with reactive methods.
However, some requests are dispatched to legacy synchronous code (on a bounded elastic scheduler). And that legacy code also uses @PreAuthorize in some places.

When delegating to this other scheduler, I'm copying the SecurityContext from ReactiveSecurityContextHolder to SecurityContextHolder. Theoretically, this could allow @PreAuthorize to continue to work for the synchronous methods.

Actual Behavior

When both @EnableGlobalMethodSecurity and @EnableReactiveMethodSecurity are enabled at within the same app, the following error occurs:

The bean 'methodSecurityInterceptor', defined in class path resource [org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecurityConfiguration.class], could not be registered. A bean with that name has already been defined in class path resource [org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.class] and overriding is disabled.

Expected Behavior

• No errors when enabling method security annotations for both synchronous and reactive methods.
• Method security annotations work for both synchronous and reactive methods. (assuming the SecurityContext is available in the appropriate holder). It would be fine to require the app to manage propagating the SecurityContext between holders when appropriate. I'm not expecting spring security to have to do that everywhere.
• The same MethodSecurityExpressionHandler should be able to be used by both

Configuration

@EnableGlobalMethodSecurity
@EnableReactiveMethodSecurity

Version

5.2.0.RELEASE