feat(security): avoid auto generated user with basic auth credentials

sda-commons-web-autoconfigure/src/main/java/org/sdase/commons/spring/boot/web/auth/SdaSecurityConfiguration.java

@@ -18,8 +18,10 @@
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationManagerResolver;
 import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver;
@@ -66,6 +68,12 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
     return http.build();
   }
 
+  @Bean
+  // Avoid generating a user with basic credentials
+  AuthenticationManager authenticationManager(AuthenticationManagerBuilder auth) {
+    return auth.getOrBuild();
+  }
+
   private void oidcAuthentication(HttpSecurity http) throws Exception {
     var authenticationManagerResolver = createAuthenticationManagerResolver();
     http.csrf()

sda-commons-web-autoconfigure/src/test/java/org/sdase/commons/spring/boot/web/auth/NoDevelopUserCreatedTest.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2022- SDA SE Open Industry Solutions (https://www.sda.se)
+ *
+ * Use of this source code is governed by an MIT-style
+ * license that can be found in the LICENSE file or at
+ * https://opensource.org/licenses/MIT.
+ */
+package org.sdase.commons.spring.boot.web.auth;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.springframework.boot.test.context.SpringBootTest.WebEnvironment.RANDOM_PORT;
+
+import org.junit.jupiter.api.Test;
+import org.sdase.commons.spring.boot.web.testing.auth.DisableSdaAuthInitializer;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.context.ApplicationContext;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+import org.springframework.test.context.ContextConfiguration;
+
+@SpringBootTest(classes = AuthTestApp.class, webEnvironment = RANDOM_PORT)
+@ContextConfiguration(initializers = DisableSdaAuthInitializer.class)
+class NoDevelopUserCreatedTest {
+
+  @Autowired ApplicationContext applicationContext;
+
+  @Test
+  void shouldNotHaveBeanWithGeneratedUser() {
+    assertThat(applicationContext.getBeansOfType(InMemoryUserDetailsManager.class)).isEmpty();
+  }
+}