Spring 7 Upgrade: Impact on Strategy Library and Web Customizations

For full release notes, see What's New in Strategy.

Upgrades on Third Party Dependencies

See the following list of upgraded third party libraries used in Strategy Library and Web that effects customizations:

Replace Deprecated Codes

Several third-party dependencies are upgraded to match the Spring 7 update. This version includes system breaking changes, so direct use of these dependencies in customization code may require updates. See the Spring component migration guide or each dependency's release notes for the required changes.

• Spring Framework 7 release notes
• Spring Boot 4 migration guide
• Spring Security 7 migration guide

See the following common changes in the new third-party dependencies.

Replace Unsupported javax.annotation.* and javax.inject.*

Spring Framework 7 removed support for javax.annotation and javax.inject APIS. Migration involves replacing them with the Jakarta equivalents. See the following example:

Prior Migration:

import javax.annotation.Resource;

Updated Migration:

import jakarta.annotation.Resource;

Replace AntPathRequestMatcher and MvcRequestMatcher Usage

AntPathRequestMatcher and MvcRequestMatcher reached end-of-life in Spring Security 7. In most cases, replace these values with PathPatternRequestMatcher.

Note: PatPatternRequestMatcher supports different patterns than AntPathRequestMatcher. For example, PathPatternRequestMatcher does not support ** in the middle of a pattern, such as /plugins/**/*.js. For supported patterns, see the PathPattern java doc.

Updates on Spring Security XML Configuration

Some changes were made to the Spring Security XML configuration due to class deprecation and updates. Review the following bean items to check they are overwritten during customization. If so, corresponding changes must be applied.

SAML XML Configuration Updates on Library Web and Strategy Web and Mobile

Strategy now uses Spring Security SAML provider with OpenSAML 5. See the following list of updated beans:

OIDC XML Configuration Updates on Library Web and Strategy Web and Mobile

Strategy replaced deprecated Spring Security OAuth2 classes from Library web and Strategy Web OIDC bean definitions:

Original:

<bean id="oidcTokenResponseClient" class="org.springframework.security.oauth2.client.endpoint.DefaultAuthorizationCodeTokenResponseClient">
		<property name="requestEntityConverter" ref="requestEntityConverter"/>
    </bean>
    <bean id="requestEntityConverter" class="com.microstrategy.auth.oidc.OidcResponseMessageConverterWithPkce"/>

Updated:

<bean id="oidcTokenResponseClient" class="org.springframework.security.oauth2.client.endpoint.RestClientAuthorizationCodeTokenResponseClient">
		<property name="parametersConverter" ref="requestParametersConverter"/>
    </bean>
    <bean id="requestParametersConverter" class="com.microstrategy.auth.oidc.OidcResponseMessageConverterWithPkce"/>

General HTTP Security XML Configuration Updates on Library Web

On Library Web authentication/authorization, Strategy replaced the deprecated use of access decision manager with a new MstrAuthorizationManager:

Original:

<security:http auto-config="false" entry-point-ref="mstrLoginEntryPoint" access-decision-manager-ref="mstrAccessDecisionManager" use-authorization-manager="false" authentication-manager-ref="namespaceAuthenticationManager">
    ...
    </security:http>
    <bean id="mstrAccessDecisionManager" class="com.microstrategy.auth.MstrAccessDecisionManager" />

Updated:

<security:http auto-config="false" entry-point-ref="mstrLoginEntryPoint" authorization-manager-ref="mstrAuthorizationManager" authentication-manager-ref="namespaceAuthenticationManager">
    ...
    </security:http>
	<bean id="mstrAuthorizationManager" class="com.microstrategy.auth.MstrAuthorizationManager" />