http://www.springframework.org/schema/security/spring-security.xsd is gone!?

[FelixJongleur42]

As a result of #8091 !?

[MikeN123]

This seems to break startup of all our applications. That is something we need to investigate, but could the XSD maybe be fixed urgently in the meantime?

[MikeN123]

Apparently this was already fixed in #7623, so only Spring Security 5.2.0 and 5.2.1 are broken in this regard.

[tadamczak]

I confirm that it breaks build of all our applications too.

[bclozel]

I took the liberty to add that file back in our schemas (linking to the latest available schema) for now.
I'll let the Spring Security team handle specifics for this issue.
Thanks

[qeepcologne]

we had the same problem with:
http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
and had to host the file on our own website as emergency hotfix - there is no https version, and i cannot find the file via directotry listing @ http://www.springframework.org/schema/
We use spring-security 5.3.0.RELEASE + spring-security-oauth2 2.4.0.RELEASE.

[jzheaux]

My apologies for the hiccup - there's a step in our release process that's easy to miss. I'll leave this ticket open to investigate the possibility of simplifying that step.

@qeepcologne will you please confirm that you can reach the spring-security-oauth2-2.0.xsd now?

@FelixJongleur42, @tadamczak, and @MikeN123 are you able to reach spring-security.xsd?

[MikeN123]

Yes, works for us now. Will also be upgrading to Spring Sec 5.2.2. soon to make sure it uses the XSD in the JAR.

[dc-oe]

This issue has broken us because we rely on getting the xsd files from your Internet location. Whoever put it back after deleting it changed the definition of the password-encoder element. It is different than the xsd's for 5.2 and 5.3 that are in https://github.com/spring-projects/spring-security/blob/master/config/src/main/resources/org/springframework/security/config/spring-security-5.2.xsd. Where did this come from and is this they type of thing we can expect in the future?

[qeepcologne]

thanks, the file (http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd) is downloadable.

[dc-oe]

Why was the password-encoder definition changed in http://www.springframework.org/schema/security/spring-security.xsd?

[dc-oe]

This is the XML fragment that started failing after last night's schema fiasco.

    <authentication-provider>
        <password-encoder ref="sha256passwordEncoder">
            <salt-source user-property="username" />
        </password-encoder>

Any thoughts as to why? Have we been misusing it all this time?

Thanks