Disabling Spring Security leads to Failed to load application context - spring-boot

Question

I am disabling Spring Security for the test profile as below:
spring:
config:
activate:
on-profile: test
autoconfigure:
exclude[0]: org.springframework.boot.actuate.autoconfigure.security.reactive.ReactiveManagementWebSecurityAutoConfiguration
exclude[1]: org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration
Error:
Failed to load ApplicationContext
java.lang.IllegalStateException: Failed to load ApplicationContext
Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/boot/autoconfigure/security/oauth2/client/reactive/ReactiveOAuth2ClientConfigurations$ReactiveOAuth2ClientConfiguration$SecurityWebFilterChainConfiguration.class]: Unsatisfied dependency expressed through method 'springSecurityFilterChain' parameter 0; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type 'org.springframework.security.config.web.server.ServerHttpSecurity' available: expected at least 1 bean which qualifies as autowire candidate. Dependency annotations: {}

Answer 1

A small clarification that you are not disabling Spring Security, you are disabling the Spring Boot auto-configuration of Spring Security. You can read more about that in the Spring Boot reference documentation.
In your configuration you are disabling the ReactiveSecurityAutoConfiguration, but the ReactiveOAuth2ClientAutoConfiguration is still enabled, presumably because you have a dependency such as spring-boot-starter-oauth2-client.
As described in the error message, the ReactiveOAuth2ClientAutoConfiguration is attempting to create a SecurityWebFilterChain bean, but cannot inject the required ServerHttpSecurity bean, because the ReactiveSecurityAutoConfiguration is disabled.
To fix the error message, you can disable the OAuth 2.0 client auto-configuration as well.
spring:
autoconfigure:
exclude[0]: org.springframework.boot.actuate.autoconfigure.security.reactive.ReactiveManagementWebSecurityAutoConfiguration
exclude[1]: org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration
exclude[2]: org.springframework.boot.autoconfigure.security.oauth2.client.reactive.ReactiveOAuth2ClientAutoConfiguration

Answer 2

I am using the okta-spring-boot-starter and this worked for me:
spring:
autoconfigure:
exclude:
- org.springframework.boot.autoconfigure.security.oauth2.client.reactive.ReactiveOAuth2ClientAutoConfiguration
- org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration
- org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration