Class file for org.springframework.security.authentication.encoding.PasswordEncoder not found - spring

Question

I've made a simple restAPI with Spring-boot and spring security, implementing Basic Authentication. I want to use inMemoryAuthentication, and bcryptPasswordEncoder, but for some reason my compiler is looking for the passwordEncoder in the wrong place, See title vs security.crypto.password.PasswordEncoder.
My Basic auth looks like this:
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
Configuration
#EnableWebSecurity
public class BasicAuthConfig extends WebSecurityConfigurerAdapter {
// Authentication : User --> Roles
// NoOpPasswordEncoder has been deprecated in Spring security so {noop} is being used to avoid errors
protected void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth.inMemoryAuthentication()
.passwordEncoder(passwordEncoder())
.withUser("user1")
.password("{noop}secret1")
.roles("USER")
.and().withUser("admin1")
.password("{noop}secret1")
.roles("USER", "ADMIN");
}
// Authorization : Role -> Access
protected void configure(HttpSecurity http) throws Exception {
http
.httpBasic()
.and().authorizeRequests()
.antMatchers("/tokenservice/**")
.hasRole("USER")
.antMatchers("/**")
.hasRole("ADMIN")
.and().csrf()
.disable()
.headers()
.frameOptions()
.and().disable()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
#Bean
public PasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
}
I get this error when trying to compile:
Error:(21, 7) java: cannot access org.springframework.security.authentication.encoding.PasswordEncoder
class file for org.springframework.security.authentication.encoding.PasswordEncoder not found
Disregard the {noop} in front of the password. is there for testing without passwordEncoder.
I'm very new to Spring and gradle, and java all in all. Could i be using a wrong version of Spring? If thats the case, how do i fix it?

Answer 1

If your using latest spring-security version, you should find PasswordEncoder class in org.springframework.security.crypto.password package.
PasswordEncoder in package org.springframework.security.authentication.encoding.PasswordEncoder has been deprecated

Answer 2

Looks like it is caused by incompatible versions of spring-security-config (4.0.2.RELEASE) and spring-security-core (5.0.3.RELEASE)
The newer version of spring-security-core only accepts org.springframework.security.crypto.password.PasswordEncoder
I fixed this by downgrading spring-security-core to match spring-security-config.

Answer 3

It was due to version mismatch in spring security config jar.
When you are upgrading your spring version from 4.x to 5.x , this issue occurs as PasswordEncoder class object is restricted in use.
In spring-security-config 4.x version in AbstractDaoAuthenticationConfigurer the passwordEncoder() is overloading both the org.springframework.security.crypto.password.PasswordEncoder and org.springframework.security.authentication.encoding.PasswordEncoder, where else in spring-security-config 5.x it is only the org.springframework.security.crypto.password.PasswordEncoder
spring-security-config 4.x
public C passwordEncoder(org.springframework.security.crypto.password.PasswordEncoder passwordEncoder)
{
this.provider.setPasswordEncoder(passwordEncoder);
return this;
}
public C passwordEncoder(org.springframework.security.authentication.encoding.PasswordEncoder passwordEncoder)
{
this.provider.setPasswordEncoder(passwordEncoder);
return this;
}
spring-security-config 5.x
import org.springframework.security.crypto.password.PasswordEncoder;
public C passwordEncoder(PasswordEncoder passwordEncoder)
{
this.provider.setPasswordEncoder(passwordEncoder);
return this;
}
Most probably solution is to downgrade your spring version to 4.x.