# spring-projects/spring-security architecture

> Architecture diagram of the GitHub repository spring-projects/spring-security, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/spring-projects/spring-security
- Repository: https://github.com/spring-projects/spring-security

## Overview

Spring Security is a Java security framework spanning authentication context, authorization, ACLs, and protocol-specific integrations. The central workflow is an application request entering a security interceptor, obtaining authorization metadata, and being evaluated against the current identity and its authorities; ACLs add object-level permissions. The tree also exposes OAuth client and authorization-server persistence, plus CAS, LDAP, SAML, and WebAuthn modules. Several core relationships are documented by the excerpts and source index; unsampled runtime connections are shown as unverified rather than asserted.

Main entry points: [`acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java`](https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java) (JDBC ACL Service), [`access/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java`](https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java) (Method Interceptor), [`core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java`](https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java) (Context Executor), [`web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java`](https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java) (Pre-auth User Details)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_identity["Identity Context"]
  node_authn["Authentication"]
  node_authority["Granted Authorities"]
  node_security_context["Security Context"]
  node_context_holder["Context Holder"]
  node_executor["Context Executor"]
  node_preauth_user["Pre-auth User Details"]
end

subgraph group_authorization["Access Authorization"]
  node_web_interceptor["Web Interceptor"]
  node_method_interceptor["Method Interceptor"]
  node_method_metadata["Method Metadata"]
  node_decision["Access Decisions"]
  node_message_security["Message Security"]
end

subgraph group_acl["ACL Permissions"]
  node_acl_identity["Object Identity"]
  node_acl_sid["Security Identity<br/>[Sid.java]"]
  node_acl_service[("JDBC ACL Service")]
  node_acl_model["ACL Model<br/>[AclImpl.java]"]
end

subgraph group_oauth["OAuth2 Services"]
  node_oauth_registration["Client Registration"]
  node_oauth_userinfo["UserInfo Client"]
  node_access_token["Access Token"]
  node_authorized_client_store[("Authorized Client Store")]
  node_authorization_store[("Authorization Store")]
  node_registered_client["Registered Client"]
end

subgraph group_integrations["Protocol Integrations"]
  node_cas["CAS Authentication"]
  node_ldap["LDAP User Services"]
  node_saml["SAML Support"]
  node_webauthn["WebAuthn"]
end

node_application(("Application"))

node_application -.->|"invokes"| node_web_interceptor
node_application -.->|"invokes"| node_method_interceptor
node_application -.->|"secures messages"| node_message_security
node_web_interceptor -.->|"checks access"| node_decision
node_method_interceptor -.->|"loads metadata"| node_method_metadata
node_method_interceptor -.->|"checks access"| node_decision
node_authn -->|"carries"| node_authority
node_context_holder -->|"stores context"| node_security_context
node_executor -->|"propagates context"| node_context_holder
node_executor -->|"wraps tasks with"| node_security_context
node_preauth_user -->|"reads token"| node_authn
node_preauth_user -->|"uses authorities"| node_authority
node_acl_service -->|"persists identity"| node_acl_identity
node_acl_service -->|"persists SID"| node_acl_sid
node_acl_service -.->|"writes entries"| node_acl_model
node_oauth_userinfo -->|"reads provider config"| node_oauth_registration
node_authorized_client_store -->|"loads registration"| node_oauth_registration
node_authorized_client_store -->|"persists token"| node_access_token
node_authorization_store -->|"uses registered client"| node_registered_client
node_authorization_store -->|"persists token"| node_access_token

click node_authn "https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/Authentication.java"
click node_authority "https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/GrantedAuthority.java"
click node_security_context "https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/context/SecurityContext.java"
click node_context_holder "https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/context/SecurityContextHolder.java"
click node_executor "https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java"
click node_preauth_user "https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java"
click node_web_interceptor "https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java"
click node_method_interceptor "https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java"
click node_method_metadata "https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/access/method/DelegatingMethodSecurityMetadataSource.java"
click node_decision "https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/access/vote/AffirmativeBased.java"
click node_message_security "https://github.com/spring-projects/spring-security/blob/main/messaging/src/main/java/org/springframework/security/messaging/access/intercept/MessageMatcherDelegatingAuthorizationManager.java"
click node_acl_identity "https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/model/ObjectIdentity.java"
click node_acl_sid "https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/model/Sid.java"
click node_acl_service "https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java"
click node_acl_model "https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java"
click node_oauth_registration "https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java"
click node_oauth_userinfo "https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java"
click node_access_token "https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/OAuth2AccessToken.java"
click node_authorized_client_store "https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java"
click node_authorization_store "https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java"
click node_registered_client "https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClient.java"
click node_cas "https://github.com/spring-projects/spring-security/blob/main/cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationProvider.java"
click node_ldap "https://github.com/spring-projects/spring-security/blob/main/ldap/src/main/java/org/springframework/security/ldap/userdetails/LdapUserDetailsService.java"
click node_saml "https://github.com/spring-projects/spring-security/blob/main/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/core/OpenSamlInitializationService.java"
click node_webauthn "https://github.com/spring-projects/spring-security/blob/main/webauthn/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_authn,node_authority,node_security_context,node_context_holder,node_executor,node_preauth_user toneBlue
class node_web_interceptor,node_method_interceptor,node_method_metadata,node_decision,node_message_security toneAmber
class node_acl_identity,node_acl_sid,node_acl_service,node_acl_model toneMint
class node_oauth_registration,node_oauth_userinfo,node_access_token,node_authorized_client_store,node_authorization_store,node_registered_client toneRose
class node_cas,node_ldap,node_saml,node_webauthn,node_application toneIndigo
```

## Components

### Identity Context

- [Authentication](https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/Authentication.java): `core/src/main/java/org/springframework/security/core/Authentication.java`
- [Granted Authorities](https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/GrantedAuthority.java): `core/src/main/java/org/springframework/security/core/GrantedAuthority.java`
- [Security Context](https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/context/SecurityContext.java): `core/src/main/java/org/springframework/security/core/context/SecurityContext.java`
- [Context Holder](https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/core/context/SecurityContextHolder.java): `core/src/main/java/org/springframework/security/core/context/SecurityContextHolder.java`
- [Context Executor](https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java): `core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java`
- [Pre-auth User Details](https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java): `web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java`

### Access Authorization

- [Web Interceptor](https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java): `access/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java`
- [Method Interceptor](https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java): `access/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java`
- [Method Metadata](https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/access/method/DelegatingMethodSecurityMetadataSource.java): `access/src/main/java/org/springframework/security/access/method/DelegatingMethodSecurityMetadataSource.java`
- [Access Decisions](https://github.com/spring-projects/spring-security/blob/main/access/src/main/java/org/springframework/security/access/vote/AffirmativeBased.java): `access/src/main/java/org/springframework/security/access/vote/AffirmativeBased.java`
- [Message Security](https://github.com/spring-projects/spring-security/blob/main/messaging/src/main/java/org/springframework/security/messaging/access/intercept/MessageMatcherDelegatingAuthorizationManager.java): `messaging/src/main/java/org/springframework/security/messaging/access/intercept/MessageMatcherDelegatingAuthorizationManager.java`

### ACL Permissions

- [Object Identity](https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/model/ObjectIdentity.java): `acl/src/main/java/org/springframework/security/acls/model/ObjectIdentity.java`
- [Security Identity](https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/model/Sid.java): `acl/src/main/java/org/springframework/security/acls/model/Sid.java`
- [JDBC ACL Service](https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java): `acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java`
- [ACL Model](https://github.com/spring-projects/spring-security/blob/main/acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java): `acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java`

### OAuth2 Services

- [Client Registration](https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java): `oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java`
- [UserInfo Client](https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java): `oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java`
- [Access Token](https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/OAuth2AccessToken.java): `oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/OAuth2AccessToken.java`
- [Authorized Client Store](https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java): `oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java`
- [Authorization Store](https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java): `oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java`
- [Registered Client](https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClient.java): `oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClient.java`

### Protocol Integrations

- [CAS Authentication](https://github.com/spring-projects/spring-security/blob/main/cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationProvider.java): `cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationProvider.java`
- [LDAP User Services](https://github.com/spring-projects/spring-security/blob/main/ldap/src/main/java/org/springframework/security/ldap/userdetails/LdapUserDetailsService.java): `ldap/src/main/java/org/springframework/security/ldap/userdetails/LdapUserDetailsService.java`
- [SAML Support](https://github.com/spring-projects/spring-security/blob/main/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/core/OpenSamlInitializationService.java): `saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/core/OpenSamlInitializationService.java`
- [WebAuthn](https://github.com/spring-projects/spring-security/blob/main/webauthn/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java): `webauthn/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java`

### Other components

- **Application**

## Connections

- Application → Web Interceptor: invokes
- Application → Method Interceptor: invokes
- Application → Message Security: secures messages
- Web Interceptor → Access Decisions: checks access
- Method Interceptor → Method Metadata: loads metadata
- Method Interceptor → Access Decisions: checks access
- Authentication → Granted Authorities: carries (evidence: `core/src/main/java/org/springframework/security/core/GrantedAuthority.java`)
- Context Holder → Security Context: stores context (evidence: `core/src/main/java/org/springframework/security/core/context/SecurityContextHolder.java`)
- Context Executor → Context Holder: propagates context (evidence: `core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java`)
- Context Executor → Security Context: wraps tasks with (evidence: `core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java`)
- Pre-auth User Details → Authentication: reads token (evidence: `web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java`)
- Pre-auth User Details → Granted Authorities: uses authorities (evidence: `web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java`)
- JDBC ACL Service → Object Identity: persists identity (evidence: `acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java`)
- JDBC ACL Service → Security Identity: persists SID (evidence: `acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java`)
- JDBC ACL Service → ACL Model: writes entries
- UserInfo Client → Client Registration: reads provider config (evidence: `oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java`)
- Authorized Client Store → Client Registration: loads registration (evidence: `oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java`)
- Authorized Client Store → Access Token: persists token (evidence: `oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java`)
- Authorization Store → Registered Client: uses registered client (evidence: `oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java`)
- Authorization Store → Access Token: persists token (evidence: `oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java`)