relying-party-registration doesn't resolve placeholders in xml

[rvervaek]

Describe the bug
When declaring a relying-party-registration element in a Spring Security XML namespace configuration, attributes having a property-placeholder value (e.g. ${...}) are not resolved, even when property-placeholder configuration is declared.

Expected behavior
The property-placeholders are resolved when the Spring context is created (ref. #14645).

Sample
demo.zip

Versions:

• Spring framework: 6.2.1
• Spring Security 6.4.2

[kse-music]

It seems that the settings.properties was not added to the environment. I can start it using the method below.

public class DemoApplication {

	public static void main(String[] args) throws IOException {
		ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext(new String[]{"ac-security-config.xml"},false);
		context.getEnvironment().getPropertySources()
				.addLast(new ResourcePropertySource(new ClassPathResource("settings.properties")));
		context.refresh();
		context.start();
	}

}

[rvervaek]

@kse-music

The Spring Framework documentation mentions that adding PropertySources to the Environment is only required in case of modularization of properties. In this example this is not the case is it?

[kse-music]

@rvervaek

By researching the PropertySourcesPlaceholderConfigurer source code, it does not actually add properties directly to the Environment. Instead, after the instance is created, it invkoe the postProcessBeanFactory method, where it adds the property source and the current Environment as two property sources and calls addEmbeddedValueResolver to add it to the IOC container as a placeholder resolver. Therefore, when parsing and loading BeanDefinition during XML parsing, there are only two property sources in Environment: systemEnvironment and systemProperties

[rvervaek]

@kse-music

Can you think of a solution where those property-placeholders are resolved and added to the environment BEFORE the relying-party-registration XML bean definition is parsed?

I understand that problem is more related to the IOC container instead of Spring Security.