removing DOCKER_ENABLE_SECURITY flag

2026-07-16 19:33:11 +02:00 · 2025-06-05 11:02:40 +01:00
parent 5a50947e5e
commit 41cd7d8f47
65 changed files with 415 additions and 330 deletions
@@ -1,11 +1,8 @@
 package stirling.software.proprietary.security;

-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.Optional;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.InternalAuthenticationServiceException;
@@ -13,6 +10,13 @@ import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.LoginAttemptService;
 import stirling.software.proprietary.security.service.UserService;
@@ -1,14 +1,18 @@
 package stirling.software.proprietary.security;

+import java.io.IOException;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.SavedRequest;
+
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
-import java.io.IOException;
+
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
-import org.springframework.security.web.savedrequest.SavedRequest;
+
 import stirling.software.common.util.RequestUriUtils;
 import stirling.software.proprietary.security.service.LoginAttemptService;
 import stirling.software.proprietary.security.service.UserService;
@@ -1,22 +1,27 @@
 package stirling.software.proprietary.security;

-import com.coveo.saml.SamlClient;
-import com.coveo.saml.SamlException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.RSAPrivateKey;
 import java.util.ArrayList;
 import java.util.List;
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.core.io.Resource;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
 import org.springframework.security.saml2.provider.service.authentication.Saml2Authentication;
 import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
+
+import com.coveo.saml.SamlClient;
+import com.coveo.saml.SamlException;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.configuration.AppConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
@@ -171,8 +176,7 @@ public class CustomLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
    private SamlClient getSamlClient(
            String registrationId, SAML2 samlConf, List<X509Certificate> certificates)
            throws SamlException {
-        String serverUrl =
-                appConfig.getBaseUrl() + ":" + appConfig.getServerPort();
+        String serverUrl = appConfig.getBaseUrl() + ":" + appConfig.getServerPort();

        String relyingPartyIdentifier =
                serverUrl + "/saml2/service-provider-metadata/" + registrationId;
@@ -1,14 +1,18 @@
 package stirling.software.proprietary.security;

-import jakarta.annotation.PostConstruct;
 import java.sql.SQLException;
 import java.util.UUID;
+
+import org.springframework.stereotype.Component;
+
+import jakarta.annotation.PostConstruct;
+
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.stereotype.Component;
+
 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.common.model.enumeration.Role;
+import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.proprietary.security.service.DatabaseServiceInterface;
 import stirling.software.proprietary.security.service.UserService;

@@ -1,8 +1,10 @@
 package stirling.software.proprietary.security;

-import lombok.RequiredArgsConstructor;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
 import stirling.software.proprietary.security.filter.IPRateLimitingFilter;

@Component
@@ -1,8 +1,7 @@
 package stirling.software.proprietary.security.configuration;

 import javax.sql.DataSource;
-import lombok.Getter;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.boot.autoconfigure.domain.EntityScan;
@@ -11,6 +10,10 @@ import org.springframework.boot.jdbc.DatabaseDriver;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+
+import lombok.Getter;
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.exception.UnsupportedProviderException;
@@ -65,15 +68,17 @@ public class DatabaseConfig {
    private DataSource useDefaultDataSource(DataSourceBuilder<?> dataSourceBuilder) {
        log.info("Using default H2 database");

-        dataSourceBuilder.url(DATASOURCE_DEFAULT_URL)
-            .driverClassName(DatabaseDriver.H2.getDriverClassName())
-            .username(DEFAULT_USERNAME);
+        dataSourceBuilder
+                .url(DATASOURCE_DEFAULT_URL)
+                .driverClassName(DatabaseDriver.H2.getDriverClassName())
+                .username(DEFAULT_USERNAME);

        return dataSourceBuilder.build();
    }

    @ConditionalOnBooleanProperty(name = "premium.enabled")
-    private DataSource useCustomDataSource(DataSourceBuilder<?> dataSourceBuilder) throws UnsupportedProviderException {
+    private DataSource useCustomDataSource(DataSourceBuilder<?> dataSourceBuilder)
+            throws UnsupportedProviderException {
        log.info("Using custom database configuration");

        if (!datasource.getCustomDatabaseUrl().isBlank()) {
@@ -85,11 +90,11 @@ public class DatabaseConfig {
        } else {
            dataSourceBuilder.driverClassName(getDriverClassName(datasource.getType()));
            dataSourceBuilder.url(
-                generateCustomDataSourceUrl(
-                    datasource.getType(),
-                    datasource.getHostName(),
-                    datasource.getPort(),
-                    datasource.getName()));
+                    generateCustomDataSourceUrl(
+                            datasource.getType(),
+                            datasource.getHostName(),
+                            datasource.getPort(),
+                            datasource.getName()));
        }
        dataSourceBuilder.username(datasource.getUsername());
        dataSourceBuilder.password(datasource.getPassword());
@@ -10,6 +10,7 @@ import org.springframework.mail.javamail.JavaMailSenderImpl;

 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.model.ApplicationProperties;

 /**
@@ -1,7 +1,7 @@
 package stirling.software.proprietary.security.configuration;

 import java.util.Optional;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
@@ -26,6 +26,9 @@ import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
 import org.springframework.security.web.savedrequest.NullRequestCache;
 import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
+
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.configuration.AppConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.security.CustomAuthenticationFailureHandler;
@@ -71,22 +74,22 @@ public class SecurityConfiguration {
    private final OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver;

    public SecurityConfiguration(
-        PersistentLoginRepository persistentLoginRepository,
-        CustomUserDetailsService userDetailsService,
-        @Lazy UserService userService,
-        @Qualifier("loginEnabled") boolean loginEnabledValue,
-        @Qualifier("runningProOrHigher") boolean runningProOrHigher,
-        AppConfig appConfig,
-        ApplicationProperties applicationProperties,
-        UserAuthenticationFilter userAuthenticationFilter,
-        LoginAttemptService loginAttemptService,
-        FirstLoginFilter firstLoginFilter,
-        SessionPersistentRegistry sessionRegistry,
-        @Autowired(required = false) GrantedAuthoritiesMapper oAuth2userAuthoritiesMapper,
-        @Autowired(required = false)
-        RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations,
-        @Autowired(required = false)
-        OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver) {
+            PersistentLoginRepository persistentLoginRepository,
+            CustomUserDetailsService userDetailsService,
+            @Lazy UserService userService,
+            @Qualifier("loginEnabled") boolean loginEnabledValue,
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher,
+            AppConfig appConfig,
+            ApplicationProperties applicationProperties,
+            UserAuthenticationFilter userAuthenticationFilter,
+            LoginAttemptService loginAttemptService,
+            FirstLoginFilter firstLoginFilter,
+            SessionPersistentRegistry sessionRegistry,
+            @Autowired(required = false) GrantedAuthoritiesMapper oAuth2userAuthoritiesMapper,
+            @Autowired(required = false)
+                    RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations,
+            @Autowired(required = false)
+                    OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver) {
        this.userDetailsService = userDetailsService;
        this.userService = userService;
        this.loginEnabledValue = loginEnabledValue;
@@ -116,180 +119,183 @@ public class SecurityConfiguration {

        if (loginEnabledValue) {
            http.addFilterBefore(
-                userAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
+                    userAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
            if (!applicationProperties.getSecurity().getCsrfDisabled()) {
                CookieCsrfTokenRepository cookieRepo =
-                    CookieCsrfTokenRepository.withHttpOnlyFalse();
+                        CookieCsrfTokenRepository.withHttpOnlyFalse();
                CsrfTokenRequestAttributeHandler requestHandler =
-                    new CsrfTokenRequestAttributeHandler();
+                        new CsrfTokenRequestAttributeHandler();
                requestHandler.setCsrfRequestAttributeName(null);
                http.csrf(
-                    csrf ->
-                        csrf.ignoringRequestMatchers(
-                                request -> {
-                                    String apiKey = request.getHeader("X-API-KEY");
-                                    // If there's no API key, don't ignore CSRF
-                                    // (return false)
-                                    if (apiKey == null || apiKey.trim().isEmpty()) {
-                                        return false;
-                                    }
-                                    // Validate API key using existing UserService
-                                    try {
-                                        Optional<User> user =
-                                            userService.getUserByApiKey(apiKey);
-                                        // If API key is valid, ignore CSRF (return
-                                        // true)
-                                        // If API key is invalid, don't ignore CSRF
-                                        // (return false)
-                                        return user.isPresent();
-                                    } catch (Exception e) {
-                                        // If there's any error validating the API
-                                        // key, don't ignore CSRF
-                                        return false;
-                                    }
-                                })
-                            .csrfTokenRepository(cookieRepo)
-                            .csrfTokenRequestHandler(requestHandler));
+                        csrf ->
+                                csrf.ignoringRequestMatchers(
+                                                request -> {
+                                                    String apiKey = request.getHeader("X-API-KEY");
+                                                    // If there's no API key, don't ignore CSRF
+                                                    // (return false)
+                                                    if (apiKey == null || apiKey.trim().isEmpty()) {
+                                                        return false;
+                                                    }
+                                                    // Validate API key using existing UserService
+                                                    try {
+                                                        Optional<User> user =
+                                                                userService.getUserByApiKey(apiKey);
+                                                        // If API key is valid, ignore CSRF (return
+                                                        // true)
+                                                        // If API key is invalid, don't ignore CSRF
+                                                        // (return false)
+                                                        return user.isPresent();
+                                                    } catch (Exception e) {
+                                                        // If there's any error validating the API
+                                                        // key, don't ignore CSRF
+                                                        return false;
+                                                    }
+                                                })
+                                        .csrfTokenRepository(cookieRepo)
+                                        .csrfTokenRequestHandler(requestHandler));
            }
            http.addFilterBefore(rateLimitingFilter(), UsernamePasswordAuthenticationFilter.class);
            http.addFilterAfter(firstLoginFilter, UsernamePasswordAuthenticationFilter.class);
            http.sessionManagement(
-                sessionManagement ->
-                    sessionManagement
-                        .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
-                        .maximumSessions(10)
-                        .maxSessionsPreventsLogin(false)
-                        .sessionRegistry(sessionRegistry)
-                        .expiredUrl("/login?logout=true"));
+                    sessionManagement ->
+                            sessionManagement
+                                    .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
+                                    .maximumSessions(10)
+                                    .maxSessionsPreventsLogin(false)
+                                    .sessionRegistry(sessionRegistry)
+                                    .expiredUrl("/login?logout=true"));
            http.authenticationProvider(daoAuthenticationProvider());
            http.requestCache(requestCache -> requestCache.requestCache(new NullRequestCache()));
            http.logout(
-                logout ->
-                    logout.logoutRequestMatcher(PathPatternRequestMatcher.withDefaults().matcher("/logout"))
-                        .logoutSuccessHandler(
-                            new CustomLogoutSuccessHandler(applicationProperties, appConfig))
-                        .clearAuthentication(true)
-                        .invalidateHttpSession(true)
-                        .deleteCookies("JSESSIONID", "remember-me"));
+                    logout ->
+                            logout.logoutRequestMatcher(
+                                            PathPatternRequestMatcher.withDefaults()
+                                                    .matcher("/logout"))
+                                    .logoutSuccessHandler(
+                                            new CustomLogoutSuccessHandler(
+                                                    applicationProperties, appConfig))
+                                    .clearAuthentication(true)
+                                    .invalidateHttpSession(true)
+                                    .deleteCookies("JSESSIONID", "remember-me"));
            http.rememberMe(
-                rememberMeConfigurer -> // Use the configurator directly
+                    rememberMeConfigurer -> // Use the configurator directly
                    rememberMeConfigurer
-                        .tokenRepository(persistentTokenRepository())
-                        .tokenValiditySeconds( // 14 days
-                            14 * 24 * 60 * 60)
-                        .userDetailsService( // Your existing UserDetailsService
-                            userDetailsService)
-                        .useSecureCookie( // Enable secure cookie
-                            true)
-                        .rememberMeParameter( // Form parameter name
-                            "remember-me")
-                        .rememberMeCookieName( // Cookie name
-                            "remember-me")
-                        .alwaysRemember(false));
+                                    .tokenRepository(persistentTokenRepository())
+                                    .tokenValiditySeconds( // 14 days
+                                            14 * 24 * 60 * 60)
+                                    .userDetailsService( // Your existing UserDetailsService
+                                            userDetailsService)
+                                    .useSecureCookie( // Enable secure cookie
+                                            true)
+                                    .rememberMeParameter( // Form parameter name
+                                            "remember-me")
+                                    .rememberMeCookieName( // Cookie name
+                                            "remember-me")
+                                    .alwaysRemember(false));
            http.authorizeHttpRequests(
-                authz ->
-                    authz.requestMatchers(
-                            req -> {
-                                String uri = req.getRequestURI();
-                                String contextPath = req.getContextPath();
-                                // Remove the context path from the URI
-                                String trimmedUri =
-                                    uri.startsWith(contextPath)
-                                        ? uri.substring(
-                                        contextPath.length())
-                                        : uri;
-                                return trimmedUri.startsWith("/login")
-                                    || trimmedUri.startsWith("/oauth")
-                                    || trimmedUri.startsWith("/saml2")
-                                    || trimmedUri.endsWith(".svg")
-                                    || trimmedUri.startsWith("/register")
-                                    || trimmedUri.startsWith("/error")
-                                    || trimmedUri.startsWith("/images/")
-                                    || trimmedUri.startsWith("/public/")
-                                    || trimmedUri.startsWith("/css/")
-                                    || trimmedUri.startsWith("/fonts/")
-                                    || trimmedUri.startsWith("/js/")
-                                    || trimmedUri.startsWith(
-                                    "/api/v1/info/status");
-                            })
-                        .permitAll()
-                        .anyRequest()
-                        .authenticated());
+                    authz ->
+                            authz.requestMatchers(
+                                            req -> {
+                                                String uri = req.getRequestURI();
+                                                String contextPath = req.getContextPath();
+                                                // Remove the context path from the URI
+                                                String trimmedUri =
+                                                        uri.startsWith(contextPath)
+                                                                ? uri.substring(
+                                                                        contextPath.length())
+                                                                : uri;
+                                                return trimmedUri.startsWith("/login")
+                                                        || trimmedUri.startsWith("/oauth")
+                                                        || trimmedUri.startsWith("/saml2")
+                                                        || trimmedUri.endsWith(".svg")
+                                                        || trimmedUri.startsWith("/register")
+                                                        || trimmedUri.startsWith("/error")
+                                                        || trimmedUri.startsWith("/images/")
+                                                        || trimmedUri.startsWith("/public/")
+                                                        || trimmedUri.startsWith("/css/")
+                                                        || trimmedUri.startsWith("/fonts/")
+                                                        || trimmedUri.startsWith("/js/")
+                                                        || trimmedUri.startsWith(
+                                                                "/api/v1/info/status");
+                                            })
+                                    .permitAll()
+                                    .anyRequest()
+                                    .authenticated());
            // Handle User/Password Logins
            if (applicationProperties.getSecurity().isUserPass()) {
                http.formLogin(
-                    formLogin ->
-                        formLogin
-                            .loginPage("/login")
-                            .successHandler(
-                                new CustomAuthenticationSuccessHandler(
-                                    loginAttemptService, userService))
-                            .failureHandler(
-                                new CustomAuthenticationFailureHandler(
-                                    loginAttemptService, userService))
-                            .defaultSuccessUrl("/")
-                            .permitAll());
+                        formLogin ->
+                                formLogin
+                                        .loginPage("/login")
+                                        .successHandler(
+                                                new CustomAuthenticationSuccessHandler(
+                                                        loginAttemptService, userService))
+                                        .failureHandler(
+                                                new CustomAuthenticationFailureHandler(
+                                                        loginAttemptService, userService))
+                                        .defaultSuccessUrl("/")
+                                        .permitAll());
            }
            // Handle OAUTH2 Logins
            if (applicationProperties.getSecurity().isOauth2Active()) {
                http.oauth2Login(
-                    oauth2 ->
-                        oauth2.loginPage("/oauth2")
-                            /*
-                            This Custom handler is used to check if the OAUTH2 user trying to log in, already exists in the database.
-                            If user exists, login proceeds as usual. If user does not exist, then it is auto-created but only if 'OAUTH2AutoCreateUser'
-                            is set as true, else login fails with an error message advising the same.
-                             */
-                            .successHandler(
-                                new CustomOAuth2AuthenticationSuccessHandler(
-                                    loginAttemptService,
-                                    applicationProperties,
-                                    userService))
-                            .failureHandler(
-                                new CustomOAuth2AuthenticationFailureHandler())
-                            . // Add existing Authorities from the database
-                            userInfoEndpoint(
-                            userInfoEndpoint ->
-                                userInfoEndpoint
-                                    .oidcUserService(
-                                        new CustomOAuth2UserService(
-                                            applicationProperties,
-                                            userService,
-                                            loginAttemptService))
-                                    .userAuthoritiesMapper(
-                                        oAuth2userAuthoritiesMapper))
-                            .permitAll());
+                        oauth2 ->
+                                oauth2.loginPage("/oauth2")
+                                        /*
+                                        This Custom handler is used to check if the OAUTH2 user trying to log in, already exists in the database.
+                                        If user exists, login proceeds as usual. If user does not exist, then it is auto-created but only if 'OAUTH2AutoCreateUser'
+                                        is set as true, else login fails with an error message advising the same.
+                                         */
+                                        .successHandler(
+                                                new CustomOAuth2AuthenticationSuccessHandler(
+                                                        loginAttemptService,
+                                                        applicationProperties,
+                                                        userService))
+                                        .failureHandler(
+                                                new CustomOAuth2AuthenticationFailureHandler())
+                                        . // Add existing Authorities from the database
+                                        userInfoEndpoint(
+                                                userInfoEndpoint ->
+                                                        userInfoEndpoint
+                                                                .oidcUserService(
+                                                                        new CustomOAuth2UserService(
+                                                                                applicationProperties,
+                                                                                userService,
+                                                                                loginAttemptService))
+                                                                .userAuthoritiesMapper(
+                                                                        oAuth2userAuthoritiesMapper))
+                                        .permitAll());
            }
            // Handle SAML
            if (applicationProperties.getSecurity().isSaml2Active() && runningProOrHigher) {
                // Configure the authentication provider
                OpenSaml4AuthenticationProvider authenticationProvider =
-                    new OpenSaml4AuthenticationProvider();
+                        new OpenSaml4AuthenticationProvider();
                authenticationProvider.setResponseAuthenticationConverter(
-                    new CustomSaml2ResponseAuthenticationConverter(userService));
+                        new CustomSaml2ResponseAuthenticationConverter(userService));
                http.authenticationProvider(authenticationProvider)
-                    .saml2Login(
-                        saml2 -> {
-                            try {
-                                saml2.loginPage("/saml2")
-                                    .relyingPartyRegistrationRepository(
-                                        saml2RelyingPartyRegistrations)
-                                    .authenticationManager(
-                                        new ProviderManager(authenticationProvider))
-                                    .successHandler(
-                                        new CustomSaml2AuthenticationSuccessHandler(
-                                            loginAttemptService,
-                                            applicationProperties,
-                                            userService))
-                                    .failureHandler(
-                                        new CustomSaml2AuthenticationFailureHandler())
-                                    .authenticationRequestResolver(
-                                        saml2AuthenticationRequestResolver);
-                            } catch (Exception e) {
-                                log.error("Error configuring SAML 2 login", e);
-                                throw new RuntimeException(e);
-                            }
-                        });
+                        .saml2Login(
+                                saml2 -> {
+                                    try {
+                                        saml2.loginPage("/saml2")
+                                                .relyingPartyRegistrationRepository(
+                                                        saml2RelyingPartyRegistrations)
+                                                .authenticationManager(
+                                                        new ProviderManager(authenticationProvider))
+                                                .successHandler(
+                                                        new CustomSaml2AuthenticationSuccessHandler(
+                                                                loginAttemptService,
+                                                                applicationProperties,
+                                                                userService))
+                                                .failureHandler(
+                                                        new CustomSaml2AuthenticationFailureHandler())
+                                                .authenticationRequestResolver(
+                                                        saml2AuthenticationRequestResolver);
+                                    } catch (Exception e) {
+                                        log.error("Error configuring SAML 2 login", e);
+                                        throw new RuntimeException(e);
+                                    }
+                                });
            }
        } else {
            log.debug("Login is not enabled.");
@@ -26,6 +26,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;

 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.proprietary.security.database.H2SQLCondition;
 import stirling.software.proprietary.security.service.DatabaseService;

@@ -29,11 +29,11 @@ import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

-import stirling.software.proprietary.security.model.AuthenticationType;
-import stirling.software.common.model.enumeration.Role;
-import stirling.software.proprietary.security.model.User;
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.proprietary.security.model.AuthenticationType;
+import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.model.api.user.UsernameAndPass;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
 import stirling.software.proprietary.security.service.UserService;
@@ -29,12 +29,12 @@ import jakarta.servlet.http.HttpServletRequest;

 import lombok.extern.slf4j.Slf4j;

-import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2.Client;
 import stirling.software.common.model.ApplicationProperties.Security.SAML2;
+import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
 import stirling.software.common.model.oauth2.KeycloakProvider;
@@ -1,10 +1,13 @@
 package stirling.software.proprietary.security.database;

 import java.sql.SQLException;
-import lombok.RequiredArgsConstructor;
+
 import org.springframework.context.annotation.Conditional;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.proprietary.security.service.DatabaseServiceInterface;

@@ -4,6 +4,7 @@ import java.util.Set;

 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.stereotype.Repository;
+
 import stirling.software.proprietary.security.model.Authority;

@Repository
@@ -5,6 +5,7 @@ import java.util.Date;
 import org.springframework.security.web.authentication.rememberme.PersistentRememberMeToken;
 import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
 import org.springframework.transaction.annotation.Transactional;
+
 import stirling.software.proprietary.security.model.PersistentLogin;

 public class JPATokenRepositoryImpl implements PersistentTokenRepository {
@@ -2,6 +2,7 @@ package stirling.software.proprietary.security.database.repository;

 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.stereotype.Repository;
+
 import stirling.software.proprietary.security.model.PersistentLogin;

@Repository
@@ -1,13 +1,16 @@
 package stirling.software.proprietary.security.database.repository;

-import jakarta.transaction.Transactional;
 import java.util.Date;
 import java.util.List;
+
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Modifying;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
 import org.springframework.stereotype.Repository;
+
+import jakarta.transaction.Transactional;
+
 import stirling.software.proprietary.security.model.SessionEntity;

@Repository
@@ -7,6 +7,7 @@ import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
 import org.springframework.stereotype.Repository;
+
 import stirling.software.proprietary.security.model.User;

@Repository
@@ -1,20 +1,24 @@
 package stirling.software.proprietary.security.filter;

+import java.io.IOException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.Optional;
+
+import org.springframework.context.annotation.Lazy;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
-import java.io.IOException;
-import java.text.SimpleDateFormat;
-import java.util.Date;
-import java.util.Optional;
+
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.context.annotation.Lazy;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.stereotype.Component;
-import org.springframework.web.filter.OncePerRequestFilter;
+
 import stirling.software.common.util.RequestUriUtils;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.UserService;
@@ -1,15 +1,18 @@
 package stirling.software.proprietary.security.filter;

+import java.io.IOException;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicInteger;
+
 import jakarta.servlet.Filter;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.ServletRequest;
 import jakarta.servlet.ServletResponse;
 import jakarta.servlet.http.HttpServletRequest;
-import java.io.IOException;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.atomic.AtomicInteger;
+
 import lombok.RequiredArgsConstructor;
+
 import stirling.software.common.util.RequestUriUtils;

@RequiredArgsConstructor
@@ -1,13 +1,9 @@
 package stirling.software.proprietary.security.filter;

-import jakarta.servlet.FilterChain;
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.List;
 import java.util.Optional;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.http.HttpStatus;
@@ -20,6 +16,14 @@ import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.stereotype.Component;
 import org.springframework.web.filter.OncePerRequestFilter;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
 import stirling.software.common.model.ApplicationProperties.Security.SAML2;
@@ -1,17 +1,10 @@
 package stirling.software.proprietary.security.filter;

-import io.github.bucket4j.Bandwidth;
-import io.github.bucket4j.Bucket;
-import io.github.bucket4j.ConsumptionProbe;
-import io.github.pixee.security.Newlines;
-import jakarta.servlet.FilterChain;
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.time.Duration;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
+
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.Authentication;
@@ -20,6 +13,17 @@ import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.stereotype.Component;
 import org.springframework.web.filter.OncePerRequestFilter;
+
+import io.github.bucket4j.Bandwidth;
+import io.github.bucket4j.Bucket;
+import io.github.bucket4j.ConsumptionProbe;
+import io.github.pixee.security.Newlines;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
 import stirling.software.common.model.enumeration.Role;

@Component
@@ -14,6 +14,7 @@ import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
 import lombok.ToString;
+
 import stirling.software.common.model.enumeration.Role;

@Entity
@@ -7,6 +7,7 @@ import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
 import lombok.NoArgsConstructor;
+
 import stirling.software.common.model.api.GeneralFile;

@Data
@@ -1,10 +1,7 @@
 package stirling.software.proprietary.security.oauth2;

-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.LockedException;
@@ -13,6 +10,12 @@ import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
 import org.springframework.security.oauth2.core.OAuth2Error;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;

+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import lombok.extern.slf4j.Slf4j;
+
@Slf4j
 public class CustomOAuth2AuthenticationFailureHandler
        extends SimpleUrlAuthenticationFailureHandler {
@@ -1,18 +1,22 @@
 package stirling.software.proprietary.security.oauth2;

-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import jakarta.servlet.http.HttpSession;
 import java.io.IOException;
 import java.sql.SQLException;
-import lombok.RequiredArgsConstructor;
+
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
 import org.springframework.security.web.savedrequest.SavedRequest;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+
+import lombok.RequiredArgsConstructor;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
 import stirling.software.common.model.exception.UnsupportedProviderException;
@@ -1,13 +1,16 @@
 package stirling.software.proprietary.security.oauth2;

+import static org.springframework.security.oauth2.core.AuthorizationGrantType.AUTHORIZATION_CODE;
+import static stirling.software.common.util.ProviderUtils.validateProvider;
+import static stirling.software.common.util.ValidationUtils.isStringEmpty;
+
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Optional;
 import java.util.Set;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -20,20 +23,20 @@ import org.springframework.security.oauth2.client.registration.ClientRegistratio
 import org.springframework.security.oauth2.client.registration.ClientRegistrations;
 import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
 import org.springframework.security.oauth2.core.user.OAuth2UserAuthority;
+
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2.Client;
 import stirling.software.common.model.enumeration.UsernameAttribute;
-import stirling.software.proprietary.security.model.exception.NoProviderFoundException;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
 import stirling.software.common.model.oauth2.KeycloakProvider;
 import stirling.software.common.model.oauth2.Provider;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.model.exception.NoProviderFoundException;
 import stirling.software.proprietary.security.service.UserService;
-import static org.springframework.security.oauth2.core.AuthorizationGrantType.AUTHORIZATION_CODE;
-import static stirling.software.common.util.ProviderUtils.validateProvider;
-import static stirling.software.common.util.ValidationUtils.isStringEmpty;

@Slf4j
@Configuration
@@ -6,6 +6,7 @@ import java.nio.charset.StandardCharsets;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.RSAPrivateKey;
+
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.openssl.PEMKeyPair;
 import org.bouncycastle.openssl.PEMParser;
@@ -3,6 +3,7 @@ package stirling.software.proprietary.security.saml2;
 import java.io.Serializable;
 import java.util.List;
 import java.util.Map;
+
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal;

@@ -1,9 +1,7 @@
 package stirling.software.proprietary.security.saml2;

-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.security.authentication.ProviderNotFoundException;
 import org.springframework.security.core.AuthenticationException;
@@ -11,6 +9,11 @@ import org.springframework.security.saml2.core.Saml2Error;
 import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;

+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import lombok.extern.slf4j.Slf4j;
+
@Slf4j
@ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
 public class CustomSaml2AuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
@@ -1,17 +1,21 @@
 package stirling.software.proprietary.security.saml2;

+import java.io.IOException;
+import java.sql.SQLException;
+
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.SavedRequest;
+
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
-import java.io.IOException;
-import java.sql.SQLException;
+
 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.security.authentication.LockedException;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
-import org.springframework.security.web.savedrequest.SavedRequest;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security.SAML2;
 import stirling.software.common.model.exception.UnsupportedProviderException;
@@ -5,8 +5,7 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.saml2.core.Assertion;
 import org.opensaml.saml.saml2.core.Attribute;
@@ -17,6 +16,10 @@ import org.springframework.core.convert.converter.Converter;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider.ResponseToken;
 import org.springframework.security.saml2.provider.service.authentication.Saml2Authentication;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.UserService;

@@ -1,11 +1,9 @@
 package stirling.software.proprietary.security.saml2;

-import jakarta.servlet.http.HttpServletRequest;
 import java.security.cert.X509Certificate;
 import java.util.Collections;
 import java.util.UUID;
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
+
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -21,6 +19,12 @@ import org.springframework.security.saml2.provider.service.registration.RelyingP
 import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
 import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository;
 import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security.SAML2;

@@ -1,10 +1,13 @@
 package stirling.software.proprietary.security.service;

 import java.util.Optional;
-import lombok.RequiredArgsConstructor;
+
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+
 import stirling.software.common.configuration.interfaces.ShowAdminInterface;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.security.database.repository.UserRepository;
@@ -1,7 +1,7 @@
 package stirling.software.proprietary.security.service;

 import java.util.Optional;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
@@ -10,6 +10,9 @@ import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
 import org.springframework.security.oauth2.core.OAuth2Error;
 import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
 import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.ApplicationProperties.Security.OAUTH2;
 import stirling.software.common.model.enumeration.UsernameAttribute;
@@ -2,7 +2,7 @@ package stirling.software.proprietary.security.service;

 import java.util.Collection;
 import java.util.Set;
-import lombok.RequiredArgsConstructor;
+
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -10,6 +10,9 @@ import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.User;
@@ -18,11 +18,15 @@ import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.List;
 import java.util.stream.Collectors;
+
 import javax.sql.DataSource;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.jdbc.datasource.init.CannotReadScriptException;
 import org.springframework.jdbc.datasource.init.ScriptException;
 import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.FileInfo;
@@ -235,27 +239,27 @@ public class DatabaseService implements DatabaseServiceInterface {

    private boolean isH2Database() {
        boolean isTypeH2 =
-            datasourceProps.getType().equalsIgnoreCase(ApplicationProperties.Driver.H2.name());
+                datasourceProps.getType().equalsIgnoreCase(ApplicationProperties.Driver.H2.name());
        boolean isDBUrlH2 =
-            datasourceProps.getCustomDatabaseUrl().contains("h2")
-                || datasourceProps.getCustomDatabaseUrl().contains("H2");
+                datasourceProps.getCustomDatabaseUrl().contains("h2")
+                        || datasourceProps.getCustomDatabaseUrl().contains("H2");
        boolean isCustomDatabase = datasourceProps.isEnableCustomDatabase();

        if (isCustomDatabase) {
            if (isTypeH2 && !isDBUrlH2) {
                log.warn(
-                    "Datasource type is H2, but the URL does not contain 'h2'. "
-                        + "Please check your configuration.");
+                        "Datasource type is H2, but the URL does not contain 'h2'. "
+                                + "Please check your configuration.");
                throw new IllegalStateException(
-                    "Datasource type is H2, but the URL does not contain 'h2'. Please check"
-                        + " your configuration.");
+                        "Datasource type is H2, but the URL does not contain 'h2'. Please check"
+                                + " your configuration.");
            } else if (!isTypeH2 && isDBUrlH2) {
                log.warn(
-                    "Datasource URL contains 'h2', but the type is not H2. "
-                        + "Please check your configuration.");
+                        "Datasource URL contains 'h2', but the type is not H2. "
+                                + "Please check your configuration.");
                throw new IllegalStateException(
-                    "Datasource URL contains 'h2', but the type is not H2. Please check your"
-                        + " configuration.");
+                        "Datasource URL contains 'h2', but the type is not H2. Please check your"
+                                + " configuration.");
            }
        }
        boolean isH2 = isTypeH2 && isDBUrlH2;
@@ -1,11 +1,15 @@
 package stirling.software.proprietary.security.service;

-import jakarta.annotation.PostConstruct;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.TimeUnit;
+
+import org.springframework.stereotype.Service;
+
+import jakarta.annotation.PostConstruct;
+
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.stereotype.Service;
+
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.security.model.AttemptCounter;

@@ -1,6 +1,5 @@
 package stirling.software.proprietary.security.service;

-import java.io.IOException;
 import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -9,8 +8,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.UUID;
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
+
 import org.springframework.context.MessageSource;
 import org.springframework.context.i18n.LocaleContextHolder;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -25,10 +23,14 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.common.service.UserServiceInterface;
-import stirling.software.common.model.enumeration.Role;
 import stirling.software.proprietary.security.database.repository.AuthorityRepository;
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.AuthenticationType;
@@ -84,7 +86,7 @@ public class UserService implements UserServiceInterface {

    public Authentication getAuthentication(String apiKey) {
        Optional<User> user = getUserByApiKey(apiKey);
-        if (!user.isPresent()) {
+        if (user.isEmpty()) {
            throw new UsernameNotFoundException("API key is not valid");
        }
        // Convert the user into an Authentication object
@@ -301,9 +303,7 @@ public class UserService implements UserServiceInterface {
    }

    public void changeUsername(User user, String newUsername)
-            throws IllegalArgumentException,
-                    SQLException,
-                    UnsupportedProviderException {
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
        if (!isUsernameValid(newUsername)) {
            throw new IllegalArgumentException(getInvalidUsernameMessage());
        }
@@ -1,15 +1,17 @@
 package stirling.software.proprietary.security.session;

+import org.springframework.stereotype.Component;
+
 import jakarta.servlet.http.HttpSessionEvent;
 import jakarta.servlet.http.HttpSessionListener;
+
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.stereotype.Component;

@Component
@Slf4j
 public class CustomHttpSessionListener implements HttpSessionListener {

-    private SessionPersistentRegistry sessionPersistentRegistry;
+    private final SessionPersistentRegistry sessionPersistentRegistry;

    public CustomHttpSessionListener(SessionPersistentRegistry sessionPersistentRegistry) {
        super();
@@ -1,6 +1,5 @@
 package stirling.software.proprietary.security.session;

-import jakarta.transaction.Transactional;
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -8,13 +7,18 @@ import java.util.Comparator;
 import java.util.Date;
 import java.util.List;
 import java.util.Optional;
-import lombok.RequiredArgsConstructor;
+
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.security.core.session.SessionInformation;
 import org.springframework.security.core.session.SessionRegistry;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.stereotype.Component;
+
+import jakarta.transaction.Transactional;
+
+import lombok.RequiredArgsConstructor;
+
 import stirling.software.proprietary.security.database.repository.SessionRepository;
 import stirling.software.proprietary.security.model.SessionEntity;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
@@ -3,6 +3,7 @@ package stirling.software.proprietary.security.session;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.core.session.SessionRegistryImpl;
+
 import stirling.software.proprietary.security.database.repository.SessionRepository;

@Configuration
@@ -14,7 +15,8 @@ public class SessionRegistryConfig {
    }

    @Bean
-    public SessionPersistentRegistry sessionPersistentRegistry(SessionRepository sessionRepository) {
+    public SessionPersistentRegistry sessionPersistentRegistry(
+            SessionRepository sessionRepository) {
        return new SessionPersistentRegistry(sessionRepository);
    }
 }
@@ -4,11 +4,13 @@ import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.Date;
 import java.util.List;
-import lombok.RequiredArgsConstructor;
+
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.security.core.session.SessionInformation;
 import org.springframework.stereotype.Component;

+import lombok.RequiredArgsConstructor;
+
@Component
@RequiredArgsConstructor
 public class SessionScheduled {