[Security] Customized access decision manager configuration is ignored #28766
Description
Symfony version(s) affected: 3.4.15
Description
All customized security.yml options for the access decision manager are ignored if the 'strategy' option is not defined. Our application only implemented 'allow_if_all_abstain'. It reverted to the default value 'false' while it was defined as 'true'.
How to reproduce
Change the default value of any of the access_decision_manager options but omit the 'strategy' option.
Possible Solution
I think it is caused by the following changes in Symfony\Bundle\SecurityBundle\DependencyInjection\MainConfiguration.php:
Additional context
I'm not sure if this is the lowest version in which this issue occurs, we upgraded from 3.3.18.