Question: Can you use cbauth (via cbsecurity) in a submodule?

[homestar9]

I'm trying to figure out if this is a bug, intentional behavior, or just user error on my part.

I have a Coldbox app that only needs to use cbauth (via cbsecurity) in a module. I have defined my cbsecurity settings in the module's ModuleConfig.cfc like this:

settings = {
      cbsecurity = {
                // Module Relocation when an invalid access is detected, instead of each rule declaring one.
                "invalidAuthenticationEvent" 	: "admin:errors.onAuthenticationFailure",
                // Default Auhtentication Action: override or redirect when a user has not logged in
                "defaultAuthenticationAction"	: "override",
                // Module override event when an invalid access is detected, instead of each rule declaring one.
                "invalidAuthorizationEvent"		: "admin:errors.onAuthorizationFailure",
                // Default Authorization Action: override or redirect when a user does not have enough permissions to access something
                "defaultAuthorizationAction"	: "override",
                // cbauth
                "userService"                   : "AuthenticationService@admin",
                // You can define your security rules here
                "rules"							: [
                    {
                        "secureList" 	: "admin:*",
                        "whitelist" 	: "admin:login"
                    }
                ]
            }

However, when I try to access the submodule I get the following error:
No [userServiceClass] provided. Please set in config/ColdBox.cfc under moduleSettings.cbauth.userServiceClass.

I can make the error go away if I put the following in my root app's Coldbox.cfc config file:

moduleSettings = {
            cbauth = {
                userServiceClass = "AuthenticationService@cms"
            }
        };

However, it smells funny to me to have to specify the cbauth settings in the app root if cbauth is only needed at the module level. Is this intentional behavior of cbauth? Or perhaps I am missing something?

[homestar9]

@elpete checking in on this issue to make sure you received it.
I believe the issue can be fixed by modifying AuthenticationService so that it gets the property userServiceClass from moduleSettings instead of Coldbox settings, right?

In other words, a module should be able to set up cbauth instead of relying on the root app to do it.

[elpete]

I believe when we set this up it was intended to set both manually in the config/ColdBox.cfc. That may have changed with cbSecurity 3.