From 17bef05c3cd132edbb710b14215e21d87f8bc2b7 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Mon, 1 Jul 2013 08:46:57 -0500 Subject: [PATCH] #138 WebInvocationPrivilegeEvaluator has default value --- .../annotation/web/builders/WebSecurity.java | 22 +++++++++++++++++-- .../WebSecurityConfigurerAdapter.java | 14 ++++++++---- .../AbstractInterceptUrlConfigurer.java | 1 + .../WebSecurityConfigurationTests.groovy | 22 +++++++++++++++++++ 4 files changed, 53 insertions(+), 6 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java index e96fc9ce8a..a6b48d8c04 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java @@ -88,6 +88,10 @@ public final class WebSecurity extends private SecurityExpressionHandler expressionHandler = new DefaultWebSecurityExpressionHandler(); + private Runnable postBuildAction = new Runnable() { + public void run() {} + }; + /** * Creates a new instance * @see WebSecurityConfiguration @@ -198,7 +202,7 @@ public final class WebSecurity extends /** * Set the {@link WebInvocationPrivilegeEvaluator} to be used. If this is * null, then a {@link DefaultWebInvocationPrivilegeEvaluator} will be - * created when {@link #setSecurityInterceptor(FilterSecurityInterceptor)} + * created when {@link #securityInterceptor(FilterSecurityInterceptor)} * is non null. * * @param privilegeEvaluator @@ -246,9 +250,22 @@ public final class WebSecurity extends /** * Sets the {@link FilterSecurityInterceptor}. This is typically invoked by {@link WebSecurityConfigurerAdapter}. * @param securityInterceptor the {@link FilterSecurityInterceptor} to use + * @return the {@link WebSecurity} for further customizations */ - public void setSecurityInterceptor(FilterSecurityInterceptor securityInterceptor) { + public WebSecurity securityInterceptor(FilterSecurityInterceptor securityInterceptor) { this.filterSecurityInterceptor = securityInterceptor; + return this; + } + + /** + * Executes the Runnable immediately after the build takes place + * + * @param postBuildAction + * @return the {@link WebSecurity} for further customizations + */ + public WebSecurity postBuildAction(Runnable postBuildAction) { + this.postBuildAction = postBuildAction; + return this; } @Override @@ -278,6 +295,7 @@ public final class WebSecurity extends "********************************************************************\n\n"); result = new DebugFilter(filterChainProxy); } + postBuildAction.run(); return result; } diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java index 773daf1b25..962daf01f7 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java @@ -243,12 +243,17 @@ public abstract class WebSecurityConfigurerAdapter implements SecurityConfigurer } @Override - public void init(WebSecurity web) throws Exception { - HttpSecurity http = getHttp(); - FilterSecurityInterceptor securityInterceptor = http.getSharedObject(FilterSecurityInterceptor.class); + public void init(final WebSecurity web) throws Exception { + final HttpSecurity http = getHttp(); web .addSecurityFilterChainBuilder(http) - .setSecurityInterceptor(securityInterceptor); + .postBuildAction(new Runnable() { + @Override + public void run() { + FilterSecurityInterceptor securityInterceptor = http.getSharedObject(FilterSecurityInterceptor.class); + web.securityInterceptor(securityInterceptor); + } + }); } /** @@ -298,6 +303,7 @@ public abstract class WebSecurityConfigurerAdapter implements SecurityConfigurer this.objectPostProcessor = objectPostProcessor; } + /** * Delays the use of the {@link AuthenticationManager} build from the * {@link AuthenticationManagerBuilder} to ensure that it has been fully diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractInterceptUrlConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractInterceptUrlConfigurer.java index c1a5cd424f..84dd79e666 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractInterceptUrlConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractInterceptUrlConfigurer.java @@ -106,6 +106,7 @@ abstract class AbstractInterceptUrlConfigurer,C if(filterSecurityInterceptorOncePerRequest != null) { securityInterceptor.setObserveOncePerRequest(filterSecurityInterceptorOncePerRequest); } + securityInterceptor = postProcess(securityInterceptor); http.addFilter(securityInterceptor); http.setSharedObject(FilterSecurityInterceptor.class, securityInterceptor); } diff --git a/config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.groovy b/config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.groovy index 796912e536..acfd786a14 100644 --- a/config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.groovy +++ b/config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.groovy @@ -32,6 +32,7 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.config.annotation.web.builders.WebSecurity import org.springframework.security.web.FilterChainProxy import org.springframework.security.web.SecurityFilterChain +import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator; import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator; import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler; import org.springframework.security.web.access.expression.WebSecurityExpressionHandler; @@ -235,4 +236,25 @@ class WebSecurityConfigurationTests extends BaseSpringSpec { .anyRequest().authenticated() } } + + def "#138 WebInvocationPrivilegeEvaluator defaults"() { + when: + loadConfig(WebInvocationPrivilegeEvaluatorDefaultsConfig) + then: + WebInvocationPrivilegeEvaluator wipe = context.getBean(WebInvocationPrivilegeEvaluator) + wipe instanceof DefaultWebInvocationPrivilegeEvaluator + wipe.securityInterceptor != null + } + + @EnableWebSecurity + @Configuration + static class WebInvocationPrivilegeEvaluatorDefaultsConfig extends WebSecurityConfigurerAdapter { + + @Override + protected void configure(HttpSecurity http) throws Exception { + http + .authorizeUrls() + .anyRequest().authenticated() + } + } }