2 changed files with 96 additions and 100 deletions
@ -1,100 +0,0 @@
@@ -1,100 +0,0 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.issue50; |
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired |
||||
import org.springframework.security.access.AccessDeniedException |
||||
import org.springframework.security.authentication.AuthenticationManager |
||||
import org.springframework.security.authentication.BadCredentialsException |
||||
import org.springframework.security.authentication.TestingAuthenticationToken |
||||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken |
||||
import org.springframework.security.config.annotation.issue50.domain.User |
||||
import org.springframework.security.config.annotation.issue50.repo.UserRepository |
||||
import org.springframework.security.core.Authentication |
||||
import org.springframework.security.core.context.SecurityContextHolder |
||||
import org.springframework.security.core.userdetails.UsernameNotFoundException |
||||
import org.springframework.security.web.FilterChainProxy |
||||
import org.springframework.test.context.ContextConfiguration |
||||
import org.springframework.transaction.annotation.Transactional |
||||
|
||||
import spock.lang.Specification |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
@ContextConfiguration(classes=[ApplicationConfig,SecurityConfig]) |
||||
@Transactional |
||||
class Issue50Tests extends Specification { |
||||
@Autowired |
||||
private FilterChainProxy springSecurityFilterChain |
||||
@Autowired |
||||
private AuthenticationManager authenticationManager |
||||
@Autowired |
||||
private UserRepository userRepo |
||||
|
||||
def setup() { |
||||
SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_ADMIN") |
||||
} |
||||
|
||||
def cleanup() { |
||||
SecurityContextHolder.clearContext() |
||||
} |
||||
|
||||
// https://github.com/SpringSource/spring-security-javaconfig/issues/50 |
||||
def "#50 - GlobalMethodSecurityConfiguration should load AuthenticationManager lazily"() { |
||||
when: |
||||
"Configuration Loads" |
||||
then: "GlobalMethodSecurityConfiguration loads AuthenticationManager lazily" |
||||
noExceptionThrown() |
||||
} |
||||
|
||||
def "AuthenticationManager will not authenticate missing user"() { |
||||
when: |
||||
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "password")) |
||||
then: |
||||
thrown(UsernameNotFoundException) |
||||
} |
||||
|
||||
def "AuthenticationManager will not authenticate with invalid password"() { |
||||
when: |
||||
User user = new User(username:"test",password:"password") |
||||
userRepo.save(user) |
||||
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , "invalid")) |
||||
then: |
||||
thrown(BadCredentialsException) |
||||
} |
||||
|
||||
def "AuthenticationManager can be used to authenticate a user"() { |
||||
when: |
||||
User user = new User(username:"test",password:"password") |
||||
userRepo.save(user) |
||||
Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password)) |
||||
then: |
||||
result.principal == user.username |
||||
} |
||||
|
||||
def "Global Method Security is enabled and works"() { |
||||
setup: |
||||
SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_USER") |
||||
when: |
||||
User user = new User(username:"denied",password:"password") |
||||
userRepo.save(user) |
||||
Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password)) |
||||
then: |
||||
thrown(AccessDeniedException) |
||||
} |
||||
} |
||||
@ -0,0 +1,96 @@
@@ -0,0 +1,96 @@
|
||||
/* |
||||
* Copyright 2002-2018 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.issue50; |
||||
|
||||
import org.junit.After; |
||||
import org.junit.Before; |
||||
import org.junit.Test; |
||||
import org.junit.runner.RunWith; |
||||
import org.springframework.beans.factory.annotation.Autowired; |
||||
import org.springframework.security.access.AccessDeniedException; |
||||
import org.springframework.security.authentication.AuthenticationManager; |
||||
import org.springframework.security.authentication.BadCredentialsException; |
||||
import org.springframework.security.authentication.TestingAuthenticationToken; |
||||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; |
||||
import org.springframework.security.config.annotation.issue50.domain.User; |
||||
import org.springframework.security.config.annotation.issue50.repo.UserRepository; |
||||
import org.springframework.security.core.Authentication; |
||||
import org.springframework.security.core.context.SecurityContextHolder; |
||||
import org.springframework.security.core.userdetails.UsernameNotFoundException; |
||||
import org.springframework.test.context.ContextConfiguration; |
||||
import org.springframework.test.context.junit4.SpringRunner; |
||||
|
||||
import javax.transaction.Transactional; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
@Transactional |
||||
@RunWith(SpringRunner.class) |
||||
@ContextConfiguration(classes = {ApplicationConfig.class, SecurityConfig.class}) |
||||
public class Issue50Tests { |
||||
@Autowired |
||||
private AuthenticationManager authenticationManager; |
||||
|
||||
@Autowired |
||||
private UserRepository userRepo; |
||||
|
||||
@Before |
||||
public void setup() { |
||||
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("test", null, "ROLE_ADMIN")); |
||||
} |
||||
|
||||
@After |
||||
public void cleanup() { |
||||
SecurityContextHolder.clearContext(); |
||||
} |
||||
|
||||
@Test |
||||
// https://github.com/SpringSource/spring-security-javaconfig/issues/50
|
||||
public void loadWhenGlobalMethodSecurityConfigurationThenAuthenticationManagerLazy() { |
||||
// no exception
|
||||
} |
||||
|
||||
@Test(expected = UsernameNotFoundException.class) |
||||
public void authenticateWhenMissingUserThenUsernameNotFoundException() { |
||||
this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "password")); |
||||
} |
||||
|
||||
@Test(expected = BadCredentialsException.class) |
||||
public void authenticateWhenInvalidPasswordThenBadCredentialsException() { |
||||
this.userRepo.save(User.withUsernameAndPassword("test", "password")); |
||||
this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "invalid")); |
||||
} |
||||
|
||||
@Test |
||||
public void authenticateWhenValidUserThenAuthenticates() { |
||||
this.userRepo.save(User.withUsernameAndPassword("test", "password")); |
||||
Authentication result = this.authenticationManager |
||||
.authenticate(new UsernamePasswordAuthenticationToken("test", "password")); |
||||
assertThat(result.getName()).isEqualTo("test"); |
||||
} |
||||
|
||||
@Test(expected = AccessDeniedException.class) |
||||
public void globalMethodSecurityIsEnabledWhenNotAllowedThenAccessDenied() { |
||||
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("test", null, "ROLE_USER")); |
||||
this.userRepo.save(User.withUsernameAndPassword("denied", "password")); |
||||
Authentication result = this.authenticationManager |
||||
.authenticate(new UsernamePasswordAuthenticationToken("test", "password")); |
||||
} |
||||
} |
||||
Loading…
Reference in new issue