Rob Winch
12 years ago
21 changed files with 994 additions and 68 deletions
@ -0,0 +1,91 @@
@@ -0,0 +1,91 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.authentication.configuration; |
||||
|
||||
import java.lang.annotation.Documented; |
||||
import java.lang.annotation.Retention; |
||||
import java.lang.annotation.Target; |
||||
|
||||
import org.springframework.context.annotation.Import; |
||||
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; |
||||
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; |
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; |
||||
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity; |
||||
|
||||
/** |
||||
* The {@link EnableGlobalAuthentication} annotation signals that the annotated |
||||
* class can be used to configure a global instance of |
||||
* {@link AuthenticationManagerBuilder}. For example: |
||||
* |
||||
* <pre class="code"> |
||||
* @Configuration |
||||
* @EnableGlobalAuthentication |
||||
* public class MyGlobalAuthenticationConfiguration { |
||||
* |
||||
* @Autowired |
||||
* public void configureGlobal(AuthenticationManagerBuilder auth) { |
||||
* auth |
||||
* .inMemoryAuthentication() |
||||
* .withUser("user").password("password").roles("USER").and() |
||||
* .withUser("admin").password("password").roles("USER", "ADMIN"); |
||||
* } |
||||
* } |
||||
* </pre> |
||||
* |
||||
* Annotations that are annotated with {@link EnableGlobalAuthentication} also |
||||
* signal that the annotated class can be used to configure a global instance of |
||||
* {@link AuthenticationManagerBuilder}. For example: |
||||
* |
||||
* <pre class="code"> |
||||
* @Configuration |
||||
* @EnableWebSecurity |
||||
* public class MyWebSecurityConfiguration extends WebSecurityConfigurerAdapter { |
||||
* |
||||
* @Autowired |
||||
* public void configureGlobal(AuthenticationManagerBuilder auth) { |
||||
* auth |
||||
* .inMemoryAuthentication() |
||||
* .withUser("user").password("password").roles("USER").and() |
||||
* .withUser("admin").password("password").roles("USER", "ADMIN"); |
||||
* } |
||||
* |
||||
* // Possibly overridden methods ...
|
||||
* } |
||||
* </pre> |
||||
* |
||||
* The following annotations are annotated with {@link EnableGlobalAuthentication} |
||||
* |
||||
* <ul> |
||||
* <li> {@link EnableWebSecurity} </li> |
||||
* <li> {@link EnableWebMvcSecurity} </li> |
||||
* <li> {@link EnableGlobalMethodSecurity} </li> |
||||
* </ul> |
||||
* |
||||
* Configuring {@link AuthenticationManagerBuilder} in a class without the {@link EnableGlobalAuthentication} annotation has |
||||
* unpredictable results. |
||||
* |
||||
* @see EnableWebMvcSecurity |
||||
* @see EnableWebSecurity |
||||
* @see EnableGlobalMethodSecurity |
||||
* |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
@Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME) |
||||
@Target(value={java.lang.annotation.ElementType.TYPE}) |
||||
@Documented |
||||
@Import(AuthenticationConfiguration.class) |
||||
public @interface EnableGlobalAuthentication {} |
||||
@ -0,0 +1,39 @@
@@ -0,0 +1,39 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.authentication.configurers; |
||||
|
||||
import org.springframework.core.annotation.Order; |
||||
import org.springframework.security.authentication.AuthenticationManager; |
||||
import org.springframework.security.config.annotation.SecurityConfigurer; |
||||
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; |
||||
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; |
||||
|
||||
/** |
||||
* A {@link SecurityConfigurer} that can be exposed as a bean to configure the |
||||
* global {@link AuthenticationManagerBuilder}. Beans of this type are |
||||
* automatically used by {@link AuthenticationConfiguration} to configure the |
||||
* global {@link AuthenticationManagerBuilder}. |
||||
* |
||||
* @since 3.2.1 |
||||
* @author Rob Winch |
||||
*/ |
||||
@Order(100) |
||||
public abstract class GlobalAuthenticationConfigurerAdapter implements SecurityConfigurer<AuthenticationManager, AuthenticationManagerBuilder> { |
||||
|
||||
public void init(AuthenticationManagerBuilder auth) throws Exception {} |
||||
|
||||
public void configure(AuthenticationManagerBuilder auth) throws Exception {} |
||||
} |
||||
@ -0,0 +1,295 @@
@@ -0,0 +1,295 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.authentication.configuration; |
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired |
||||
import org.springframework.context.annotation.Bean |
||||
import org.springframework.context.annotation.Configuration |
||||
import org.springframework.context.annotation.Import |
||||
import org.springframework.core.Ordered |
||||
import org.springframework.core.annotation.Order |
||||
import org.springframework.security.access.annotation.Secured |
||||
import org.springframework.security.authentication.AuthenticationManager |
||||
import org.springframework.security.authentication.TestingAuthenticationToken |
||||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken |
||||
import org.springframework.security.authentication.dao.DaoAuthenticationProvider; |
||||
import org.springframework.security.config.annotation.BaseSpringSpec |
||||
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder |
||||
import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter |
||||
import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration |
||||
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity |
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity |
||||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter |
||||
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity |
||||
import org.springframework.security.core.AuthenticationException |
||||
import org.springframework.security.core.authority.AuthorityUtils |
||||
import org.springframework.security.core.context.SecurityContextHolder |
||||
import org.springframework.security.core.userdetails.User |
||||
import org.springframework.security.provisioning.InMemoryUserDetailsManager |
||||
|
||||
class AuthenticationConfigurationTests extends BaseSpringSpec { |
||||
|
||||
def "Ordering Autowired on EnableGlobalMethodSecurity"() { |
||||
setup: |
||||
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER")) |
||||
when: |
||||
loadConfig(GlobalMethodSecurityAutowiredConfigAndServicesConfig) |
||||
then: |
||||
context.getBean(Service).run() |
||||
} |
||||
|
||||
@Configuration |
||||
@Import([GlobalMethodSecurityAutowiredConfig,ServicesConfig]) |
||||
static class GlobalMethodSecurityAutowiredConfigAndServicesConfig {} |
||||
|
||||
@Configuration |
||||
@EnableGlobalMethodSecurity(securedEnabled = true) |
||||
static class GlobalMethodSecurityAutowiredConfig { |
||||
@Autowired |
||||
public void configureGlobal(AuthenticationManagerBuilder auth) { |
||||
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER") |
||||
} |
||||
} |
||||
|
||||
def "Ordering Autowired on EnableWebSecurity"() { |
||||
setup: |
||||
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER")) |
||||
when: |
||||
loadConfig(GlobalMethodSecurityConfigAndServicesConfig) |
||||
then: |
||||
context.getBean(Service).run() |
||||
} |
||||
|
||||
@Configuration |
||||
@Import([GlobalMethodSecurityConfig,WebSecurityConfig,ServicesConfig]) |
||||
static class GlobalMethodSecurityConfigAndServicesConfig {} |
||||
|
||||
@Configuration |
||||
@EnableGlobalMethodSecurity(securedEnabled = true) |
||||
static class GlobalMethodSecurityConfig {} |
||||
|
||||
@Configuration |
||||
@EnableWebSecurity |
||||
static class WebSecurityConfig extends WebSecurityConfigurerAdapter { |
||||
@Autowired |
||||
public void configureGlobal(AuthenticationManagerBuilder auth) { |
||||
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER") |
||||
} |
||||
} |
||||
|
||||
// |
||||
|
||||
def "Ordering Autowired on EnableWebMvcSecurity"() { |
||||
setup: |
||||
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "password","ROLE_USER")) |
||||
when: |
||||
loadConfig(GlobalMethodSecurityMvcSecurityAndServicesConfig) |
||||
then: |
||||
context.getBean(Service).run() |
||||
} |
||||
|
||||
@Configuration |
||||
@Import([GlobalMethodSecurityConfig,WebMvcSecurityConfig,ServicesConfig]) |
||||
static class GlobalMethodSecurityMvcSecurityAndServicesConfig {} |
||||
|
||||
@Configuration |
||||
@EnableWebMvcSecurity |
||||
static class WebMvcSecurityConfig extends WebSecurityConfigurerAdapter { |
||||
@Autowired |
||||
public void configureGlobal(AuthenticationManagerBuilder auth) { |
||||
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER") |
||||
} |
||||
} |
||||
|
||||
// |
||||
|
||||
def "no authentication getAuthenticationManager falls back to null"() { |
||||
when: |
||||
loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration) |
||||
then: |
||||
context.getBean(AuthenticationConfiguration).authenticationManager == null |
||||
} |
||||
|
||||
def "QuiesentGlobalAuthenticationConfiguererAdapter falls back to null"() { |
||||
when: |
||||
loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,QuiesentGlobalAuthenticationConfiguererAdapter) |
||||
then: |
||||
context.getBean(AuthenticationConfiguration).authenticationManager == null |
||||
} |
||||
|
||||
@Configuration |
||||
static class QuiesentGlobalAuthenticationConfiguererAdapter extends GlobalAuthenticationConfigurerAdapter {} |
||||
|
||||
// |
||||
|
||||
def "GlobalAuthenticationConfiguererAdapterImpl configures authentication successfully"() { |
||||
setup: |
||||
def token = new UsernamePasswordAuthenticationToken("user", "password") |
||||
when: |
||||
loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,GlobalAuthenticationConfiguererAdapterImpl) |
||||
then: |
||||
context.getBean(AuthenticationConfiguration).authenticationManager.authenticate(token)?.name == "user" |
||||
} |
||||
|
||||
@Configuration |
||||
static class GlobalAuthenticationConfiguererAdapterImpl extends GlobalAuthenticationConfigurerAdapter { |
||||
public void init(AuthenticationManagerBuilder auth) throws Exception { |
||||
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER") |
||||
} |
||||
} |
||||
|
||||
// |
||||
|
||||
def "AuthenticationManagerBean configures authentication successfully"() { |
||||
setup: |
||||
def token = new UsernamePasswordAuthenticationToken("user", "password") |
||||
def auth = new UsernamePasswordAuthenticationToken("user", "password", AuthorityUtils.createAuthorityList("ROLE_USER")) |
||||
AuthenticationManagerBeanConfig.AM = Mock(AuthenticationManager) |
||||
1 * AuthenticationManagerBeanConfig.AM.authenticate(token) >> auth |
||||
when: |
||||
loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration,AuthenticationManagerBeanConfig) |
||||
then: |
||||
context.getBean(AuthenticationConfiguration).authenticationManager.authenticate(token).name == auth.name |
||||
} |
||||
|
||||
@Configuration |
||||
static class AuthenticationManagerBeanConfig { |
||||
static AuthenticationManager AM |
||||
@Bean |
||||
public AuthenticationManager authenticationManager() { |
||||
AM |
||||
} |
||||
} |
||||
|
||||
// |
||||
|
||||
@Configuration |
||||
static class ServicesConfig { |
||||
@Bean |
||||
public Service service() { |
||||
return new ServiceImpl() |
||||
} |
||||
} |
||||
|
||||
static interface Service { |
||||
public void run(); |
||||
} |
||||
|
||||
static class ServiceImpl implements Service { |
||||
@Secured("ROLE_USER") |
||||
public void run() {} |
||||
} |
||||
|
||||
// |
||||
|
||||
def "GlobalAuthenticationConfigurerAdapter are ordered"() { |
||||
setup: |
||||
loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration) |
||||
AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration) |
||||
config.setGlobalAuthenticationConfigurers([new LowestOrderGlobalAuthenticationConfigurerAdapter(), new HighestOrderGlobalAuthenticationConfigurerAdapter(), new DefaultOrderGlobalAuthenticationConfigurerAdapter()]) |
||||
when: |
||||
config.getAuthenticationManager() |
||||
then: |
||||
DefaultOrderGlobalAuthenticationConfigurerAdapter.inits == [HighestOrderGlobalAuthenticationConfigurerAdapter,DefaultOrderGlobalAuthenticationConfigurerAdapter,LowestOrderGlobalAuthenticationConfigurerAdapter] |
||||
DefaultOrderGlobalAuthenticationConfigurerAdapter.configs == [HighestOrderGlobalAuthenticationConfigurerAdapter,DefaultOrderGlobalAuthenticationConfigurerAdapter,LowestOrderGlobalAuthenticationConfigurerAdapter] |
||||
|
||||
} |
||||
|
||||
static class DefaultOrderGlobalAuthenticationConfigurerAdapter extends GlobalAuthenticationConfigurerAdapter { |
||||
static List inits = [] |
||||
static List configs = [] |
||||
|
||||
public void init(AuthenticationManagerBuilder auth) throws Exception { |
||||
inits.add(getClass()) |
||||
} |
||||
|
||||
public void configure(AuthenticationManagerBuilder auth) throws Exception { |
||||
configs.add(getClass()) |
||||
} |
||||
} |
||||
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) |
||||
static class LowestOrderGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {} |
||||
|
||||
@Order(Ordered.HIGHEST_PRECEDENCE) |
||||
static class HighestOrderGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter {} |
||||
|
||||
// |
||||
|
||||
def "Spring Boot not triggered when already configured"() { |
||||
setup: |
||||
loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration) |
||||
AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration) |
||||
config.setGlobalAuthenticationConfigurers([new ConfiguresInMemoryConfigurerAdapter(), new BootGlobalAuthenticationConfigurerAdapter()]) |
||||
AuthenticationManager authenticationManager = config.authenticationManager |
||||
when: |
||||
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password")) |
||||
then: |
||||
noExceptionThrown() |
||||
when: |
||||
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("boot","password")) |
||||
then: |
||||
thrown(AuthenticationException) |
||||
} |
||||
|
||||
|
||||
def "Spring Boot is triggered when not already configured"() { |
||||
setup: |
||||
loadConfig(AuthenticationConfiguration,ObjectPostProcessorConfiguration) |
||||
AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration) |
||||
config.setGlobalAuthenticationConfigurers([new BootGlobalAuthenticationConfigurerAdapter()]) |
||||
AuthenticationManager authenticationManager = config.authenticationManager |
||||
when: |
||||
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("boot","password")) |
||||
then: |
||||
noExceptionThrown() |
||||
} |
||||
|
||||
static class ConfiguresInMemoryConfigurerAdapter extends GlobalAuthenticationConfigurerAdapter { |
||||
|
||||
public void init(AuthenticationManagerBuilder auth) throws Exception { |
||||
auth |
||||
.inMemoryAuthentication() |
||||
.withUser("user").password("password").roles("USER") |
||||
} |
||||
} |
||||
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) |
||||
static class BootGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter { |
||||
public void init(AuthenticationManagerBuilder auth) throws Exception { |
||||
auth.apply(new DefaultBootGlobalAuthenticationConfigurerAdapter()) |
||||
} |
||||
} |
||||
|
||||
static class DefaultBootGlobalAuthenticationConfigurerAdapter extends DefaultOrderGlobalAuthenticationConfigurerAdapter { |
||||
@Override |
||||
public void configure(AuthenticationManagerBuilder auth) throws Exception { |
||||
if(auth.isConfigured()) { |
||||
return; |
||||
} |
||||
|
||||
User user = new User("boot","password", AuthorityUtils.createAuthorityList("ROLE_USER")) |
||||
|
||||
List<User> users = Arrays.asList(user); |
||||
InMemoryUserDetailsManager inMemory = new InMemoryUserDetailsManager(users); |
||||
|
||||
DaoAuthenticationProvider provider = new DaoAuthenticationProvider() |
||||
provider.userDetailsService = inMemory |
||||
|
||||
auth.authenticationProvider(provider) |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,68 @@
@@ -0,0 +1,68 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.issue50; |
||||
|
||||
import javax.sql.DataSource; |
||||
|
||||
import org.springframework.context.annotation.Bean; |
||||
import org.springframework.context.annotation.Configuration; |
||||
import org.springframework.data.jpa.repository.config.EnableJpaRepositories; |
||||
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder; |
||||
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType; |
||||
import org.springframework.orm.jpa.JpaTransactionManager; |
||||
import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean; |
||||
import org.springframework.orm.jpa.vendor.Database; |
||||
import org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter; |
||||
import org.springframework.security.config.annotation.issue50.domain.User; |
||||
import org.springframework.transaction.PlatformTransactionManager; |
||||
import org.springframework.transaction.annotation.EnableTransactionManagement; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
@Configuration |
||||
@EnableJpaRepositories("org.springframework.security.config.annotation.issue50.repo") |
||||
@EnableTransactionManagement |
||||
public class ApplicationConfig { |
||||
@Bean |
||||
public DataSource dataSource() { |
||||
EmbeddedDatabaseBuilder builder = new EmbeddedDatabaseBuilder(); |
||||
return builder.setType(EmbeddedDatabaseType.HSQL).build(); |
||||
} |
||||
|
||||
@Bean |
||||
public LocalContainerEntityManagerFactoryBean entityManagerFactory() { |
||||
HibernateJpaVendorAdapter vendorAdapter = new HibernateJpaVendorAdapter(); |
||||
vendorAdapter.setDatabase(Database.HSQL); |
||||
vendorAdapter.setGenerateDdl(true); |
||||
vendorAdapter.setShowSql(true); |
||||
|
||||
LocalContainerEntityManagerFactoryBean factory = new LocalContainerEntityManagerFactoryBean(); |
||||
factory.setJpaVendorAdapter(vendorAdapter); |
||||
factory.setPackagesToScan(User.class.getPackage().getName()); |
||||
factory.setDataSource(dataSource()); |
||||
|
||||
return factory; |
||||
} |
||||
|
||||
@Bean |
||||
public PlatformTransactionManager transactionManager() { |
||||
JpaTransactionManager txManager = new JpaTransactionManager(); |
||||
txManager.setEntityManagerFactory(entityManagerFactory().getObject()); |
||||
return txManager; |
||||
} |
||||
} |
||||
@ -0,0 +1,100 @@
@@ -0,0 +1,100 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.issue50; |
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired |
||||
import org.springframework.security.access.AccessDeniedException |
||||
import org.springframework.security.authentication.AuthenticationManager |
||||
import org.springframework.security.authentication.BadCredentialsException |
||||
import org.springframework.security.authentication.TestingAuthenticationToken |
||||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken |
||||
import org.springframework.security.config.annotation.issue50.domain.User |
||||
import org.springframework.security.config.annotation.issue50.repo.UserRepository |
||||
import org.springframework.security.core.Authentication |
||||
import org.springframework.security.core.context.SecurityContextHolder |
||||
import org.springframework.security.core.userdetails.UsernameNotFoundException |
||||
import org.springframework.security.web.FilterChainProxy |
||||
import org.springframework.test.context.ContextConfiguration |
||||
import org.springframework.transaction.annotation.Transactional |
||||
|
||||
import spock.lang.Specification |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
@ContextConfiguration(classes=[ApplicationConfig,SecurityConfig]) |
||||
@Transactional |
||||
class Issue50Tests extends Specification { |
||||
@Autowired |
||||
private FilterChainProxy springSecurityFilterChain |
||||
@Autowired |
||||
private AuthenticationManager authenticationManager |
||||
@Autowired |
||||
private UserRepository userRepo |
||||
|
||||
def setup() { |
||||
SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_ADMIN") |
||||
} |
||||
|
||||
def cleanup() { |
||||
SecurityContextHolder.clearContext() |
||||
} |
||||
|
||||
// https://github.com/SpringSource/spring-security-javaconfig/issues/50 |
||||
def "#50 - GlobalMethodSecurityConfiguration should load AuthenticationManager lazily"() { |
||||
when: |
||||
"Configuration Loads" |
||||
then: "GlobalMethodSecurityConfiguration loads AuthenticationManager lazily" |
||||
noExceptionThrown() |
||||
} |
||||
|
||||
def "AuthenticationManager will not authenticate missing user"() { |
||||
when: |
||||
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "password")) |
||||
then: |
||||
thrown(UsernameNotFoundException) |
||||
} |
||||
|
||||
def "AuthenticationManager will not authenticate with invalid password"() { |
||||
when: |
||||
User user = new User(username:"test",password:"password") |
||||
userRepo.save(user) |
||||
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , "invalid")) |
||||
then: |
||||
thrown(BadCredentialsException) |
||||
} |
||||
|
||||
def "AuthenticationManager can be used to authenticate a user"() { |
||||
when: |
||||
User user = new User(username:"test",password:"password") |
||||
userRepo.save(user) |
||||
Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password)) |
||||
then: |
||||
result.principal == user.username |
||||
} |
||||
|
||||
def "Global Method Security is enabled and works"() { |
||||
setup: |
||||
SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_USER") |
||||
when: |
||||
User user = new User(username:"denied",password:"password") |
||||
userRepo.save(user) |
||||
Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password)) |
||||
then: |
||||
thrown(AccessDeniedException) |
||||
} |
||||
} |
||||
@ -0,0 +1,90 @@
@@ -0,0 +1,90 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.issue50; |
||||
|
||||
import org.spockframework.util.Assert; |
||||
import org.springframework.beans.factory.annotation.Autowired; |
||||
import org.springframework.context.annotation.Bean; |
||||
import org.springframework.context.annotation.Configuration; |
||||
import org.springframework.security.authentication.AuthenticationManager; |
||||
import org.springframework.security.authentication.AuthenticationProvider; |
||||
import org.springframework.security.authentication.BadCredentialsException; |
||||
import org.springframework.security.authentication.TestingAuthenticationToken; |
||||
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; |
||||
import org.springframework.security.config.annotation.issue50.domain.User; |
||||
import org.springframework.security.config.annotation.issue50.repo.UserRepository; |
||||
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; |
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity; |
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; |
||||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; |
||||
import org.springframework.security.core.Authentication; |
||||
import org.springframework.security.core.AuthenticationException; |
||||
import org.springframework.security.core.userdetails.UsernameNotFoundException; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
@EnableWebSecurity |
||||
@EnableGlobalMethodSecurity(prePostEnabled = true) |
||||
@Configuration |
||||
public class SecurityConfig extends WebSecurityConfigurerAdapter { |
||||
@Autowired |
||||
private UserRepository myUserRepository; |
||||
|
||||
@Override |
||||
protected void configure(AuthenticationManagerBuilder auth) throws Exception { |
||||
auth |
||||
.authenticationProvider(authenticationProvider()); |
||||
} |
||||
|
||||
@Override |
||||
protected void configure(HttpSecurity http) throws Exception { |
||||
http |
||||
.authorizeRequests() |
||||
.antMatchers("/*").permitAll(); |
||||
} |
||||
|
||||
@Bean |
||||
@Override |
||||
public AuthenticationManager authenticationManagerBean() |
||||
throws Exception { |
||||
return super.authenticationManagerBean(); |
||||
} |
||||
|
||||
@Bean |
||||
public AuthenticationProvider authenticationProvider() { |
||||
Assert.notNull(myUserRepository); |
||||
return new AuthenticationProvider() { |
||||
public boolean supports(Class<?> authentication) { |
||||
return true; |
||||
} |
||||
public Authentication authenticate(Authentication authentication) |
||||
throws AuthenticationException { |
||||
Object principal = authentication.getPrincipal(); |
||||
String username = String.valueOf(principal); |
||||
User user = myUserRepository.findByUsername(username); |
||||
if(user == null) { |
||||
throw new UsernameNotFoundException("No user for principal "+principal); |
||||
} |
||||
if(!authentication.getCredentials().equals(user.getPassword())) { |
||||
throw new BadCredentialsException("Invalid password"); |
||||
} |
||||
return new TestingAuthenticationToken(principal, null, "ROLE_USER"); |
||||
} |
||||
}; |
||||
} |
||||
} |
||||
@ -0,0 +1,62 @@
@@ -0,0 +1,62 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.issue50.domain; |
||||
|
||||
import javax.persistence.Entity; |
||||
import javax.persistence.GeneratedValue; |
||||
import javax.persistence.GenerationType; |
||||
import javax.persistence.Id; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
@Entity |
||||
public class User { |
||||
|
||||
@Id |
||||
@GeneratedValue(strategy = GenerationType.AUTO) |
||||
private Long id; |
||||
|
||||
private String username; |
||||
|
||||
private String password; |
||||
|
||||
public Long getId() { |
||||
return id; |
||||
} |
||||
|
||||
public void setId(Long id) { |
||||
this.id = id; |
||||
} |
||||
|
||||
public String getUsername() { |
||||
return username; |
||||
} |
||||
|
||||
public void setUsername(String username) { |
||||
this.username = username; |
||||
} |
||||
|
||||
public String getPassword() { |
||||
return password; |
||||
} |
||||
|
||||
public void setPassword(String password) { |
||||
this.password = password; |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,30 @@
@@ -0,0 +1,30 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.issue50.repo; |
||||
|
||||
import org.springframework.data.repository.CrudRepository; |
||||
import org.springframework.security.access.prepost.PreAuthorize; |
||||
import org.springframework.security.config.annotation.issue50.domain.User; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
public interface UserRepository extends CrudRepository<User, String> { |
||||
|
||||
@PreAuthorize("hasRole('ROLE_ADMIN')") |
||||
User findByUsername(String username); |
||||
} |
||||
Loading…
Reference in new issue