GitHub-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

SEC-271: Fixed IllegalStateException being thrown by LogoutHandlerOrdereResolver and add an assert statement in the unit test

1.0.x
Vishal Puri 19 years ago
parent
a01bb3bbee
commit
a934f82af4
4 changed files with 200 additions and 159 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 8
      core/src/main/java/org/acegisecurity/config/LogoutHandlerOrderResolver.java
  2. 14
      core/src/test/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParserTests.java
  3. 3
      core/src/test/resources/org/acegisecurity/config/logout-filter-with-handlers.xml
  4. 152
      samples/tutorial/src/webapp/WEB-INF/applicationContext-acegi-security.xml

8
core/src/main/java/org/acegisecurity/config/LogoutHandlerOrderResolver.java
Unescape View File

@ -67,11 +67,15 @@ public class LogoutHandlerOrderResolver implements BeanFactoryPostProcessor { @@ -67,11 +67,15 @@ public class LogoutHandlerOrderResolver implements BeanFactoryPostProcessor {
for (int i = 0, n = names.length; i < n; i++) {
RootBeanDefinition definition = (RootBeanDefinition) beanFactory.getBeanDefinition(names[i]);
if (definition.hasBeanClass()) {
if (Ordered.class.isAssignableFrom(definition.getBeanClass())) {
definition.getPropertyValues().addPropertyValue("order", new Integer(getOrder(definition.getBeanClass())));
} else {
definition.getPropertyValues().addPropertyValue("order",
new Integer(getOrder(definition.getBeanClass())));
}
else {
definition.getPropertyValues().addPropertyValue("order", new Integer(Integer.MAX_VALUE));
}
}
list.add(definition);
}
Collections.sort(list, new OrderComparator());

14
core/src/test/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParserTests.java
Unescape View File

@ -3,11 +3,15 @@ @@ -3,11 +3,15 @@
*/
package org.acegisecurity.config;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import java.util.Map;
import junit.framework.TestCase;
import org.acegisecurity.ui.logout.LogoutHandler;
import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;
/**
* @author vpuri
*
@ -15,7 +19,11 @@ import junit.framework.TestCase; @@ -15,7 +19,11 @@ import junit.framework.TestCase;
public class LogoutFilterBeanDefinitionParserTests extends TestCase {
public void testLogoutFilter() {
ApplicationContext context = new ClassPathXmlApplicationContext("org/acegisecurity/config/logout-filter-with-handlers.xml");
ApplicationContext context = new ClassPathXmlApplicationContext(
"org/acegisecurity/config/logout-filter-with-handlers.xml");
ConfigurableListableBeanFactory bf = (ConfigurableListableBeanFactory) context.getAutowireCapableBeanFactory();
Map m = bf.getBeansOfType(LogoutHandler.class);
assertEquals(2, m.size());
}
}

3
core/src/test/resources/org/acegisecurity/config/logout-filter-with-handlers.xml
Unescape View File

@ -19,6 +19,9 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc @@ -19,6 +19,9 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc
<security:authentication-remember-me-services
id="rememberMeServices" key="someValue" />
<bean id="SecurityContextLogoutHandler"
class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler" />
<security:principal-repository id="userDetailsService">
<security:user-definition username="vishal"
password="nottellingya" enabled="true">

152
samples/tutorial/src/webapp/WEB-INF/applicationContext-acegi-security.xml
Unescape View File

@ -1,5 +1,12 @@ @@ -1,5 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/beans/spring-util-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
<!--
- A simple "base bones" Acegi Security configuration.
@ -16,9 +23,10 @@ @@ -16,9 +23,10 @@
- $Id$
-->
<beans>
<bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
<bean id="filterChainProxy"
class="org.acegisecurity.util.FilterChainProxy">
<property name="filterInvocationDefinitionSource">
<value>
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
@ -28,61 +36,82 @@ @@ -28,61 +36,82 @@
</property>
</bean>
<bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
<!-- sessionCreation defaults to ifRequired(true) always(true) never(false) . -->
<security:session-context-integration
id="httpSessionContextIntegrationFilter" sessionCreation="ifRequired" />
<bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">
<constructor-arg value="/index.jsp"/> <!-- URL redirected to after logout -->
<constructor-arg>
<list>
<ref bean="rememberMeServices"/>
<bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>
</list>
</constructor-arg>
</bean>
<bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationFailureUrl" value="/acegilogin.jsp?login_error=1"/>
<property name="defaultTargetUrl" value="/"/>
<property name="filterProcessesUrl" value="/j_acegi_security_check"/>
<property name="rememberMeServices" ref="rememberMeServices"/>
</bean>
<!-- If LogoutFilter does not have setHandlers populated, introspect app ctx for LogoutHandlers, using Ordered (if present, otherwise assume Integer.MAX_VALUE) -->
<!-- The logoutUrl and redirectAfterLogout are both optional and default to that shown -->
<security:logout-support id="logoutFilter"
redirectAfterLogoutUrl="/index.jsp" />
<bean id="securityContextHolderAwareRequestFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>
<security:authentication-remember-me-services
id="rememberMeServices" key="someValue" />
<bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="rememberMeServices" ref="rememberMeServices"/>
</bean>
<bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
<bean id="securityContextLogoutHandler"
class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler" />
<!-- the URLs are all mandatory and have no defaults (well, except authenticationUrl) -->
<security:authentication-form id="authenticationProcessinFilter"
authenticationUrl="/j_acegi_security_check" defaultTargetUrl="/"
errorFormUrl="/acegilogin.jsp?login_error=1" />
<!-- make it optional, if not supplied autodetect all auth-providers from app ctx, using Ordered to resolve their order -->
<security:authentication-mechanism id="authenticationManager" />
<!-- dao authentication provider "authenticationRepository" -->
<security:authentication-repository id="daoAuthenticationProvider" />
<bean id="securityContextHolderAwareRequestFilter"
class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter" />
<!-- makes the filter, but does little else, as it auto-detects everything -->
<security:authentication-remember-me-filter id="rememberMeFilter" />
<bean id="anonymousProcessingFilter"
class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
<property name="key" value="changeThis" />
<property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/>
<property name="userAttribute"
value="anonymousUser,ROLE_ANONYMOUS" />
</bean>
<bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
<property name="authenticationEntryPoint">
<bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
<!-- Basically accessDeniedUrl is optional, we if unspecified impl will auto-detect any AccessDeniedHandler in ctx and use it;
alternately if there are > 1 such handlers, we can nominate the one to use via accessDeniedBeanRef; provide nested elements for
other props; i do not mind if you move the access denied stuff to a sub-element -->
<security:exception-translation id="exceptionTranslationFilter">
<security:entry-point
entryPointBeanRef="authenticationEntryPoint" />
</security:exception-translation>
<bean id="authenticationEntryPoint"
class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
<property name="loginFormUrl" value="/acegilogin.jsp" />
<property name="forceHttps" value="false" />
</bean>
</property>
<property name="accessDeniedHandler">
<bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
<bean id="accessDeniedHandler"
class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
<property name="errorPage" value="/accessDenied.jsp" />
</bean>
</property>
</bean>
<bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<bean id="filterInvocationInterceptor"
class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager"
ref="authenticationManager" />
<property name="accessDecisionManager">
<bean class="org.acegisecurity.vote.AffirmativeBased">
<property name="allowIfAllAbstainDecisions" value="false"/>
<property name="allowIfAllAbstainDecisions"
value="false" />
<property name="decisionVoters">
<list>
<bean class="org.acegisecurity.vote.RoleVoter" />
<bean class="org.acegisecurity.vote.AuthenticatedVoter"/>
<bean
class="org.acegisecurity.vote.AuthenticatedVoter" />
</list>
</property>
</bean>
@ -98,51 +127,48 @@ @@ -98,51 +127,48 @@
</property>
</bean>
<bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
<property name="userDetailsService" ref="userDetailsService"/>
<property name="key" value="changeThis"/>
</bean>
<bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
<!--<bean id="authenticationManager"
class="org.acegisecurity.providers.ProviderManager">
<property name="providers">
<list>
<ref local="daoAuthenticationProvider" />
<bean class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
<bean
class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
<property name="key" value="changeThis" />
</bean>
<bean class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
<bean
class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
<property name="key" value="changeThis" />
</bean>
</list>
</property>
</bean>
</bean>-->
<bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
<property name="userDetailsService" ref="userDetailsService"/>
<property name="userCache">
<bean class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
<bean id="userCache"
class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
<property name="cache">
<bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
<bean
class="org.springframework.cache.ehcache.EhCacheFactoryBean">
<property name="cacheManager">
<bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
<bean
class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />
</property>
<property name="cacheName" value="userCache" />
</bean>
</property>
</bean>
</property>
</bean>
<!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->
<bean id="userDetailsService" class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
<property name="userProperties">
<bean class="org.springframework.beans.factory.config.PropertiesFactoryBean">
<property name="location" value="/WEB-INF/users.properties"/>
</bean>
</property>
</bean>
<security:principal-repository id="userDetailsService">
<security:properties resource="/WEB-INF/users.properties" />
</security:principal-repository>
<!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
<bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener"/>
<bean id="loggerListener"
class="org.acegisecurity.event.authentication.LoggerListener" />
</beans>
Write Preview
Loading…
Cancel
Save