diff --git a/config/src/test/groovy/org/springframework/security/config/annotation/issue50/Issue50Tests.groovy b/config/src/test/groovy/org/springframework/security/config/annotation/issue50/Issue50Tests.groovy deleted file mode 100644 index 2449a46f2a..0000000000 --- a/config/src/test/groovy/org/springframework/security/config/annotation/issue50/Issue50Tests.groovy +++ /dev/null @@ -1,100 +0,0 @@ -/* - * Copyright 2002-2013 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.springframework.security.config.annotation.issue50; - -import org.springframework.beans.factory.annotation.Autowired -import org.springframework.security.access.AccessDeniedException -import org.springframework.security.authentication.AuthenticationManager -import org.springframework.security.authentication.BadCredentialsException -import org.springframework.security.authentication.TestingAuthenticationToken -import org.springframework.security.authentication.UsernamePasswordAuthenticationToken -import org.springframework.security.config.annotation.issue50.domain.User -import org.springframework.security.config.annotation.issue50.repo.UserRepository -import org.springframework.security.core.Authentication -import org.springframework.security.core.context.SecurityContextHolder -import org.springframework.security.core.userdetails.UsernameNotFoundException -import org.springframework.security.web.FilterChainProxy -import org.springframework.test.context.ContextConfiguration -import org.springframework.transaction.annotation.Transactional - -import spock.lang.Specification - -/** - * @author Rob Winch - * - */ -@ContextConfiguration(classes=[ApplicationConfig,SecurityConfig]) -@Transactional -class Issue50Tests extends Specification { - @Autowired - private FilterChainProxy springSecurityFilterChain - @Autowired - private AuthenticationManager authenticationManager - @Autowired - private UserRepository userRepo - - def setup() { - SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_ADMIN") - } - - def cleanup() { - SecurityContextHolder.clearContext() - } - - // https://github.com/SpringSource/spring-security-javaconfig/issues/50 - def "#50 - GlobalMethodSecurityConfiguration should load AuthenticationManager lazily"() { - when: - "Configuration Loads" - then: "GlobalMethodSecurityConfiguration loads AuthenticationManager lazily" - noExceptionThrown() - } - - def "AuthenticationManager will not authenticate missing user"() { - when: - authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "password")) - then: - thrown(UsernameNotFoundException) - } - - def "AuthenticationManager will not authenticate with invalid password"() { - when: - User user = new User(username:"test",password:"password") - userRepo.save(user) - authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , "invalid")) - then: - thrown(BadCredentialsException) - } - - def "AuthenticationManager can be used to authenticate a user"() { - when: - User user = new User(username:"test",password:"password") - userRepo.save(user) - Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password)) - then: - result.principal == user.username - } - - def "Global Method Security is enabled and works"() { - setup: - SecurityContextHolder.context.authentication = new TestingAuthenticationToken("test",null,"ROLE_USER") - when: - User user = new User(username:"denied",password:"password") - userRepo.save(user) - Authentication result = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.username , user.password)) - then: - thrown(AccessDeniedException) - } -} diff --git a/config/src/test/java/org/springframework/security/config/annotation/issue50/Issue50Tests.java b/config/src/test/java/org/springframework/security/config/annotation/issue50/Issue50Tests.java new file mode 100644 index 0000000000..b93b14fe00 --- /dev/null +++ b/config/src/test/java/org/springframework/security/config/annotation/issue50/Issue50Tests.java @@ -0,0 +1,96 @@ +/* + * Copyright 2002-2018 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.security.config.annotation.issue50; + +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.access.AccessDeniedException; +import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.authentication.BadCredentialsException; +import org.springframework.security.authentication.TestingAuthenticationToken; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.config.annotation.issue50.domain.User; +import org.springframework.security.config.annotation.issue50.repo.UserRepository; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.core.userdetails.UsernameNotFoundException; +import org.springframework.test.context.ContextConfiguration; +import org.springframework.test.context.junit4.SpringRunner; + +import javax.transaction.Transactional; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * @author Rob Winch + * + */ +@Transactional +@RunWith(SpringRunner.class) +@ContextConfiguration(classes = {ApplicationConfig.class, SecurityConfig.class}) +public class Issue50Tests { + @Autowired + private AuthenticationManager authenticationManager; + + @Autowired + private UserRepository userRepo; + + @Before + public void setup() { + SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("test", null, "ROLE_ADMIN")); + } + + @After + public void cleanup() { + SecurityContextHolder.clearContext(); + } + + @Test + // https://github.com/SpringSource/spring-security-javaconfig/issues/50 + public void loadWhenGlobalMethodSecurityConfigurationThenAuthenticationManagerLazy() { + // no exception + } + + @Test(expected = UsernameNotFoundException.class) + public void authenticateWhenMissingUserThenUsernameNotFoundException() { + this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "password")); + } + + @Test(expected = BadCredentialsException.class) + public void authenticateWhenInvalidPasswordThenBadCredentialsException() { + this.userRepo.save(User.withUsernameAndPassword("test", "password")); + this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("test", "invalid")); + } + + @Test + public void authenticateWhenValidUserThenAuthenticates() { + this.userRepo.save(User.withUsernameAndPassword("test", "password")); + Authentication result = this.authenticationManager + .authenticate(new UsernamePasswordAuthenticationToken("test", "password")); + assertThat(result.getName()).isEqualTo("test"); + } + + @Test(expected = AccessDeniedException.class) + public void globalMethodSecurityIsEnabledWhenNotAllowedThenAccessDenied() { + SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("test", null, "ROLE_USER")); + this.userRepo.save(User.withUsernameAndPassword("denied", "password")); + Authentication result = this.authenticationManager + .authenticate(new UsernamePasswordAuthenticationToken("test", "password")); + } +}