SecurityContextHolderAwareRequestConfig groovy->java
Issue: gh-4939
This commit is contained in:
Josh Cummings
parent
de95583509
commit
3332ccbe50
|
|
@ -1,171 +0,0 @@
|
|||
/*
|
||||
* Copyright 2002-2012 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.config.http
|
||||
|
||||
import static org.springframework.security.config.ConfigTestUtils.AUTH_PROVIDER_XML
|
||||
|
||||
import java.io.IOException;
|
||||
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.ServletRequest;
|
||||
import javax.servlet.ServletResponse;
|
||||
import javax.servlet.http.HttpServletRequest
|
||||
import javax.servlet.http.HttpServletResponse
|
||||
|
||||
import org.springframework.mock.web.MockFilterChain
|
||||
import org.springframework.mock.web.MockHttpServletRequest
|
||||
import org.springframework.mock.web.MockHttpServletResponse
|
||||
import org.springframework.security.authentication.TestingAuthenticationToken
|
||||
import org.springframework.security.core.context.SecurityContext
|
||||
import org.springframework.security.core.context.SecurityContextHolder
|
||||
import org.springframework.security.web.access.ExceptionTranslationFilter
|
||||
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
|
||||
import org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler
|
||||
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler
|
||||
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint
|
||||
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter
|
||||
import org.springframework.security.web.context.HttpSessionSecurityContextRepository
|
||||
import org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Rob Winch
|
||||
*/
|
||||
class SecurityContextHolderAwareRequestConfigTests extends AbstractHttpConfigTests {
|
||||
|
||||
def withAutoConfig() {
|
||||
httpAutoConfig () {
|
||||
csrf(disabled:true)
|
||||
}
|
||||
createAppContext(AUTH_PROVIDER_XML)
|
||||
|
||||
def securityContextAwareFilter = getFilter(SecurityContextHolderAwareRequestFilter)
|
||||
|
||||
expect:
|
||||
securityContextAwareFilter.authenticationEntryPoint.loginFormUrl == getFilter(ExceptionTranslationFilter).authenticationEntryPoint.loginFormUrl
|
||||
securityContextAwareFilter.authenticationManager == getFilter(UsernamePasswordAuthenticationFilter).authenticationManager
|
||||
securityContextAwareFilter.logoutHandlers.size() == 1
|
||||
securityContextAwareFilter.logoutHandlers[0].class == SecurityContextLogoutHandler
|
||||
}
|
||||
|
||||
def explicitEntryPoint() {
|
||||
xml.http() {
|
||||
'http-basic'('entry-point-ref': 'ep')
|
||||
}
|
||||
bean('ep', BasicAuthenticationEntryPoint.class.name, ['realmName':'whocares'],[:])
|
||||
createAppContext(AUTH_PROVIDER_XML)
|
||||
|
||||
def securityContextAwareFilter = getFilter(SecurityContextHolderAwareRequestFilter)
|
||||
|
||||
expect:
|
||||
securityContextAwareFilter.authenticationEntryPoint == getFilter(ExceptionTranslationFilter).authenticationEntryPoint
|
||||
securityContextAwareFilter.authenticationManager == getFilter(BasicAuthenticationFilter).authenticationManager
|
||||
securityContextAwareFilter.logoutHandlers == null
|
||||
}
|
||||
|
||||
def formLogin() {
|
||||
xml.http() {
|
||||
'form-login'()
|
||||
}
|
||||
createAppContext(AUTH_PROVIDER_XML)
|
||||
|
||||
def securityContextAwareFilter = getFilter(SecurityContextHolderAwareRequestFilter)
|
||||
|
||||
expect:
|
||||
securityContextAwareFilter.authenticationEntryPoint.loginFormUrl == getFilter(ExceptionTranslationFilter).authenticationEntryPoint.loginFormUrl
|
||||
securityContextAwareFilter.authenticationManager == getFilter(UsernamePasswordAuthenticationFilter).authenticationManager
|
||||
securityContextAwareFilter.logoutHandlers == null
|
||||
}
|
||||
|
||||
def multiHttp() {
|
||||
xml.http('authentication-manager-ref' : 'authManager', 'pattern' : '/first/**') {
|
||||
'form-login'('login-page' : '/login')
|
||||
'logout'('invalidate-session' : 'true')
|
||||
csrf(disabled:true)
|
||||
}
|
||||
xml.http('authentication-manager-ref' : 'authManager2') {
|
||||
'form-login'('login-page' : '/login2')
|
||||
'logout'('invalidate-session' : 'false')
|
||||
csrf(disabled:true)
|
||||
}
|
||||
|
||||
String secondAuthManager = AUTH_PROVIDER_XML.replace("alias='authManager'", "id='authManager2'")
|
||||
createAppContext(AUTH_PROVIDER_XML + secondAuthManager)
|
||||
|
||||
def securityContextAwareFilter = getFilters('/first/filters').find { it instanceof SecurityContextHolderAwareRequestFilter }
|
||||
def secondSecurityContextAwareFilter = getFilter(SecurityContextHolderAwareRequestFilter)
|
||||
|
||||
expect:
|
||||
securityContextAwareFilter.authenticationEntryPoint.loginFormUrl == '/login'
|
||||
securityContextAwareFilter.authenticationManager == getFilters('/first/filters').find { it instanceof UsernamePasswordAuthenticationFilter}.authenticationManager
|
||||
securityContextAwareFilter.authenticationManager.parent == appContext.getBean('authManager')
|
||||
securityContextAwareFilter.logoutHandlers.size() == 1
|
||||
securityContextAwareFilter.logoutHandlers[0].class == SecurityContextLogoutHandler
|
||||
securityContextAwareFilter.logoutHandlers[0].invalidateHttpSession == true
|
||||
|
||||
secondSecurityContextAwareFilter.authenticationEntryPoint.loginFormUrl == '/login2'
|
||||
secondSecurityContextAwareFilter.authenticationManager == getFilter(UsernamePasswordAuthenticationFilter).authenticationManager
|
||||
secondSecurityContextAwareFilter.authenticationManager.parent == appContext.getBean('authManager2')
|
||||
securityContextAwareFilter.logoutHandlers.size() == 1
|
||||
secondSecurityContextAwareFilter.logoutHandlers[0].class == SecurityContextLogoutHandler
|
||||
secondSecurityContextAwareFilter.logoutHandlers[0].invalidateHttpSession == false
|
||||
}
|
||||
|
||||
def logoutCustom() {
|
||||
xml.http() {
|
||||
'form-login'('login-page' : '/login')
|
||||
'logout'('invalidate-session' : 'false', 'logout-success-url' : '/login?logout', 'delete-cookies' : 'JSESSIONID')
|
||||
csrf(disabled:true)
|
||||
}
|
||||
createAppContext(AUTH_PROVIDER_XML)
|
||||
|
||||
def securityContextAwareFilter = getFilter(SecurityContextHolderAwareRequestFilter)
|
||||
|
||||
expect:
|
||||
securityContextAwareFilter.authenticationEntryPoint.loginFormUrl == getFilter(ExceptionTranslationFilter).authenticationEntryPoint.loginFormUrl
|
||||
securityContextAwareFilter.authenticationManager == getFilter(UsernamePasswordAuthenticationFilter).authenticationManager
|
||||
securityContextAwareFilter.logoutHandlers.size() == 2
|
||||
securityContextAwareFilter.logoutHandlers[0].class == SecurityContextLogoutHandler
|
||||
securityContextAwareFilter.logoutHandlers[0].invalidateHttpSession == false
|
||||
securityContextAwareFilter.logoutHandlers[1].class == CookieClearingLogoutHandler
|
||||
securityContextAwareFilter.logoutHandlers[1].cookiesToClear == ['JSESSIONID']
|
||||
}
|
||||
|
||||
def 'SEC-2926: Role Prefix is set'() {
|
||||
setup:
|
||||
httpAutoConfig () {
|
||||
|
||||
}
|
||||
createAppContext(AUTH_PROVIDER_XML)
|
||||
|
||||
MockFilterChain chain = new MockFilterChain() {
|
||||
public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
|
||||
assert request.isUserInRole("USER")
|
||||
|
||||
super.doFilter(request,response)
|
||||
}
|
||||
}
|
||||
MockHttpServletRequest request = new MockHttpServletRequest(method:'GET')
|
||||
SecurityContext context = SecurityContextHolder.createEmptyContext()
|
||||
context.setAuthentication(new TestingAuthenticationToken("user", "pass", "ROLE_USER"))
|
||||
request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, context)
|
||||
|
||||
when:
|
||||
springSecurityFilterChain.doFilter(request, new MockHttpServletResponse(), chain)
|
||||
then:
|
||||
chain.request != null
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,302 @@
|
|||
/*
|
||||
* Copyright 2002-2018 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.config.http;
|
||||
|
||||
import org.apache.http.HttpHeaders;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.mock.web.MockHttpSession;
|
||||
import org.springframework.security.config.test.SpringTestRule;
|
||||
import org.springframework.security.core.context.SecurityContextHolder;
|
||||
import org.springframework.security.test.context.annotation.SecurityTestExecutionListeners;
|
||||
import org.springframework.security.test.context.support.WithMockUser;
|
||||
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
import org.springframework.test.web.servlet.MvcResult;
|
||||
import org.springframework.web.bind.annotation.GetMapping;
|
||||
import org.springframework.web.bind.annotation.RestController;
|
||||
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.hamcrest.core.StringContains.containsString;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.cookie;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Rob Winch
|
||||
* @author Josh Cummings
|
||||
*/
|
||||
@RunWith(SpringJUnit4ClassRunner.class)
|
||||
@SecurityTestExecutionListeners
|
||||
public class SecurityContextHolderAwareRequestConfigTests {
|
||||
|
||||
private static final String CONFIG_LOCATION_PREFIX =
|
||||
"classpath:org/springframework/security/config/http/SecurityContextHolderAwareRequestConfigTests";
|
||||
|
||||
@Rule
|
||||
public final SpringTestRule spring = new SpringTestRule();
|
||||
|
||||
@Autowired
|
||||
private MockMvc mvc;
|
||||
|
||||
@Test
|
||||
public void servletLoginWhenUsingDefaultConfigurationThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("Simple")).autowire();
|
||||
|
||||
this.mvc.perform(get("/good-login"))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(content().string("user"));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletAuthenticateWhenUsingDefaultConfigurationThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("Simple")).autowire();
|
||||
|
||||
this.mvc.perform(get("/authenticate"))
|
||||
.andExpect(status().isFound())
|
||||
.andExpect(redirectedUrl("http://localhost/login"));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletLogoutWhenUsingDefaultConfigurationThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("Simple")).autowire();
|
||||
|
||||
MvcResult result = this.mvc.perform(get("/good-login")).andReturn();
|
||||
|
||||
MockHttpSession session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNotNull();
|
||||
|
||||
result = this.mvc.perform(get("/do-logout").session(session))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(content().string(""))
|
||||
.andReturn();
|
||||
|
||||
session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNull();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletAuthenticateWhenUsingHttpBasicThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("HttpBasic")).autowire();
|
||||
|
||||
this.mvc.perform(get("/authenticate"))
|
||||
.andExpect(status().isUnauthorized())
|
||||
.andExpect(header().string(HttpHeaders.WWW_AUTHENTICATE, containsString("discworld")));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletAuthenticateWhenUsingFormLoginThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("FormLogin")).autowire();
|
||||
|
||||
this.mvc.perform(get("/authenticate"))
|
||||
.andExpect(status().isFound())
|
||||
.andExpect(redirectedUrl("http://localhost/login"));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletLoginWhenUsingMultipleHttpConfigsThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("MultiHttp")).autowire();
|
||||
|
||||
this.mvc.perform(get("/good-login"))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(content().string("user"));
|
||||
|
||||
this.mvc.perform(get("/v2/good-login"))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(content().string("user2"));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletAuthenticateWhenUsingMultipleHttpConfigsThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("MultiHttp")).autowire();
|
||||
|
||||
this.mvc.perform(get("/authenticate"))
|
||||
.andExpect(status().isFound())
|
||||
.andExpect(redirectedUrl("http://localhost/login"));
|
||||
|
||||
this.mvc.perform(get("/v2/authenticate"))
|
||||
.andExpect(status().isFound())
|
||||
.andExpect(redirectedUrl("http://localhost/login2"));
|
||||
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletLogoutWhenUsingMultipleHttpConfigsThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("MultiHttp")).autowire();
|
||||
|
||||
MvcResult result = this.mvc.perform(get("/good-login")).andReturn();
|
||||
|
||||
MockHttpSession session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNotNull();
|
||||
|
||||
result = this.mvc.perform(get("/do-logout").session(session))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(content().string(""))
|
||||
.andReturn();
|
||||
|
||||
session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNotNull();
|
||||
|
||||
result = this.mvc.perform(get("/v2/good-login")).andReturn();
|
||||
|
||||
session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNotNull();
|
||||
|
||||
result = this.mvc.perform(get("/v2/do-logout").session(session))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(content().string(""))
|
||||
.andReturn();
|
||||
|
||||
session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNull();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void servletLogoutWhenUsingCustomLogoutThenUsesSpringSecurity()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("Logout")).autowire();
|
||||
|
||||
this.mvc.perform(get("/authenticate"))
|
||||
.andExpect(status().isFound())
|
||||
.andExpect(redirectedUrl("http://localhost/signin"));
|
||||
|
||||
MvcResult result = this.mvc.perform(get("/good-login")).andReturn();
|
||||
|
||||
MockHttpSession session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNotNull();
|
||||
|
||||
result = this.mvc.perform(get("/do-logout").session(session))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(content().string(""))
|
||||
.andExpect(cookie().maxAge("JSESSIONID", 0))
|
||||
.andReturn();
|
||||
|
||||
session = (MockHttpSession) result.getRequest().getSession(false);
|
||||
|
||||
assertThat(session).isNotNull();
|
||||
}
|
||||
|
||||
/**
|
||||
* SEC-2926: Role Prefix is set
|
||||
*/
|
||||
@Test
|
||||
@WithMockUser
|
||||
public void servletIsUserInRoleWhenUsingDefaultConfigThenRoleIsSet()
|
||||
throws Exception {
|
||||
|
||||
this.spring.configLocations(this.xml("Simple")).autowire();
|
||||
|
||||
this.mvc.perform(get("/role")).andExpect(content().string("true"));
|
||||
}
|
||||
|
||||
@RestController
|
||||
public static class ServletAuthenticatedController {
|
||||
@GetMapping("/v2/good-login")
|
||||
public String v2Login(HttpServletRequest request) throws ServletException {
|
||||
|
||||
request.login("user2", "password2");
|
||||
|
||||
return this.principal();
|
||||
}
|
||||
|
||||
@GetMapping("/good-login")
|
||||
public String login(HttpServletRequest request) throws ServletException {
|
||||
|
||||
request.login("user", "password");
|
||||
|
||||
return this.principal();
|
||||
}
|
||||
|
||||
@GetMapping("/v2/authenticate")
|
||||
public String v2Authenticate(HttpServletRequest request, HttpServletResponse response)
|
||||
throws IOException, ServletException {
|
||||
|
||||
return this.authenticate(request, response);
|
||||
}
|
||||
|
||||
@GetMapping("/authenticate")
|
||||
public String authenticate(HttpServletRequest request, HttpServletResponse response)
|
||||
throws IOException, ServletException {
|
||||
|
||||
request.authenticate(response);
|
||||
|
||||
return this.principal();
|
||||
}
|
||||
|
||||
@GetMapping("/v2/do-logout")
|
||||
public String v2Logout(HttpServletRequest request) throws ServletException {
|
||||
return this.logout(request);
|
||||
}
|
||||
|
||||
@GetMapping("/do-logout")
|
||||
public String logout(HttpServletRequest request) throws ServletException {
|
||||
request.logout();
|
||||
|
||||
return this.principal();
|
||||
}
|
||||
|
||||
@GetMapping("/role")
|
||||
public String role(HttpServletRequest request) {
|
||||
return String.valueOf(request.isUserInRole("USER"));
|
||||
}
|
||||
|
||||
private String principal() {
|
||||
if ( SecurityContextHolder.getContext().getAuthentication() != null ) {
|
||||
return SecurityContextHolder.getContext().getAuthentication().getName();
|
||||
}
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
private String xml(String configName) {
|
||||
return CONFIG_LOCATION_PREFIX + "-" + configName + ".xml";
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
~ Copyright 2002-2018 the original author or authors.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd
|
||||
http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans.xsd">
|
||||
|
||||
<http>
|
||||
<form-login/>
|
||||
<csrf disabled="true"/>
|
||||
</http>
|
||||
|
||||
<b:bean class="org.springframework.security.config.http.SecurityContextHolderAwareRequestConfigTests.ServletAuthenticatedController"/>
|
||||
|
||||
<b:import resource="userservice.xml"/>
|
||||
</b:beans>
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
~ Copyright 2002-2018 the original author or authors.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd
|
||||
http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans.xsd">
|
||||
|
||||
<http>
|
||||
<http-basic entry-point-ref="ep"/>
|
||||
<csrf disabled="true"/>
|
||||
</http>
|
||||
|
||||
<b:bean class="org.springframework.security.config.http.SecurityContextHolderAwareRequestConfigTests.ServletAuthenticatedController"/>
|
||||
|
||||
<b:bean name="ep" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
|
||||
<b:property name="realmName" value="discworld"/>
|
||||
</b:bean>
|
||||
|
||||
<b:import resource="userservice.xml"/>
|
||||
</b:beans>
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
~ Copyright 2002-2018 the original author or authors.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd
|
||||
http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans.xsd">
|
||||
|
||||
<http>
|
||||
<form-login login-page="/signin"/>
|
||||
<logout invalidate-session="false" delete-cookies="JSESSIONID"/>
|
||||
<csrf disabled="true"/>
|
||||
</http>
|
||||
|
||||
<b:bean class="org.springframework.security.config.http.SecurityContextHolderAwareRequestConfigTests.ServletAuthenticatedController"/>
|
||||
|
||||
<b:import resource="userservice.xml"/>
|
||||
</b:beans>
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
~ Copyright 2002-2018 the original author or authors.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd
|
||||
http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans.xsd">
|
||||
|
||||
<http authentication-manager-ref="authManager2" pattern="/v2/**">
|
||||
<form-login login-page="/login2"/>
|
||||
<logout invalidate-session="true"/>
|
||||
<csrf disabled="true"/>
|
||||
</http>
|
||||
|
||||
<http authentication-manager-ref="authManager">
|
||||
<form-login login-page="/login"/>
|
||||
<logout invalidate-session="false"/>
|
||||
<csrf disabled="true"/>
|
||||
</http>
|
||||
|
||||
<b:bean class="org.springframework.security.config.http.SecurityContextHolderAwareRequestConfigTests.ServletAuthenticatedController"/>
|
||||
|
||||
<authentication-manager id="authManager2">
|
||||
<authentication-provider>
|
||||
<user-service>
|
||||
<user name="user2" password="{noop}password2" authorities="ROLE_USER"/>
|
||||
</user-service>
|
||||
</authentication-provider>
|
||||
</authentication-manager>
|
||||
|
||||
<authentication-manager id="authManager">
|
||||
<authentication-provider>
|
||||
<user-service>
|
||||
<user name="user" password="{noop}password" authorities="ROLE_USER"/>
|
||||
</user-service>
|
||||
</authentication-provider>
|
||||
</authentication-manager>
|
||||
</b:beans>
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
~ Copyright 2002-2018 the original author or authors.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd
|
||||
http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans.xsd">
|
||||
|
||||
<http auto-config="true" use-expressions="false">
|
||||
<csrf disabled="true"/>
|
||||
</http>
|
||||
|
||||
<b:bean class="org.springframework.security.config.http.SecurityContextHolderAwareRequestConfigTests.ServletAuthenticatedController"/>
|
||||
|
||||
<b:import resource="userservice.xml"/>
|
||||
</b:beans>
|
||||
Loading…
Reference in New Issue