Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1123: Renamed ObjectDefinitionSource to SecurityMetadataSourceand performed related refactoring

This commit is contained in:
Luke Taylor 2009-03-20 04:32:06 +00:00
parent 9b52e7bf69
commit 4aff4b2350
57 changed files with 510 additions and 615 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/src/main/java/org/springframework/security/annotation/Jsr250MethodDefinitionSource.java → core/src/main/java/org/springframework/security/annotation/Jsr250MethodSecurityMetadataSource.java
View File

@ -27,7 +27,7 @@ import javax.annotation.security.RolesAllowed;
import org.springframework.core.annotation.AnnotationUtils; import org.springframework.core.annotation.AnnotationUtils;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.intercept.method.AbstractFallbackMethodDefinitionSource; import org.springframework.security.intercept.method.AbstractFallbackMethodSecurityMetadataSource;
/** /**
@ -37,7 +37,7 @@ import org.springframework.security.intercept.method.AbstractFallbackMethodDefin
* @version $Id$ * @version $Id$
* @since 2.0 * @since 2.0
*/ */
public class Jsr250MethodDefinitionSource extends AbstractFallbackMethodDefinitionSource { public class Jsr250MethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {
protected List<ConfigAttribute> findAttributes(Class<?> clazz) { protected List<ConfigAttribute> findAttributes(Class<?> clazz) {
return processAnnotations(clazz.getAnnotations()); return processAnnotations(clazz.getAnnotations());

4
core/src/main/java/org/springframework/security/annotation/SecuredMethodDefinitionSource.java → core/src/main/java/org/springframework/security/annotation/SecuredMethodSecurityMetadataSource.java
View File

@ -24,7 +24,7 @@ import java.util.List;
import org.springframework.core.annotation.AnnotationUtils; import org.springframework.core.annotation.AnnotationUtils;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.SecurityConfig; import org.springframework.security.SecurityConfig;
import org.springframework.security.intercept.method.AbstractFallbackMethodDefinitionSource; import org.springframework.security.intercept.method.AbstractFallbackMethodSecurityMetadataSource;
/** /**
@ -33,7 +33,7 @@ import org.springframework.security.intercept.method.AbstractFallbackMethodDefin
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
public class SecuredMethodDefinitionSource extends AbstractFallbackMethodDefinitionSource { public class SecuredMethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {
protected List<ConfigAttribute> findAttributes(Class<?> clazz) { protected List<ConfigAttribute> findAttributes(Class<?> clazz) {
return processAnnotation(clazz.getAnnotation(Secured.class)); return processAnnotation(clazz.getAnnotation(Secured.class));

9
core/src/main/java/org/springframework/security/config/BeanIds.java
View File

@ -55,13 +55,10 @@ public abstract class BeanIds {
public static final String DEFAULT_LOGIN_PAGE_GENERATING_FILTER = "_defaultLoginPageFilter"; public static final String DEFAULT_LOGIN_PAGE_GENERATING_FILTER = "_defaultLoginPageFilter";
public static final String SECURITY_CONTEXT_HOLDER_AWARE_REQUEST_FILTER = "_securityContextHolderAwareRequestFilter"; public static final String SECURITY_CONTEXT_HOLDER_AWARE_REQUEST_FILTER = "_securityContextHolderAwareRequestFilter";
public static final String SESSION_FIXATION_PROTECTION_FILTER = "_sessionFixationProtectionFilter"; public static final String SESSION_FIXATION_PROTECTION_FILTER = "_sessionFixationProtectionFilter";
// public static final String GLOBAL_METHOD_SECURITY_INTERCEPTOR = "_methodSecurityInterceptor"; public static final String METHOD_SECURITY_METADATA_SOURCE_ADVISOR = "_methodSecurityMetadataSourceAdvisor";
// public static final String METHOD_SECURITY_INTERCEPTOR_POST_PROCESSOR = "_methodSecurityInterceptorPostProcessor";
public static final String METHOD_DEFINITION_SOURCE_ADVISOR = "_methodDefinitionSourceAdvisor";
public static final String PROTECT_POINTCUT_POST_PROCESSOR = "_protectPointcutPostProcessor"; public static final String PROTECT_POINTCUT_POST_PROCESSOR = "_protectPointcutPostProcessor";
// public static final String DELEGATING_METHOD_DEFINITION_SOURCE = "_delegatingMethodDefinitionSource"; public static final String SECURED_METHOD_SECURITY_METADATA_SOURCE = "_securedSecurityMetadataSource";
public static final String SECURED_METHOD_DEFINITION_SOURCE = "_securedMethodDefinitionSource"; public static final String JSR_250_METHOD_SECURITY_METADATA_SOURCE = "_jsr250SecurityMetadataSource";
public static final String JSR_250_METHOD_DEFINITION_SOURCE = "_jsr250MethodDefinitionSource";
public static final String EMBEDDED_APACHE_DS = "_apacheDirectoryServerContainer"; public static final String EMBEDDED_APACHE_DS = "_apacheDirectoryServerContainer";
public static final String CONTEXT_SOURCE = "_securityContextSource"; public static final String CONTEXT_SOURCE = "_securityContextSource";
public static final String PORT_MAPPER = "_portMapper"; public static final String PORT_MAPPER = "_portMapper";

6
core/src/main/java/org/springframework/security/config/FilterChainProxyPostProcessor.java
View File

@ -19,7 +19,7 @@ import org.springframework.core.Ordered;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.config.ConfigUtils.FilterChainList; import org.springframework.security.config.ConfigUtils.FilterChainList;
import org.springframework.security.context.SecurityContextPersistenceFilter; import org.springframework.security.context.SecurityContextPersistenceFilter;
import org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource; import org.springframework.security.intercept.web.DefaultFilterInvocationSecurityMetadataSource;
import org.springframework.security.intercept.web.FilterSecurityInterceptor; import org.springframework.security.intercept.web.FilterSecurityInterceptor;
import org.springframework.security.providers.anonymous.AnonymousAuthenticationToken; import org.springframework.security.providers.anonymous.AnonymousAuthenticationToken;
import org.springframework.security.providers.anonymous.AnonymousProcessingFilter; import org.springframework.security.providers.anonymous.AnonymousProcessingFilter;
@ -147,8 +147,8 @@ public class FilterChainProxyPostProcessor implements BeanPostProcessor, BeanFac
FilterSecurityInterceptor fsi = FilterSecurityInterceptor fsi =
((FilterSecurityInterceptor)beanFactory.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR)); ((FilterSecurityInterceptor)beanFactory.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR));
DefaultFilterInvocationDefinitionSource fids = DefaultFilterInvocationSecurityMetadataSource fids =
(DefaultFilterInvocationDefinitionSource) fsi.getObjectDefinitionSource(); (DefaultFilterInvocationSecurityMetadataSource) fsi.getSecurityMetadataSource();
List<ConfigAttribute> attributes = fids.lookupAttributes(loginPage, "POST"); List<ConfigAttribute> attributes = fids.lookupAttributes(loginPage, "POST");
if (attributes == null) { if (attributes == null) {

8
core/src/main/java/org/springframework/security/config/FilterInvocationDefinitionSourceBeanDefinitionParser.java → core/src/main/java/org/springframework/security/config/FilterInvocationSecurityMetadataSourceBeanDefinitionParser.java
View File

@ -7,7 +7,7 @@ import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser; import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
import org.springframework.beans.factory.xml.ParserContext; import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.intercept.web.FilterInvocationDefinitionSource; import org.springframework.security.intercept.web.FilterInvocationSecurityMetadataSource;
import org.springframework.security.intercept.web.RequestKey; import org.springframework.security.intercept.web.RequestKey;
import org.springframework.security.util.AntUrlPathMatcher; import org.springframework.security.util.AntUrlPathMatcher;
import org.springframework.security.util.UrlMatcher; import org.springframework.security.util.UrlMatcher;
@ -16,15 +16,15 @@ import org.springframework.util.xml.DomUtils;
import org.w3c.dom.Element; import org.w3c.dom.Element;
/** /**
* Allows for convenient creation of a {@link FilterInvocationDefinitionSource} bean for use with a FilterSecurityInterceptor. * Allows for convenient creation of a {@link FilterInvocationSecurityMetadataSource} bean for use with a FilterSecurityInterceptor.
* *
* @author Luke Taylor * @author Luke Taylor
* @version $Id$ * @version $Id$
*/ */
public class FilterInvocationDefinitionSourceBeanDefinitionParser extends AbstractSingleBeanDefinitionParser { public class FilterInvocationSecurityMetadataSourceBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
protected String getBeanClassName(Element element) { protected String getBeanClassName(Element element) {
return "org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource"; return "org.springframework.security.intercept.web.DefaultFilterInvocationSecurityMetadataSource";
} }
protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) { protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {

44
core/src/main/java/org/springframework/security/config/GlobalMethodSecurityBeanDefinitionParser.java
View File

@ -21,10 +21,10 @@ import org.springframework.security.SecurityConfig;
import org.springframework.security.expression.method.MethodExpressionAfterInvocationProvider; import org.springframework.security.expression.method.MethodExpressionAfterInvocationProvider;
import org.springframework.security.expression.method.MethodExpressionVoter; import org.springframework.security.expression.method.MethodExpressionVoter;
import org.springframework.security.expression.support.DefaultSecurityExpressionHandler; import org.springframework.security.expression.support.DefaultSecurityExpressionHandler;
import org.springframework.security.intercept.method.DelegatingMethodDefinitionSource; import org.springframework.security.intercept.method.DelegatingMethodSecurityMetadataSource;
import org.springframework.security.intercept.method.MapBasedMethodDefinitionSource; import org.springframework.security.intercept.method.MapBasedMethodSecurityMetadataSource;
import org.springframework.security.intercept.method.ProtectPointcutPostProcessor; import org.springframework.security.intercept.method.ProtectPointcutPostProcessor;
import org.springframework.security.intercept.method.aopalliance.MethodDefinitionSourceAdvisor; import org.springframework.security.intercept.method.aopalliance.MethodSecurityMetadataSourceAdvisor;
import org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor; import org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor;
import org.springframework.security.vote.AffirmativeBased; import org.springframework.security.vote.AffirmativeBased;
import org.springframework.security.vote.AuthenticatedVoter; import org.springframework.security.vote.AuthenticatedVoter;
@ -45,9 +45,9 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
private final Log logger = LogFactory.getLog(getClass()); private final Log logger = LogFactory.getLog(getClass());
private static final String SECURED_METHOD_DEFINITION_SOURCE_CLASS = "org.springframework.security.annotation.SecuredMethodDefinitionSource"; private static final String SECURED_METHOD_DEFINITION_SOURCE_CLASS = "org.springframework.security.annotation.SecuredMethodSecurityMetadataSource";
private static final String EXPRESSION_METHOD_DEFINITION_SOURCE_CLASS = "org.springframework.security.expression.method.ExpressionAnnotationMethodDefinitionSource"; private static final String EXPRESSION_METHOD_DEFINITION_SOURCE_CLASS = "org.springframework.security.expression.method.ExpressionAnnotationMethodSecurityMetadataSource";
private static final String JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS = "org.springframework.security.annotation.Jsr250MethodDefinitionSource"; private static final String JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS = "org.springframework.security.annotation.Jsr250MethodSecurityMetadataSource";
private static final String JSR_250_VOTER_CLASS = "org.springframework.security.annotation.Jsr250Voter"; private static final String JSR_250_VOTER_CLASS = "org.springframework.security.annotation.Jsr250Voter";
/* /*
@ -56,7 +56,7 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
static final String SECURITY_INTERCEPTOR_ID = "_globalMethodSecurityInterceptor"; static final String SECURITY_INTERCEPTOR_ID = "_globalMethodSecurityInterceptor";
static final String INTERCEPTOR_POST_PROCESSOR_ID = "_globalMethodSecurityInterceptorPostProcessor"; static final String INTERCEPTOR_POST_PROCESSOR_ID = "_globalMethodSecurityInterceptorPostProcessor";
static final String ACCESS_MANAGER_ID = "_globalMethodSecurityAccessManager"; static final String ACCESS_MANAGER_ID = "_globalMethodSecurityAccessManager";
private static final String DELEGATING_METHOD_DEFINITION_SOURCE_ID = "_delegatingMethodDefinitionSource"; private static final String DELEGATING_METHOD_DEFINITION_SOURCE_ID = "_delegatingMethodSecurityMetadataSource";
private static final String EXPRESSION_HANDLER_ID = "_methodExpressionHandler"; private static final String EXPRESSION_HANDLER_ID = "_methodExpressionHandler";
private static final String ATT_ACCESS = "access"; private static final String ATT_ACCESS = "access";
@ -83,9 +83,9 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
if (pointcutMap.size() > 0) { if (pointcutMap.size() > 0) {
// SEC-1016: Put the pointcut MDS first, but only add it if there are actually any pointcuts defined. // SEC-1016: Put the pointcut MDS first, but only add it if there are actually any pointcuts defined.
MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource = new MapBasedMethodDefinitionSource(); MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource = new MapBasedMethodSecurityMetadataSource();
delegates.add(mapBasedMethodDefinitionSource); delegates.add(mapBasedMethodSecurityMetadataSource);
registerProtectPointcutPostProcessor(parserContext, pointcutMap, mapBasedMethodDefinitionSource, source); registerProtectPointcutPostProcessor(parserContext, pointcutMap, mapBasedMethodSecurityMetadataSource, source);
} }
if (expressionsEnabled) { if (expressionsEnabled) {
@ -123,7 +123,7 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
delegates.add(BeanDefinitionBuilder.rootBeanDefinition(JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS).getBeanDefinition()); delegates.add(BeanDefinitionBuilder.rootBeanDefinition(JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS).getBeanDefinition());
} }
registerDelegatingMethodDefinitionSource(parserContext, delegates, source); registerDelegatingMethodSecurityMetadataSource(parserContext, delegates, source);
String accessManagerId = element.getAttribute(ATT_ACCESS_MGR); String accessManagerId = element.getAttribute(ATT_ACCESS_MGR);
@ -167,24 +167,24 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
} }
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
private void registerDelegatingMethodDefinitionSource(ParserContext parserContext, ManagedList delegates, Object source) { private void registerDelegatingMethodSecurityMetadataSource(ParserContext parserContext, ManagedList delegates, Object source) {
if (parserContext.getRegistry().containsBeanDefinition(DELEGATING_METHOD_DEFINITION_SOURCE_ID)) { if (parserContext.getRegistry().containsBeanDefinition(DELEGATING_METHOD_DEFINITION_SOURCE_ID)) {
parserContext.getReaderContext().error("Duplicate <global-method-security> detected.", source); parserContext.getReaderContext().error("Duplicate <global-method-security> detected.", source);
} }
RootBeanDefinition delegatingMethodDefinitionSource = new RootBeanDefinition(DelegatingMethodDefinitionSource.class); RootBeanDefinition delegatingMethodSecurityMetadataSource = new RootBeanDefinition(DelegatingMethodSecurityMetadataSource.class);
delegatingMethodDefinitionSource.setRole(BeanDefinition.ROLE_INFRASTRUCTURE); delegatingMethodSecurityMetadataSource.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
delegatingMethodDefinitionSource.setSource(source); delegatingMethodSecurityMetadataSource.setSource(source);
delegatingMethodDefinitionSource.getPropertyValues().addPropertyValue("methodDefinitionSources", delegates); delegatingMethodSecurityMetadataSource.getPropertyValues().addPropertyValue("methodSecurityMetadataSources", delegates);
parserContext.getRegistry().registerBeanDefinition(DELEGATING_METHOD_DEFINITION_SOURCE_ID, delegatingMethodDefinitionSource); parserContext.getRegistry().registerBeanDefinition(DELEGATING_METHOD_DEFINITION_SOURCE_ID, delegatingMethodSecurityMetadataSource);
} }
private void registerProtectPointcutPostProcessor(ParserContext parserContext, private void registerProtectPointcutPostProcessor(ParserContext parserContext,
Map<String, List<ConfigAttribute>> pointcutMap, Map<String, List<ConfigAttribute>> pointcutMap,
MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource, Object source) { MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource, Object source) {
RootBeanDefinition ppbp = new RootBeanDefinition(ProtectPointcutPostProcessor.class); RootBeanDefinition ppbp = new RootBeanDefinition(ProtectPointcutPostProcessor.class);
ppbp.setRole(BeanDefinition.ROLE_INFRASTRUCTURE); ppbp.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
ppbp.setSource(source); ppbp.setSource(source);
ppbp.getConstructorArgumentValues().addGenericArgumentValue(mapBasedMethodDefinitionSource); ppbp.getConstructorArgumentValues().addGenericArgumentValue(mapBasedMethodSecurityMetadataSource);
ppbp.getPropertyValues().addPropertyValue("pointcutMap", pointcutMap); ppbp.getPropertyValues().addPropertyValue("pointcutMap", pointcutMap);
parserContext.getRegistry().registerBeanDefinition(BeanIds.PROTECT_POINTCUT_POST_PROCESSOR, ppbp); parserContext.getRegistry().registerBeanDefinition(BeanIds.PROTECT_POINTCUT_POST_PROCESSOR, ppbp);
} }
@ -224,7 +224,7 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
interceptor.getPropertyValues().addPropertyValue("accessDecisionManager", new RuntimeBeanReference(accessManagerId)); interceptor.getPropertyValues().addPropertyValue("accessDecisionManager", new RuntimeBeanReference(accessManagerId));
interceptor.getPropertyValues().addPropertyValue("authenticationManager", new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER)); interceptor.getPropertyValues().addPropertyValue("authenticationManager", new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER));
interceptor.getPropertyValues().addPropertyValue("objectDefinitionSource", new RuntimeBeanReference(DELEGATING_METHOD_DEFINITION_SOURCE_ID)); interceptor.getPropertyValues().addPropertyValue("securityMetadataSource", new RuntimeBeanReference(DELEGATING_METHOD_DEFINITION_SOURCE_ID));
parserContext.getRegistry().registerBeanDefinition(SECURITY_INTERCEPTOR_ID, interceptor); parserContext.getRegistry().registerBeanDefinition(SECURITY_INTERCEPTOR_ID, interceptor);
parserContext.registerComponent(new BeanComponentDefinition(interceptor, SECURITY_INTERCEPTOR_ID)); parserContext.registerComponent(new BeanComponentDefinition(interceptor, SECURITY_INTERCEPTOR_ID));
@ -233,12 +233,12 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
} }
private void registerAdvisor(ParserContext parserContext, Object source) { private void registerAdvisor(ParserContext parserContext, Object source) {
RootBeanDefinition advisor = new RootBeanDefinition(MethodDefinitionSourceAdvisor.class); RootBeanDefinition advisor = new RootBeanDefinition(MethodSecurityMetadataSourceAdvisor.class);
advisor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE); advisor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
advisor.setSource(source); advisor.setSource(source);
advisor.getConstructorArgumentValues().addGenericArgumentValue(SECURITY_INTERCEPTOR_ID); advisor.getConstructorArgumentValues().addGenericArgumentValue(SECURITY_INTERCEPTOR_ID);
advisor.getConstructorArgumentValues().addGenericArgumentValue(new RuntimeBeanReference(DELEGATING_METHOD_DEFINITION_SOURCE_ID)); advisor.getConstructorArgumentValues().addGenericArgumentValue(new RuntimeBeanReference(DELEGATING_METHOD_DEFINITION_SOURCE_ID));
parserContext.getRegistry().registerBeanDefinition(BeanIds.METHOD_DEFINITION_SOURCE_ADVISOR, advisor); parserContext.getRegistry().registerBeanDefinition(BeanIds.METHOD_SECURITY_METADATA_SOURCE_ADVISOR, advisor);
} }
} }

18
core/src/main/java/org/springframework/security/config/HttpSecurityBeanDefinitionParser.java
View File

@ -22,7 +22,7 @@ import org.springframework.security.SecurityConfig;
import org.springframework.security.context.HttpSessionSecurityContextRepository; import org.springframework.security.context.HttpSessionSecurityContextRepository;
import org.springframework.security.context.SecurityContextPersistenceFilter; import org.springframework.security.context.SecurityContextPersistenceFilter;
import org.springframework.security.expression.web.WebExpressionVoter; import org.springframework.security.expression.web.WebExpressionVoter;
import org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource; import org.springframework.security.intercept.web.DefaultFilterInvocationSecurityMetadataSource;
import org.springframework.security.intercept.web.FilterSecurityInterceptor; import org.springframework.security.intercept.web.FilterSecurityInterceptor;
import org.springframework.security.intercept.web.RequestKey; import org.springframework.security.intercept.web.RequestKey;
import org.springframework.security.securechannel.ChannelDecisionManagerImpl; import org.springframework.security.securechannel.ChannelDecisionManagerImpl;
@ -106,7 +106,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
private static final String ATT_DISABLE_URL_REWRITING = "disable-url-rewriting"; private static final String ATT_DISABLE_URL_REWRITING = "disable-url-rewriting";
private static final String EXPRESSION_FIDS_CLASS = "org.springframework.security.expression.web.ExpressionBasedFilterInvocationDefinitionSource"; private static final String EXPRESSION_FIDS_CLASS = "org.springframework.security.expression.web.ExpressionBasedFilterInvocationSecurityMetadataSource";
private static final String EXPRESSION_HANDLER_CLASS = "org.springframework.security.expression.support.DefaultSecurityExpressionHandler"; private static final String EXPRESSION_HANDLER_CLASS = "org.springframework.security.expression.support.DefaultSecurityExpressionHandler";
private static final String EXPRESSION_HANDLER_ID = "_webExpressionHandler"; private static final String EXPRESSION_HANDLER_ID = "_webExpressionHandler";
@ -172,7 +172,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
fidsBuilder.addConstructorArgReference(expressionHandlerRef); fidsBuilder.addConstructorArgReference(expressionHandlerRef);
voters = new Class[] {WebExpressionVoter.class}; voters = new Class[] {WebExpressionVoter.class};
} else { } else {
fidsBuilder = BeanDefinitionBuilder.rootBeanDefinition(DefaultFilterInvocationDefinitionSource.class); fidsBuilder = BeanDefinitionBuilder.rootBeanDefinition(DefaultFilterInvocationSecurityMetadataSource.class);
fidsBuilder.addConstructorArgValue(matcher); fidsBuilder.addConstructorArgValue(matcher);
fidsBuilder.addConstructorArgValue(requestToAttributesMap); fidsBuilder.addConstructorArgValue(requestToAttributesMap);
voters = new Class[] {RoleVoter.class, AuthenticatedVoter.class}; voters = new Class[] {RoleVoter.class, AuthenticatedVoter.class};
@ -359,7 +359,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
builder.addPropertyValue("observeOncePerRequest", Boolean.FALSE); builder.addPropertyValue("observeOncePerRequest", Boolean.FALSE);
} }
builder.addPropertyValue("objectDefinitionSource", fids); builder.addPropertyValue("securityMetadataSource", fids);
pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_SECURITY_INTERCEPTOR, builder.getBeanDefinition()); pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_SECURITY_INTERCEPTOR, builder.getBeanDefinition());
ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.FILTER_SECURITY_INTERCEPTOR)); ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.FILTER_SECURITY_INTERCEPTOR));
} }
@ -369,11 +369,11 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
RootBeanDefinition channelFilter = new RootBeanDefinition(ChannelProcessingFilter.class); RootBeanDefinition channelFilter = new RootBeanDefinition(ChannelProcessingFilter.class);
channelFilter.getPropertyValues().addPropertyValue("channelDecisionManager", channelFilter.getPropertyValues().addPropertyValue("channelDecisionManager",
new RuntimeBeanReference(BeanIds.CHANNEL_DECISION_MANAGER)); new RuntimeBeanReference(BeanIds.CHANNEL_DECISION_MANAGER));
DefaultFilterInvocationDefinitionSource channelFilterInvDefSource = DefaultFilterInvocationSecurityMetadataSource channelFilterInvDefSource =
new DefaultFilterInvocationDefinitionSource(matcher, channelRequestMap); new DefaultFilterInvocationSecurityMetadataSource(matcher, channelRequestMap);
channelFilterInvDefSource.setStripQueryStringFromUrls(matcher instanceof AntUrlPathMatcher); channelFilterInvDefSource.setStripQueryStringFromUrls(matcher instanceof AntUrlPathMatcher);
channelFilter.getPropertyValues().addPropertyValue("filterInvocationDefinitionSource", channelFilter.getPropertyValues().addPropertyValue("filterInvocationSecurityMetadataSource",
channelFilterInvDefSource); channelFilterInvDefSource);
RootBeanDefinition channelDecisionManager = new RootBeanDefinition(ChannelDecisionManagerImpl.class); RootBeanDefinition channelDecisionManager = new RootBeanDefinition(ChannelDecisionManagerImpl.class);
ManagedList channelProcessors = new ManagedList(3); ManagedList channelProcessors = new ManagedList(3);
@ -639,7 +639,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
} }
/** /**
* Parses the filter invocation map which will be used to configure the FilterInvocationDefinitionSource * Parses the filter invocation map which will be used to configure the FilterInvocationSecurityMetadataSource
* used in the security interceptor. * used in the security interceptor.
*/ */
static LinkedHashMap<RequestKey, List<ConfigAttribute>> static LinkedHashMap<RequestKey, List<ConfigAttribute>>
@ -677,7 +677,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
if (useExpressions) { if (useExpressions) {
logger.info("Creating access control expression attribute '" + access + "' for " + key); logger.info("Creating access control expression attribute '" + access + "' for " + key);
attributes = new ArrayList<ConfigAttribute>(1); attributes = new ArrayList<ConfigAttribute>(1);
// The expression will be parsed later by the ExpressionFilterInvocationDefinitionSource // The expression will be parsed later by the ExpressionFilterInvocationSecurityMetadataSource
attributes.add(new SecurityConfig(access)); attributes.add(new SecurityConfig(access));
} else { } else {

4
core/src/main/java/org/springframework/security/config/InterceptMethodsBeanDefinitionDecorator.java
View File

@ -80,11 +80,11 @@ class InternalInterceptMethodsBeanDefinitionDecorator extends AbstractIntercepto
} }
} }
// Rely on the default property editor for MethodSecurityInterceptor.setObjectDefinitionSource to setup the MethodDefinitionSource // Rely on the default property editor for MethodSecurityInterceptor.setSecurityMetadataSource to setup the MethodSecurityMetadataSource
sb.append(methodName + "=" + accessConfig).append("\r\n"); sb.append(methodName + "=" + accessConfig).append("\r\n");
} }
interceptor.addPropertyValue("objectDefinitionSource", sb.toString()); interceptor.addPropertyValue("securityMetadataSource", sb.toString());
return interceptor.getBeanDefinition(); return interceptor.getBeanDefinition();
} }

2
core/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java
View File

@ -23,7 +23,7 @@ public class SecurityNamespaceHandler extends NamespaceHandlerSupport {
registerBeanDefinitionParser(Elements.AUTHENTICATION_PROVIDER, new AuthenticationProviderBeanDefinitionParser()); registerBeanDefinitionParser(Elements.AUTHENTICATION_PROVIDER, new AuthenticationProviderBeanDefinitionParser());
registerBeanDefinitionParser(Elements.GLOBAL_METHOD_SECURITY, new GlobalMethodSecurityBeanDefinitionParser()); registerBeanDefinitionParser(Elements.GLOBAL_METHOD_SECURITY, new GlobalMethodSecurityBeanDefinitionParser());
registerBeanDefinitionParser(Elements.AUTHENTICATION_MANAGER, new AuthenticationManagerBeanDefinitionParser()); registerBeanDefinitionParser(Elements.AUTHENTICATION_MANAGER, new AuthenticationManagerBeanDefinitionParser());
registerBeanDefinitionParser(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationDefinitionSourceBeanDefinitionParser()); registerBeanDefinitionParser(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationSecurityMetadataSourceBeanDefinitionParser());
// Decorators // Decorators
registerBeanDefinitionDecorator(Elements.INTERCEPT_METHODS, new InterceptMethodsBeanDefinitionDecorator()); registerBeanDefinitionDecorator(Elements.INTERCEPT_METHODS, new InterceptMethodsBeanDefinitionDecorator());

12
core/src/main/java/org/springframework/security/expression/method/ExpressionAnnotationMethodDefinitionSource.java → core/src/main/java/org/springframework/security/expression/method/ExpressionAnnotationMethodSecurityMetadataSource.java
View File

@ -18,11 +18,11 @@ import org.springframework.security.expression.annotation.PostAuthorize;
import org.springframework.security.expression.annotation.PostFilter; import org.springframework.security.expression.annotation.PostFilter;
import org.springframework.security.expression.annotation.PreAuthorize; import org.springframework.security.expression.annotation.PreAuthorize;
import org.springframework.security.expression.annotation.PreFilter; import org.springframework.security.expression.annotation.PreFilter;
import org.springframework.security.intercept.method.AbstractMethodDefinitionSource; import org.springframework.security.intercept.method.AbstractMethodSecurityMetadataSource;
import org.springframework.util.ClassUtils; import org.springframework.util.ClassUtils;
/** /**
* MethodDefinitionSource which extracts metadata from the @PreFilter and @PreAuthorize annotations * <tt>MethodSecurityMetadataSource</tt> which extracts metadata from the @PreFilter and @PreAuthorize annotations
* placed on a method. The metadata is encapsulated in a {@link AbstractExpressionBasedMethodConfigAttribute} instance. * placed on a method. The metadata is encapsulated in a {@link AbstractExpressionBasedMethodConfigAttribute} instance.
* <p> * <p>
* Annotations may be specified on classes or methods, and method-specific annotations will take precedence. * Annotations may be specified on classes or methods, and method-specific annotations will take precedence.
@ -38,10 +38,10 @@ import org.springframework.util.ClassUtils;
* @since 2.5 * @since 2.5
* @version $Id$ * @version $Id$
*/ */
public class ExpressionAnnotationMethodDefinitionSource extends AbstractMethodDefinitionSource { public class ExpressionAnnotationMethodSecurityMetadataSource extends AbstractMethodSecurityMetadataSource {
private ExpressionParser parser; private ExpressionParser parser;
public ExpressionAnnotationMethodDefinitionSource() { public ExpressionAnnotationMethodSecurityMetadataSource() {
parser = new SpelAntlrExpressionParser(); parser = new SpelAntlrExpressionParser();
} }
@ -49,7 +49,7 @@ public class ExpressionAnnotationMethodDefinitionSource extends AbstractMethodDe
* Constructor which obtains the expression parser from the {@link SecurityExpressionHandler#getExpressionParser() } * Constructor which obtains the expression parser from the {@link SecurityExpressionHandler#getExpressionParser() }
* method on the supplied <tt>SecurityExpressionHandler</tt>. * method on the supplied <tt>SecurityExpressionHandler</tt>.
*/ */
public ExpressionAnnotationMethodDefinitionSource(SecurityExpressionHandler handler) { public ExpressionAnnotationMethodSecurityMetadataSource(SecurityExpressionHandler handler) {
parser = handler.getExpressionParser(); parser = handler.getExpressionParser();
} }
@ -76,7 +76,7 @@ public class ExpressionAnnotationMethodDefinitionSource extends AbstractMethodDe
} }
/** /**
* See {@link org.springframework.security.intercept.method.AbstractFallbackMethodDefinitionSource#getAttributes(Method, Class)} * See {@link org.springframework.security.intercept.method.AbstractFallbackMethodSecurityMetadataSource#getAttributes(Method, Class)}
* for the logic of this method. The ordering here is slightly different in that we consider method-specific * for the logic of this method. The ordering here is slightly different in that we consider method-specific
* annotations on an interface before class-level ones. * annotations on an interface before class-level ones.
*/ */

10
core/src/main/java/org/springframework/security/expression/web/ExpressionBasedFilterInvocationDefinitionSource.java → core/src/main/java/org/springframework/security/expression/web/ExpressionBasedFilterInvocationSecurityMetadataSource.java
View File

@ -11,22 +11,22 @@ import org.springframework.expression.ExpressionParser;
import org.springframework.expression.ParseException; import org.springframework.expression.ParseException;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.expression.SecurityExpressionHandler; import org.springframework.security.expression.SecurityExpressionHandler;
import org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource; import org.springframework.security.intercept.web.DefaultFilterInvocationSecurityMetadataSource;
import org.springframework.security.intercept.web.RequestKey; import org.springframework.security.intercept.web.RequestKey;
import org.springframework.security.util.UrlMatcher; import org.springframework.security.util.UrlMatcher;
import org.springframework.util.Assert; import org.springframework.util.Assert;
/** /**
* Expression-based <tt>FilterInvocationDefinitionSource</tt>. * Expression-based <tt>FilterInvocationSecurityMetadataSource</tt>.
* *
* @author Luke Taylor * @author Luke Taylor
* @version $Id$ * @version $Id$
* @since 2.5 * @since 2.5
*/ */
public final class ExpressionBasedFilterInvocationDefinitionSource extends DefaultFilterInvocationDefinitionSource { public final class ExpressionBasedFilterInvocationSecurityMetadataSource extends DefaultFilterInvocationSecurityMetadataSource {
private final static Log logger = LogFactory.getLog(ExpressionBasedFilterInvocationDefinitionSource.class); private final static Log logger = LogFactory.getLog(ExpressionBasedFilterInvocationSecurityMetadataSource.class);
public ExpressionBasedFilterInvocationDefinitionSource(UrlMatcher urlMatcher, public ExpressionBasedFilterInvocationSecurityMetadataSource(UrlMatcher urlMatcher,
LinkedHashMap<RequestKey, List<ConfigAttribute>> requestMap, SecurityExpressionHandler expressionHandler) { LinkedHashMap<RequestKey, List<ConfigAttribute>> requestMap, SecurityExpressionHandler expressionHandler) {
super(urlMatcher, processMap(requestMap, expressionHandler.getExpressionParser())); super(urlMatcher, processMap(requestMap, expressionHandler.getExpressionParser()));
Assert.notNull(expressionHandler, "A non-null SecurityExpressionHandler is required"); Assert.notNull(expressionHandler, "A non-null SecurityExpressionHandler is required");

16
core/src/main/java/org/springframework/security/intercept/AbstractSecurityInterceptor.java
View File

@ -54,7 +54,7 @@ import org.springframework.util.Assert;
* <ol> * <ol>
* <li>Obtain the {@link Authentication} object from the {@link SecurityContextHolder}.</li> * <li>Obtain the {@link Authentication} object from the {@link SecurityContextHolder}.</li>
* <li>Determine if the request relates to a secured or public invocation by looking up the secure object request * <li>Determine if the request relates to a secured or public invocation by looking up the secure object request
* against the {@link ObjectDefinitionSource}.</li> * against the {@link SecurityMetadataSource}.</li>
* <li>For an invocation that is secured (there is a list of <code>ConfigAttribute</code>s for the secure * <li>For an invocation that is secured (there is a list of <code>ConfigAttribute</code>s for the secure
* object invocation): * object invocation):
* <ol type="a"> * <ol type="a">
@ -122,9 +122,9 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
Assert.notNull(this.authenticationManager, "An AuthenticationManager is required"); Assert.notNull(this.authenticationManager, "An AuthenticationManager is required");
Assert.notNull(this.accessDecisionManager, "An AccessDecisionManager is required"); Assert.notNull(this.accessDecisionManager, "An AccessDecisionManager is required");
Assert.notNull(this.runAsManager, "A RunAsManager is required"); Assert.notNull(this.runAsManager, "A RunAsManager is required");
Assert.notNull(this.obtainObjectDefinitionSource(), "An ObjectDefinitionSource is required"); Assert.notNull(this.obtainSecurityMetadataSource(), "An SecurityMetadataSource is required");
Assert.isTrue(this.obtainObjectDefinitionSource().supports(getSecureObjectClass()), Assert.isTrue(this.obtainSecurityMetadataSource().supports(getSecureObjectClass()),
"ObjectDefinitionSource does not support secure object class: " + getSecureObjectClass()); "SecurityMetadataSource does not support secure object class: " + getSecureObjectClass());
Assert.isTrue(this.runAsManager.supports(getSecureObjectClass()), Assert.isTrue(this.runAsManager.supports(getSecureObjectClass()),
"RunAsManager does not support secure object class: " + getSecureObjectClass()); "RunAsManager does not support secure object class: " + getSecureObjectClass());
Assert.isTrue(this.accessDecisionManager.supports(getSecureObjectClass()), Assert.isTrue(this.accessDecisionManager.supports(getSecureObjectClass()),
@ -136,10 +136,10 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
} }
if (this.validateConfigAttributes) { if (this.validateConfigAttributes) {
Collection<ConfigAttribute> attributeDefs = this.obtainObjectDefinitionSource().getAllConfigAttributes(); Collection<ConfigAttribute> attributeDefs = this.obtainSecurityMetadataSource().getAllConfigAttributes();
if (attributeDefs == null) { if (attributeDefs == null) {
logger.warn("Could not validate configuration attributes as the ObjectDefinitionSource did not return " logger.warn("Could not validate configuration attributes as the SecurityMetadataSource did not return "
+ "any attributes from getAllConfigAttributes()"); + "any attributes from getAllConfigAttributes()");
return; return;
} }
@ -171,7 +171,7 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
+ getSecureObjectClass()); + getSecureObjectClass());
} }
List<ConfigAttribute> attributes = this.obtainObjectDefinitionSource().getAttributes(object); List<ConfigAttribute> attributes = this.obtainSecurityMetadataSource().getAttributes(object);
if (attributes == null) { if (attributes == null) {
if (rejectPublicInvocations) { if (rejectPublicInvocations) {
@ -371,7 +371,7 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
return validateConfigAttributes; return validateConfigAttributes;
} }
public abstract ObjectDefinitionSource obtainObjectDefinitionSource(); public abstract SecurityMetadataSource obtainSecurityMetadataSource();
public void setAccessDecisionManager(AccessDecisionManager accessDecisionManager) { public void setAccessDecisionManager(AccessDecisionManager accessDecisionManager) {
this.accessDecisionManager = accessDecisionManager; this.accessDecisionManager = accessDecisionManager;

6
core/src/main/java/org/springframework/security/intercept/ObjectDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/SecurityMetadataSource.java
View File

@ -28,7 +28,7 @@ import org.springframework.security.ConfigAttribute;
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
public interface ObjectDefinitionSource { public interface SecurityMetadataSource {
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
/** /**
@ -41,7 +41,7 @@ public interface ObjectDefinitionSource {
* @return the attributes that apply to the passed in secured object or null if there are no applicable attributes. * @return the attributes that apply to the passed in secured object or null if there are no applicable attributes.
* *
* @throws IllegalArgumentException if the passed object is not of a type supported by the * @throws IllegalArgumentException if the passed object is not of a type supported by the
* <code>ObjectDefinitionSource</code> implementation * <code>SecurityMetadataSource</code> implementation
*/ */
List<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException; List<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException;
@ -56,7 +56,7 @@ public interface ObjectDefinitionSource {
Collection<ConfigAttribute> getAllConfigAttributes(); Collection<ConfigAttribute> getAllConfigAttributes();
/** /**
* Indicates whether the <code>ObjectDefinitionSource</code> implementation is able to provide * Indicates whether the <code>SecurityMetadataSource</code> implementation is able to provide
* <code>ConfigAttribute</code>s for the indicated secure object type. * <code>ConfigAttribute</code>s for the indicated secure object type.
* *
* @param clazz the class that is being queried * @param clazz the class that is being queried

10
core/src/main/java/org/springframework/security/intercept/method/AbstractFallbackMethodDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/method/AbstractFallbackMethodSecurityMetadataSource.java
View File

@ -7,25 +7,25 @@ import org.springframework.security.ConfigAttribute;
import org.springframework.util.ClassUtils; import org.springframework.util.ClassUtils;
/** /**
* Abstract implementation of {@link MethodDefinitionSource} that supports both Spring AOP and AspectJ and * Abstract implementation of {@link MethodSecurityMetadataSource} that supports both Spring AOP and AspectJ and
* performs attribute resolution from: 1. specific target method; 2. target class; 3. declaring method; * performs attribute resolution from: 1. specific target method; 2. target class; 3. declaring method;
* 4. declaring class/interface. Use with {@link DelegatingMethodDefinitionSource} for caching support. * 4. declaring class/interface. Use with {@link DelegatingMethodSecurityMetadataSource} for caching support.
* <p> * <p>
* This class mimics the behaviour of Spring's AbstractFallbackTransactionAttributeSource class. * This class mimics the behaviour of Spring's <tt>AbstractFallbackTransactionAttributeSource</tt> class.
* <p> * <p>
* Note that this class cannot extract security metadata where that metadata is expressed by way of * Note that this class cannot extract security metadata where that metadata is expressed by way of
* a target method/class (i.e. #1 and #2 above) AND the target method/class is encapsulated in another * a target method/class (i.e. #1 and #2 above) AND the target method/class is encapsulated in another
* proxy object. Spring Security does not walk a proxy chain to locate the concrete/final target object. * proxy object. Spring Security does not walk a proxy chain to locate the concrete/final target object.
* Consider making Spring Security your final advisor (so it advises the final target, as opposed to * Consider making Spring Security your final advisor (so it advises the final target, as opposed to
* another proxy), move the metadata to declared methods or interfaces the proxy implements, or provide * another proxy), move the metadata to declared methods or interfaces the proxy implements, or provide
* your own replacement <tt>MethodDefinitionSource</tt>. * your own replacement <tt>MethodSecurityMetadataSource</tt>.
* *
* @author Ben Alex * @author Ben Alex
* @author Luke taylor * @author Luke taylor
* @version $Id$ * @version $Id$
* @since 2.0 * @since 2.0
*/ */
public abstract class AbstractFallbackMethodDefinitionSource extends AbstractMethodDefinitionSource { public abstract class AbstractFallbackMethodSecurityMetadataSource extends AbstractMethodSecurityMetadataSource {
public List<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) { public List<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) {
// The method may be on an interface, but we need attributes from the target class. // The method may be on an interface, but we need attributes from the target class.

4
core/src/main/java/org/springframework/security/intercept/method/AbstractMethodDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/method/AbstractMethodSecurityMetadataSource.java
View File

@ -33,14 +33,14 @@ import java.util.List;
/** /**
* Abstract implementation of <tt>MethodDefinitionSource</tt> which resolves the secured object type to * Abstract implementation of <tt>MethodSecurityMetadataSource</tt> which resolves the secured object type to
* either a MethodInvocation or a JoinPoint. * either a MethodInvocation or a JoinPoint.
* *
* @author Ben Alex * @author Ben Alex
* @author Luke Taylor * @author Luke Taylor
* @version $Id$ * @version $Id$
*/ */
public abstract class AbstractMethodDefinitionSource implements MethodDefinitionSource { public abstract class AbstractMethodSecurityMetadataSource implements MethodSecurityMetadataSource {
protected final Log logger = LogFactory.getLog(getClass()); protected final Log logger = LogFactory.getLog(getClass());

14
core/src/main/java/org/springframework/security/intercept/method/DelegatingMethodDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/method/DelegatingMethodSecurityMetadataSource.java
View File

@ -22,17 +22,17 @@ import org.springframework.util.ObjectUtils;
* @author Luke Taylor * @author Luke Taylor
* @version $Id$ * @version $Id$
*/ */
public final class DelegatingMethodDefinitionSource extends AbstractMethodDefinitionSource implements InitializingBean { public final class DelegatingMethodSecurityMetadataSource extends AbstractMethodSecurityMetadataSource implements InitializingBean {
private final static List<ConfigAttribute> NULL_CONFIG_ATTRIBUTE = Collections.emptyList(); private final static List<ConfigAttribute> NULL_CONFIG_ATTRIBUTE = Collections.emptyList();
private List<MethodDefinitionSource> methodDefinitionSources; private List<MethodSecurityMetadataSource> methodSecurityMetadataSources;
private final Map<DefaultCacheKey, List<ConfigAttribute>> attributeCache = private final Map<DefaultCacheKey, List<ConfigAttribute>> attributeCache =
new HashMap<DefaultCacheKey, List<ConfigAttribute>>(); new HashMap<DefaultCacheKey, List<ConfigAttribute>>();
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
public void afterPropertiesSet() throws Exception { public void afterPropertiesSet() throws Exception {
Assert.notNull(methodDefinitionSources, "A list of MethodDefinitionSources is required"); Assert.notNull(methodSecurityMetadataSources, "A list of MethodSecurityMetadataSources is required");
} }
public List<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) { public List<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) {
@ -50,7 +50,7 @@ public final class DelegatingMethodDefinitionSource extends AbstractMethodDefini
// No cached value, so query the sources to find a result // No cached value, so query the sources to find a result
List<ConfigAttribute> attributes = null; List<ConfigAttribute> attributes = null;
for (MethodDefinitionSource s : methodDefinitionSources) { for (MethodSecurityMetadataSource s : methodSecurityMetadataSources) {
attributes = s.getAttributes(method, targetClass); attributes = s.getAttributes(method, targetClass);
if (attributes != null) { if (attributes != null) {
break; break;
@ -75,7 +75,7 @@ public final class DelegatingMethodDefinitionSource extends AbstractMethodDefini
public Collection<ConfigAttribute> getAllConfigAttributes() { public Collection<ConfigAttribute> getAllConfigAttributes() {
Set<ConfigAttribute> set = new HashSet<ConfigAttribute>(); Set<ConfigAttribute> set = new HashSet<ConfigAttribute>();
for (MethodDefinitionSource s : methodDefinitionSources) { for (MethodSecurityMetadataSource s : methodSecurityMetadataSources) {
Collection<ConfigAttribute> attrs = s.getAllConfigAttributes(); Collection<ConfigAttribute> attrs = s.getAllConfigAttributes();
if (attrs != null) { if (attrs != null) {
set.addAll(attrs); set.addAll(attrs);
@ -85,8 +85,8 @@ public final class DelegatingMethodDefinitionSource extends AbstractMethodDefini
} }
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public void setMethodDefinitionSources(List methodDefinitionSources) { public void setMethodSecurityMetadataSources(List methodSecurityMetadataSources) {
this.methodDefinitionSources = methodDefinitionSources; this.methodSecurityMetadataSources = methodSecurityMetadataSources;
} }
//~ Inner Classes ================================================================================================== //~ Inner Classes ==================================================================================================

10
core/src/main/java/org/springframework/security/intercept/method/MapBasedMethodDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/method/MapBasedMethodSecurityMetadataSource.java
View File

@ -34,7 +34,7 @@ import org.springframework.util.ClassUtils;
* Stores a list of <tt>ConfigAttribute</tt>s for a method or class signature. * Stores a list of <tt>ConfigAttribute</tt>s for a method or class signature.
* *
* <p> * <p>
* This class is the preferred implementation of {@link MethodDefinitionSource} for XML-based * This class is the preferred implementation of {@link MethodSecurityMetadataSource} for XML-based
* definition of method security metadata. To assist in XML-based definition, wildcard support * definition of method security metadata. To assist in XML-based definition, wildcard support
* is provided. * is provided.
* </p> * </p>
@ -43,7 +43,7 @@ import org.springframework.util.ClassUtils;
* @version $Id$ * @version $Id$
* @since 2.0 * @since 2.0
*/ */
public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefinitionSource implements BeanClassLoaderAware { public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource implements BeanClassLoaderAware {
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader(); private ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();
@ -56,14 +56,14 @@ public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefini
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
public MapBasedMethodDefinitionSource() { public MapBasedMethodSecurityMetadataSource() {
} }
/** /**
* Creates the MapBasedMethodDefinitionSource from a * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a
* @param methodMap map of method names to <tt>ConfigAttribute</tt>s. * @param methodMap map of method names to <tt>ConfigAttribute</tt>s.
*/ */
public MapBasedMethodDefinitionSource(Map<String, List<ConfigAttribute>> methodMap) { public MapBasedMethodSecurityMetadataSource(Map<String, List<ConfigAttribute>> methodMap) {
for (Map.Entry<String, List<ConfigAttribute>> entry : methodMap.entrySet()) { for (Map.Entry<String, List<ConfigAttribute>> entry : methodMap.entrySet()) {
addSecureMethod(entry.getKey(), entry.getValue()); addSecureMethod(entry.getKey(), entry.getValue());
} }

2
core/src/main/java/org/springframework/security/intercept/method/MethodInvocationPrivilegeEvaluator.java
View File

@ -59,7 +59,7 @@ public class MethodInvocationPrivilegeEvaluator implements InitializingBean {
Assert.notNull(mi, "MethodInvocation required"); Assert.notNull(mi, "MethodInvocation required");
Assert.notNull(mi.getMethod(), "MethodInvocation must provide a non-null getMethod()"); Assert.notNull(mi.getMethod(), "MethodInvocation must provide a non-null getMethod()");
List<ConfigAttribute> attrs = securityInterceptor.obtainObjectDefinitionSource().getAttributes(mi); List<ConfigAttribute> attrs = securityInterceptor.obtainSecurityMetadataSource().getAttributes(mi);
if (attrs == null) { if (attrs == null) {
if (securityInterceptor.isRejectPublicInvocations()) { if (securityInterceptor.isRejectPublicInvocations()) {

6
core/src/main/java/org/springframework/security/intercept/method/MethodDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/method/MethodSecurityMetadataSource.java
View File

@ -19,16 +19,16 @@ import java.lang.reflect.Method;
import java.util.List; import java.util.List;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.intercept.ObjectDefinitionSource; import org.springframework.security.intercept.SecurityMetadataSource;
/** /**
* Interface for <code>ObjectDefinitionSource</code> implementations * Interface for <code>SecurityMetadataSource</code> implementations
* that are designed to perform lookups keyed on <code>Method</code>s. * that are designed to perform lookups keyed on <code>Method</code>s.
* *
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
public interface MethodDefinitionSource extends ObjectDefinitionSource { public interface MethodSecurityMetadataSource extends SecurityMetadataSource {
public List<ConfigAttribute> getAttributes(Method method, Class<?> targetClass); public List<ConfigAttribute> getAttributes(Method method, Class<?> targetClass);
} }

10
core/src/main/java/org/springframework/security/intercept/method/MethodDefinitionSourceEditor.java → core/src/main/java/org/springframework/security/intercept/method/MethodSecurityMetadataSourceEditor.java
View File

@ -30,21 +30,21 @@ import org.springframework.util.StringUtils;
/** /**
* Property editor to assist with the setup of a {@link MethodDefinitionSource}. * Property editor to assist with the setup of a {@link MethodSecurityMetadataSource}.
* <p> * <p>
* The class creates and populates a {@link MapBasedMethodDefinitionSource}. * The class creates and populates a {@link MapBasedMethodSecurityMetadataSource}.
* *
* @author Ben Alex * @author Ben Alex
* @deprecated use method annotations or the protect-pointcut support from the namespace * @deprecated use method annotations or the protect-pointcut support from the namespace
* @version $Id$ * @version $Id$
*/ */
public class MethodDefinitionSourceEditor extends PropertyEditorSupport { public class MethodSecurityMetadataSourceEditor extends PropertyEditorSupport {
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public void setAsText(String s) throws IllegalArgumentException { public void setAsText(String s) throws IllegalArgumentException {
if ((s == null) || "".equals(s)) { if ((s == null) || "".equals(s)) {
setValue(new MapBasedMethodDefinitionSource()); setValue(new MapBasedMethodSecurityMetadataSource());
return; return;
} }
@ -71,6 +71,6 @@ public class MethodDefinitionSourceEditor extends PropertyEditorSupport {
mappings.put(name, attributes); mappings.put(name, attributes);
} }
setValue(new MapBasedMethodDefinitionSource(mappings)); setValue(new MapBasedMethodSecurityMetadataSource(mappings));
} }
} }

20
core/src/main/java/org/springframework/security/intercept/method/ProtectPointcutPostProcessor.java
View File

@ -15,19 +15,19 @@ import org.aspectj.weaver.tools.PointcutPrimitive;
import org.springframework.beans.BeansException; import org.springframework.beans.BeansException;
import org.springframework.beans.factory.config.BeanPostProcessor; import org.springframework.beans.factory.config.BeanPostProcessor;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.intercept.method.aopalliance.MethodDefinitionSourceAdvisor; import org.springframework.security.intercept.method.aopalliance.MethodSecurityMetadataSourceAdvisor;
import org.springframework.util.Assert; import org.springframework.util.Assert;
import org.springframework.util.StringUtils; import org.springframework.util.StringUtils;
/** /**
* Parses AspectJ pointcut expressions, registering methods that match the pointcut with a * Parses AspectJ pointcut expressions, registering methods that match the pointcut with a
* traditional {@link MapBasedMethodDefinitionSource}. * traditional {@link MapBasedMethodSecurityMetadataSource}.
* *
* <p> * <p>
* This class provides a convenient way of declaring a list of pointcuts, and then * This class provides a convenient way of declaring a list of pointcuts, and then
* having every method of every bean defined in the Spring application context compared with * having every method of every bean defined in the Spring application context compared with
* those pointcuts. Where a match is found, the matching method will be registered with the * those pointcuts. Where a match is found, the matching method will be registered with the
* {@link MapBasedMethodDefinitionSource}. * {@link MapBasedMethodSecurityMetadataSource}.
* <p> * <p>
* It is very important to understand that only the <b>first</b> pointcut that matches a given * It is very important to understand that only the <b>first</b> pointcut that matches a given
* method will be taken as authoritative for that method. This is why pointcuts should be provided * method will be taken as authoritative for that method. This is why pointcuts should be provided
@ -36,8 +36,8 @@ import org.springframework.util.StringUtils;
* Note also that only beans defined in the Spring application context will be examined by this * Note also that only beans defined in the Spring application context will be examined by this
* class. * class.
* <p> * <p>
* Because this class registers method security metadata with {@link MapBasedMethodDefinitionSource}, * Because this class registers method security metadata with {@link MapBasedMethodSecurityMetadataSource},
* normal Spring Security capabilities such as {@link MethodDefinitionSourceAdvisor} can be used. * normal Spring Security capabilities such as {@link MethodSecurityMetadataSourceAdvisor} can be used.
* It does not matter the fact the method metadata was originally obtained from an AspectJ pointcut * It does not matter the fact the method metadata was originally obtained from an AspectJ pointcut
* expression evaluation. * expression evaluation.
* *
@ -51,12 +51,12 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
private static final Log logger = LogFactory.getLog(ProtectPointcutPostProcessor.class); private static final Log logger = LogFactory.getLog(ProtectPointcutPostProcessor.class);
private Map<String,List<ConfigAttribute>> pointcutMap = new LinkedHashMap<String,List<ConfigAttribute>>(); private Map<String,List<ConfigAttribute>> pointcutMap = new LinkedHashMap<String,List<ConfigAttribute>>();
private MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource; private MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource;
private PointcutParser parser; private PointcutParser parser;
public ProtectPointcutPostProcessor(MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource) { public ProtectPointcutPostProcessor(MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource) {
Assert.notNull(mapBasedMethodDefinitionSource, "MapBasedMethodDefinitionSource to populate is required"); Assert.notNull(mapBasedMethodSecurityMetadataSource, "MapBasedMethodSecurityMetadataSource to populate is required");
this.mapBasedMethodDefinitionSource = mapBasedMethodDefinitionSource; this.mapBasedMethodSecurityMetadataSource = mapBasedMethodSecurityMetadataSource;
// Set up AspectJ pointcut expression parser // Set up AspectJ pointcut expression parser
Set<PointcutPrimitive> supportedPrimitives = new HashSet<PointcutPrimitive>(3); Set<PointcutPrimitive> supportedPrimitives = new HashSet<PointcutPrimitive>(3);
@ -115,7 +115,7 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
logger.debug("AspectJ pointcut expression '" + expression.getPointcutExpression() + "' matches target class '" + targetClass.getName() + "' (bean ID '" + beanName + "') for method '" + method + "'; registering security configuration attribute '" + attr + "'"); logger.debug("AspectJ pointcut expression '" + expression.getPointcutExpression() + "' matches target class '" + targetClass.getName() + "' (bean ID '" + beanName + "') for method '" + method + "'; registering security configuration attribute '" + attr + "'");
} }
mapBasedMethodDefinitionSource.addSecureMethod(targetClass, method, attr); mapBasedMethodSecurityMetadataSource.addSecureMethod(targetClass, method, attr);
} }
return matches; return matches;

22
core/src/main/java/org/springframework/security/intercept/method/aopalliance/MethodSecurityInterceptor.java
View File

@ -17,8 +17,8 @@ package org.springframework.security.intercept.method.aopalliance;
import org.springframework.security.intercept.AbstractSecurityInterceptor; import org.springframework.security.intercept.AbstractSecurityInterceptor;
import org.springframework.security.intercept.InterceptorStatusToken; import org.springframework.security.intercept.InterceptorStatusToken;
import org.springframework.security.intercept.ObjectDefinitionSource; import org.springframework.security.intercept.SecurityMetadataSource;
import org.springframework.security.intercept.method.MethodDefinitionSource; import org.springframework.security.intercept.method.MethodSecurityMetadataSource;
import org.aopalliance.intercept.MethodInterceptor; import org.aopalliance.intercept.MethodInterceptor;
import org.aopalliance.intercept.MethodInvocation; import org.aopalliance.intercept.MethodInvocation;
@ -26,8 +26,8 @@ import org.aopalliance.intercept.MethodInvocation;
/** /**
* Provides security interception of AOP Alliance based method invocations.<p>The * Provides security interception of AOP Alliance based method invocations.<p>The
* <code>ObjectDefinitionSource</code> required by this security interceptor is of type {@link * <code>SecurityMetadataSource</code> required by this security interceptor is of type {@link
* MethodDefinitionSource}. This is shared with the AspectJ based security interceptor * MethodSecurityMetadataSource}. This is shared with the AspectJ based security interceptor
* (<code>AspectJSecurityInterceptor</code>), since both work with Java <code>Method</code>s.</p> * (<code>AspectJSecurityInterceptor</code>), since both work with Java <code>Method</code>s.</p>
* <P>Refer to {@link AbstractSecurityInterceptor} for details on the workflow.</p> * <P>Refer to {@link AbstractSecurityInterceptor} for details on the workflow.</p>
* *
@ -37,12 +37,12 @@ import org.aopalliance.intercept.MethodInvocation;
public class MethodSecurityInterceptor extends AbstractSecurityInterceptor implements MethodInterceptor { public class MethodSecurityInterceptor extends AbstractSecurityInterceptor implements MethodInterceptor {
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private MethodDefinitionSource objectDefinitionSource; private MethodSecurityMetadataSource securityMetadataSource;
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
public MethodDefinitionSource getObjectDefinitionSource() { public MethodSecurityMetadataSource getSecurityMetadataSource() {
return this.objectDefinitionSource; return this.securityMetadataSource;
} }
public Class<? extends Object> getSecureObjectClass() { public Class<? extends Object> getSecureObjectClass() {
@ -71,11 +71,11 @@ public class MethodSecurityInterceptor extends AbstractSecurityInterceptor imple
return result; return result;
} }
public ObjectDefinitionSource obtainObjectDefinitionSource() { public SecurityMetadataSource obtainSecurityMetadataSource() {
return this.objectDefinitionSource; return this.securityMetadataSource;
} }
public void setObjectDefinitionSource(MethodDefinitionSource newSource) { public void setSecurityMetadataSource(MethodSecurityMetadataSource newSource) {
this.objectDefinitionSource = newSource; this.securityMetadataSource = newSource;
} }
} }

24
core/src/main/java/org/springframework/security/intercept/method/aopalliance/MethodDefinitionSourceAdvisor.java → core/src/main/java/org/springframework/security/intercept/method/aopalliance/MethodSecurityMetadataSourceAdvisor.java
View File

@ -26,11 +26,11 @@ import org.springframework.aop.support.StaticMethodMatcherPointcut;
import org.springframework.beans.BeansException; import org.springframework.beans.BeansException;
import org.springframework.beans.factory.BeanFactory; import org.springframework.beans.factory.BeanFactory;
import org.springframework.beans.factory.BeanFactoryAware; import org.springframework.beans.factory.BeanFactoryAware;
import org.springframework.security.intercept.method.MethodDefinitionSource; import org.springframework.security.intercept.method.MethodSecurityMetadataSource;
import org.springframework.util.Assert; import org.springframework.util.Assert;
/** /**
* Advisor driven by a {@link MethodDefinitionSource}, used to exclude a {@link MethodSecurityInterceptor} from * Advisor driven by a {@link MethodSecurityMetadataSource}, used to exclude a {@link MethodSecurityInterceptor} from
* public (ie non-secure) methods. * public (ie non-secure) methods.
* <p> * <p>
* Because the AOP framework caches advice calculations, this is normally faster than just letting the * Because the AOP framework caches advice calculations, this is normally faster than just letting the
@ -47,12 +47,12 @@ import org.springframework.util.Assert;
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor implements BeanFactoryAware { public class MethodSecurityMetadataSourceAdvisor extends AbstractPointcutAdvisor implements BeanFactoryAware {
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private MethodDefinitionSource attributeSource; private MethodSecurityMetadataSource attributeSource;
private MethodSecurityInterceptor interceptor; private MethodSecurityInterceptor interceptor;
private Pointcut pointcut = new MethodDefinitionSourcePointcut(); private Pointcut pointcut = new MethodSecurityMetadataSourcePointcut();
private BeanFactory beanFactory; private BeanFactory beanFactory;
private String adviceBeanName; private String adviceBeanName;
private final Object adviceMonitor = new Object(); private final Object adviceMonitor = new Object();
@ -62,12 +62,12 @@ public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor imple
/** /**
* @deprecated use the decoupled approach instead * @deprecated use the decoupled approach instead
*/ */
public MethodDefinitionSourceAdvisor(MethodSecurityInterceptor advice) { public MethodSecurityMetadataSourceAdvisor(MethodSecurityInterceptor advice) {
Assert.notNull(advice.getObjectDefinitionSource(), "Cannot construct a MethodDefinitionSourceAdvisor using a " + Assert.notNull(advice.getSecurityMetadataSource(), "Cannot construct a MethodSecurityMetadataSourceAdvisor using a " +
"MethodSecurityInterceptor that has no ObjectDefinitionSource configured"); "MethodSecurityInterceptor that has no SecurityMetadataSource configured");
this.interceptor = advice; this.interceptor = advice;
this.attributeSource = advice.getObjectDefinitionSource(); this.attributeSource = advice.getSecurityMetadataSource();
} }
/** /**
@ -82,7 +82,7 @@ public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor imple
* @param adviceBeanName name of the MethodSecurityInterceptor bean * @param adviceBeanName name of the MethodSecurityInterceptor bean
* @param attributeSource the attribute source (should be the same as the one used on the interceptor) * @param attributeSource the attribute source (should be the same as the one used on the interceptor)
*/ */
public MethodDefinitionSourceAdvisor(String adviceBeanName, MethodDefinitionSource attributeSource) { public MethodSecurityMetadataSourceAdvisor(String adviceBeanName, MethodSecurityMetadataSource attributeSource) {
Assert.notNull(adviceBeanName, "The adviceBeanName cannot be null"); Assert.notNull(adviceBeanName, "The adviceBeanName cannot be null");
Assert.notNull(attributeSource, "The attributeSource cannot be null"); Assert.notNull(attributeSource, "The attributeSource cannot be null");
@ -114,7 +114,7 @@ public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor imple
//~ Inner Classes ================================================================================================== //~ Inner Classes ==================================================================================================
class MethodDefinitionSourcePointcut extends StaticMethodMatcherPointcut { class MethodSecurityMetadataSourcePointcut extends StaticMethodMatcherPointcut {
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public boolean matches(Method m, Class targetClass) { public boolean matches(Method m, Class targetClass) {
return attributeSource.getAttributes(m, targetClass) != null; return attributeSource.getAttributes(m, targetClass) != null;
@ -124,7 +124,7 @@ public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor imple
/** /**
* Represents a <code>MethodInvocation</code>. * Represents a <code>MethodInvocation</code>.
* <p> * <p>
* Required as <code>MethodDefinitionSource</code> only supports lookup of configuration attributes for * Required as <code>MethodSecurityMetadataSource</code> only supports lookup of configuration attributes for
* <code>MethodInvocation</code>s. * <code>MethodInvocation</code>s.
*/ */
class InternalMethodInvocation implements MethodInvocation { class InternalMethodInvocation implements MethodInvocation {

18
core/src/main/java/org/springframework/security/intercept/method/aspectj/AspectJAnnotationSecurityInterceptor.java
View File

@ -2,8 +2,8 @@ package org.springframework.security.intercept.method.aspectj;
import org.springframework.security.intercept.AbstractSecurityInterceptor; import org.springframework.security.intercept.AbstractSecurityInterceptor;
import org.springframework.security.intercept.InterceptorStatusToken; import org.springframework.security.intercept.InterceptorStatusToken;
import org.springframework.security.intercept.ObjectDefinitionSource; import org.springframework.security.intercept.SecurityMetadataSource;
import org.springframework.security.intercept.method.MethodDefinitionSource; import org.springframework.security.intercept.method.MethodSecurityMetadataSource;
import org.aspectj.lang.JoinPoint; import org.aspectj.lang.JoinPoint;
@ -16,12 +16,12 @@ import org.aspectj.lang.JoinPoint;
public class AspectJAnnotationSecurityInterceptor extends AbstractSecurityInterceptor { public class AspectJAnnotationSecurityInterceptor extends AbstractSecurityInterceptor {
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private MethodDefinitionSource objectDefinitionSource; private MethodSecurityMetadataSource securityMetadataSource;
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
public MethodDefinitionSource getObjectDefinitionSource() { public MethodSecurityMetadataSource getSecurityMetadataSource() {
return this.objectDefinitionSource; return this.securityMetadataSource;
} }
public Class<? extends Object> getSecureObjectClass() { public Class<? extends Object> getSecureObjectClass() {
@ -50,12 +50,12 @@ public class AspectJAnnotationSecurityInterceptor extends AbstractSecurityInterc
return result; return result;
} }
public ObjectDefinitionSource obtainObjectDefinitionSource() { public SecurityMetadataSource obtainSecurityMetadataSource() {
return this.objectDefinitionSource; return this.securityMetadataSource;
} }
public void setObjectDefinitionSource(MethodDefinitionSource newSource) { public void setSecurityMetadataSource(MethodSecurityMetadataSource newSource) {
this.objectDefinitionSource = newSource; this.securityMetadataSource = newSource;
} }
} }

18
core/src/main/java/org/springframework/security/intercept/method/aspectj/AspectJSecurityInterceptor.java
View File

@ -17,8 +17,8 @@ package org.springframework.security.intercept.method.aspectj;
import org.springframework.security.intercept.AbstractSecurityInterceptor; import org.springframework.security.intercept.AbstractSecurityInterceptor;
import org.springframework.security.intercept.InterceptorStatusToken; import org.springframework.security.intercept.InterceptorStatusToken;
import org.springframework.security.intercept.ObjectDefinitionSource; import org.springframework.security.intercept.SecurityMetadataSource;
import org.springframework.security.intercept.method.MethodDefinitionSource; import org.springframework.security.intercept.method.MethodSecurityMetadataSource;
import org.aspectj.lang.JoinPoint; import org.aspectj.lang.JoinPoint;
@ -26,8 +26,8 @@ import org.aspectj.lang.JoinPoint;
/** /**
* Provides security interception of AspectJ method invocations. * Provides security interception of AspectJ method invocations.
* <p> * <p>
* The <code>ObjectDefinitionSource</code> required by this security interceptor is of type * The <code>SecurityMetadataSource</code> required by this security interceptor is of type
* {@link MethodDefinitionSource}. This is shared with the AOP Alliance based security interceptor * {@link MethodSecurityMetadataSource}. This is shared with the AOP Alliance based security interceptor
* (<code>MethodSecurityInterceptor</code>), since both work with Java <code>Method</code>s. * (<code>MethodSecurityInterceptor</code>), since both work with Java <code>Method</code>s.
* <p> * <p>
* The secure object type is <code>org.aspectj.lang.JoinPoint</code>, which is passed from the relevant * The secure object type is <code>org.aspectj.lang.JoinPoint</code>, which is passed from the relevant
@ -42,7 +42,7 @@ import org.aspectj.lang.JoinPoint;
public class AspectJSecurityInterceptor extends AbstractSecurityInterceptor { public class AspectJSecurityInterceptor extends AbstractSecurityInterceptor {
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private MethodDefinitionSource objectDefinitionSource; private MethodSecurityMetadataSource securityMetadataSource;
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
@ -72,11 +72,11 @@ public class AspectJSecurityInterceptor extends AbstractSecurityInterceptor {
return result; return result;
} }
public ObjectDefinitionSource obtainObjectDefinitionSource() { public SecurityMetadataSource obtainSecurityMetadataSource() {
return this.objectDefinitionSource; return this.securityMetadataSource;
} }
public void setObjectDefinitionSource(MethodDefinitionSource newSource) { public void setSecurityMetadataSource(MethodSecurityMetadataSource newSource) {
this.objectDefinitionSource = newSource; this.securityMetadataSource = newSource;
} }
} }

4
core/src/main/java/org/springframework/security/intercept/web/DefaultFilterInvocationDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/web/DefaultFilterInvocationSecurityMetadataSource.java
View File

@ -51,7 +51,7 @@ import org.springframework.security.util.UrlMatcher;
* @author Luke Taylor * @author Luke Taylor
* @version $Id$ * @version $Id$
*/ */
public class DefaultFilterInvocationDefinitionSource implements FilterInvocationDefinitionSource { public class DefaultFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
private static final Set<String> HTTP_METHODS = new HashSet<String>(Arrays.asList("DELETE", "GET", "HEAD", "OPTIONS", "POST", "PUT", "TRACE")); private static final Set<String> HTTP_METHODS = new HashSet<String>(Arrays.asList("DELETE", "GET", "HEAD", "OPTIONS", "POST", "PUT", "TRACE"));
@ -76,7 +76,7 @@ public class DefaultFilterInvocationDefinitionSource implements FilterInvocation
* @param urlMatcher typically an ant or regular expression matcher. * @param urlMatcher typically an ant or regular expression matcher.
* @param requestMap order-preserving map of request definitions to attribute lists * @param requestMap order-preserving map of request definitions to attribute lists
*/ */
public DefaultFilterInvocationDefinitionSource(UrlMatcher urlMatcher, public DefaultFilterInvocationSecurityMetadataSource(UrlMatcher urlMatcher,
LinkedHashMap<RequestKey, List<ConfigAttribute>> requestMap) { LinkedHashMap<RequestKey, List<ConfigAttribute>> requestMap) {
this.urlMatcher = urlMatcher; this.urlMatcher = urlMatcher;

6
core/src/main/java/org/springframework/security/intercept/web/FilterInvocationDefinitionSource.java → core/src/main/java/org/springframework/security/intercept/web/FilterInvocationSecurityMetadataSource.java
View File

@ -15,14 +15,14 @@
package org.springframework.security.intercept.web; package org.springframework.security.intercept.web;
import org.springframework.security.intercept.ObjectDefinitionSource; import org.springframework.security.intercept.SecurityMetadataSource;
/** /**
* Marker interface for <code>ObjectDefinitionSource</code> implementations * Marker interface for <code>SecurityMetadataSource</code> implementations
* that are designed to perform lookups keyed on {@link FilterInvocation}s. * that are designed to perform lookups keyed on {@link FilterInvocation}s.
* *
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
public interface FilterInvocationDefinitionSource extends ObjectDefinitionSource {} public interface FilterInvocationSecurityMetadataSource extends SecurityMetadataSource {}

30
core/src/main/java/org/springframework/security/intercept/web/FilterSecurityInterceptor.java
View File

@ -17,7 +17,7 @@ package org.springframework.security.intercept.web;
import org.springframework.security.intercept.AbstractSecurityInterceptor; import org.springframework.security.intercept.AbstractSecurityInterceptor;
import org.springframework.security.intercept.InterceptorStatusToken; import org.springframework.security.intercept.InterceptorStatusToken;
import org.springframework.security.intercept.ObjectDefinitionSource; import org.springframework.security.intercept.SecurityMetadataSource;
import org.springframework.security.ui.FilterChainOrder; import org.springframework.security.ui.FilterChainOrder;
import org.springframework.core.Ordered; import org.springframework.core.Ordered;
@ -34,8 +34,8 @@ import javax.servlet.ServletResponse;
/** /**
* Performs security handling of HTTP resources via a filter implementation. * Performs security handling of HTTP resources via a filter implementation.
* <p> * <p>
* The <code>ObjectDefinitionSource</code> required by this security interceptor is of type {@link * The <code>SecurityMetadataSource</code> required by this security interceptor is of type {@link
* FilterInvocationDefinitionSource}. * FilterInvocationSecurityMetadataSource}.
* <p> * <p>
* Refer to {@link AbstractSecurityInterceptor} for details on the workflow.</p> * Refer to {@link AbstractSecurityInterceptor} for details on the workflow.</p>
* *
@ -49,7 +49,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private FilterInvocationDefinitionSource objectDefinitionSource; private FilterInvocationSecurityMetadataSource securityMetadataSource;
private boolean observeOncePerRequest = true; private boolean observeOncePerRequest = true;
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
@ -85,8 +85,8 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
invoke(fi); invoke(fi);
} }
public FilterInvocationDefinitionSource getObjectDefinitionSource() { public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
return this.objectDefinitionSource; return this.securityMetadataSource;
} }
public Class<? extends Object> getSecureObjectClass() { public Class<? extends Object> getSecureObjectClass() {
@ -96,7 +96,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
public void invoke(FilterInvocation fi) throws IOException, ServletException { public void invoke(FilterInvocation fi) throws IOException, ServletException {
if ((fi.getRequest() != null) && (fi.getRequest().getAttribute(FILTER_APPLIED) != null) if ((fi.getRequest() != null) && (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
&& observeOncePerRequest) { && observeOncePerRequest) {
// filter already applied to this request and user wants us to observce // filter already applied to this request and user wants us to observe
// once-per-request handling, so don't re-do security checking // once-per-request handling, so don't re-do security checking
fi.getChain().doFilter(fi.getRequest(), fi.getResponse()); fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
} else { } else {
@ -129,12 +129,20 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
return observeOncePerRequest; return observeOncePerRequest;
} }
public ObjectDefinitionSource obtainObjectDefinitionSource() { public SecurityMetadataSource obtainSecurityMetadataSource() {
return this.objectDefinitionSource; return this.securityMetadataSource;
} }
public void setObjectDefinitionSource(FilterInvocationDefinitionSource newSource) { /**
this.objectDefinitionSource = newSource; * @deprecated use setSecurityMetadataSource instead
*/
public void setObjectDefinitionSource(FilterInvocationSecurityMetadataSource newSource) {
logger.warn("The property 'objectDefinitionSource' is deprecated. Please use 'securityMetadataSource' instead");
this.securityMetadataSource = newSource;
}
public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource newSource) {
this.securityMetadataSource = newSource;
} }
public void setObserveOncePerRequest(boolean observeOncePerRequest) { public void setObserveOncePerRequest(boolean observeOncePerRequest) {

2
core/src/main/java/org/springframework/security/intercept/web/WebInvocationPrivilegeEvaluator.java
View File

@ -51,7 +51,7 @@ public class WebInvocationPrivilegeEvaluator implements InitializingBean {
public boolean isAllowed(FilterInvocation fi, Authentication authentication) { public boolean isAllowed(FilterInvocation fi, Authentication authentication) {
Assert.notNull(fi, "FilterInvocation required"); Assert.notNull(fi, "FilterInvocation required");
List<ConfigAttribute> attrs = securityInterceptor.obtainObjectDefinitionSource().getAttributes(fi); List<ConfigAttribute> attrs = securityInterceptor.obtainSecurityMetadataSource().getAttributes(fi);
if (attrs == null) { if (attrs == null) {
if (securityInterceptor.isRejectPublicInvocations()) { if (securityInterceptor.isRejectPublicInvocations()) {

20
core/src/main/java/org/springframework/security/securechannel/ChannelProcessingFilter.java
View File

@ -29,7 +29,7 @@ import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.InitializingBean; import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.intercept.web.FilterInvocation; import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.intercept.web.FilterInvocationDefinitionSource; import org.springframework.security.intercept.web.FilterInvocationSecurityMetadataSource;
import org.springframework.security.ui.FilterChainOrder; import org.springframework.security.ui.FilterChainOrder;
import org.springframework.security.ui.SpringSecurityFilter; import org.springframework.security.ui.SpringSecurityFilter;
import org.springframework.util.Assert; import org.springframework.util.Assert;
@ -51,19 +51,19 @@ public class ChannelProcessingFilter extends SpringSecurityFilter implements Ini
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private ChannelDecisionManager channelDecisionManager; private ChannelDecisionManager channelDecisionManager;
private FilterInvocationDefinitionSource filterInvocationDefinitionSource; private FilterInvocationSecurityMetadataSource filterInvocationSecurityMetadataSource;
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
public void afterPropertiesSet() throws Exception { public void afterPropertiesSet() throws Exception {
Assert.notNull(filterInvocationDefinitionSource, "filterInvocationDefinitionSource must be specified"); Assert.notNull(filterInvocationSecurityMetadataSource, "filterInvocationSecurityMetadataSource must be specified");
Assert.notNull(channelDecisionManager, "channelDecisionManager must be specified"); Assert.notNull(channelDecisionManager, "channelDecisionManager must be specified");
Collection<ConfigAttribute> attrDefs = this.filterInvocationDefinitionSource.getAllConfigAttributes(); Collection<ConfigAttribute> attrDefs = this.filterInvocationSecurityMetadataSource.getAllConfigAttributes();
if (attrDefs == null) { if (attrDefs == null) {
if (logger.isWarnEnabled()) { if (logger.isWarnEnabled()) {
logger.warn("Could not validate configuration attributes as the FilterInvocationDefinitionSource did " logger.warn("Could not validate configuration attributes as the FilterInvocationSecurityMetadataSource did "
+ "not return any attributes"); + "not return any attributes");
} }
@ -91,7 +91,7 @@ public class ChannelProcessingFilter extends SpringSecurityFilter implements Ini
throws IOException, ServletException { throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain); FilterInvocation fi = new FilterInvocation(request, response, chain);
List<ConfigAttribute> attr = this.filterInvocationDefinitionSource.getAttributes(fi); List<ConfigAttribute> attr = this.filterInvocationSecurityMetadataSource.getAttributes(fi);
if (attr != null) { if (attr != null) {
if (logger.isDebugEnabled()) { if (logger.isDebugEnabled()) {
@ -112,16 +112,16 @@ public class ChannelProcessingFilter extends SpringSecurityFilter implements Ini
return channelDecisionManager; return channelDecisionManager;
} }
public FilterInvocationDefinitionSource getFilterInvocationDefinitionSource() { public FilterInvocationSecurityMetadataSource getFilterInvocationSecurityMetadataSource() {
return filterInvocationDefinitionSource; return filterInvocationSecurityMetadataSource;
} }
public void setChannelDecisionManager(ChannelDecisionManager channelDecisionManager) { public void setChannelDecisionManager(ChannelDecisionManager channelDecisionManager) {
this.channelDecisionManager = channelDecisionManager; this.channelDecisionManager = channelDecisionManager;
} }
public void setFilterInvocationDefinitionSource(FilterInvocationDefinitionSource filterInvocationDefinitionSource) { public void setFilterInvocationSecurityMetadataSource(FilterInvocationSecurityMetadataSource filterInvocationSecurityMetadataSource) {
this.filterInvocationDefinitionSource = filterInvocationDefinitionSource; this.filterInvocationSecurityMetadataSource = filterInvocationSecurityMetadataSource;
} }
public int getOrder() { public int getOrder() {

4
core/src/main/java/org/springframework/security/util/FilterChainProxy.java
View File

@ -35,7 +35,7 @@ import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory; import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean; import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.intercept.web.FilterInvocation; import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.intercept.web.FilterInvocationDefinitionSource; import org.springframework.security.intercept.web.FilterInvocationSecurityMetadataSource;
import org.springframework.util.Assert; import org.springframework.util.Assert;
import org.springframework.web.filter.DelegatingFilterProxy; import org.springframework.web.filter.DelegatingFilterProxy;
@ -53,7 +53,7 @@ import org.springframework.web.filter.DelegatingFilterProxy;
* *
* <p>As of version 2.0, <tt>FilterChainProxy</tt> is configured using an ordered Map of path patterns to <tt>List</tt>s * <p>As of version 2.0, <tt>FilterChainProxy</tt> is configured using an ordered Map of path patterns to <tt>List</tt>s
* of <tt>Filter</tt> objects. In previous * of <tt>Filter</tt> objects. In previous
* versions, a {@link FilterInvocationDefinitionSource} was used. This is now deprecated in favour of namespace-based * versions, a {@link FilterInvocationSecurityMetadataSource} was used. This is now deprecated in favour of namespace-based
* configuration which provides a more robust and simplfied syntax. The Map instance will normally be * configuration which provides a more robust and simplfied syntax. The Map instance will normally be
* created while parsing the namespace configuration, so doesn't have to be set explicitly. * created while parsing the namespace configuration, so doesn't have to be set explicitly.
* Instead the &lt;filter-chain-map&gt; element should be used within the FilterChainProxy bean declaration. * Instead the &lt;filter-chain-map&gt; element should be used within the FilterChainProxy bean declaration.

10
core/src/main/java/org/springframework/security/util/FilterInvocationUtils.java
View File

@ -16,6 +16,7 @@
package org.springframework.security.util; package org.springframework.security.util;
import org.springframework.security.intercept.web.FilterInvocation; import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.intercept.web.FilterInvocationSecurityMetadataSource;
import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse; import org.springframework.mock.web.MockHttpServletResponse;
@ -48,18 +49,16 @@ public final class FilterInvocationUtils {
/** /**
* Creates a <code>FilterInvocation</code> for the specified <code>contextPath</code> and <code>Uri</code>. * Creates a <code>FilterInvocation</code> for the specified <code>contextPath</code> and <code>Uri</code>.
* Note the normal subclasses of <code>DefaultFilterInvocationDefinitionSource</code> disregard the * Note the normal subclasses of <tt>DefaultFilterInvocationSecurityMetadataSource</tt> disregard the
* <code>contextPath</code> when evaluating which secure object metadata applies to a given * <code>contextPath</code> when evaluating which secure object metadata applies to a given
* <code>FilterInvocation</code>, so generally the <code>contextPath</code> is unimportant unless you are using a * <code>FilterInvocation</code>, so generally the <code>contextPath</code> is unimportant unless you are using a
* custom <code>FilterInvocationDefinitionSource</code>. * custom <code>FilterInvocationSecurityMetadataSource</code>.
* *
* @param contextPath the <code>contextPath</code> that will be contained within the * @param contextPath the <code>contextPath</code> that will be contained within the
* <code>FilterInvocation</code><code>HttpServletRequest</code> * <code>FilterInvocation</code><code>HttpServletRequest</code>
* @param uri the URI of the request, such as <code>/foo/default.jsp</code> * @param uri the URI of the request, such as <code>/foo/default.jsp</code>
* *
* @return a fully-formed <code>FilterInvocation</code> (never <code>null</code>) * @return a fully-formed <code>FilterInvocation</code> (never <code>null</code>)
*
* @throws UnsupportedOperationException DOCUMENT ME!
*/ */
public static FilterInvocation create(String contextPath, String uri) { public static FilterInvocation create(String contextPath, String uri) {
Assert.hasText(contextPath, "contextPath required"); Assert.hasText(contextPath, "contextPath required");
@ -72,8 +71,7 @@ public final class FilterInvocationUtils {
FilterInvocation fi = new FilterInvocation(req, new MockHttpServletResponse(), FilterInvocation fi = new FilterInvocation(req, new MockHttpServletResponse(),
new FilterChain() { new FilterChain() {
public void doFilter(ServletRequest arg0, ServletResponse arg1) public void doFilter(ServletRequest arg0, ServletResponse arg1) throws IOException, ServletException {
throws IOException, ServletException {
throw new UnsupportedOperationException( throw new UnsupportedOperationException(
"WebInvocationPrivilegeEvaluator does not support filter chains"); "WebInvocationPrivilegeEvaluator does not support filter chains");
} }

2
core/src/test/java/org/springframework/security/annotation/Jsr250MethodDefinitionSourceTests.java
View File

@ -19,7 +19,7 @@ import org.springframework.security.ConfigAttribute;
* @version $Id$ * @version $Id$
*/ */
public class Jsr250MethodDefinitionSourceTests { public class Jsr250MethodDefinitionSourceTests {
Jsr250MethodDefinitionSource mds = new Jsr250MethodDefinitionSource(); Jsr250MethodSecurityMetadataSource mds = new Jsr250MethodSecurityMetadataSource();
A a = new A(); A a = new A();
UserAllowedClass userAllowed = new UserAllowedClass(); UserAllowedClass userAllowed = new UserAllowedClass();
DenyAllClass denyAll = new DenyAllClass(); DenyAllClass denyAll = new DenyAllClass();

12
core/src/test/java/org/springframework/security/annotation/MethodDefinitionSourceEditorTigerTests.java
View File

@ -26,8 +26,8 @@ import org.springframework.security.SecurityConfig;
import org.springframework.security.annotation.test.Entity; import org.springframework.security.annotation.test.Entity;
import org.springframework.security.annotation.test.PersonServiceImpl; import org.springframework.security.annotation.test.PersonServiceImpl;
import org.springframework.security.annotation.test.Service; import org.springframework.security.annotation.test.Service;
import org.springframework.security.intercept.method.MapBasedMethodDefinitionSource; import org.springframework.security.intercept.method.MapBasedMethodSecurityMetadataSource;
import org.springframework.security.intercept.method.MethodDefinitionSourceEditor; import org.springframework.security.intercept.method.MethodSecurityMetadataSourceEditor;
import org.springframework.security.intercept.method.MockMethodInvocation; import org.springframework.security.intercept.method.MockMethodInvocation;
@ -50,13 +50,13 @@ public class MethodDefinitionSourceEditorTigerTests {
@Test @Test
public void testConcreteClassInvocations() throws Exception { public void testConcreteClassInvocations() throws Exception {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText( editor.setAsText(
"org.springframework.security.annotation.test.Service.makeLower*=ROLE_FROM_INTERFACE\r\n" + "org.springframework.security.annotation.test.Service.makeLower*=ROLE_FROM_INTERFACE\r\n" +
"org.springframework.security.annotation.test.Service.makeUpper*=ROLE_FROM_INTERFACE\r\n" + "org.springframework.security.annotation.test.Service.makeUpper*=ROLE_FROM_INTERFACE\r\n" +
"org.springframework.security.annotation.test.ServiceImpl.makeUpper*=ROLE_FROM_IMPLEMENTATION"); "org.springframework.security.annotation.test.ServiceImpl.makeUpper*=ROLE_FROM_IMPLEMENTATION");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(3, map.getMethodMapSize()); assertEquals(3, map.getMethodMapSize());
List<? extends ConfigAttribute> returnedMakeLower = map.getAttributes(makeLower); List<? extends ConfigAttribute> returnedMakeLower = map.getAttributes(makeLower);
@ -70,13 +70,13 @@ public class MethodDefinitionSourceEditorTigerTests {
@Test @Test
public void testBridgeMethodResolution() throws Exception { public void testBridgeMethodResolution() throws Exception {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText( editor.setAsText(
"org.springframework.security.annotation.test.PersonService.makeUpper*=ROLE_FROM_INTERFACE\r\n" + "org.springframework.security.annotation.test.PersonService.makeUpper*=ROLE_FROM_INTERFACE\r\n" +
"org.springframework.security.annotation.test.ServiceImpl.makeUpper*=ROLE_FROM_ABSTRACT\r\n" + "org.springframework.security.annotation.test.ServiceImpl.makeUpper*=ROLE_FROM_ABSTRACT\r\n" +
"org.springframework.security.annotation.test.PersonServiceImpl.makeUpper*=ROLE_FROM_PSI"); "org.springframework.security.annotation.test.PersonServiceImpl.makeUpper*=ROLE_FROM_PSI");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(3, map.getMethodMapSize()); assertEquals(3, map.getMethodMapSize());
List<? extends ConfigAttribute> returnedMakeUpper = map.getAttributes(makeUpper); List<? extends ConfigAttribute> returnedMakeUpper = map.getAttributes(makeUpper);

4
core/src/test/java/org/springframework/security/annotation/SecuredMethodDefinitionSourceTests.java
View File

@ -27,7 +27,7 @@ import org.springframework.util.StringUtils;
/** /**
* Tests for {@link org.springframework.security.annotation.SecuredMethodDefinitionSource} * Tests for {@link org.springframework.security.annotation.SecuredMethodSecurityMetadataSource}
* *
* @author Mark St.Godard * @author Mark St.Godard
* @author Joe Scalise * @author Joe Scalise
@ -37,7 +37,7 @@ import org.springframework.util.StringUtils;
public class SecuredMethodDefinitionSourceTests extends TestCase { public class SecuredMethodDefinitionSourceTests extends TestCase {
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private SecuredMethodDefinitionSource mds = new SecuredMethodDefinitionSource();; private SecuredMethodSecurityMetadataSource mds = new SecuredMethodSecurityMetadataSource();;
private Log logger = LogFactory.getLog(SecuredMethodDefinitionSourceTests.class); private Log logger = LogFactory.getLog(SecuredMethodDefinitionSourceTests.class);
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================

6
core/src/test/java/org/springframework/security/config/FilterInvocationDefinitionSourceParserTests.java
View File

@ -12,7 +12,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse; import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.SecurityConfig; import org.springframework.security.SecurityConfig;
import org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource; import org.springframework.security.intercept.web.DefaultFilterInvocationSecurityMetadataSource;
import org.springframework.security.intercept.web.FilterInvocation; import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.util.InMemoryXmlApplicationContext; import org.springframework.security.util.InMemoryXmlApplicationContext;
@ -42,7 +42,7 @@ public class FilterInvocationDefinitionSourceParserTests {
"<filter-invocation-definition-source id='fids'>" + "<filter-invocation-definition-source id='fids'>" +
" <intercept-url pattern='/**' access='ROLE_A'/>" + " <intercept-url pattern='/**' access='ROLE_A'/>" +
"</filter-invocation-definition-source>"); "</filter-invocation-definition-source>");
DefaultFilterInvocationDefinitionSource fids = (DefaultFilterInvocationDefinitionSource) appContext.getBean("fids"); DefaultFilterInvocationSecurityMetadataSource fids = (DefaultFilterInvocationSecurityMetadataSource) appContext.getBean("fids");
List<? extends ConfigAttribute> cad = fids.getAttributes(createFilterInvocation("/anything", "GET")); List<? extends ConfigAttribute> cad = fids.getAttributes(createFilterInvocation("/anything", "GET"));
assertNotNull(cad); assertNotNull(cad);
assertTrue(cad.contains(new SecurityConfig("ROLE_A"))); assertTrue(cad.contains(new SecurityConfig("ROLE_A")));
@ -53,7 +53,7 @@ public class FilterInvocationDefinitionSourceParserTests {
setContext( setContext(
"<http auto-config='true'/>" + "<http auto-config='true'/>" +
"<b:bean id='fsi' class='org.springframework.security.intercept.web.FilterSecurityInterceptor' autowire='byType'>" + "<b:bean id='fsi' class='org.springframework.security.intercept.web.FilterSecurityInterceptor' autowire='byType'>" +
" <b:property name='objectDefinitionSource'>" + " <b:property name='securityMetadataSource'>" +
" <filter-invocation-definition-source>" + " <filter-invocation-definition-source>" +
" <intercept-url pattern='/secure/extreme/**' access='ROLE_SUPERVISOR'/>" + " <intercept-url pattern='/secure/extreme/**' access='ROLE_SUPERVISOR'/>" +
" <intercept-url pattern='/secure/**' access='ROLE_USER'/>" + " <intercept-url pattern='/secure/**' access='ROLE_USER'/>" +

14
core/src/test/java/org/springframework/security/config/HttpSecurityBeanDefinitionParserTests.java
View File

@ -29,7 +29,7 @@ import org.springframework.security.context.HttpSessionSecurityContextRepository
import org.springframework.security.context.SecurityContextHolder; import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.context.SecurityContextPersistenceFilter; import org.springframework.security.context.SecurityContextPersistenceFilter;
import org.springframework.security.intercept.web.FilterInvocation; import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.intercept.web.FilterInvocationDefinitionSource; import org.springframework.security.intercept.web.FilterInvocationSecurityMetadataSource;
import org.springframework.security.intercept.web.FilterSecurityInterceptor; import org.springframework.security.intercept.web.FilterSecurityInterceptor;
import org.springframework.security.providers.TestingAuthenticationToken; import org.springframework.security.providers.TestingAuthenticationToken;
import org.springframework.security.providers.UsernamePasswordAuthenticationToken; import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
@ -86,7 +86,7 @@ public class HttpSecurityBeanDefinitionParserTests {
checkAutoConfigFilters(filterList); checkAutoConfigFilters(filterList);
assertEquals(true, FieldUtils.getFieldValue(appContext.getBean("_filterChainProxy"), "stripQueryStringFromUrls")); assertEquals(true, FieldUtils.getFieldValue(appContext.getBean("_filterChainProxy"), "stripQueryStringFromUrls"));
assertEquals(true, FieldUtils.getFieldValue(filterList.get(AUTO_CONFIG_FILTERS-1), "objectDefinitionSource.stripQueryStringFromUrls")); assertEquals(true, FieldUtils.getFieldValue(filterList.get(AUTO_CONFIG_FILTERS-1), "securityMetadataSource.stripQueryStringFromUrls"));
} }
@Test(expected=BeanDefinitionParsingException.class) @Test(expected=BeanDefinitionParsingException.class)
@ -144,7 +144,7 @@ public class HttpSecurityBeanDefinitionParserTests {
List<Filter> allFilters = getFilters("/ImCaughtByTheUniversalMatchPattern"); List<Filter> allFilters = getFilters("/ImCaughtByTheUniversalMatchPattern");
checkAutoConfigFilters(allFilters); checkAutoConfigFilters(allFilters);
assertEquals(false, FieldUtils.getFieldValue(appContext.getBean("_filterChainProxy"), "stripQueryStringFromUrls")); assertEquals(false, FieldUtils.getFieldValue(appContext.getBean("_filterChainProxy"), "stripQueryStringFromUrls"));
assertEquals(false, FieldUtils.getFieldValue(allFilters.get(AUTO_CONFIG_FILTERS-1), "objectDefinitionSource.stripQueryStringFromUrls")); assertEquals(false, FieldUtils.getFieldValue(allFilters.get(AUTO_CONFIG_FILTERS-1), "securityMetadataSource.stripQueryStringFromUrls"));
} }
@Test @Test
@ -225,7 +225,7 @@ public class HttpSecurityBeanDefinitionParserTests {
FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR); FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR);
FilterInvocationDefinitionSource fids = fis.getObjectDefinitionSource(); FilterInvocationSecurityMetadataSource fids = fis.getSecurityMetadataSource();
List<? extends ConfigAttribute> attrDef = fids.getAttributes(createFilterinvocation("/Secure", null)); List<? extends ConfigAttribute> attrDef = fids.getAttributes(createFilterinvocation("/Secure", null));
assertEquals(2, attrDef.size()); assertEquals(2, attrDef.size());
assertTrue(attrDef.contains(new SecurityConfig("ROLE_A"))); assertTrue(attrDef.contains(new SecurityConfig("ROLE_A")));
@ -245,7 +245,7 @@ public class HttpSecurityBeanDefinitionParserTests {
" </http>" + AUTH_PROVIDER_XML); " </http>" + AUTH_PROVIDER_XML);
FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR); FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR);
FilterInvocationDefinitionSource fids = fis.getObjectDefinitionSource(); FilterInvocationSecurityMetadataSource fids = fis.getSecurityMetadataSource();
List<? extends ConfigAttribute> attrs = fids.getAttributes(createFilterinvocation("/secure", "POST")); List<? extends ConfigAttribute> attrs = fids.getAttributes(createFilterinvocation("/secure", "POST"));
assertEquals(2, attrs.size()); assertEquals(2, attrs.size());
assertTrue(attrs.contains(new SecurityConfig("ROLE_A"))); assertTrue(attrs.contains(new SecurityConfig("ROLE_A")));
@ -685,7 +685,7 @@ public class HttpSecurityBeanDefinitionParserTests {
"</http>" + AUTH_PROVIDER_XML); "</http>" + AUTH_PROVIDER_XML);
FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR); FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR);
FilterInvocationDefinitionSource fids = fis.getObjectDefinitionSource(); FilterInvocationSecurityMetadataSource fids = fis.getSecurityMetadataSource();
List<? extends ConfigAttribute> attrDef = fids.getAttributes(createFilterinvocation("/someurl", null)); List<? extends ConfigAttribute> attrDef = fids.getAttributes(createFilterinvocation("/someurl", null));
assertEquals(1, attrDef.size()); assertEquals(1, attrDef.size());
assertTrue(attrDef.contains(new SecurityConfig("ROLE_B"))); assertTrue(attrDef.contains(new SecurityConfig("ROLE_B")));
@ -723,7 +723,7 @@ public class HttpSecurityBeanDefinitionParserTests {
FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR); FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR);
FilterInvocationDefinitionSource fids = fis.getObjectDefinitionSource(); FilterInvocationSecurityMetadataSource fids = fis.getSecurityMetadataSource();
List<? extends ConfigAttribute> attrDef = fids.getAttributes(createFilterinvocation("/secure", null)); List<? extends ConfigAttribute> attrDef = fids.getAttributes(createFilterinvocation("/secure", null));
assertEquals(1, attrDef.size()); assertEquals(1, attrDef.size());

4
core/src/test/java/org/springframework/security/expression/method/ExpressionAnnotationMethodDefinitionSourceTests.java
View File

@ -11,14 +11,14 @@ import org.springframework.security.expression.annotation.PostAuthorize;
import org.springframework.security.expression.annotation.PostFilter; import org.springframework.security.expression.annotation.PostFilter;
import org.springframework.security.expression.annotation.PreAuthorize; import org.springframework.security.expression.annotation.PreAuthorize;
import org.springframework.security.expression.annotation.PreFilter; import org.springframework.security.expression.annotation.PreFilter;
import org.springframework.security.expression.method.ExpressionAnnotationMethodDefinitionSource; import org.springframework.security.expression.method.ExpressionAnnotationMethodSecurityMetadataSource;
import org.springframework.security.expression.method.PostInvocationExpressionAttribute; import org.springframework.security.expression.method.PostInvocationExpressionAttribute;
import org.springframework.security.expression.method.PreInvocationExpressionAttribute; import org.springframework.security.expression.method.PreInvocationExpressionAttribute;
import org.springframework.security.intercept.method.MockMethodInvocation; import org.springframework.security.intercept.method.MockMethodInvocation;
public class ExpressionAnnotationMethodDefinitionSourceTests { public class ExpressionAnnotationMethodDefinitionSourceTests {
private ExpressionAnnotationMethodDefinitionSource mds = new ExpressionAnnotationMethodDefinitionSource(); private ExpressionAnnotationMethodSecurityMetadataSource mds = new ExpressionAnnotationMethodSecurityMetadataSource();
private MockMethodInvocation voidImpl1; private MockMethodInvocation voidImpl1;
private MockMethodInvocation voidImpl2; private MockMethodInvocation voidImpl2;

24
core/src/test/java/org/springframework/security/intercept/AbstractSecurityInterceptorTests.java
View File

@ -46,7 +46,7 @@ public class AbstractSecurityInterceptorTests {
si.setAuthenticationManager(jmock.mock(AuthenticationManager.class)); si.setAuthenticationManager(jmock.mock(AuthenticationManager.class));
si.setAfterInvocationManager(jmock.mock(AfterInvocationManager.class)); si.setAfterInvocationManager(jmock.mock(AfterInvocationManager.class));
si.setAccessDecisionManager(jmock.mock(AccessDecisionManager.class)); si.setAccessDecisionManager(jmock.mock(AccessDecisionManager.class));
si.setObjectDefinitionSource(jmock.mock(ObjectDefinitionSource.class)); si.setSecurityMetadataSource(jmock.mock(SecurityMetadataSource.class));
jmock.checking(new Expectations() {{ ignoring(anything()); }}); jmock.checking(new Expectations() {{ ignoring(anything()); }});
si.beforeInvocation(new SimpleMethodInvocation()); si.beforeInvocation(new SimpleMethodInvocation());
@ -59,7 +59,7 @@ public class AbstractSecurityInterceptorTests {
si.setAuthenticationManager(jmock.mock(AuthenticationManager.class)); si.setAuthenticationManager(jmock.mock(AuthenticationManager.class));
si.setAfterInvocationManager(jmock.mock(AfterInvocationManager.class)); si.setAfterInvocationManager(jmock.mock(AfterInvocationManager.class));
si.setAccessDecisionManager(jmock.mock(AccessDecisionManager.class)); si.setAccessDecisionManager(jmock.mock(AccessDecisionManager.class));
si.setObjectDefinitionSource(jmock.mock(ObjectDefinitionSource.class)); si.setSecurityMetadataSource(jmock.mock(SecurityMetadataSource.class));
jmock.checking(new Expectations() {{ ignoring(anything()); }}); jmock.checking(new Expectations() {{ ignoring(anything()); }});
@ -69,34 +69,34 @@ public class AbstractSecurityInterceptorTests {
//~ Inner Classes ================================================================================================== //~ Inner Classes ==================================================================================================
private class MockSecurityInterceptorReturnsNull extends AbstractSecurityInterceptor { private class MockSecurityInterceptorReturnsNull extends AbstractSecurityInterceptor {
private ObjectDefinitionSource objectDefinitionSource; private SecurityMetadataSource securityMetadataSource;
public Class<? extends Object> getSecureObjectClass() { public Class<? extends Object> getSecureObjectClass() {
return null; return null;
} }
public ObjectDefinitionSource obtainObjectDefinitionSource() { public SecurityMetadataSource obtainSecurityMetadataSource() {
return objectDefinitionSource; return securityMetadataSource;
} }
public void setObjectDefinitionSource(ObjectDefinitionSource objectDefinitionSource) { public void setSecurityMetadataSource(SecurityMetadataSource securityMetadataSource) {
this.objectDefinitionSource = objectDefinitionSource; this.securityMetadataSource = securityMetadataSource;
} }
} }
private class MockSecurityInterceptorWhichOnlySupportsStrings extends AbstractSecurityInterceptor { private class MockSecurityInterceptorWhichOnlySupportsStrings extends AbstractSecurityInterceptor {
private ObjectDefinitionSource objectDefinitionSource; private SecurityMetadataSource securityMetadataSource;
public Class<? extends Object> getSecureObjectClass() { public Class<? extends Object> getSecureObjectClass() {
return String.class; return String.class;
} }
public ObjectDefinitionSource obtainObjectDefinitionSource() { public SecurityMetadataSource obtainSecurityMetadataSource() {
return objectDefinitionSource; return securityMetadataSource;
} }
public void setObjectDefinitionSource(ObjectDefinitionSource objectDefinitionSource) { public void setSecurityMetadataSource(SecurityMetadataSource securityMetadataSource) {
this.objectDefinitionSource = objectDefinitionSource; this.securityMetadataSource = securityMetadataSource;
} }
} }
} }

8
core/src/test/java/org/springframework/security/intercept/method/MapBasedMethodDefinitionSourceTests.java → core/src/test/java/org/springframework/security/intercept/method/MapBasedMethodSecurityMetadataSourceTests.java
View File

@ -11,21 +11,21 @@ import org.springframework.security.ConfigAttribute;
import org.springframework.security.SecurityConfig; import org.springframework.security.SecurityConfig;
/** /**
* Tests for {@link MapBasedMethodDefinitionSource}. * Tests for {@link MapBasedMethodSecurityMetadataSource}.
* *
* @author Luke Taylor * @author Luke Taylor
* @since 2.0.4 * @since 2.0.4
*/ */
public class MapBasedMethodDefinitionSourceTests { public class MapBasedMethodSecurityMetadataSourceTests {
private final List<ConfigAttribute> ROLE_A = SecurityConfig.createList("ROLE_A"); private final List<ConfigAttribute> ROLE_A = SecurityConfig.createList("ROLE_A");
private final List<ConfigAttribute> ROLE_B = SecurityConfig.createList("ROLE_B"); private final List<ConfigAttribute> ROLE_B = SecurityConfig.createList("ROLE_B");
private MapBasedMethodDefinitionSource mds; private MapBasedMethodSecurityMetadataSource mds;
private Method someMethodString; private Method someMethodString;
private Method someMethodInteger; private Method someMethodInteger;
@Before @Before
public void initialize() throws Exception { public void initialize() throws Exception {
mds = new MapBasedMethodDefinitionSource(); mds = new MapBasedMethodSecurityMetadataSource();
someMethodString = MockService.class.getMethod("someMethod", String.class); someMethodString = MockService.class.getMethod("someMethod", String.class);
someMethodInteger = MockService.class.getMethod("someMethod", Integer.class); someMethodInteger = MockService.class.getMethod("someMethod", Integer.class);
} }

6
core/src/test/java/org/springframework/security/intercept/method/MethodInvocationPrivilegeEvaluatorTests.java
View File

@ -50,7 +50,7 @@ public class MethodInvocationPrivilegeEvaluatorTests {
private TestingAuthenticationToken token; private TestingAuthenticationToken token;
private MethodSecurityInterceptor interceptor; private MethodSecurityInterceptor interceptor;
private AccessDecisionManager adm; private AccessDecisionManager adm;
private MethodDefinitionSource mds; private MethodSecurityMetadataSource mds;
private final List<ConfigAttribute> role = SecurityConfig.createList("ROLE_IGNORED"); private final List<ConfigAttribute> role = SecurityConfig.createList("ROLE_IGNORED");
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
@ -62,10 +62,10 @@ public class MethodInvocationPrivilegeEvaluatorTests {
token = new TestingAuthenticationToken("Test", "Password", "ROLE_SOMETHING"); token = new TestingAuthenticationToken("Test", "Password", "ROLE_SOMETHING");
adm = jmock.mock(AccessDecisionManager.class); adm = jmock.mock(AccessDecisionManager.class);
AuthenticationManager authman = jmock.mock(AuthenticationManager.class); AuthenticationManager authman = jmock.mock(AuthenticationManager.class);
mds = jmock.mock(MethodDefinitionSource.class); mds = jmock.mock(MethodSecurityMetadataSource.class);
interceptor.setAccessDecisionManager(adm); interceptor.setAccessDecisionManager(adm);
interceptor.setAuthenticationManager(authman); interceptor.setAuthenticationManager(authman);
interceptor.setObjectDefinitionSource(mds); interceptor.setSecurityMetadataSource(mds);
} }
@Test @Test

48
core/src/test/java/org/springframework/security/intercept/method/MethodDefinitionSourceEditorTests.java → core/src/test/java/org/springframework/security/intercept/method/MethodSecurityMetadataSourceEditorTests.java
View File

@ -31,13 +31,13 @@ import org.springframework.security.TargetObject;
/** /**
* Tests {@link MethodDefinitionSourceEditor} and its associated {@link MapBasedMethodDefinitionSource}. * Tests {@link MethodSecurityMetadataSourceEditor} and its associated {@link MapBasedMethodSecurityMetadataSource}.
* *
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
@SuppressWarnings("deprecation") @SuppressWarnings("deprecation")
public class MethodDefinitionSourceEditorTests extends TestCase { public class MethodSecurityMetadataSourceEditorTests extends TestCase {
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
public final void setUp() throws Exception { public final void setUp() throws Exception {
@ -45,10 +45,10 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
} }
public void testAspectJJointPointLookup() throws Exception { public void testAspectJJointPointLookup() throws Exception {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY"); editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
Class<TargetObject> clazz = TargetObject.class; Class<TargetObject> clazz = TargetObject.class;
Method method = clazz.getMethod("countLength", new Class[] {String.class}); Method method = clazz.getMethod("countLength", new Class[] {String.class});
@ -61,7 +61,7 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
} }
public void testClassNameNotFoundResultsInException() { public void testClassNameNotFoundResultsInException() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
try { try {
editor.setAsText("org.springframework.security.DOES_NOT_EXIST_NAME=FOO,BAR"); editor.setAsText("org.springframework.security.DOES_NOT_EXIST_NAME=FOO,BAR");
@ -72,7 +72,7 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
} }
public void testClassNameNotInProperFormatResultsInException() { public void testClassNameNotInProperFormatResultsInException() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
try { try {
editor.setAsText("DOES_NOT_EXIST_NAME=FOO,BAR"); editor.setAsText("DOES_NOT_EXIST_NAME=FOO,BAR");
@ -83,7 +83,7 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
} }
public void testClassNameValidButMethodNameInvalidResultsInException() { public void testClassNameValidButMethodNameInvalidResultsInException() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
try { try {
editor.setAsText("org.springframework.security.TargetObject.INVALID_METHOD=FOO,BAR"); editor.setAsText("org.springframework.security.TargetObject.INVALID_METHOD=FOO,BAR");
@ -94,7 +94,7 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
} }
public void testConcreteClassInvocationsAlsoReturnDefinitionsAgainstInterface() throws Exception { public void testConcreteClassInvocationsAlsoReturnDefinitionsAgainstInterface() throws Exception {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText( editor.setAsText(
"org.springframework.security.ITargetObject.computeHashCode*=ROLE_FROM_INTERFACE\r\n" + "org.springframework.security.ITargetObject.computeHashCode*=ROLE_FROM_INTERFACE\r\n" +
"org.springframework.security.ITargetObject.makeLower*=ROLE_FROM_INTERFACE\r\n" + "org.springframework.security.ITargetObject.makeLower*=ROLE_FROM_INTERFACE\r\n" +
@ -103,7 +103,7 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
"org.springframework.security.OtherTargetObject.computeHashCode*=ROLE_FROM_OTO\r\n" + "org.springframework.security.OtherTargetObject.computeHashCode*=ROLE_FROM_OTO\r\n" +
"org.springframework.security.OtherTargetObject.makeUpper*=ROLE_FROM_IMPLEMENTATION"); "org.springframework.security.OtherTargetObject.makeUpper*=ROLE_FROM_IMPLEMENTATION");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(6, map.getMethodMapSize()); assertEquals(6, map.getMethodMapSize());
List<? extends ConfigAttribute> returnedMakeLower = map.getAttributes(new MockMethodInvocation(ITargetObject.class, "makeLowerCase", new Class[] {String.class}, new OtherTargetObject())); List<? extends ConfigAttribute> returnedMakeLower = map.getAttributes(new MockMethodInvocation(ITargetObject.class, "makeLowerCase", new Class[] {String.class}, new OtherTargetObject()));
@ -124,38 +124,38 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
} }
public void testEmptyStringReturnsEmptyMap() { public void testEmptyStringReturnsEmptyMap() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText(""); editor.setAsText("");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(0, map.getMethodMapSize()); assertEquals(0, map.getMethodMapSize());
} }
public void testIterator() { public void testIterator() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText( editor.setAsText(
"org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY\r\norg.springframework.security.TargetObject.make*=ROLE_NINE,ROLE_SUPERVISOR"); "org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY\r\norg.springframework.security.TargetObject.make*=ROLE_NINE,ROLE_SUPERVISOR");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(5, map.getAllConfigAttributes().size()); assertEquals(5, map.getAllConfigAttributes().size());
} }
public void testMultiMethodParsing() { public void testMultiMethodParsing() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText( editor.setAsText(
"org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY\r\norg.springframework.security.TargetObject.make*=ROLE_NINE,ROLE_SUPERVISOR"); "org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY\r\norg.springframework.security.TargetObject.make*=ROLE_NINE,ROLE_SUPERVISOR");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(3, map.getMethodMapSize()); assertEquals(3, map.getMethodMapSize());
} }
public void testMultiMethodParsingWhereLaterMethodsOverrideEarlierMethods() throws Exception { public void testMultiMethodParsingWhereLaterMethodsOverrideEarlierMethods() throws Exception {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText( editor.setAsText(
"org.springframework.security.TargetObject.*=ROLE_GENERAL\r\norg.springframework.security.TargetObject.makeLower*=ROLE_LOWER\r\norg.springframework.security.TargetObject.make*=ROLE_MAKE\r\norg.springframework.security.TargetObject.makeUpper*=ROLE_UPPER"); "org.springframework.security.TargetObject.*=ROLE_GENERAL\r\norg.springframework.security.TargetObject.makeLower*=ROLE_LOWER\r\norg.springframework.security.TargetObject.make*=ROLE_MAKE\r\norg.springframework.security.TargetObject.makeUpper*=ROLE_UPPER");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(14, map.getMethodMapSize()); assertEquals(14, map.getMethodMapSize());
List<? extends ConfigAttribute> returnedMakeLower = map.getAttributes(new MockMethodInvocation(ITargetObject.class, List<? extends ConfigAttribute> returnedMakeLower = map.getAttributes(new MockMethodInvocation(ITargetObject.class,
@ -174,11 +174,11 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
assertEquals(expectedCountLength, returnedCountLength); assertEquals(expectedCountLength, returnedCountLength);
} }
public void testNullIsReturnedByMethodDefinitionSourceWhenMethodInvocationNotDefined() throws Exception { public void testNullIsReturnedByMethodSecurityMetadataSourceWhenMethodInvocationNotDefined() throws Exception {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY"); editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
List<? extends ConfigAttribute> configAttributeDefinition = map.getAttributes(new MockMethodInvocation( List<? extends ConfigAttribute> configAttributeDefinition = map.getAttributes(new MockMethodInvocation(
ITargetObject.class, "makeLowerCase", new Class[] {String.class}, new TargetObject())); ITargetObject.class, "makeLowerCase", new Class[] {String.class}, new TargetObject()));
@ -186,18 +186,18 @@ public class MethodDefinitionSourceEditorTests extends TestCase {
} }
public void testNullReturnsEmptyMap() { public void testNullReturnsEmptyMap() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText(null); editor.setAsText(null);
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
assertEquals(0, map.getMethodMapSize()); assertEquals(0, map.getMethodMapSize());
} }
public void testSingleMethodParsing() throws Exception { public void testSingleMethodParsing() throws Exception {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY"); editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
List<? extends ConfigAttribute> returnedCountLength = map.getAttributes(new MockMethodInvocation(ITargetObject.class, List<? extends ConfigAttribute> returnedCountLength = map.getAttributes(new MockMethodInvocation(ITargetObject.class,
"countLength", new Class[] {String.class}, new TargetObject())); "countLength", new Class[] {String.class}, new TargetObject()));

4
core/src/test/java/org/springframework/security/intercept/method/MockMethodDefinitionSource.java → core/src/test/java/org/springframework/security/intercept/method/MockMethodSecurityMetadataSource.java
View File

@ -30,7 +30,7 @@ import org.springframework.security.SecurityConfig;
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
public class MockMethodDefinitionSource implements MethodDefinitionSource { public class MockMethodSecurityMetadataSource implements MethodSecurityMetadataSource {
//~ Instance fields ================================================================================================ //~ Instance fields ================================================================================================
private List<ConfigAttribute> list; private List<ConfigAttribute> list;
@ -38,7 +38,7 @@ public class MockMethodDefinitionSource implements MethodDefinitionSource {
//~ Constructors =================================================================================================== //~ Constructors ===================================================================================================
public MockMethodDefinitionSource(boolean includeInvalidAttributes, boolean returnACollectionWhenRequested) { public MockMethodSecurityMetadataSource(boolean includeInvalidAttributes, boolean returnACollectionWhenRequested) {
returnACollection = returnACollectionWhenRequested; returnACollection = returnACollectionWhenRequested;
list = new ArrayList<ConfigAttribute>(); list = new ArrayList<ConfigAttribute>();

104
core/src/test/java/org/springframework/security/intercept/method/aopalliance/MethodSecurityInterceptorTests.java
View File

@ -41,7 +41,7 @@ import org.springframework.security.RunAsManager;
import org.springframework.security.SecurityConfig; import org.springframework.security.SecurityConfig;
import org.springframework.security.TargetObject; import org.springframework.security.TargetObject;
import org.springframework.security.context.SecurityContextHolder; import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.intercept.method.MethodDefinitionSource; import org.springframework.security.intercept.method.MethodSecurityMetadataSource;
import org.springframework.security.providers.TestingAuthenticationToken; import org.springframework.security.providers.TestingAuthenticationToken;
import org.springframework.security.runas.RunAsUserToken; import org.springframework.security.runas.RunAsUserToken;
@ -59,7 +59,7 @@ public class MethodSecurityInterceptorTests {
private ITargetObject realTarget; private ITargetObject realTarget;
private ITargetObject advisedTarget; private ITargetObject advisedTarget;
private AccessDecisionManager adm; private AccessDecisionManager adm;
private MethodDefinitionSource mds; private MethodSecurityMetadataSource mds;
private AuthenticationManager authman; private AuthenticationManager authman;
private Expectations mdsWillReturnNullFromGetAttributes; private Expectations mdsWillReturnNullFromGetAttributes;
@ -74,10 +74,10 @@ public class MethodSecurityInterceptorTests {
interceptor = new MethodSecurityInterceptor(); interceptor = new MethodSecurityInterceptor();
adm = jmock.mock(AccessDecisionManager.class); adm = jmock.mock(AccessDecisionManager.class);
authman = jmock.mock(AuthenticationManager.class); authman = jmock.mock(AuthenticationManager.class);
mds = jmock.mock(MethodDefinitionSource.class); mds = jmock.mock(MethodSecurityMetadataSource.class);
interceptor.setAccessDecisionManager(adm); interceptor.setAccessDecisionManager(adm);
interceptor.setAuthenticationManager(authman); interceptor.setAuthenticationManager(authman);
interceptor.setObjectDefinitionSource(mds); interceptor.setSecurityMetadataSource(mds);
createTarget(false); createTarget(false);
mdsWillReturnNullFromGetAttributes = new Expectations() {{ mdsWillReturnNullFromGetAttributes = new Expectations() {{
@ -109,7 +109,7 @@ public class MethodSecurityInterceptorTests {
assertEquals(adm, interceptor.getAccessDecisionManager()); assertEquals(adm, interceptor.getAccessDecisionManager());
assertEquals(runAs, interceptor.getRunAsManager()); assertEquals(runAs, interceptor.getRunAsManager());
assertEquals(authman, interceptor.getAuthenticationManager()); assertEquals(authman, interceptor.getAuthenticationManager());
assertEquals(mds, interceptor.getObjectDefinitionSource()); assertEquals(mds, interceptor.getSecurityMetadataSource());
assertEquals(aim, interceptor.getAfterInvocationManager()); assertEquals(aim, interceptor.getAfterInvocationManager());
} }
@ -126,8 +126,8 @@ public class MethodSecurityInterceptorTests {
} }
@Test(expected=IllegalArgumentException.class) @Test(expected=IllegalArgumentException.class)
public void missingMethodDefinitionSourceIsRejected() throws Exception { public void missingMethodSecurityMetadataSourceIsRejected() throws Exception {
interceptor.setObjectDefinitionSource(null); interceptor.setSecurityMetadataSource(null);
interceptor.afterPropertiesSet(); interceptor.afterPropertiesSet();
} }
@ -138,7 +138,7 @@ public class MethodSecurityInterceptorTests {
} }
@Test(expected=IllegalArgumentException.class) @Test(expected=IllegalArgumentException.class)
public void initializationRejectsObjectDefinitionSourceThatDoesNotSupportMethodInvocation() throws Throwable { public void initializationRejectsSecurityMetadataSourceThatDoesNotSupportMethodInvocation() throws Throwable {
jmock.checking(new Expectations() {{ jmock.checking(new Expectations() {{
oneOf(mds).supports(MethodInvocation.class); will(returnValue(false)); oneOf(mds).supports(MethodInvocation.class); will(returnValue(false));
}}); }});
@ -198,7 +198,7 @@ public class MethodSecurityInterceptorTests {
} }
@Test @Test
public void validationNotAttemptedIfMethodDefinitionSourceReturnsNullForAttributes() throws Exception { public void validationNotAttemptedIfMethodSecurityMetadataSourceReturnsNullForAttributes() throws Exception {
jmock.checking(new Expectations() {{ jmock.checking(new Expectations() {{
oneOf(mds).supports(MethodInvocation.class); will(returnValue(true)); oneOf(mds).supports(MethodInvocation.class); will(returnValue(true));
oneOf(adm).supports(MethodInvocation.class); will(returnValue(true)); oneOf(adm).supports(MethodInvocation.class); will(returnValue(true));
@ -302,90 +302,4 @@ public class MethodSecurityInterceptorTests {
}}); }});
advisedTarget.makeUpperCase("hello"); advisedTarget.makeUpperCase("hello");
} }
//~ Inner Classes ==================================================================================================
// private static class MockMethodDefinitionSource() extends AbstractMethodDefinitionSource {
//
// }
/*
private class MockAccessDecisionManagerWhichOnlySupportsStrings implements AccessDecisionManager {
public void decide(Authentication authentication, Object object, List<ConfigAttribute> configAttributes)
throws AccessDeniedException {
throw new UnsupportedOperationException("mock method not implemented");
}
public boolean supports(Class<?> clazz) {
if (String.class.isAssignableFrom(clazz)) {
return true;
} else {
return false;
}
}
public boolean supports(ConfigAttribute attribute) {
return true;
}
}
private class MockAfterInvocationManagerWhichOnlySupportsStrings implements AfterInvocationManager {
public Object decide(Authentication authentication, Object object, List<ConfigAttribute> config,
Object returnedObject) throws AccessDeniedException {
throw new UnsupportedOperationException("mock method not implemented");
}
public boolean supports(Class<?> clazz) {
if (String.class.isAssignableFrom(clazz)) {
return true;
} else {
return false;
}
}
public boolean supports(ConfigAttribute attribute) {
return true;
}
}
private class MockObjectDefinitionSourceWhichOnlySupportsStrings implements MethodDefinitionSource {
public Collection<ConfigAttribute> getAllConfigAttributes() {
return null;
}
public List<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) {
throw new UnsupportedOperationException("mock method not implemented");
}
public boolean supports(Class<?> clazz) {
if (String.class.isAssignableFrom(clazz)) {
return true;
} else {
return false;
}
}
public List<ConfigAttribute> getAttributes(Object object) {
throw new UnsupportedOperationException("mock method not implemented");
}
}
private class MockRunAsManagerWhichOnlySupportsStrings implements RunAsManager {
public Authentication buildRunAs(Authentication authentication, Object object, List<ConfigAttribute> config) {
throw new UnsupportedOperationException("mock method not implemented");
}
public boolean supports(Class<?> clazz) {
if (String.class.isAssignableFrom(clazz)) {
return true;
} else {
return false;
}
}
public boolean supports(ConfigAttribute attribute) {
return true;
}
}*/
} }

2
core/src/test/java/org/springframework/security/intercept/method/aopalliance/MethodSecurityInterceptorWithAopConfigTests.java
View File

@ -56,7 +56,7 @@ public class MethodSecurityInterceptorWithAopConfigTests {
"</aop:config>" + "</aop:config>" +
"<b:bean id='target' class='org.springframework.security.TargetObject'/>" + "<b:bean id='target' class='org.springframework.security.TargetObject'/>" +
"<b:bean id='securityInterceptor' class='org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor' autowire='byType' >" + "<b:bean id='securityInterceptor' class='org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor' autowire='byType' >" +
" <b:property name='objectDefinitionSource'>" + " <b:property name='securityMetadataSource'>" +
" <b:value>" + " <b:value>" +
"org.springframework.security.TargetObject.makeLower*=ROLE_A\n" + "org.springframework.security.TargetObject.makeLower*=ROLE_A\n" +
"org.springframework.security.TargetObject.makeUpper*=ROLE_A\n" + "org.springframework.security.TargetObject.makeUpper*=ROLE_A\n" +

34
core/src/test/java/org/springframework/security/intercept/method/aopalliance/MethodDefinitionSourceAdvisorTests.java → core/src/test/java/org/springframework/security/intercept/method/aopalliance/MethodSecurityMetadataSourceAdvisorTests.java
View File

@ -20,45 +20,37 @@ import java.lang.reflect.Method;
import junit.framework.TestCase; import junit.framework.TestCase;
import org.springframework.security.TargetObject; import org.springframework.security.TargetObject;
import org.springframework.security.intercept.method.MapBasedMethodDefinitionSource; import org.springframework.security.intercept.method.MapBasedMethodSecurityMetadataSource;
import org.springframework.security.intercept.method.MethodDefinitionSourceEditor; import org.springframework.security.intercept.method.MethodSecurityMetadataSourceEditor;
/** /**
* Tests {@link MethodDefinitionSourceAdvisor}. * Tests {@link MethodSecurityMetadataSourceAdvisor}.
* *
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
@SuppressWarnings("deprecation") @SuppressWarnings("deprecation")
public class MethodDefinitionSourceAdvisorTests extends TestCase { public class MethodSecurityMetadataSourceAdvisorTests extends TestCase {
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
private MethodSecurityInterceptor getInterceptor() { private MethodSecurityInterceptor getInterceptor() {
MethodDefinitionSourceEditor editor = new MethodDefinitionSourceEditor(); MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_NOT_USED"); editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_NOT_USED");
MapBasedMethodDefinitionSource map = (MapBasedMethodDefinitionSource) editor.getValue(); MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
MethodSecurityInterceptor msi = new MethodSecurityInterceptor(); MethodSecurityInterceptor msi = new MethodSecurityInterceptor();
msi.setObjectDefinitionSource(map); msi.setSecurityMetadataSource(map);
return msi; return msi;
} }
public static void main(String[] args) {
junit.textui.TestRunner.run(MethodDefinitionSourceAdvisorTests.class);
}
public final void setUp() throws Exception {
super.setUp();
}
public void testAdvisorReturnsFalseWhenMethodInvocationNotDefined() public void testAdvisorReturnsFalseWhenMethodInvocationNotDefined()
throws Exception { throws Exception {
Class<TargetObject> clazz = TargetObject.class; Class<TargetObject> clazz = TargetObject.class;
Method method = clazz.getMethod("makeLowerCase", new Class[] {String.class}); Method method = clazz.getMethod("makeLowerCase", new Class[] {String.class});
MethodDefinitionSourceAdvisor advisor = new MethodDefinitionSourceAdvisor(getInterceptor()); MethodSecurityMetadataSourceAdvisor advisor = new MethodSecurityMetadataSourceAdvisor(getInterceptor());
assertFalse(advisor.getPointcut().getMethodMatcher().matches(method, clazz)); assertFalse(advisor.getPointcut().getMethodMatcher().matches(method, clazz));
} }
@ -67,7 +59,7 @@ public class MethodDefinitionSourceAdvisorTests extends TestCase {
Class<TargetObject> clazz = TargetObject.class; Class<TargetObject> clazz = TargetObject.class;
Method method = clazz.getMethod("countLength", new Class[] {String.class}); Method method = clazz.getMethod("countLength", new Class[] {String.class});
MethodDefinitionSourceAdvisor advisor = new MethodDefinitionSourceAdvisor(getInterceptor()); MethodSecurityMetadataSourceAdvisor advisor = new MethodSecurityMetadataSourceAdvisor(getInterceptor());
assertTrue(advisor.getPointcut().getMethodMatcher().matches(method, clazz)); assertTrue(advisor.getPointcut().getMethodMatcher().matches(method, clazz));
} }
@ -75,8 +67,8 @@ public class MethodDefinitionSourceAdvisorTests extends TestCase {
MethodSecurityInterceptor msi = new MethodSecurityInterceptor(); MethodSecurityInterceptor msi = new MethodSecurityInterceptor();
try { try {
new MethodDefinitionSourceAdvisor(msi); new MethodSecurityMetadataSourceAdvisor(msi);
fail("Should have detected null ObjectDefinitionSource and thrown AopConfigException"); fail("Should have detected null SecurityMetadataSource and thrown AopConfigException");
} catch (IllegalArgumentException expected) { } catch (IllegalArgumentException expected) {
assertTrue(true); assertTrue(true);
} }
@ -86,7 +78,7 @@ public class MethodDefinitionSourceAdvisorTests extends TestCase {
Class<TargetObject> clazz = TargetObject.class; Class<TargetObject> clazz = TargetObject.class;
Method method = clazz.getMethod("countLength", new Class[] {String.class}); Method method = clazz.getMethod("countLength", new Class[] {String.class});
MethodDefinitionSourceAdvisor.InternalMethodInvocation imi = new MethodDefinitionSourceAdvisor(getInterceptor()).new InternalMethodInvocation(method, clazz); MethodSecurityMetadataSourceAdvisor.InternalMethodInvocation imi = new MethodSecurityMetadataSourceAdvisor(getInterceptor()).new InternalMethodInvocation(method, clazz);
try { try {
imi.getArguments(); imi.getArguments();
@ -110,7 +102,7 @@ public class MethodDefinitionSourceAdvisorTests extends TestCase {
} }
try { try {
new MethodDefinitionSourceAdvisor(getInterceptor()).new InternalMethodInvocation(); new MethodSecurityMetadataSourceAdvisor(getInterceptor()).new InternalMethodInvocation();
fail("Should have thrown UnsupportedOperationException"); fail("Should have thrown UnsupportedOperationException");
} catch (UnsupportedOperationException expected) { } catch (UnsupportedOperationException expected) {
assertTrue(true); assertTrue(true);

8
core/src/test/java/org/springframework/security/intercept/method/aspectj/AspectJSecurityInterceptorTests.java
View File

@ -32,7 +32,7 @@ import org.springframework.security.MockJoinPoint;
import org.springframework.security.SecurityConfig; import org.springframework.security.SecurityConfig;
import org.springframework.security.TargetObject; import org.springframework.security.TargetObject;
import org.springframework.security.context.SecurityContextHolder; import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.intercept.method.MethodDefinitionSource; import org.springframework.security.intercept.method.MethodSecurityMetadataSource;
import org.springframework.security.providers.TestingAuthenticationToken; import org.springframework.security.providers.TestingAuthenticationToken;
@ -47,7 +47,7 @@ public class AspectJSecurityInterceptorTests {
private TestingAuthenticationToken token; private TestingAuthenticationToken token;
private AspectJSecurityInterceptor interceptor; private AspectJSecurityInterceptor interceptor;
private AccessDecisionManager adm; private AccessDecisionManager adm;
private MethodDefinitionSource mds; private MethodSecurityMetadataSource mds;
private AuthenticationManager authman; private AuthenticationManager authman;
private AspectJCallback aspectJCallback; private AspectJCallback aspectJCallback;
private JoinPoint joinPoint; private JoinPoint joinPoint;
@ -61,10 +61,10 @@ public class AspectJSecurityInterceptorTests {
interceptor = new AspectJSecurityInterceptor(); interceptor = new AspectJSecurityInterceptor();
adm = jmock.mock(AccessDecisionManager.class); adm = jmock.mock(AccessDecisionManager.class);
authman = jmock.mock(AuthenticationManager.class); authman = jmock.mock(AuthenticationManager.class);
mds = jmock.mock(MethodDefinitionSource.class); mds = jmock.mock(MethodSecurityMetadataSource.class);
interceptor.setAccessDecisionManager(adm); interceptor.setAccessDecisionManager(adm);
interceptor.setAuthenticationManager(authman); interceptor.setAuthenticationManager(authman);
interceptor.setObjectDefinitionSource(mds); interceptor.setSecurityMetadataSource(mds);
Method method = TargetObject.class.getMethod("countLength", new Class[] {String.class}); Method method = TargetObject.class.getMethod("countLength", new Class[] {String.class});
joinPoint = new MockJoinPoint(new TargetObject(), method); joinPoint = new MockJoinPoint(new TargetObject(), method);
aspectJCallback = jmock.mock(AspectJCallback.class); aspectJCallback = jmock.mock(AspectJCallback.class);

14
core/src/test/java/org/springframework/security/intercept/web/DefaultFilterInvocationDefinitionSourceTests.java → core/src/test/java/org/springframework/security/intercept/web/DefaultFilterInvocationSecurityMetadataSourceTests.java
View File

@ -29,29 +29,29 @@ import org.springframework.security.util.AntUrlPathMatcher;
import org.springframework.security.util.MockFilterChain; import org.springframework.security.util.MockFilterChain;
/** /**
* Tests parts of {@link DefaultFilterInvocationDefinitionSource} not tested by {@link * Tests parts of {@link DefaultFilterInvocationSecurityMetadataSource} not tested by {@link
* FilterInvocationDefinitionSourceEditorTests}. * FilterInvocationDefinitionSourceEditorTests}.
* *
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public class DefaultFilterInvocationDefinitionSourceTests { public class DefaultFilterInvocationSecurityMetadataSourceTests {
private DefaultFilterInvocationDefinitionSource fids; private DefaultFilterInvocationSecurityMetadataSource fids;
private List<ConfigAttribute> def = SecurityConfig.createList("ROLE_ONE"); private List<ConfigAttribute> def = SecurityConfig.createList("ROLE_ONE");
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
private void createFids(String url, String method) { private void createFids(String url, String method) {
LinkedHashMap requestMap = new LinkedHashMap(); LinkedHashMap requestMap = new LinkedHashMap();
requestMap.put(new RequestKey(url, method), def); requestMap.put(new RequestKey(url, method), def);
fids = new DefaultFilterInvocationDefinitionSource(new AntUrlPathMatcher(), requestMap); fids = new DefaultFilterInvocationSecurityMetadataSource(new AntUrlPathMatcher(), requestMap);
fids.setStripQueryStringFromUrls(true); fids.setStripQueryStringFromUrls(true);
} }
private void createFids(String url, boolean convertToLowerCase) { private void createFids(String url, boolean convertToLowerCase) {
LinkedHashMap requestMap = new LinkedHashMap(); LinkedHashMap requestMap = new LinkedHashMap();
requestMap.put(new RequestKey(url), def); requestMap.put(new RequestKey(url), def);
fids = new DefaultFilterInvocationDefinitionSource(new AntUrlPathMatcher(convertToLowerCase), requestMap); fids = new DefaultFilterInvocationSecurityMetadataSource(new AntUrlPathMatcher(convertToLowerCase), requestMap);
fids.setStripQueryStringFromUrls(true); fids.setStripQueryStringFromUrls(true);
} }
@ -59,7 +59,7 @@ public class DefaultFilterInvocationDefinitionSourceTests {
public void convertUrlToLowercaseIsTrueByDefault() { public void convertUrlToLowercaseIsTrueByDefault() {
LinkedHashMap requestMap = new LinkedHashMap(); LinkedHashMap requestMap = new LinkedHashMap();
requestMap.put(new RequestKey("/something"), def); requestMap.put(new RequestKey("/something"), def);
fids = new DefaultFilterInvocationDefinitionSource(new AntUrlPathMatcher(), requestMap); fids = new DefaultFilterInvocationSecurityMetadataSource(new AntUrlPathMatcher(), requestMap);
assertTrue(fids.isConvertUrlToLowercaseBeforeComparison()); assertTrue(fids.isConvertUrlToLowercaseBeforeComparison());
} }
@ -154,7 +154,7 @@ public class DefaultFilterInvocationDefinitionSourceTests {
requestMap.put(new RequestKey("/**"), def); requestMap.put(new RequestKey("/**"), def);
List<ConfigAttribute> postOnlyDef = SecurityConfig.createList("ROLE_TWO"); List<ConfigAttribute> postOnlyDef = SecurityConfig.createList("ROLE_TWO");
requestMap.put(new RequestKey("/somepage**", "POST"), postOnlyDef); requestMap.put(new RequestKey("/somepage**", "POST"), postOnlyDef);
fids = new DefaultFilterInvocationDefinitionSource(new AntUrlPathMatcher(), requestMap); fids = new DefaultFilterInvocationSecurityMetadataSource(new AntUrlPathMatcher(), requestMap);
List<ConfigAttribute> attrs = fids.getAttributes(createFilterInvocation("/somepage", "POST")); List<ConfigAttribute> attrs = fids.getAttributes(createFilterInvocation("/somepage", "POST"));
assertEquals(postOnlyDef, attrs); assertEquals(postOnlyDef, attrs);

6
core/src/test/java/org/springframework/security/intercept/web/FilterSecurityInterceptorTests.java
View File

@ -48,7 +48,7 @@ public class FilterSecurityInterceptorTests {
private Mockery jmock = new JUnit4Mockery(); private Mockery jmock = new JUnit4Mockery();
private AuthenticationManager am; private AuthenticationManager am;
private AccessDecisionManager adm; private AccessDecisionManager adm;
private FilterInvocationDefinitionSource ods; private FilterInvocationSecurityMetadataSource ods;
private RunAsManager ram; private RunAsManager ram;
private FilterSecurityInterceptor interceptor; private FilterSecurityInterceptor interceptor;
@ -59,11 +59,11 @@ public class FilterSecurityInterceptorTests {
public final void setUp() throws Exception { public final void setUp() throws Exception {
interceptor = new FilterSecurityInterceptor(); interceptor = new FilterSecurityInterceptor();
am = jmock.mock(AuthenticationManager.class); am = jmock.mock(AuthenticationManager.class);
ods = jmock.mock(FilterInvocationDefinitionSource.class); ods = jmock.mock(FilterInvocationSecurityMetadataSource.class);
adm = jmock.mock(AccessDecisionManager.class); adm = jmock.mock(AccessDecisionManager.class);
ram = jmock.mock(RunAsManager.class); ram = jmock.mock(RunAsManager.class);
interceptor.setAuthenticationManager(am); interceptor.setAuthenticationManager(am);
interceptor.setObjectDefinitionSource(ods); interceptor.setSecurityMetadataSource(ods);
interceptor.setAccessDecisionManager(adm); interceptor.setAccessDecisionManager(adm);
interceptor.setRunAsManager(ram); interceptor.setRunAsManager(ram);
interceptor.setApplicationEventPublisher(new MockApplicationEventPublisher(true)); interceptor.setApplicationEventPublisher(new MockApplicationEventPublisher(true));

6
core/src/test/java/org/springframework/security/intercept/web/WebInvocationPrivilegeEvaluatorTests.java
View File

@ -48,7 +48,7 @@ public class WebInvocationPrivilegeEvaluatorTests {
private Mockery jmock = new JUnit4Mockery(); private Mockery jmock = new JUnit4Mockery();
private AuthenticationManager am; private AuthenticationManager am;
private AccessDecisionManager adm; private AccessDecisionManager adm;
private FilterInvocationDefinitionSource ods; private FilterInvocationSecurityMetadataSource ods;
private RunAsManager ram; private RunAsManager ram;
private FilterSecurityInterceptor interceptor; private FilterSecurityInterceptor interceptor;
@ -58,11 +58,11 @@ public class WebInvocationPrivilegeEvaluatorTests {
public final void setUp() throws Exception { public final void setUp() throws Exception {
interceptor = new FilterSecurityInterceptor(); interceptor = new FilterSecurityInterceptor();
am = jmock.mock(AuthenticationManager.class); am = jmock.mock(AuthenticationManager.class);
ods = jmock.mock(FilterInvocationDefinitionSource.class); ods = jmock.mock(FilterInvocationSecurityMetadataSource.class);
adm = jmock.mock(AccessDecisionManager.class); adm = jmock.mock(AccessDecisionManager.class);
ram = jmock.mock(RunAsManager.class); ram = jmock.mock(RunAsManager.class);
interceptor.setAuthenticationManager(am); interceptor.setAuthenticationManager(am);
interceptor.setObjectDefinitionSource(ods); interceptor.setSecurityMetadataSource(ods);
interceptor.setAccessDecisionManager(adm); interceptor.setAccessDecisionManager(adm);
interceptor.setRunAsManager(ram); interceptor.setRunAsManager(ram);
interceptor.setApplicationEventPublisher(new MockApplicationEventPublisher(true)); interceptor.setApplicationEventPublisher(new MockApplicationEventPublisher(true));

62
core/src/test/java/org/springframework/security/securechannel/ChannelProcessingFilterTests.java
View File

@ -15,20 +15,21 @@
package org.springframework.security.securechannel; package org.springframework.security.securechannel;
import static org.junit.Assert.*;
import java.io.IOException; import java.io.IOException;
import java.util.Collection; import java.util.Collection;
import java.util.List; import java.util.List;
import javax.servlet.ServletException; import javax.servlet.ServletException;
import junit.framework.TestCase; import org.junit.Test;
import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse; import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.ConfigAttribute; import org.springframework.security.ConfigAttribute;
import org.springframework.security.SecurityConfig; import org.springframework.security.SecurityConfig;
import org.springframework.security.intercept.web.FilterInvocation; import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.intercept.web.FilterInvocationDefinitionSource; import org.springframework.security.intercept.web.FilterInvocationSecurityMetadataSource;
import org.springframework.security.util.MockFilterChain; import org.springframework.security.util.MockFilterChain;
@ -38,72 +39,57 @@ import org.springframework.security.util.MockFilterChain;
* @author Ben Alex * @author Ben Alex
* @version $Id$ * @version $Id$
*/ */
public class ChannelProcessingFilterTests extends TestCase { public class ChannelProcessingFilterTests {
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
public void testDetectsMissingChannelDecisionManager() @Test(expected=IllegalArgumentException.class)
throws Exception { public void testDetectsMissingChannelDecisionManager() throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "MOCK"); MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "MOCK");
filter.setFilterInvocationDefinitionSource(fids); filter.setFilterInvocationSecurityMetadataSource(fids);
try {
filter.afterPropertiesSet(); filter.afterPropertiesSet();
fail("Should have thrown IllegalArgumentException");
} catch (IllegalArgumentException expected) {
assertEquals("channelDecisionManager must be specified", expected.getMessage());
}
} }
public void testDetectsMissingFilterInvocationDefinitionSource() @Test(expected=IllegalArgumentException.class)
throws Exception { public void testDetectsMissingFilterInvocationSecurityMetadataSource() throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "MOCK")); filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "MOCK"));
try {
filter.afterPropertiesSet(); filter.afterPropertiesSet();
fail("Should have thrown IllegalArgumentException");
} catch (IllegalArgumentException expected) {
assertEquals("filterInvocationDefinitionSource must be specified", expected.getMessage());
}
} }
@Test
public void testDetectsSupportedConfigAttribute() throws Exception { public void testDetectsSupportedConfigAttribute() throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "SUPPORTS_MOCK_ONLY")); filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "SUPPORTS_MOCK_ONLY"));
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SUPPORTS_MOCK_ONLY"); MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SUPPORTS_MOCK_ONLY");
filter.setFilterInvocationDefinitionSource(fids); filter.setFilterInvocationSecurityMetadataSource(fids);
filter.afterPropertiesSet(); filter.afterPropertiesSet();
assertTrue(true);
} }
@Test(expected=IllegalArgumentException.class)
public void testDetectsUnsupportedConfigAttribute() throws Exception { public void testDetectsUnsupportedConfigAttribute() throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "SUPPORTS_MOCK_ONLY")); filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "SUPPORTS_MOCK_ONLY"));
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SUPPORTS_MOCK_ONLY", "INVALID_ATTRIBUTE"); MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SUPPORTS_MOCK_ONLY", "INVALID_ATTRIBUTE");
filter.setFilterInvocationDefinitionSource(fids); filter.setFilterInvocationSecurityMetadataSource(fids);
try {
filter.afterPropertiesSet(); filter.afterPropertiesSet();
fail("Should have thrown IllegalArgumentException");
} catch (IllegalArgumentException expected) {
assertTrue(expected.getMessage().startsWith("Unsupported configuration attributes:"));
}
} }
@Test
public void testDoFilterWhenManagerDoesCommitResponse() throws Exception { public void testDoFilterWhenManagerDoesCommitResponse() throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
filter.setChannelDecisionManager(new MockChannelDecisionManager(true, "SOME_ATTRIBUTE")); filter.setChannelDecisionManager(new MockChannelDecisionManager(true, "SOME_ATTRIBUTE"));
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE"); MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE");
filter.setFilterInvocationDefinitionSource(fids); filter.setFilterInvocationSecurityMetadataSource(fids);
MockHttpServletRequest request = new MockHttpServletRequest(); MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("info=now"); request.setQueryString("info=now");
@ -113,16 +99,16 @@ public class ChannelProcessingFilterTests extends TestCase {
MockFilterChain chain = new MockFilterChain(false); MockFilterChain chain = new MockFilterChain(false);
filter.doFilter(request, response, chain); filter.doFilter(request, response, chain);
assertTrue(true);
} }
@Test
public void testDoFilterWhenManagerDoesNotCommitResponse() throws Exception { public void testDoFilterWhenManagerDoesNotCommitResponse() throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "SOME_ATTRIBUTE")); filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "SOME_ATTRIBUTE"));
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE"); MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE");
filter.setFilterInvocationDefinitionSource(fids); filter.setFilterInvocationSecurityMetadataSource(fids);
MockHttpServletRequest request = new MockHttpServletRequest(); MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("info=now"); request.setQueryString("info=now");
@ -132,9 +118,9 @@ public class ChannelProcessingFilterTests extends TestCase {
MockFilterChain chain = new MockFilterChain(true); MockFilterChain chain = new MockFilterChain(true);
filter.doFilter(request, response, chain); filter.doFilter(request, response, chain);
assertTrue(true);
} }
@Test
public void testDoFilterWhenNullConfigAttributeReturned() public void testDoFilterWhenNullConfigAttributeReturned()
throws Exception { throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
@ -142,7 +128,7 @@ public class ChannelProcessingFilterTests extends TestCase {
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "NOT_USED"); MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "NOT_USED");
filter.setFilterInvocationDefinitionSource(fids); filter.setFilterInvocationSecurityMetadataSource(fids);
MockHttpServletRequest request = new MockHttpServletRequest(); MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("info=now"); request.setQueryString("info=now");
@ -152,9 +138,9 @@ public class ChannelProcessingFilterTests extends TestCase {
MockFilterChain chain = new MockFilterChain(true); MockFilterChain chain = new MockFilterChain(true);
filter.doFilter(request, response, chain); filter.doFilter(request, response, chain);
assertTrue(true);
} }
@Test
public void testGetterSetters() throws Exception { public void testGetterSetters() throws Exception {
ChannelProcessingFilter filter = new ChannelProcessingFilter(); ChannelProcessingFilter filter = new ChannelProcessingFilter();
filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "MOCK")); filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "MOCK"));
@ -162,8 +148,8 @@ public class ChannelProcessingFilterTests extends TestCase {
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", false, "MOCK"); MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", false, "MOCK");
filter.setFilterInvocationDefinitionSource(fids); filter.setFilterInvocationSecurityMetadataSource(fids);
assertTrue(filter.getFilterInvocationDefinitionSource() != null); assertTrue(filter.getFilterInvocationSecurityMetadataSource() != null);
filter.init(null); filter.init(null);
filter.afterPropertiesSet(); filter.afterPropertiesSet();
@ -197,7 +183,7 @@ public class ChannelProcessingFilterTests extends TestCase {
} }
} }
private class MockFilterInvocationDefinitionMap implements FilterInvocationDefinitionSource { private class MockFilterInvocationDefinitionMap implements FilterInvocationSecurityMetadataSource {
private List<ConfigAttribute> toReturn; private List<ConfigAttribute> toReturn;
private String servletPath; private String servletPath;
private boolean provideIterator; private boolean provideIterator;

2
core/src/test/resources/org/springframework/security/vote/labelBasedSecurityApplicationContext.xml
View File

@ -64,7 +64,7 @@
<property name="validateConfigAttributes"><value>false</value></property> <property name="validateConfigAttributes"><value>false</value></property>
<property name="authenticationManager"><ref bean="authenticationManager"/></property> <property name="authenticationManager"><ref bean="authenticationManager"/></property>
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
<property name="objectDefinitionSource"> <property name="securityMetadataSource">
<value> <value>
org.springframework.security.vote.SampleService.get*=ROLE_BASIC org.springframework.security.vote.SampleService.get*=ROLE_BASIC
org.springframework.security.vote.SampleService.do*=ROLE_BASIC,LABELED_OPERATION org.springframework.security.vote.SampleService.do*=ROLE_BASIC,LABELED_OPERATION

2
itest/context/src/test/resources/filter-chain-performance-app-context.xml
View File

@ -91,7 +91,7 @@
<bean id="fsi" class="org.springframework.security.intercept.web.FilterSecurityInterceptor"> <bean id="fsi" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/> <property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="accessDecisionManager"/> <property name="accessDecisionManager" ref="accessDecisionManager"/>
<property name="objectDefinitionSource"> <property name="securityMetadataSource">
<sec:filter-invocation-definition-source> <sec:filter-invocation-definition-source>
<sec:intercept-url pattern="/secure/extreme/**" access="ROLE_2"/> <sec:intercept-url pattern="/secure/extreme/**" access="ROLE_2"/>
<sec:intercept-url pattern="/secure/**" access="ROLE_1"/> <sec:intercept-url pattern="/secure/**" access="ROLE_1"/>

2
itest/context/src/test/resources/sec-936-app-context.xml
View File

@ -30,7 +30,7 @@
<property name="rejectPublicInvocations" value="true"/> <property name="rejectPublicInvocations" value="true"/>
<property name="authenticationManager" ref="authenticationManager"/> <property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="accessDecisionManager"/> <property name="accessDecisionManager" ref="accessDecisionManager"/>
<property name="objectDefinitionSource"><value> <property name="securityMetadataSource"><value>
org.springframework.security.concurrent.SessionRegistry.get*=ROLE_C org.springframework.security.concurrent.SessionRegistry.get*=ROLE_C
</value></property> </value></property>
</bean> </bean>

2
ntlm/applicationContext.xml
View File

@ -60,7 +60,7 @@
<bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor"> <bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager"><ref local="providerManager"/></property> <property name="authenticationManager"><ref local="providerManager"/></property>
<property name="accessDecisionManager"><ref local="accessDecisionManager"/></property> <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
<property name="objectDefinitionSource"> <property name="securityMetadataSource">
<value> <value>
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
PATTERN_TYPE_APACHE_ANT PATTERN_TYPE_APACHE_ANT

4
samples/dms/src/main/resources/applicationContext-dms-secure.xml
View File

@ -220,13 +220,13 @@
<!-- ================= METHOD INVOCATION AUTHORIZATION ==================== --> <!-- ================= METHOD INVOCATION AUTHORIZATION ==================== -->
<bean id="methodSecurityAdvisor" class="org.springframework.security.intercept.method.aopalliance.MethodDefinitionSourceAdvisor" autowire="constructor"/> <bean id="methodSecurityAdvisor" class="org.springframework.security.intercept.method.aopalliance.MethodSecurityMetadataSourceAdvisor" autowire="constructor"/>
<bean id="methodSecurityInterceptor" class="org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor"> <bean id="methodSecurityInterceptor" class="org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor">
<property name="authenticationManager"><ref bean="authenticationManager"/></property> <property name="authenticationManager"><ref bean="authenticationManager"/></property>
<property name="accessDecisionManager"><ref local="businessAccessDecisionManager"/></property> <property name="accessDecisionManager"><ref local="businessAccessDecisionManager"/></property>
<property name="afterInvocationManager"><ref local="afterInvocationManager"/></property> <property name="afterInvocationManager"><ref local="afterInvocationManager"/></property>
<property name="objectDefinitionSource"> <property name="securityMetadataSource">
<value> <value>
sample.dms.DocumentDao.create=ACL_ABSTRACT_ELEMENT_WRITE_PARENT sample.dms.DocumentDao.create=ACL_ABSTRACT_ELEMENT_WRITE_PARENT
sample.dms.DocumentDao.delete=ACL_ABSTRACT_ELEMENT_WRITE sample.dms.DocumentDao.delete=ACL_ABSTRACT_ELEMENT_WRITE

2
samples/preauth/src/main/webapp/WEB-INF/applicationContext-security.xml
View File

@ -85,7 +85,7 @@
<bean id="fsi" class="org.springframework.security.intercept.web.FilterSecurityInterceptor"> <bean id="fsi" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/> <property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/> <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
<property name="objectDefinitionSource"> <property name="securityMetadataSource">
<sec:filter-invocation-definition-source> <sec:filter-invocation-definition-source>
<sec:intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/> <sec:intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
<sec:intercept-url pattern="/secure/**" access="ROLE_USER"/> <sec:intercept-url pattern="/secure/**" access="ROLE_USER"/>