mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-06-28 23:02:15 +00:00
No longer required.
This commit is contained in:
Ben Alex
parent
8808f5e8dd
commit
6c5a5cd311
@ -1,149 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.attribute;
|
|
||||||
|
|
||||||
import junit.framework.TestCase;
|
|
||||||
|
|
||||||
import net.sf.acegisecurity.Authentication;
|
|
||||||
import net.sf.acegisecurity.ConfigAttribute;
|
|
||||||
import net.sf.acegisecurity.ConfigAttributeDefinition;
|
|
||||||
import net.sf.acegisecurity.GrantedAuthority;
|
|
||||||
import net.sf.acegisecurity.GrantedAuthorityImpl;
|
|
||||||
import net.sf.acegisecurity.MethodDefinitionAttributes;
|
|
||||||
import net.sf.acegisecurity.SecurityConfig;
|
|
||||||
import net.sf.acegisecurity.context.ContextHolder;
|
|
||||||
import net.sf.acegisecurity.context.SecureContextImpl;
|
|
||||||
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
|
|
||||||
|
|
||||||
import org.springframework.context.support.ClassPathXmlApplicationContext;
|
|
||||||
|
|
||||||
import java.lang.reflect.Method;
|
|
||||||
|
|
||||||
import java.util.HashSet;
|
|
||||||
import java.util.Iterator;
|
|
||||||
import java.util.Set;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* DOCUMENT ME!
|
|
||||||
*
|
|
||||||
* @author CameronBraid
|
|
||||||
*/
|
|
||||||
public class AttributesTests extends TestCase {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
ClassPathXmlApplicationContext applicationContext;
|
|
||||||
|
|
||||||
//~ Constructors ===========================================================
|
|
||||||
|
|
||||||
/**
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
public AttributesTests(String a) {
|
|
||||||
super(a);
|
|
||||||
}
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public void testAttributesForImpl() throws Exception {
|
|
||||||
ConfigAttributeDefinition def = getConfigAttributeDefinition(TestServiceImpl.class);
|
|
||||||
Set set = toSet(def);
|
|
||||||
assertTrue(set.contains(new SecurityConfig("ROLE_INTERFACE")));
|
|
||||||
assertTrue(set.contains(new SecurityConfig("ROLE_INTERFACE_METHOD")));
|
|
||||||
|
|
||||||
assertTrue(set.contains(new SecurityConfig("ROLE_CLASS")));
|
|
||||||
assertTrue(set.contains(new SecurityConfig("ROLE_CLASS_METHOD")));
|
|
||||||
}
|
|
||||||
|
|
||||||
public void testAttributesForInterface() throws Exception {
|
|
||||||
ConfigAttributeDefinition def = getConfigAttributeDefinition(TestService.class);
|
|
||||||
Set set = toSet(def);
|
|
||||||
System.out.println(set.toString());
|
|
||||||
assertTrue(set.contains(new SecurityConfig("ROLE_INTERFACE")));
|
|
||||||
assertTrue(set.contains(new SecurityConfig("ROLE_INTERFACE_METHOD")));
|
|
||||||
}
|
|
||||||
|
|
||||||
public void testInterceptionWithMockAttributesAndSecureContext()
|
|
||||||
throws Exception {
|
|
||||||
applicationContext = new ClassPathXmlApplicationContext(
|
|
||||||
"/net/sf/acegisecurity/attribute/applicationContext.xml");
|
|
||||||
|
|
||||||
TestService service = (TestService) applicationContext.getBean(
|
|
||||||
"testService");
|
|
||||||
|
|
||||||
SecureContextImpl context = new SecureContextImpl();
|
|
||||||
ContextHolder.setContext(context);
|
|
||||||
|
|
||||||
Authentication auth;
|
|
||||||
|
|
||||||
auth = new TestingAuthenticationToken("test", "test",
|
|
||||||
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_CLASS"), new GrantedAuthorityImpl(
|
|
||||||
"ROLE_INTERFACE"), new GrantedAuthorityImpl(
|
|
||||||
"ROLE_CLASS_METHOD"), new GrantedAuthorityImpl(
|
|
||||||
"ROLE_INTERFACE_METHOD")});
|
|
||||||
|
|
||||||
context.setAuthentication(auth);
|
|
||||||
service.myMethod();
|
|
||||||
|
|
||||||
auth = new TestingAuthenticationToken("test", "test",
|
|
||||||
new GrantedAuthority[] {});
|
|
||||||
context.setAuthentication(auth);
|
|
||||||
|
|
||||||
try {
|
|
||||||
service.myMethod();
|
|
||||||
fail(
|
|
||||||
"security interceptor should have detected insufficient permissions");
|
|
||||||
} catch (Exception e) {}
|
|
||||||
|
|
||||||
applicationContext.close();
|
|
||||||
ContextHolder.setContext(null);
|
|
||||||
}
|
|
||||||
|
|
||||||
private ConfigAttributeDefinition getConfigAttributeDefinition(Class clazz)
|
|
||||||
throws Exception {
|
|
||||||
final Method method = clazz.getMethod("myMethod", null);
|
|
||||||
MethodDefinitionAttributes source = new MethodDefinitionAttributes();
|
|
||||||
source.setAttributes(new TestAttributes());
|
|
||||||
|
|
||||||
ConfigAttributeDefinition config = source.getAttributes(new MockMethodInvocation() {
|
|
||||||
public Method getMethod() {
|
|
||||||
return method;
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
return config;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* convert a ConfigAttributeDefinition into a set of
|
|
||||||
* <code>ConfigAttribute</code>(s)
|
|
||||||
*
|
|
||||||
* @param def DOCUMENT ME!
|
|
||||||
*
|
|
||||||
* @return
|
|
||||||
*/
|
|
||||||
private Set toSet(ConfigAttributeDefinition def) {
|
|
||||||
Set set = new HashSet();
|
|
||||||
Iterator i = def.getConfigAttributes();
|
|
||||||
|
|
||||||
while (i.hasNext()) {
|
|
||||||
ConfigAttribute a = (ConfigAttribute) i.next();
|
|
||||||
set.add(a);
|
|
||||||
}
|
|
||||||
|
|
||||||
return set;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,75 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.attribute;
|
|
||||||
|
|
||||||
import org.springframework.metadata.Attributes;
|
|
||||||
|
|
||||||
import java.lang.reflect.Field;
|
|
||||||
import java.lang.reflect.Method;
|
|
||||||
|
|
||||||
import java.util.Collection;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* DOCUMENT ME!
|
|
||||||
*
|
|
||||||
* @author CameronBraid
|
|
||||||
*/
|
|
||||||
public class MockAttributes implements Attributes {
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.springframework.metadata.Attributes#getAttributes(java.lang.Class, java.lang.Class)
|
|
||||||
*/
|
|
||||||
public Collection getAttributes(Class arg0, Class arg1) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.springframework.metadata.Attributes#getAttributes(java.lang.Class)
|
|
||||||
*/
|
|
||||||
public Collection getAttributes(Class arg0) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.springframework.metadata.Attributes#getAttributes(java.lang.reflect.Field, java.lang.Class)
|
|
||||||
*/
|
|
||||||
public Collection getAttributes(Field arg0, Class arg1) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.springframework.metadata.Attributes#getAttributes(java.lang.reflect.Field)
|
|
||||||
*/
|
|
||||||
public Collection getAttributes(Field arg0) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.springframework.metadata.Attributes#getAttributes(java.lang.reflect.Method, java.lang.Class)
|
|
||||||
*/
|
|
||||||
public Collection getAttributes(Method arg0, Class arg1) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.springframework.metadata.Attributes#getAttributes(java.lang.reflect.Method)
|
|
||||||
*/
|
|
||||||
public Collection getAttributes(Method arg0) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,109 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.attribute;
|
|
||||||
|
|
||||||
import org.aopalliance.intercept.Invocation;
|
|
||||||
import org.aopalliance.intercept.MethodInvocation;
|
|
||||||
|
|
||||||
import java.lang.reflect.AccessibleObject;
|
|
||||||
import java.lang.reflect.Method;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* DOCUMENT ME!
|
|
||||||
*
|
|
||||||
* @author CameronBraid
|
|
||||||
*/
|
|
||||||
public class MockMethodInvocation implements MethodInvocation {
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Invocation#setArgument(int, java.lang.Object)
|
|
||||||
*/
|
|
||||||
public void setArgument(int arg0, Object arg1) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Invocation#getArgument(int)
|
|
||||||
*/
|
|
||||||
public Object getArgument(int arg0) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Invocation#getArgumentCount()
|
|
||||||
*/
|
|
||||||
public int getArgumentCount() {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Invocation#getArguments()
|
|
||||||
*/
|
|
||||||
public Object[] getArguments() {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Invocation#getAttachment(java.lang.String)
|
|
||||||
*/
|
|
||||||
public Object getAttachment(String arg0) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.MethodInvocation#getMethod()
|
|
||||||
*/
|
|
||||||
public Method getMethod() {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Joinpoint#getStaticPart()
|
|
||||||
*/
|
|
||||||
public AccessibleObject getStaticPart() {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Joinpoint#getThis()
|
|
||||||
*/
|
|
||||||
public Object getThis() {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Invocation#addAttachment(java.lang.String, java.lang.Object)
|
|
||||||
*/
|
|
||||||
public Object addAttachment(String arg0, Object arg1) {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Invocation#cloneInstance()
|
|
||||||
*/
|
|
||||||
public Invocation cloneInstance() {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* (non-Javadoc)
|
|
||||||
* @see org.aopalliance.intercept.Joinpoint#proceed()
|
|
||||||
*/
|
|
||||||
public Object proceed() throws Throwable {
|
|
||||||
throw new UnsupportedOperationException("mock method not implemented");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,73 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.attribute;
|
|
||||||
|
|
||||||
import net.sf.acegisecurity.SecurityConfig;
|
|
||||||
|
|
||||||
import java.lang.reflect.Method;
|
|
||||||
|
|
||||||
import java.util.Arrays;
|
|
||||||
import java.util.Collection;
|
|
||||||
import java.util.List;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* DOCUMENT ME!
|
|
||||||
*
|
|
||||||
* @author CameronBraid
|
|
||||||
*/
|
|
||||||
public class TestAttributes extends MockAttributes {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
List classAttributes = Arrays.asList(new SecurityConfig[] {new SecurityConfig(
|
|
||||||
"ROLE_CLASS")});
|
|
||||||
List classMethodAttributes = Arrays.asList(new SecurityConfig[] {new SecurityConfig(
|
|
||||||
"ROLE_CLASS_METHOD")});
|
|
||||||
List intrefaceAttributes = Arrays.asList(new SecurityConfig[] {new SecurityConfig(
|
|
||||||
"ROLE_INTERFACE")});
|
|
||||||
List intrefaceMethodAttributes = Arrays.asList(new SecurityConfig[] {new SecurityConfig(
|
|
||||||
"ROLE_INTERFACE_METHOD")});
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public Collection getAttributes(Class clazz) {
|
|
||||||
// interface
|
|
||||||
if (clazz.equals(TestServiceImpl.class)) {
|
|
||||||
return classAttributes;
|
|
||||||
}
|
|
||||||
|
|
||||||
// class
|
|
||||||
if (clazz.equals(TestService.class)) {
|
|
||||||
return intrefaceAttributes;
|
|
||||||
}
|
|
||||||
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
public Collection getAttributes(Method method) {
|
|
||||||
// interface
|
|
||||||
if (method.getDeclaringClass().equals(TestService.class)) {
|
|
||||||
return intrefaceMethodAttributes;
|
|
||||||
}
|
|
||||||
|
|
||||||
// class
|
|
||||||
if (method.getDeclaringClass().equals(TestServiceImpl.class)) {
|
|
||||||
return classMethodAttributes;
|
|
||||||
}
|
|
||||||
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,27 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.attribute;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* DOCUMENT ME!
|
|
||||||
*
|
|
||||||
* @author CameronBraid
|
|
||||||
*/
|
|
||||||
public interface TestService {
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public abstract void myMethod();
|
|
||||||
}
|
|
||||||
@ -1,27 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.attribute;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* DOCUMENT ME!
|
|
||||||
*
|
|
||||||
* @author CameronBraid
|
|
||||||
*/
|
|
||||||
public class TestServiceImpl implements TestService {
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public void myMethod() {}
|
|
||||||
}
|
|
||||||
@ -1,85 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="UTF-8"?>
|
|
||||||
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
|
|
||||||
<!--
|
|
||||||
* The Acegi Security System for Spring is published under the terms
|
|
||||||
* of the Apache Software License.
|
|
||||||
* $Id$
|
|
||||||
-->
|
|
||||||
|
|
||||||
<beans>
|
|
||||||
|
|
||||||
<!-- =================== SECURITY SYSTEM DEFINITIONS ================== -->
|
|
||||||
|
|
||||||
<!-- RunAsManager -->
|
|
||||||
<bean id="runAsManager" class="net.sf.acegisecurity.runas.RunAsManagerImpl">
|
|
||||||
<property name="key"><value>my_run_as_password</value></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHENTICATION DEFINITIONS ~~~~~~~~~~~~~~~~~~ -->
|
|
||||||
|
|
||||||
<!-- This authentication provider accepts any presented TestingAuthenticationToken -->
|
|
||||||
<bean id="testingAuthenticationProvider" class="net.sf.acegisecurity.providers.TestingAuthenticationProvider"/>
|
|
||||||
|
|
||||||
<!-- The authentication manager that iterates through our only authentication provider -->
|
|
||||||
<bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager">
|
|
||||||
<property name="providers">
|
|
||||||
<list>
|
|
||||||
<ref bean="testingAuthenticationProvider"/>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHORIZATION DEFINITIONS ~~~~~~~~~~~~~~~~~~~ -->
|
|
||||||
|
|
||||||
<!-- An access decision voter that reads ROLE_* configuaration settings -->
|
|
||||||
<bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter"/>
|
|
||||||
|
|
||||||
<!-- An affirmative access decision manager -->
|
|
||||||
<bean id="accessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
|
|
||||||
<property name="allowIfAllAbstainDecisions"><value>false</value></property>
|
|
||||||
<property name="decisionVoters">
|
|
||||||
<list>
|
|
||||||
<ref bean="roleVoter"/>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ===================== SECURITY DEFINITIONS ======================= -->
|
|
||||||
|
|
||||||
<bean id="attributes" class="net.sf.acegisecurity.attribute.TestAttributes"/>
|
|
||||||
<bean id="methodDefinitionSource" class="net.sf.acegisecurity.MethodDefinitionAttributes">
|
|
||||||
<property name="attributes"><ref local="attributes"/></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- We don't validate config attributes, as it's unsupported by MethodDefinitionAttributes -->
|
|
||||||
<bean id="securityInterceptor" class="net.sf.acegisecurity.SecurityInterceptor">
|
|
||||||
<property name="validateConfigAttributes"><value>false</value></property>
|
|
||||||
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
|
|
||||||
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
|
|
||||||
<property name="runAsManager"><ref bean="runAsManager"/></property>
|
|
||||||
<property name="methodDefinitionSource"><ref bean="methodDefinitionSource"/></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ======================= BUSINESS DEFINITIONS ===================== -->
|
|
||||||
|
|
||||||
<bean id="testService" class="net.sf.acegisecurity.attribute.TestServiceImpl"/>
|
|
||||||
|
|
||||||
<bean id="autoProxyCreator" class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator">
|
|
||||||
|
|
||||||
<!-- names of the interceptors that will be applied by the proxy -->
|
|
||||||
<property name="interceptorNames">
|
|
||||||
<list>
|
|
||||||
<value>securityInterceptor</value>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
|
|
||||||
<!-- the bean names to automatically generate proxies for -->
|
|
||||||
<property name="beanNames">
|
|
||||||
<list>
|
|
||||||
<value>testService</value>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
</beans>
|
|
||||||
@ -1,65 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.context;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Models a bank account.
|
|
||||||
*/
|
|
||||||
public class Account {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
private Integer id;
|
|
||||||
private String owningUserName;
|
|
||||||
private float balance;
|
|
||||||
|
|
||||||
//~ Constructors ===========================================================
|
|
||||||
|
|
||||||
public Account(Integer id, String owningUserName) {
|
|
||||||
this.id = id;
|
|
||||||
this.owningUserName = owningUserName;
|
|
||||||
}
|
|
||||||
|
|
||||||
public Account(int id, String owningUserName) {
|
|
||||||
this.id = new Integer(id);
|
|
||||||
this.owningUserName = owningUserName;
|
|
||||||
}
|
|
||||||
|
|
||||||
private Account() {
|
|
||||||
super();
|
|
||||||
}
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public float getBalance() {
|
|
||||||
return this.balance;
|
|
||||||
}
|
|
||||||
|
|
||||||
public Integer getId() {
|
|
||||||
return this.id;
|
|
||||||
}
|
|
||||||
|
|
||||||
public String getOwningUserName() {
|
|
||||||
return this.owningUserName;
|
|
||||||
}
|
|
||||||
|
|
||||||
public void deposit(float amount) {
|
|
||||||
this.balance = this.balance + amount;
|
|
||||||
}
|
|
||||||
|
|
||||||
public void withdraw(float amount) {
|
|
||||||
this.balance = this.balance - amount;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,44 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.context;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Simple business object of an in-memory banking system.
|
|
||||||
*
|
|
||||||
* <p>
|
|
||||||
* We'll spare you from <code>InsufficientFundsExceptions</code> etc. After
|
|
||||||
* all, this is intended to test security features rather than OO design!
|
|
||||||
* </p>
|
|
||||||
*
|
|
||||||
* @author Ben Alex
|
|
||||||
* @version $Id$
|
|
||||||
*/
|
|
||||||
public interface BankManager {
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public float getBalance(Integer accountNumber);
|
|
||||||
|
|
||||||
public float getBankFundsUnderControl();
|
|
||||||
|
|
||||||
public void deleteAccount(Integer accountNumber);
|
|
||||||
|
|
||||||
public Account loadAccount(Integer accountNumber);
|
|
||||||
|
|
||||||
public void saveAccount(Account account);
|
|
||||||
|
|
||||||
public void transferFunds(Integer fromAccountNumber,
|
|
||||||
Integer toAccountNumber, float amount);
|
|
||||||
}
|
|
||||||
@ -1,75 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.context;
|
|
||||||
|
|
||||||
import java.util.HashMap;
|
|
||||||
import java.util.Iterator;
|
|
||||||
import java.util.Map;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Implementation of {@link BankManager}.
|
|
||||||
*
|
|
||||||
* @author Ben Alex
|
|
||||||
* @version $Id$
|
|
||||||
*/
|
|
||||||
public class BankManagerImpl implements BankManager {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
private Map accounts = new HashMap();
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public float getBalance(Integer accountNumber) {
|
|
||||||
Account account = this.loadAccount(accountNumber);
|
|
||||||
|
|
||||||
return account.getBalance();
|
|
||||||
}
|
|
||||||
|
|
||||||
public float getBankFundsUnderControl() {
|
|
||||||
float total = 0;
|
|
||||||
Iterator iter = this.accounts.keySet().iterator();
|
|
||||||
|
|
||||||
while (iter.hasNext()) {
|
|
||||||
Integer account = (Integer) iter.next();
|
|
||||||
total = total + this.getBalance(account);
|
|
||||||
}
|
|
||||||
|
|
||||||
return total;
|
|
||||||
}
|
|
||||||
|
|
||||||
public void deleteAccount(Integer accountNumber) {
|
|
||||||
this.accounts.remove(accountNumber);
|
|
||||||
}
|
|
||||||
|
|
||||||
public Account loadAccount(Integer accountNumber) {
|
|
||||||
return (Account) accounts.get(accountNumber);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void saveAccount(Account account) {
|
|
||||||
this.accounts.put(account.getId(), account);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void transferFunds(Integer fromAccountNumber,
|
|
||||||
Integer toAccountNumber, float amount) {
|
|
||||||
Account from = this.loadAccount(fromAccountNumber);
|
|
||||||
Account to = this.loadAccount(toAccountNumber);
|
|
||||||
from.withdraw(amount);
|
|
||||||
to.deposit(amount);
|
|
||||||
this.saveAccount(from);
|
|
||||||
this.saveAccount(to);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,128 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.context;
|
|
||||||
|
|
||||||
import junit.framework.TestCase;
|
|
||||||
|
|
||||||
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
|
|
||||||
|
|
||||||
import org.springframework.context.support.ClassPathXmlApplicationContext;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Tests context objects.
|
|
||||||
*
|
|
||||||
* @author Ben Alex
|
|
||||||
* @version $Id$
|
|
||||||
*/
|
|
||||||
public class ContextTests extends TestCase {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
private ClassPathXmlApplicationContext ctx;
|
|
||||||
|
|
||||||
//~ Constructors ===========================================================
|
|
||||||
|
|
||||||
public ContextTests() {
|
|
||||||
super();
|
|
||||||
}
|
|
||||||
|
|
||||||
public ContextTests(String arg0) {
|
|
||||||
super(arg0);
|
|
||||||
}
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public final void setUp() throws Exception {
|
|
||||||
super.setUp();
|
|
||||||
ctx = new ClassPathXmlApplicationContext(
|
|
||||||
"/net/sf/acegisecurity/context/applicationContext.xml");
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void main(String[] args) {
|
|
||||||
junit.textui.TestRunner.run(ContextTests.class);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void testContextInterceptorDetectsEmptyContexts()
|
|
||||||
throws Exception {
|
|
||||||
Account ben = new Account(1, "ben");
|
|
||||||
BankManager bank = (BankManager) ctx.getBean("bankManager");
|
|
||||||
|
|
||||||
try {
|
|
||||||
bank.saveAccount(ben);
|
|
||||||
fail("Should have thrown ContextHolderEmptyException");
|
|
||||||
} catch (ContextHolderEmptyException expected) {
|
|
||||||
assertTrue(true);
|
|
||||||
}
|
|
||||||
|
|
||||||
Context context = new ContextImpl();
|
|
||||||
ContextHolder.setContext(context);
|
|
||||||
|
|
||||||
Account marissa = new Account(2, "marissa");
|
|
||||||
bank.saveAccount(marissa);
|
|
||||||
|
|
||||||
ContextHolder.setContext(null);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void testContextInterceptorProcessesValidations()
|
|
||||||
throws Exception {
|
|
||||||
ExoticContext context = new ExoticContext();
|
|
||||||
ContextHolder.setContext(context);
|
|
||||||
|
|
||||||
Account ben = new Account(1, "ben");
|
|
||||||
BankManager bank = (BankManager) ctx.getBean("bankManager");
|
|
||||||
|
|
||||||
try {
|
|
||||||
bank.saveAccount(ben);
|
|
||||||
fail(
|
|
||||||
"Should have thrown ContextInvalidException (magic number is incorrect)");
|
|
||||||
} catch (ContextInvalidException expected) {
|
|
||||||
assertTrue(true);
|
|
||||||
}
|
|
||||||
|
|
||||||
context.setMagicNumber(7);
|
|
||||||
ContextHolder.setContext(context);
|
|
||||||
|
|
||||||
Account marissa = new Account(2, "marissa");
|
|
||||||
bank.saveAccount(marissa);
|
|
||||||
|
|
||||||
ContextHolder.setContext(null);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void testContextInterceptorValidatesASecureContext()
|
|
||||||
throws Exception {
|
|
||||||
SecureContext context = new SecureContextImpl();
|
|
||||||
ContextHolder.setContext((Context) context);
|
|
||||||
|
|
||||||
Account ben = new Account(1, "ben");
|
|
||||||
BankManager bank = (BankManager) ctx.getBean("bankManager");
|
|
||||||
|
|
||||||
try {
|
|
||||||
bank.saveAccount(ben);
|
|
||||||
fail(
|
|
||||||
"Should have thrown ContextInvalidException (no authentication object)");
|
|
||||||
} catch (ContextInvalidException expected) {
|
|
||||||
assertTrue(true);
|
|
||||||
}
|
|
||||||
|
|
||||||
context.setAuthentication(new TestingAuthenticationToken("a", "b", null));
|
|
||||||
ContextHolder.setContext((Context) context);
|
|
||||||
|
|
||||||
Account marissa = new Account(2, "marissa");
|
|
||||||
bank.saveAccount(marissa);
|
|
||||||
|
|
||||||
ContextHolder.setContext(null);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,49 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.context;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Exotic implementation of a {@link Context}.
|
|
||||||
*
|
|
||||||
* <p>
|
|
||||||
* Requires the context to be set with a <code>magicNumber</code> of 7. Tests
|
|
||||||
* validation in the unit tests.
|
|
||||||
* </p>
|
|
||||||
*
|
|
||||||
* @author Ben Alex
|
|
||||||
* @version $Id$
|
|
||||||
*/
|
|
||||||
public class ExoticContext implements Context {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
private int magicNumber;
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public void setMagicNumber(int magicNumber) {
|
|
||||||
this.magicNumber = magicNumber;
|
|
||||||
}
|
|
||||||
|
|
||||||
public int getMagicNumber() {
|
|
||||||
return magicNumber;
|
|
||||||
}
|
|
||||||
|
|
||||||
public void validate() throws ContextInvalidException {
|
|
||||||
if (magicNumber != 7) {
|
|
||||||
throw new ContextInvalidException("Magic number is not 7");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,29 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="UTF-8"?>
|
|
||||||
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
|
|
||||||
<!--
|
|
||||||
* The Acegi Security System for Spring is published under the terms
|
|
||||||
* of the Apache Software License.
|
|
||||||
* $Id$
|
|
||||||
-->
|
|
||||||
|
|
||||||
<beans>
|
|
||||||
|
|
||||||
<!-- =================== CONTEXT RELATED DEFINITIONS ================== -->
|
|
||||||
|
|
||||||
<bean id="contextInterceptor" class="net.sf.acegisecurity.context.ContextInterceptor"/>
|
|
||||||
|
|
||||||
<!-- ======================= BUSINESS DEFINITIONS ===================== -->
|
|
||||||
|
|
||||||
<bean id="bankManagerTarget" class="net.sf.acegisecurity.context.BankManagerImpl"/>
|
|
||||||
|
|
||||||
<bean id="bankManager" class="org.springframework.aop.framework.ProxyFactoryBean">
|
|
||||||
<property name="proxyInterfaces"><value>net.sf.acegisecurity.context.BankManager</value></property>
|
|
||||||
<property name="interceptorNames">
|
|
||||||
<list>
|
|
||||||
<value>contextInterceptor</value>
|
|
||||||
<value>bankManagerTarget</value>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
</beans>
|
|
||||||
@ -1,110 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="UTF-8"?>
|
|
||||||
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
|
|
||||||
<!--
|
|
||||||
* The Acegi Security System for Spring is published under the terms
|
|
||||||
* of the Apache Software License.
|
|
||||||
* $Id$
|
|
||||||
-->
|
|
||||||
|
|
||||||
<beans>
|
|
||||||
|
|
||||||
<!-- =================== SECURITY SYSTEM DEFINITIONS ================== -->
|
|
||||||
|
|
||||||
<!-- RunAsManager -->
|
|
||||||
<bean id="runAsManager" class="net.sf.acegisecurity.runas.RunAsManagerImpl">
|
|
||||||
<property name="key"><value>my_run_as_password</value></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHENTICATION DEFINITIONS ~~~~~~~~~~~~~~~~~~ -->
|
|
||||||
|
|
||||||
<!-- Data access object which stores authentication information -->
|
|
||||||
<!-- The two invalid entries at the bottom are provided for testing purposes -->
|
|
||||||
<bean id="inMemoryDaoImpl" class="net.sf.acegisecurity.providers.dao.memory.InMemoryDaoImpl">
|
|
||||||
<property name="userMap">
|
|
||||||
<value>
|
|
||||||
marissa=koala,ROLE_TELLER,ROLE_SUPERVISOR
|
|
||||||
dianne=emu,disabled,ROLE_TELLER
|
|
||||||
scott=wombat,ACCOUNT_45
|
|
||||||
peter=opal,ACCOUNT_77
|
|
||||||
someone=password
|
|
||||||
someoneelse=
|
|
||||||
</value>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- Authentication provider that queries our data access object -->
|
|
||||||
<bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
|
|
||||||
<property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property>
|
|
||||||
<property name="ignorePasswordCase"><value>false</value></property>
|
|
||||||
<property name="ignoreUsernameCase"><value>true</value></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- Authentication provider that accepts as valid our RunAsManagerImpl created tokens -->
|
|
||||||
<bean id="runAsAuthenticationProvider" class="net.sf.acegisecurity.runas.RunAsImplAuthenticationProvider">
|
|
||||||
<property name="key"><value>my_run_as_password</value></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- The authentication manager that iterates through our authentication providers -->
|
|
||||||
<!-- Strictly we don't need runAsAuthenticationProvider given we haven't defined any RUN_AS configurations -->
|
|
||||||
<bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager">
|
|
||||||
<property name="providers">
|
|
||||||
<list>
|
|
||||||
<ref bean="daoAuthenticationProvider"/>
|
|
||||||
<ref bean="runAsAuthenticationProvider"/>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHORIZATION DEFINITIONS ~~~~~~~~~~~~~~~~~~~ -->
|
|
||||||
|
|
||||||
<!-- An access decision voter that reads ROLE_* configuaration settings -->
|
|
||||||
<bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter"/>
|
|
||||||
|
|
||||||
<!-- An access decision voter that reads BANKSECURITY_CUSTOMER configuaration settings -->
|
|
||||||
<bean id="bankSecurityVoter" class="net.sf.acegisecurity.BankSecurityVoter"/>
|
|
||||||
|
|
||||||
<!-- An affirmative access decision manager -->
|
|
||||||
<bean id="accessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
|
|
||||||
<property name="allowIfAllAbstainDecisions"><value>false</value></property>
|
|
||||||
<property name="decisionVoters">
|
|
||||||
<list>
|
|
||||||
<ref bean="roleVoter"/>
|
|
||||||
<ref bean="bankSecurityVoter"/>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ===================== SECURITY DEFINITIONS ======================= -->
|
|
||||||
|
|
||||||
<!-- No declaration for BankManager.getBankFundsUnderControl() makes it public -->
|
|
||||||
<bean id="bankManagerSecurity" class="net.sf.acegisecurity.SecurityInterceptor">
|
|
||||||
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
|
|
||||||
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
|
|
||||||
<property name="runAsManager"><ref bean="runAsManager"/></property>
|
|
||||||
<property name="methodDefinitionSource">
|
|
||||||
<value>
|
|
||||||
net.sf.acegisecurity.context.BankManager.delete*=ROLE_SUPERVISOR
|
|
||||||
net.sf.acegisecurity.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER
|
|
||||||
net.sf.acegisecurity.context.BankManager.loadAccount=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER
|
|
||||||
net.sf.acegisecurity.context.BankManager.saveAccount=ROLE_TELLER,ROLE_SUPERVISOR
|
|
||||||
net.sf.acegisecurity.context.BankManager.transferFunds=ROLE_SUPERVISOR
|
|
||||||
</value>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ======================= BUSINESS DEFINITIONS ===================== -->
|
|
||||||
|
|
||||||
<bean id="bankManagerTarget" class="net.sf.acegisecurity.context.BankManagerImpl"/>
|
|
||||||
|
|
||||||
<!-- We don't include any context interceptor, although we should do so prior to the security interceptor -->
|
|
||||||
<bean id="bankManager" class="org.springframework.aop.framework.ProxyFactoryBean">
|
|
||||||
<property name="proxyInterfaces"><value>net.sf.acegisecurity.context.BankManager</value></property>
|
|
||||||
<property name="interceptorNames">
|
|
||||||
<list>
|
|
||||||
<value>bankManagerSecurity</value>
|
|
||||||
<value>bankManagerTarget</value>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
</beans>
|
|
||||||
@ -1,83 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.runas;
|
|
||||||
|
|
||||||
import net.sf.acegisecurity.context.Account;
|
|
||||||
import net.sf.acegisecurity.context.BankManager;
|
|
||||||
|
|
||||||
import org.springframework.beans.factory.InitializingBean;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Acts as the "public facade" to a <code>BankManager</code>.
|
|
||||||
*
|
|
||||||
* <P>
|
|
||||||
* The security configuration of this, the public facade, specifies authorities
|
|
||||||
* that should be held by the end user. The security configuration of the
|
|
||||||
* "backend", which is not accessible to the general public, specifies certain
|
|
||||||
* authorities that are granted by the RunAsManagerImpl.
|
|
||||||
* </p>
|
|
||||||
*
|
|
||||||
* @author Ben Alex
|
|
||||||
* @version $Id$
|
|
||||||
*/
|
|
||||||
public class BankManagerPublicFacade implements BankManager, InitializingBean {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
private BankManager backend;
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public void setBackend(BankManager backend) {
|
|
||||||
this.backend = backend;
|
|
||||||
}
|
|
||||||
|
|
||||||
public BankManager getBackend() {
|
|
||||||
return backend;
|
|
||||||
}
|
|
||||||
|
|
||||||
public float getBalance(Integer accountNumber) {
|
|
||||||
return backend.getBalance(accountNumber);
|
|
||||||
}
|
|
||||||
|
|
||||||
public float getBankFundsUnderControl() {
|
|
||||||
return backend.getBankFundsUnderControl();
|
|
||||||
}
|
|
||||||
|
|
||||||
public void afterPropertiesSet() throws Exception {
|
|
||||||
if (backend == null) {
|
|
||||||
throw new IllegalArgumentException(
|
|
||||||
"A backend BankManager implementation is required");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
public void deleteAccount(Integer accountNumber) {
|
|
||||||
backend.deleteAccount(accountNumber);
|
|
||||||
}
|
|
||||||
|
|
||||||
public Account loadAccount(Integer accountNumber) {
|
|
||||||
return backend.loadAccount(accountNumber);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void saveAccount(Account account) {
|
|
||||||
backend.saveAccount(account);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void transferFunds(Integer fromAccountNumber,
|
|
||||||
Integer toAccountNumber, float amount) {
|
|
||||||
backend.transferFunds(fromAccountNumber, toAccountNumber, amount);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,114 +0,0 @@
|
|||||||
/* Copyright 2004 Acegi Technology Pty Limited
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package net.sf.acegisecurity.runas;
|
|
||||||
|
|
||||||
import junit.framework.TestCase;
|
|
||||||
|
|
||||||
import net.sf.acegisecurity.AccessDeniedException;
|
|
||||||
import net.sf.acegisecurity.context.Account;
|
|
||||||
import net.sf.acegisecurity.context.BankManager;
|
|
||||||
import net.sf.acegisecurity.context.Context;
|
|
||||||
import net.sf.acegisecurity.context.ContextHolder;
|
|
||||||
import net.sf.acegisecurity.context.SecureContext;
|
|
||||||
import net.sf.acegisecurity.context.SecureContextImpl;
|
|
||||||
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
|
|
||||||
|
|
||||||
import org.springframework.context.support.ClassPathXmlApplicationContext;
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Tests {@link RunAsManagerImpl}.
|
|
||||||
*
|
|
||||||
* @author Ben Alex
|
|
||||||
* @version $Id$
|
|
||||||
*/
|
|
||||||
public class RunAsTests extends TestCase {
|
|
||||||
//~ Instance fields ========================================================
|
|
||||||
|
|
||||||
private ClassPathXmlApplicationContext ctx;
|
|
||||||
|
|
||||||
//~ Constructors ===========================================================
|
|
||||||
|
|
||||||
public RunAsTests() {
|
|
||||||
super();
|
|
||||||
}
|
|
||||||
|
|
||||||
public RunAsTests(String arg0) {
|
|
||||||
super(arg0);
|
|
||||||
}
|
|
||||||
|
|
||||||
//~ Methods ================================================================
|
|
||||||
|
|
||||||
public final void setUp() throws Exception {
|
|
||||||
super.setUp();
|
|
||||||
ctx = new ClassPathXmlApplicationContext(
|
|
||||||
"/net/sf/acegisecurity/runas/applicationContext.xml");
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void main(String[] args) {
|
|
||||||
junit.textui.TestRunner.run(RunAsTests.class);
|
|
||||||
}
|
|
||||||
|
|
||||||
public void testRunAs() throws Exception {
|
|
||||||
Account account = new Account(45, "someone");
|
|
||||||
BankManager bank = (BankManager) ctx.getBean("bankManager");
|
|
||||||
|
|
||||||
// Try as a user without access to the account
|
|
||||||
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("peter",
|
|
||||||
"opal");
|
|
||||||
SecureContext secureContext = new SecureContextImpl();
|
|
||||||
secureContext.setAuthentication(token);
|
|
||||||
ContextHolder.setContext((Context) secureContext);
|
|
||||||
|
|
||||||
try {
|
|
||||||
// NB: account number 45 != granted authority for account 77
|
|
||||||
bank.loadAccount(account.getId());
|
|
||||||
fail("Should have thrown an AccessDeniedException");
|
|
||||||
} catch (AccessDeniedException expected) {
|
|
||||||
assertTrue(true);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Now try as user with access to account number 45
|
|
||||||
// Proves ROLE_RUN_AS_SERVER is being allocated
|
|
||||||
token = new UsernamePasswordAuthenticationToken("scott", "wombat");
|
|
||||||
secureContext.setAuthentication(token);
|
|
||||||
ContextHolder.setContext((Context) secureContext);
|
|
||||||
bank.loadAccount(account.getId());
|
|
||||||
assertTrue(true);
|
|
||||||
|
|
||||||
// Now try as user with ROLE_SUPERVISOR access to the account
|
|
||||||
// Proves ROLE_RUN_AS_SERVER is being allocated
|
|
||||||
token = new UsernamePasswordAuthenticationToken("marissa", "koala");
|
|
||||||
secureContext.setAuthentication(token);
|
|
||||||
ContextHolder.setContext((Context) secureContext);
|
|
||||||
bank.loadAccount(account.getId());
|
|
||||||
assertTrue(true);
|
|
||||||
|
|
||||||
// Now try to call a method that ROLE_RUN_AS_BACKEND not granted for
|
|
||||||
token = new UsernamePasswordAuthenticationToken("marissa", "koala");
|
|
||||||
secureContext.setAuthentication(token);
|
|
||||||
ContextHolder.setContext((Context) secureContext);
|
|
||||||
|
|
||||||
try {
|
|
||||||
bank.saveAccount(account);
|
|
||||||
fail("Should have thrown AccessDeniedException");
|
|
||||||
} catch (AccessDeniedException expected) {
|
|
||||||
assertTrue(true);
|
|
||||||
}
|
|
||||||
|
|
||||||
ContextHolder.setContext(null);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,138 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="UTF-8"?>
|
|
||||||
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
|
|
||||||
<!--
|
|
||||||
* The Acegi Security System for Spring is published under the terms
|
|
||||||
* of the Apache Software License.
|
|
||||||
* $Id$
|
|
||||||
-->
|
|
||||||
|
|
||||||
<beans>
|
|
||||||
|
|
||||||
<!-- =================== SECURITY SYSTEM DEFINITIONS ================== -->
|
|
||||||
|
|
||||||
<!-- RunAsManager -->
|
|
||||||
<bean id="runAsManager" class="net.sf.acegisecurity.runas.RunAsManagerImpl">
|
|
||||||
<property name="key"><value>my_run_as_password</value></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHENTICATION DEFINITIONS ~~~~~~~~~~~~~~~~~~ -->
|
|
||||||
|
|
||||||
<!-- Data access object which stores authentication information -->
|
|
||||||
<!-- The two invalid entries at the bottom are provided for testing purposes -->
|
|
||||||
<bean id="inMemoryDaoImpl" class="net.sf.acegisecurity.providers.dao.memory.InMemoryDaoImpl">
|
|
||||||
<property name="userMap">
|
|
||||||
<value>
|
|
||||||
marissa=koala,ROLE_TELLER,ROLE_SUPERVISOR
|
|
||||||
dianne=emu,disabled,ROLE_TELLER
|
|
||||||
scott=wombat,ACCOUNT_45
|
|
||||||
peter=opal,ACCOUNT_77
|
|
||||||
someone=password
|
|
||||||
someoneelse=
|
|
||||||
</value>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- Authentication provider that queries our data access object -->
|
|
||||||
<bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
|
|
||||||
<property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property>
|
|
||||||
<property name="ignorePasswordCase"><value>false</value></property>
|
|
||||||
<property name="ignoreUsernameCase"><value>true</value></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- Authentication provider that accepts as valid our RunAsManagerImpl created tokens -->
|
|
||||||
<bean id="runAsAuthenticationProvider" class="net.sf.acegisecurity.runas.RunAsImplAuthenticationProvider">
|
|
||||||
<property name="key"><value>my_run_as_password</value></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- The authentication manager that iterates through our authentication providers -->
|
|
||||||
<bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager">
|
|
||||||
<property name="providers">
|
|
||||||
<list>
|
|
||||||
<ref bean="daoAuthenticationProvider"/>
|
|
||||||
<ref bean="runAsAuthenticationProvider"/>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHORIZATION DEFINITIONS ~~~~~~~~~~~~~~~~~~~ -->
|
|
||||||
|
|
||||||
<!-- An access decision voter that reads ROLE_* configuaration settings -->
|
|
||||||
<bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter"/>
|
|
||||||
|
|
||||||
<!-- An access decision voter that reads BANKSECURITY_CUSTOMER configuaration settings -->
|
|
||||||
<bean id="bankSecurityVoter" class="net.sf.acegisecurity.BankSecurityVoter"/>
|
|
||||||
|
|
||||||
<!-- An affirmative access decision manager -->
|
|
||||||
<bean id="accessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
|
|
||||||
<property name="allowIfAllAbstainDecisions"><value>false</value></property>
|
|
||||||
<property name="decisionVoters">
|
|
||||||
<list>
|
|
||||||
<ref bean="roleVoter"/>
|
|
||||||
<ref bean="bankSecurityVoter"/>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ===================== SECURITY DEFINITIONS ======================= -->
|
|
||||||
|
|
||||||
<!-- Note we don't specify to grant RUN_AS_SERVER to saveAccount invocations -->
|
|
||||||
<bean id="publicBankManagerSecurity" class="net.sf.acegisecurity.SecurityInterceptor">
|
|
||||||
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
|
|
||||||
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
|
|
||||||
<property name="runAsManager"><ref bean="runAsManager"/></property>
|
|
||||||
<property name="methodDefinitionSource">
|
|
||||||
<value>
|
|
||||||
net.sf.acegisecurity.context.BankManager.delete*=ROLE_SUPERVISOR,RUN_AS_SERVER
|
|
||||||
net.sf.acegisecurity.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER,RUN_AS_SERVER
|
|
||||||
net.sf.acegisecurity.context.BankManager.loadAccount=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER,RUN_AS_SERVER
|
|
||||||
net.sf.acegisecurity.context.BankManager.saveAccount=ROLE_TELLER,ROLE_SUPERVISOR
|
|
||||||
net.sf.acegisecurity.context.BankManager.transferFunds=ROLE_SUPERVISOR,RUN_AS_SERVER
|
|
||||||
</value>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- We expect all callers of the backend object to hold the role ROLE_RUN_AS_SERVER -->
|
|
||||||
<bean id="backendBankManagerSecurity" class="net.sf.acegisecurity.SecurityInterceptor">
|
|
||||||
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
|
|
||||||
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
|
|
||||||
<property name="runAsManager"><ref bean="runAsManager"/></property>
|
|
||||||
<property name="methodDefinitionSource">
|
|
||||||
<value>
|
|
||||||
net.sf.acegisecurity.context.BankManager.delete*=ROLE_RUN_AS_SERVER
|
|
||||||
net.sf.acegisecurity.context.BankManager.getBalance=ROLE_RUN_AS_SERVER
|
|
||||||
net.sf.acegisecurity.context.BankManager.loadAccount=ROLE_RUN_AS_SERVER
|
|
||||||
net.sf.acegisecurity.context.BankManager.saveAccount=ROLE_RUN_AS_SERVER
|
|
||||||
net.sf.acegisecurity.context.BankManager.transferFunds=ROLE_RUN_AS_SERVER
|
|
||||||
</value>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<!-- ======================= BUSINESS DEFINITIONS ===================== -->
|
|
||||||
|
|
||||||
<bean id="bankManager" class="org.springframework.aop.framework.ProxyFactoryBean">
|
|
||||||
<property name="proxyInterfaces"><value>net.sf.acegisecurity.context.BankManager</value></property>
|
|
||||||
<property name="interceptorNames">
|
|
||||||
<list>
|
|
||||||
<value>publicBankManagerSecurity</value>
|
|
||||||
<value>publicBankManagerTarget</value>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<bean id="publicBankManagerTarget" class="net.sf.acegisecurity.runas.BankManagerPublicFacade">
|
|
||||||
<property name="backend"><ref bean="backendBankManager"/></property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<bean id="backendBankManager" class="org.springframework.aop.framework.ProxyFactoryBean">
|
|
||||||
<property name="proxyInterfaces"><value>net.sf.acegisecurity.context.BankManager</value></property>
|
|
||||||
<property name="interceptorNames">
|
|
||||||
<list>
|
|
||||||
<value>backendBankManagerSecurity</value>
|
|
||||||
<value>backendBankManagerTarget</value>
|
|
||||||
</list>
|
|
||||||
</property>
|
|
||||||
</bean>
|
|
||||||
|
|
||||||
<bean id="backendBankManagerTarget" class="net.sf.acegisecurity.context.BankManagerImpl"/>
|
|
||||||
|
|
||||||
</beans>
|
|
||||||
Loading…
x
Reference in New Issue
Block a user