mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-04-29 10:46:33 +00:00
UrlAuthorizationsTests groovy->java
Issue gh-4939
This commit is contained in:
Josh Cummings
parent
870d83eb3e
commit
a08be5bf6f
@ -1,79 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright 2002-2013 the original author or authors.
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* https://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package org.springframework.security.config.annotation.web.configurers;
|
|
||||||
|
|
||||||
import org.springframework.context.annotation.Configuration
|
|
||||||
import org.springframework.security.access.vote.AffirmativeBased
|
|
||||||
import org.springframework.security.config.annotation.BaseSpringSpec
|
|
||||||
import org.springframework.security.config.annotation.SecurityExpressions.*
|
|
||||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
||||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
|
||||||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
|
||||||
import org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer;
|
|
||||||
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor
|
|
||||||
|
|
||||||
/**
|
|
||||||
*
|
|
||||||
* @author Rob Winch
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
public class UrlAuthorizationsTests extends BaseSpringSpec {
|
|
||||||
|
|
||||||
def "hasAnyAuthority('ROLE_USER')"() {
|
|
||||||
when:
|
|
||||||
def expression = UrlAuthorizationConfigurer.hasAnyAuthority("ROLE_USER")
|
|
||||||
then:
|
|
||||||
expression == ["ROLE_USER"]
|
|
||||||
}
|
|
||||||
|
|
||||||
def "hasAnyAuthority('ROLE_USER','ROLE_ADMIN')"() {
|
|
||||||
when:
|
|
||||||
def expression = UrlAuthorizationConfigurer.hasAnyAuthority("ROLE_USER","ROLE_ADMIN")
|
|
||||||
then:
|
|
||||||
expression == ["ROLE_USER","ROLE_ADMIN"]
|
|
||||||
}
|
|
||||||
|
|
||||||
def "hasAnyRole('USER')"() {
|
|
||||||
when:
|
|
||||||
def expression = UrlAuthorizationConfigurer.hasAnyRole("USER")
|
|
||||||
then:
|
|
||||||
expression == ["ROLE_USER"]
|
|
||||||
}
|
|
||||||
|
|
||||||
def "hasAnyRole('ROLE_USER','ROLE_ADMIN')"() {
|
|
||||||
when:
|
|
||||||
def expression = UrlAuthorizationConfigurer.hasAnyRole("USER","ADMIN")
|
|
||||||
then:
|
|
||||||
expression == ["ROLE_USER","ROLE_ADMIN"]
|
|
||||||
}
|
|
||||||
|
|
||||||
def "uses AffirmativeBased AccessDecisionManager"() {
|
|
||||||
when: "Load Config with no specific AccessDecisionManager"
|
|
||||||
loadConfig(NoSpecificAccessDecessionManagerConfig)
|
|
||||||
then: "AccessDecessionManager matches the HttpSecurityBuilder's default"
|
|
||||||
findFilter(FilterSecurityInterceptor).accessDecisionManager.class == AffirmativeBased
|
|
||||||
}
|
|
||||||
|
|
||||||
@EnableWebSecurity
|
|
||||||
static class NoSpecificAccessDecessionManagerConfig extends WebSecurityConfigurerAdapter {
|
|
||||||
protected void configure(HttpSecurity http) throws Exception {
|
|
||||||
http
|
|
||||||
.apply(new UrlAuthorizationConfigurer()).getRegistry()
|
|
||||||
.antMatchers("/a").hasRole("ADMIN")
|
|
||||||
.anyRequest().hasRole("USER")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -0,0 +1,170 @@
|
|||||||
|
/*
|
||||||
|
* Copyright 2002-2019 the original author or authors.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
package org.springframework.security.config.annotation.web.configurers;
|
||||||
|
|
||||||
|
import java.util.List;
|
||||||
|
import javax.servlet.Filter;
|
||||||
|
|
||||||
|
import org.junit.Rule;
|
||||||
|
import org.junit.Test;
|
||||||
|
import org.junit.runner.RunWith;
|
||||||
|
|
||||||
|
import org.springframework.beans.factory.annotation.Autowired;
|
||||||
|
import org.springframework.context.ApplicationContext;
|
||||||
|
import org.springframework.security.access.vote.AffirmativeBased;
|
||||||
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||||
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||||
|
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
||||||
|
import org.springframework.security.config.test.SpringTestRule;
|
||||||
|
import org.springframework.security.test.context.annotation.SecurityTestExecutionListeners;
|
||||||
|
import org.springframework.security.test.context.support.WithMockUser;
|
||||||
|
import org.springframework.security.web.FilterChainProxy;
|
||||||
|
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
|
||||||
|
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
|
||||||
|
import org.springframework.test.web.servlet.MockMvc;
|
||||||
|
|
||||||
|
import static org.assertj.core.api.Assertions.assertThat;
|
||||||
|
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||||
|
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||||
|
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
* @author Rob Winch
|
||||||
|
* @author Josh Cummings
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
@RunWith(SpringJUnit4ClassRunner.class)
|
||||||
|
@SecurityTestExecutionListeners
|
||||||
|
public class UrlAuthorizationsTests {
|
||||||
|
|
||||||
|
@Rule
|
||||||
|
public final SpringTestRule spring = new SpringTestRule();
|
||||||
|
|
||||||
|
@Autowired
|
||||||
|
MockMvc mvc;
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@WithMockUser(authorities = "ROLE_USER")
|
||||||
|
public void hasAnyAuthorityWhenAuthoritySpecifiedThenMatchesAuthority() throws Exception {
|
||||||
|
this.spring.register(RoleConfig.class).autowire();
|
||||||
|
|
||||||
|
this.mvc.perform(get("/role-user-authority"))
|
||||||
|
.andExpect(status().isNotFound());
|
||||||
|
this.mvc.perform(get("/role-user"))
|
||||||
|
.andExpect(status().isNotFound());
|
||||||
|
this.mvc.perform(get("/role-admin-authority"))
|
||||||
|
.andExpect(status().isForbidden());
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@WithMockUser(authorities = "ROLE_ADMIN")
|
||||||
|
public void hasAnyAuthorityWhenAuthoritiesSpecifiedThenMatchesAuthority() throws Exception {
|
||||||
|
this.spring.register(RoleConfig.class).autowire();
|
||||||
|
|
||||||
|
this.mvc.perform(get("/role-user-admin-authority"))
|
||||||
|
.andExpect(status().isNotFound());
|
||||||
|
this.mvc.perform(get("/role-user-admin"))
|
||||||
|
.andExpect(status().isNotFound());
|
||||||
|
this.mvc.perform(get("/role-user-authority"))
|
||||||
|
.andExpect(status().isForbidden());
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@WithMockUser(roles = "USER")
|
||||||
|
public void hasAnyRoleWhenRoleSpecifiedThenMatchesRole() throws Exception {
|
||||||
|
this.spring.register(RoleConfig.class).autowire();
|
||||||
|
|
||||||
|
this.mvc.perform(get("/role-user"))
|
||||||
|
.andExpect(status().isNotFound());
|
||||||
|
this.mvc.perform(get("/role-admin"))
|
||||||
|
.andExpect(status().isForbidden());
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@WithMockUser(roles = "ADMIN")
|
||||||
|
public void hasAnyRoleWhenRolesSpecifiedThenMatchesRole() throws Exception {
|
||||||
|
this.spring.register(RoleConfig.class).autowire();
|
||||||
|
|
||||||
|
this.mvc.perform(get("/role-admin-user"))
|
||||||
|
.andExpect(status().isNotFound());
|
||||||
|
this.mvc.perform(get("/role-user"))
|
||||||
|
.andExpect(status().isForbidden());
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@WithMockUser(authorities = "USER")
|
||||||
|
public void hasAnyRoleWhenRoleSpecifiedThenDoesNotMatchAuthority() throws Exception {
|
||||||
|
this.spring.register(RoleConfig.class).autowire();
|
||||||
|
|
||||||
|
this.mvc.perform(get("/role-user"))
|
||||||
|
.andExpect(status().isForbidden());
|
||||||
|
this.mvc.perform(get("/role-admin"))
|
||||||
|
.andExpect(status().isForbidden());
|
||||||
|
}
|
||||||
|
|
||||||
|
@EnableWebSecurity
|
||||||
|
static class RoleConfig extends WebSecurityConfigurerAdapter {
|
||||||
|
@Override
|
||||||
|
protected void configure(HttpSecurity http) throws Exception {
|
||||||
|
// @formatter:off
|
||||||
|
http
|
||||||
|
.authorizeRequests()
|
||||||
|
.antMatchers("/role-user-authority").hasAnyAuthority("ROLE_USER")
|
||||||
|
.antMatchers("/role-admin-authority").hasAnyAuthority("ROLE_ADMIN")
|
||||||
|
.antMatchers("/role-user-admin-authority").hasAnyAuthority("ROLE_USER", "ROLE_ADMIN")
|
||||||
|
.antMatchers("/role-user").hasAnyRole("USER")
|
||||||
|
.antMatchers("/role-admin").hasAnyRole("ADMIN")
|
||||||
|
.antMatchers("/role-user-admin").hasAnyRole("USER", "ADMIN");
|
||||||
|
// @formatter:on
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void configureWhenNoAccessDecisionManagerThenDefaultsToAffirmativeBased() {
|
||||||
|
this.spring.register(NoSpecificAccessDecisionManagerConfig.class).autowire();
|
||||||
|
|
||||||
|
FilterSecurityInterceptor interceptor = getFilter(FilterSecurityInterceptor.class);
|
||||||
|
assertThat(interceptor).isNotNull();
|
||||||
|
assertThat(interceptor).extracting("accessDecisionManager")
|
||||||
|
.first().isInstanceOf(AffirmativeBased.class);
|
||||||
|
}
|
||||||
|
|
||||||
|
private <T extends Filter> T getFilter(Class<T> filterType) {
|
||||||
|
FilterChainProxy proxy = this.spring.getContext().getBean(FilterChainProxy.class);
|
||||||
|
List<Filter> filters = proxy.getFilters("/");
|
||||||
|
for (Filter filter : filters) {
|
||||||
|
if (filterType.isAssignableFrom(filter.getClass())) {
|
||||||
|
return (T) filter;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
@EnableWebSecurity
|
||||||
|
static class NoSpecificAccessDecisionManagerConfig extends WebSecurityConfigurerAdapter {
|
||||||
|
|
||||||
|
@Override
|
||||||
|
protected void configure(HttpSecurity http) throws Exception {
|
||||||
|
ApplicationContext context = getApplicationContext();
|
||||||
|
UrlAuthorizationConfigurer<HttpSecurity>.StandardInterceptUrlRegistry registry =
|
||||||
|
http.apply(new UrlAuthorizationConfigurer(context)).getRegistry();
|
||||||
|
|
||||||
|
registry
|
||||||
|
.antMatchers("/a").hasRole("ADMIN")
|
||||||
|
.anyRequest().hasRole("USER");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
x
Reference in New Issue
Block a user