From a5a5d9a1a99cafdccdf7639e1ed45b2dcb14e53d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Edd=C3=BA=20Mel=C3=A9ndez=20Gonzales?= Date: Fri, 8 Apr 2016 23:55:53 +1000 Subject: [PATCH] Add support to subclass of GrantedAuthority in SecurityMockMvcResultMatchers withAuthorities (#3793) SecurityMockMvcResultMatchers.withAuthorities(Collection) Fixes gh-3791 --- .../SecurityMockMvcResultMatchers.java | 5 +- ...WithAuthoritiesMvcResultMatchersTests.java | 96 +++++++++++++++++++ 2 files changed, 99 insertions(+), 2 deletions(-) create mode 100644 test/src/test/java/org/springframework/security/test/web/servlet/response/SecurityMockWithAuthoritiesMvcResultMatchersTests.java diff --git a/test/src/main/java/org/springframework/security/test/web/servlet/response/SecurityMockMvcResultMatchers.java b/test/src/main/java/org/springframework/security/test/web/servlet/response/SecurityMockMvcResultMatchers.java index 7078514dd9..74eb12cfb3 100644 --- a/test/src/main/java/org/springframework/security/test/web/servlet/response/SecurityMockMvcResultMatchers.java +++ b/test/src/main/java/org/springframework/security/test/web/servlet/response/SecurityMockMvcResultMatchers.java @@ -36,6 +36,7 @@ import org.springframework.test.web.servlet.ResultMatcher; * Security related {@link MockMvc} {@link ResultMatcher}s. * * @author Rob Winch + * @author Eddú Meléndez * @since 4.0 */ public final class SecurityMockMvcResultMatchers { @@ -84,7 +85,7 @@ public final class SecurityMockMvcResultMatchers { private Authentication expectedAuthentication; private Object expectedAuthenticationPrincipal; private String expectedAuthenticationName; - private Collection expectedGrantedAuthorities; + private Collection expectedGrantedAuthorities; public void match(MvcResult result) throws Exception { SecurityContext context = load(result); @@ -194,7 +195,7 @@ public final class SecurityMockMvcResultMatchers { * @param expected the {@link Authentication#getAuthorities()} * @return the {@link AuthenticatedMatcher} for further customization */ - public AuthenticatedMatcher withAuthorities(Collection expected) { + public AuthenticatedMatcher withAuthorities(Collection expected) { this.expectedGrantedAuthorities = expected; return this; } diff --git a/test/src/test/java/org/springframework/security/test/web/servlet/response/SecurityMockWithAuthoritiesMvcResultMatchersTests.java b/test/src/test/java/org/springframework/security/test/web/servlet/response/SecurityMockWithAuthoritiesMvcResultMatchersTests.java new file mode 100644 index 0000000000..965a93cdb9 --- /dev/null +++ b/test/src/test/java/org/springframework/security/test/web/servlet/response/SecurityMockWithAuthoritiesMvcResultMatchersTests.java @@ -0,0 +1,96 @@ +/* + * Copyright 2002-2016 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.security.test.web.servlet.response; + +import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin; +import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated; +import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity; + +import java.util.ArrayList; +import java.util.List; + +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.core.authority.SimpleGrantedAuthority; +import org.springframework.test.context.ContextConfiguration; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import org.springframework.test.context.web.WebAppConfiguration; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.context.WebApplicationContext; +import org.springframework.web.servlet.config.annotation.EnableWebMvc; + +@RunWith(SpringJUnit4ClassRunner.class) +@ContextConfiguration(classes = SecurityMockWithAuthoritiesMvcResultMatchersTests.Config.class) +@WebAppConfiguration +public class SecurityMockWithAuthoritiesMvcResultMatchersTests { + @Autowired + private WebApplicationContext context; + + private MockMvc mockMvc; + + @Before + public void setup() { + mockMvc = MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()) + .build(); + } + + @Test + public void withAuthoritiesNotOrderSensitive() throws Exception { + List grantedAuthorities = new ArrayList(); + grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN")); + grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_SELLER")); + mockMvc.perform(formLogin()) + .andExpect(authenticated().withAuthorities(grantedAuthorities)); + } + + @Test(expected = AssertionError.class) + public void withAuthoritiesFailsIfNotAllRoles() throws Exception { + List grantedAuthorities = new ArrayList(); + grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN")); + mockMvc.perform(formLogin()).andExpect(authenticated().withAuthorities(grantedAuthorities)); + } + + @EnableWebSecurity + @EnableWebMvc + static class Config extends WebSecurityConfigurerAdapter { + + // @formatter:off + @Autowired + public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { + auth + .inMemoryAuthentication() + .withUser("user").authorities("ROLE_ADMIN", "ROLE_SELLER").password("password"); + } + // @formatter:on + + @RestController + static class Controller { + @RequestMapping("/") + public String ok() { + return "ok"; + } + } + } +}