SEC-271: Fixed IllegalStateException being thrown by LogoutHandlerOrdereResolver and add an assert statement in the unit test
This commit is contained in:
Vishal Puri
parent
a01bb3bbee
commit
a934f82af4
|
|
@ -67,17 +67,21 @@ public class LogoutHandlerOrderResolver implements BeanFactoryPostProcessor {
|
|||
for (int i = 0, n = names.length; i < n; i++) {
|
||||
RootBeanDefinition definition = (RootBeanDefinition) beanFactory.getBeanDefinition(names[i]);
|
||||
|
||||
if (Ordered.class.isAssignableFrom(definition.getBeanClass())) {
|
||||
definition.getPropertyValues().addPropertyValue("order", new Integer(getOrder(definition.getBeanClass())));
|
||||
} else {
|
||||
definition.getPropertyValues().addPropertyValue("order", new Integer(Integer.MAX_VALUE));
|
||||
if (definition.hasBeanClass()) {
|
||||
if (Ordered.class.isAssignableFrom(definition.getBeanClass())) {
|
||||
definition.getPropertyValues().addPropertyValue("order",
|
||||
new Integer(getOrder(definition.getBeanClass())));
|
||||
}
|
||||
else {
|
||||
definition.getPropertyValues().addPropertyValue("order", new Integer(Integer.MAX_VALUE));
|
||||
}
|
||||
}
|
||||
list.add(definition);
|
||||
}
|
||||
Collections.sort(list, new OrderComparator());
|
||||
return list;
|
||||
}
|
||||
|
||||
|
||||
private int getOrder(Class clazz) {
|
||||
if (clazz.getName().equals(TokenBasedRememberMeServices.class.getName())) {
|
||||
return 100;
|
||||
|
|
|
|||
|
|
@ -3,19 +3,27 @@
|
|||
*/
|
||||
package org.acegisecurity.config;
|
||||
|
||||
import org.springframework.context.ApplicationContext;
|
||||
import org.springframework.context.support.ClassPathXmlApplicationContext;
|
||||
import java.util.Map;
|
||||
|
||||
import junit.framework.TestCase;
|
||||
|
||||
import org.acegisecurity.ui.logout.LogoutHandler;
|
||||
import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
|
||||
import org.springframework.context.ApplicationContext;
|
||||
import org.springframework.context.support.ClassPathXmlApplicationContext;
|
||||
|
||||
/**
|
||||
* @author vpuri
|
||||
*
|
||||
*
|
||||
*/
|
||||
public class LogoutFilterBeanDefinitionParserTests extends TestCase {
|
||||
|
||||
public void testLogoutFilter(){
|
||||
ApplicationContext context = new ClassPathXmlApplicationContext("org/acegisecurity/config/logout-filter-with-handlers.xml");
|
||||
|
||||
public void testLogoutFilter() {
|
||||
ApplicationContext context = new ClassPathXmlApplicationContext(
|
||||
"org/acegisecurity/config/logout-filter-with-handlers.xml");
|
||||
ConfigurableListableBeanFactory bf = (ConfigurableListableBeanFactory) context.getAutowireCapableBeanFactory();
|
||||
Map m = bf.getBeansOfType(LogoutHandler.class);
|
||||
assertEquals(2, m.size());
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -14,11 +14,14 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc
|
|||
<!-- If LogoutFilter does not have setHandlers populated, introspect app ctx for LogoutHandlers, using Ordered (if present, otherwise assume Integer.MAX_VALUE) -->
|
||||
<!-- The logoutUrl and redirectAfterLogout are both optional and default to that shown -->
|
||||
<security:logout-support id="logoutFilter"
|
||||
redirectAfterLogoutUrl="/" logoutUrl="/logout"/>
|
||||
redirectAfterLogoutUrl="/" logoutUrl="/logout" />
|
||||
|
||||
<security:authentication-remember-me-services
|
||||
id="rememberMeServices" key="someValue" />
|
||||
|
||||
<bean id="SecurityContextLogoutHandler"
|
||||
class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler" />
|
||||
|
||||
<security:principal-repository id="userDetailsService">
|
||||
<security:user-definition username="vishal"
|
||||
password="nottellingya" enabled="true">
|
||||
|
|
|
|||
|
|
@ -1,148 +1,174 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
|
||||
|
||||
<!--
|
||||
- A simple "base bones" Acegi Security configuration.
|
||||
-
|
||||
- The sample includes the "popular" features that people tend to use.
|
||||
- Specifically, form authentication, remember-me, and anonymous processing.
|
||||
- Other features aren't setup, as these can be added later by inserting
|
||||
- the relevant XML fragments as specified in the Reference Guide.
|
||||
-
|
||||
- To assist new users, the filters specified in the FilterChainProxy are
|
||||
- declared in the application context in the same order. Collaborators
|
||||
- required by those filters are placed at the end of the file.
|
||||
-
|
||||
- $Id$
|
||||
-->
|
||||
|
||||
<beans>
|
||||
|
||||
<bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
|
||||
<property name="filterInvocationDefinitionSource">
|
||||
<value>
|
||||
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
|
||||
PATTERN_TYPE_APACHE_ANT
|
||||
/**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
|
||||
</value>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
|
||||
|
||||
<bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">
|
||||
<constructor-arg value="/index.jsp"/> <!-- URL redirected to after logout -->
|
||||
<constructor-arg>
|
||||
<list>
|
||||
<ref bean="rememberMeServices"/>
|
||||
<bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>
|
||||
</list>
|
||||
</constructor-arg>
|
||||
</bean>
|
||||
|
||||
<bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="authenticationFailureUrl" value="/acegilogin.jsp?login_error=1"/>
|
||||
<property name="defaultTargetUrl" value="/"/>
|
||||
<property name="filterProcessesUrl" value="/j_acegi_security_check"/>
|
||||
<property name="rememberMeServices" ref="rememberMeServices"/>
|
||||
</bean>
|
||||
|
||||
<bean id="securityContextHolderAwareRequestFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>
|
||||
|
||||
<bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="rememberMeServices" ref="rememberMeServices"/>
|
||||
</bean>
|
||||
|
||||
<bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
|
||||
<property name="key" value="changeThis"/>
|
||||
<property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/>
|
||||
</bean>
|
||||
|
||||
<bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
|
||||
<property name="authenticationEntryPoint">
|
||||
<bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
|
||||
<property name="loginFormUrl" value="/acegilogin.jsp"/>
|
||||
<property name="forceHttps" value="false"/>
|
||||
</bean>
|
||||
</property>
|
||||
<property name="accessDeniedHandler">
|
||||
<bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
|
||||
<property name="errorPage" value="/accessDenied.jsp"/>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="accessDecisionManager">
|
||||
<bean class="org.acegisecurity.vote.AffirmativeBased">
|
||||
<property name="allowIfAllAbstainDecisions" value="false"/>
|
||||
<property name="decisionVoters">
|
||||
<list>
|
||||
<bean class="org.acegisecurity.vote.RoleVoter"/>
|
||||
<bean class="org.acegisecurity.vote.AuthenticatedVoter"/>
|
||||
</list>
|
||||
</property>
|
||||
</bean>
|
||||
</property>
|
||||
<property name="objectDefinitionSource">
|
||||
<value>
|
||||
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
|
||||
PATTERN_TYPE_APACHE_ANT
|
||||
/secure/extreme/**=ROLE_SUPERVISOR
|
||||
/secure/**=IS_AUTHENTICATED_REMEMBERED
|
||||
/**=IS_AUTHENTICATED_ANONYMOUSLY
|
||||
</value>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
|
||||
<property name="userDetailsService" ref="userDetailsService"/>
|
||||
<property name="key" value="changeThis"/>
|
||||
</bean>
|
||||
|
||||
<bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
|
||||
<property name="providers">
|
||||
<list>
|
||||
<ref local="daoAuthenticationProvider"/>
|
||||
<bean class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
|
||||
<property name="key" value="changeThis"/>
|
||||
</bean>
|
||||
<bean class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
|
||||
<property name="key" value="changeThis"/>
|
||||
</bean>
|
||||
</list>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
|
||||
<property name="userDetailsService" ref="userDetailsService"/>
|
||||
<property name="userCache">
|
||||
<bean class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
|
||||
<property name="cache">
|
||||
<bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
|
||||
<property name="cacheManager">
|
||||
<bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
|
||||
</property>
|
||||
<property name="cacheName" value="userCache"/>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->
|
||||
<bean id="userDetailsService" class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
|
||||
<property name="userProperties">
|
||||
<bean class="org.springframework.beans.factory.config.PropertiesFactoryBean">
|
||||
<property name="location" value="/WEB-INF/users.properties"/>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
|
||||
<bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener"/>
|
||||
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
|
||||
<beans xmlns="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns:security="http://www.springframework.org/schema/security"
|
||||
xmlns:util="http://www.springframework.org/schema/util"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
|
||||
http://www.springframework.org/schema/util http://www.springframework.org/schema/beans/spring-util-2.0.xsd
|
||||
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
|
||||
|
||||
<!--
|
||||
- A simple "base bones" Acegi Security configuration.
|
||||
-
|
||||
- The sample includes the "popular" features that people tend to use.
|
||||
- Specifically, form authentication, remember-me, and anonymous processing.
|
||||
- Other features aren't setup, as these can be added later by inserting
|
||||
- the relevant XML fragments as specified in the Reference Guide.
|
||||
-
|
||||
- To assist new users, the filters specified in the FilterChainProxy are
|
||||
- declared in the application context in the same order. Collaborators
|
||||
- required by those filters are placed at the end of the file.
|
||||
-
|
||||
- $Id$
|
||||
-->
|
||||
|
||||
|
||||
|
||||
<bean id="filterChainProxy"
|
||||
class="org.acegisecurity.util.FilterChainProxy">
|
||||
<property name="filterInvocationDefinitionSource">
|
||||
<value>
|
||||
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
|
||||
PATTERN_TYPE_APACHE_ANT
|
||||
/**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
|
||||
</value>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<!-- sessionCreation defaults to ifRequired(true) always(true) never(false) . -->
|
||||
<security:session-context-integration
|
||||
id="httpSessionContextIntegrationFilter" sessionCreation="ifRequired" />
|
||||
|
||||
|
||||
<!-- If LogoutFilter does not have setHandlers populated, introspect app ctx for LogoutHandlers, using Ordered (if present, otherwise assume Integer.MAX_VALUE) -->
|
||||
<!-- The logoutUrl and redirectAfterLogout are both optional and default to that shown -->
|
||||
<security:logout-support id="logoutFilter"
|
||||
redirectAfterLogoutUrl="/index.jsp" />
|
||||
|
||||
<security:authentication-remember-me-services
|
||||
id="rememberMeServices" key="someValue" />
|
||||
|
||||
|
||||
<bean id="securityContextLogoutHandler"
|
||||
class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler" />
|
||||
|
||||
<!-- the URLs are all mandatory and have no defaults (well, except authenticationUrl) -->
|
||||
<security:authentication-form id="authenticationProcessinFilter"
|
||||
authenticationUrl="/j_acegi_security_check" defaultTargetUrl="/"
|
||||
errorFormUrl="/acegilogin.jsp?login_error=1" />
|
||||
|
||||
<!-- make it optional, if not supplied autodetect all auth-providers from app ctx, using Ordered to resolve their order -->
|
||||
<security:authentication-mechanism id="authenticationManager" />
|
||||
|
||||
<!-- dao authentication provider "authenticationRepository" -->
|
||||
<security:authentication-repository id="daoAuthenticationProvider" />
|
||||
|
||||
<bean id="securityContextHolderAwareRequestFilter"
|
||||
class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter" />
|
||||
|
||||
<!-- makes the filter, but does little else, as it auto-detects everything -->
|
||||
<security:authentication-remember-me-filter id="rememberMeFilter" />
|
||||
|
||||
<bean id="anonymousProcessingFilter"
|
||||
class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
|
||||
<property name="key" value="changeThis" />
|
||||
<property name="userAttribute"
|
||||
value="anonymousUser,ROLE_ANONYMOUS" />
|
||||
</bean>
|
||||
|
||||
<!-- Basically accessDeniedUrl is optional, we if unspecified impl will auto-detect any AccessDeniedHandler in ctx and use it;
|
||||
alternately if there are > 1 such handlers, we can nominate the one to use via accessDeniedBeanRef; provide nested elements for
|
||||
other props; i do not mind if you move the access denied stuff to a sub-element -->
|
||||
<security:exception-translation id="exceptionTranslationFilter">
|
||||
<security:entry-point
|
||||
entryPointBeanRef="authenticationEntryPoint" />
|
||||
</security:exception-translation>
|
||||
|
||||
|
||||
<bean id="authenticationEntryPoint"
|
||||
class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
|
||||
<property name="loginFormUrl" value="/acegilogin.jsp" />
|
||||
<property name="forceHttps" value="false" />
|
||||
</bean>
|
||||
|
||||
|
||||
<bean id="accessDeniedHandler"
|
||||
class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
|
||||
<property name="errorPage" value="/accessDenied.jsp" />
|
||||
</bean>
|
||||
|
||||
|
||||
<bean id="filterInvocationInterceptor"
|
||||
class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager"
|
||||
ref="authenticationManager" />
|
||||
<property name="accessDecisionManager">
|
||||
<bean class="org.acegisecurity.vote.AffirmativeBased">
|
||||
<property name="allowIfAllAbstainDecisions"
|
||||
value="false" />
|
||||
<property name="decisionVoters">
|
||||
<list>
|
||||
<bean class="org.acegisecurity.vote.RoleVoter" />
|
||||
<bean
|
||||
class="org.acegisecurity.vote.AuthenticatedVoter" />
|
||||
</list>
|
||||
</property>
|
||||
</bean>
|
||||
</property>
|
||||
<property name="objectDefinitionSource">
|
||||
<value>
|
||||
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
|
||||
PATTERN_TYPE_APACHE_ANT
|
||||
/secure/extreme/**=ROLE_SUPERVISOR
|
||||
/secure/**=IS_AUTHENTICATED_REMEMBERED
|
||||
/**=IS_AUTHENTICATED_ANONYMOUSLY
|
||||
</value>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
|
||||
<!--<bean id="authenticationManager"
|
||||
class="org.acegisecurity.providers.ProviderManager">
|
||||
<property name="providers">
|
||||
<list>
|
||||
<ref local="daoAuthenticationProvider" />
|
||||
<bean
|
||||
class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
|
||||
<property name="key" value="changeThis" />
|
||||
</bean>
|
||||
<bean
|
||||
class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
|
||||
<property name="key" value="changeThis" />
|
||||
</bean>
|
||||
</list>
|
||||
</property>
|
||||
</bean>-->
|
||||
|
||||
<bean id="userCache"
|
||||
class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
|
||||
<property name="cache">
|
||||
<bean
|
||||
class="org.springframework.cache.ehcache.EhCacheFactoryBean">
|
||||
<property name="cacheManager">
|
||||
<bean
|
||||
class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />
|
||||
</property>
|
||||
<property name="cacheName" value="userCache" />
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
|
||||
<!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->
|
||||
|
||||
<security:principal-repository id="userDetailsService">
|
||||
<security:properties resource="/WEB-INF/users.properties" />
|
||||
</security:principal-repository>
|
||||
|
||||
|
||||
<!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
|
||||
<bean id="loggerListener"
|
||||
class="org.acegisecurity.event.authentication.LoggerListener" />
|
||||
|
||||
</beans>
|
||||
Loading…
Reference in New Issue