Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

UserDetailsRepositoryReactiveAuthenticationManager uses DelegatingPasswordEncoder 

This means passwords will be encoded with BCrypt by default

Issue: gh-2775
This commit is contained in:
Rob Winch 2017-10-20 16:59:52 -05:00
parent cdc992b132
commit d19b222b55
8 changed files with 74 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
config/src/test/java/org/springframework/security/config/annotation/web/reactive/EnableWebFluxSecurityTests.java
View File

@ -20,12 +20,15 @@ import org.junit.Rule;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Import;
import org.springframework.context.annotation.ImportResource;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.core.io.buffer.DataBuffer;
import org.springframework.core.io.buffer.DefaultDataBufferFactory;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.config.test.SpringTestRule;
import org.springframework.security.config.users.ReactiveAuthenticationTestConfiguration;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
@ -141,15 +144,8 @@ public class EnableWebFluxSecurityTests {
}
@EnableWebFluxSecurity
@Import(ReactiveAuthenticationTestConfiguration.class)
static class Config {
@Bean
public ReactiveUserDetailsService userDetailsRepository() {
return new MapReactiveUserDetailsService(User.withUsername("user")
.password("password")
.roles("USER")
.build()
);
}
}
@Test
@ -236,22 +232,21 @@ public class EnableWebFluxSecurityTests {
}
@EnableWebFluxSecurity
@Import(ReactiveAuthenticationTestConfiguration.class)
static class MultiSecurityHttpConfig {
@Order(Ordered.HIGHEST_PRECEDENCE) @Bean public SecurityWebFilterChain apiHttpSecurity(
@Order(Ordered.HIGHEST_PRECEDENCE)
@Bean
public SecurityWebFilterChain apiHttpSecurity(
ServerHttpSecurity http) {
http.securityMatcher(new PathPatternParserServerWebExchangeMatcher("/api/**"))
.authorizeExchange().anyExchange().denyAll();
return http.build();
}
@Bean public SecurityWebFilterChain httpSecurity(ServerHttpSecurity http) {
@Bean
public SecurityWebFilterChain httpSecurity(ServerHttpSecurity http) {
return http.build();
}
@Bean public ReactiveUserDetailsService userDetailsRepository() {
return new MapReactiveUserDetailsService(
User.withUsername("user").password("password").roles("USER").build());
}
}
private static DataBuffer toDataBuffer(String body) {

13
config/src/test/java/org/springframework/security/config/annotation/web/reactive/ServerHttpSecurityConfigurationBuilder.java
View File

@ -18,25 +18,24 @@ package org.springframework.security.config.annotation.web.reactive;
import org.springframework.security.authentication.ReactiveAuthenticationManager;
import org.springframework.security.authentication.UserDetailsRepositoryReactiveAuthenticationManager;
import org.springframework.security.config.users.ReactiveAuthenticationTestConfiguration;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
/**
* @author Rob Winch
* @since 5.0
*/
public class ServerHttpSecurityConfigurationBuilder {
public static final UserDetails USER = User.withUsername("user").password("password").roles("USER").build();
public static final UserDetails ADMIN = User.withUsername("admin").password("password").roles("USER","ADMIN").build();
public static ServerHttpSecurity http() {
return new ServerHttpSecurityConfiguration().httpSecurity();
}
public static ServerHttpSecurity httpWithDefaultAuthentication() {
ReactiveAuthenticationManager authenticationManager = new UserDetailsRepositoryReactiveAuthenticationManager(new MapReactiveUserDetailsService(USER,ADMIN));
ReactiveUserDetailsService reactiveUserDetailsService = ReactiveAuthenticationTestConfiguration
.userDetailsRepository();
ReactiveAuthenticationManager authenticationManager = new UserDetailsRepositoryReactiveAuthenticationManager(
reactiveUserDetailsService);
return http()
.authenticationManager(authenticationManager);
}

37
config/src/test/java/org/springframework/security/config/users/ReactiveAuthenticationTestConfiguration.java Normal file
View File

@ -0,0 +1,37 @@
/*
* Copyright 2002-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.config.users;
import org.junit.Test;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
import org.springframework.security.core.userdetails.PasswordEncodedUser;
import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
import org.springframework.security.core.userdetails.User;
/**
* @author Rob Winch
* @since 5.0
*/
@Configuration
public class ReactiveAuthenticationTestConfiguration {
@Bean
public static ReactiveUserDetailsService userDetailsRepository() {
return new MapReactiveUserDetailsService(PasswordEncodedUser.user(), PasswordEncodedUser.admin());
}
}

4
core/src/main/java/org/springframework/security/authentication/UserDetailsRepositoryReactiveAuthenticationManager.java
View File

@ -19,7 +19,7 @@ package org.springframework.security.authentication;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.util.Assert;
import reactor.core.publisher.Mono;
@ -32,7 +32,7 @@ import reactor.core.scheduler.Schedulers;
public class UserDetailsRepositoryReactiveAuthenticationManager implements ReactiveAuthenticationManager {
private final ReactiveUserDetailsService repository;
private PasswordEncoder passwordEncoder = NoOpPasswordEncoder.getInstance();
private PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
public UserDetailsRepositoryReactiveAuthenticationManager(ReactiveUserDetailsService reactiveUserDetailsService) {
Assert.notNull(reactiveUserDetailsService, "userDetailsRepository cannot be null");

14
core/src/test/java/org/springframework/security/authentication/ReactiveUserDetailsServiceAuthenticationManagerTests.java
View File

@ -26,9 +26,11 @@ import org.mockito.Mock;
import org.mockito.junit.MockitoJUnitRunner;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.PasswordEncodedUser;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.password.PasswordEncoder;
import reactor.core.publisher.Mono;
import reactor.test.StepVerifier;
@ -74,10 +76,13 @@ public class ReactiveUserDetailsServiceAuthenticationManagerTests {
@Test
public void authenticateWhenPasswordNotEqualThenBadCredentials() {
User user = new User(username, password, AuthorityUtils.createAuthorityList("ROLE_USER"));
UserDetails user = PasswordEncodedUser.withUsername(this.username)
.password(this.password)
.roles("USER")
.build();
when(repository.findByUsername(user.getUsername())).thenReturn(Mono.just(user));
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password + "INVALID");
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, this.password + "INVALID");
Mono<Authentication> authentication = manager.authenticate(token);
StepVerifier
@ -88,7 +93,10 @@ public class ReactiveUserDetailsServiceAuthenticationManagerTests {
@Test
public void authenticateWhenSuccessThenSuccess() {
User user = new User(username, password, AuthorityUtils.createAuthorityList("ROLE_USER"));
UserDetails user = PasswordEncodedUser.withUsername(this.username)
.password(this.password)
.roles("USER")
.build();
when(repository.findByUsername(user.getUsername())).thenReturn(Mono.just(user));
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);

6
samples/javaconfig/hellowebflux-method/src/main/java/sample/SecurityConfig.java
View File

@ -23,6 +23,7 @@ import org.springframework.security.config.annotation.web.reactive.EnableWebFlux
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.web.server.SecurityWebFilterChain;
/**
@ -47,8 +48,9 @@ public class SecurityConfig {
@Bean
public MapReactiveUserDetailsService userDetailsRepository() {
UserDetails rob = User.withUsername("rob").password("rob").roles("USER").build();
UserDetails admin = User.withUsername("admin").password("admin").roles("USER","ADMIN").build();
User.UserBuilder userBuilder = User.withDefaultPasswordEncoder();
UserDetails rob = userBuilder.username("rob").password("rob").roles("USER").build();
UserDetails admin = userBuilder.username("admin").password("admin").roles("USER","ADMIN").build();
return new MapReactiveUserDetailsService(rob, admin);
}

3
samples/javaconfig/hellowebflux/src/main/java/sample/HelloWebfluxSecurityConfig.java
View File

@ -31,7 +31,8 @@ public class HelloWebfluxSecurityConfig {
@Bean
public MapReactiveUserDetailsService userDetailsRepository() {
UserDetails user = User.withUsername("user")
UserDetails user = User.withDefaultPasswordEncoder()
.username("user")
.password("user")
.roles("USER")
.build();

3
samples/javaconfig/hellowebfluxfn/src/main/java/sample/HelloWebfluxFnSecurityConfig.java
View File

@ -31,7 +31,8 @@ public class HelloWebfluxFnSecurityConfig {
@Bean
public MapReactiveUserDetailsService userDetailsRepository() {
UserDetails user = User.withUsername("user")
UserDetails user = User.withDefaultPasswordEncoder()
.username("user")
.password("user")
.roles("USER")
.build();