Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,369 Commits 32 Branches 333 Tags 109 MiB
Commit Graph

1725 Commits

Author SHA1 Message Date
Josh Cummings f438bdfbcf
Add spring-security-5.4.xsd 
Issue gh-8138
 2020-03-18 09:45:10 -06:00
Erik van Paassen ad9bb7f230 Fix typo in Javadoc of HttpSecurity#csrf() 
`HttpSecurity#csrf()` obviously returns a `CsrfConfigurer`, while the Javadoc states that it returns the `ServletApiConfigurer`.
 2020-03-17 12:42:11 -06:00
Eleftheria Stein 40b15f5a46 Rename to SessionFixationDslTests 2020-03-17 12:05:25 -04:00
Josh Cummings bfd36d9a54
Remove Redundant ConcurrentSessionFilter Refs 
Fixes gh-8105
 2020-03-13 16:27:30 -06:00
Markus Engelbrecht d81321bc29
Fix typo 'properites' in documentation 
Fixes gh-8095
 2020-03-11 10:54:14 -06:00
Josh Cummings 6eadf7b140
Unlock dependencies for 5.3.0.RELEASE 
This reverts commit 147d7dadd7.
 2020-03-04 12:02:48 -07:00
Josh Cummings 147d7dadd7
Lock dependencies for 5.3.0.RELEASE 2020-03-04 10:28:39 -07:00
Josh Cummings c729fee7bc
Malformed Bearer Token Returns 401 for WebFlux 
Fixes gh-7668
 2020-03-03 15:42:02 -07:00
Joe Grandja c111099640 Polish client-registration xsd attributes 
Issue gh-4557
 2020-03-02 15:02:46 -05:00
Josh Cummings e97396b9c7 Add Resource Server XML Support 
Fixes gh-5185
 2020-03-02 11:51:40 -07:00
Josh Cummings f1a2d69968 Add AuthenticationProvider List Configurability 
Issue gh-5185
 2020-03-02 11:51:40 -07:00
Josh Cummings 34b40deb38 Add By-RequestMatcher Exception Handling 
Issue gh-5185
 2020-03-02 11:51:40 -07:00
Josh Cummings 98a2ca3bbc Add Csrf Ignore Configurability 
Issue gh-5185
 2020-03-02 11:51:40 -07:00
Josh Cummings 19584884b3
Register Authentication Provider in Init Phase 
Fixes gh-8031
 2020-02-28 15:32:27 -07:00
Filip Hanik 3257349045 Support POST binding for AuthNRequest 
Has been tested with

- Keycloak
- SSOCircle
- Okta
- SimpleSAMLPhp

This PR extends (builds on previous commits and adds user configuration
options)
https://github.com/spring-projects/spring-security/pull/7758
 2020-02-28 09:15:26 -08:00
Rob Winch 727fee1e12 Polish HeaderWriterSpec 
Assert.notNull(Object,Supplier) is for when then message passed in
requires concatenation and avoids doing extra work. Since this does
not require concatenation, we can use Assert.notNull(Object,String)

Issue gh-7636
 2020-02-27 07:57:51 -06:00
Ankur Pathak 480c5bc87e Custom ServerHttpHeadersWriter to HeaderSpec 
Add the ability to have a custom ServerHttpHeadersWriter to HeaderSpec
Fixes gh-7636
 2020-02-27 07:55:30 -06:00
Eleftheria Stein 2fb3d3d5a2 Add hasRole to authorizeRequests in Kotlin DSL 
Fixes: gh-8023
 2020-02-25 08:29:26 -05:00
Joe Grandja 4cd89b584f Polish gh-5184 2020-02-20 21:25:17 -05:00
Joe Grandja 8a4ff4452b Add XML namespace support for oauth2-client 
Fixes gh-5184
 2020-02-20 20:05:48 -05:00
Eleftheria Stein 171e0d048f Fix typo in WebSecurityConfigurer Javadoc 
Fixes: gh-7876
 2020-02-14 11:00:45 +01:00
Joe Grandja ff8002eb2e Polish gh-4557 2020-02-12 15:47:57 -05:00
Ruby Hartono 71a5c9521c Add XML namespace support for oauth2-login 
Fixes gh-4557
 2020-02-12 15:26:17 -05:00
Joe Grandja 40c0a452d7 Define oauth2-login xsd elements 
Issue gh-4557
 2020-02-12 15:26:17 -05:00
Eleftheria Stein fde3ccb8b3 Add marker to make Kotlin DSL type safe 
Fixes: gh-7971
 2020-02-12 11:35:45 +01:00
Eleftheria Stein 1d6fdd249b Add missing Javadoc to Kotlin class 2020-02-11 18:09:30 +01:00
Eleftheria Stein f37a4557e6 Fix typo in Kotlin Javadoc 2020-02-11 18:09:30 +01:00
Josh Cummings 5bdf57d1e5
Remove Groovy and Spock Dependencies 
Fixes gh-4939
 2020-02-10 10:38:40 -07:00
Eleftheria Stein a5210aaf9b Support custom filter in Kotlin DSL 
Fixes: gh-7951
 2020-02-10 12:03:32 +01:00
Stephane Maldini 851be025e9 Don't force downcasting of RequestAttributes to ServletRequestAttributes 
Fixes gh-7952
 2020-02-07 20:44:19 -05:00
Eleftheria Stein 8c0b754a49 Fix credentials precedence over introspector in Kotlin 
Fixes: gh-7878
 2020-02-06 11:01:42 +01:00
Eleftheria Stein 1fed688f05 Fix JWK Set URI precedence over decoder in Kotlin 
Fixes: gh-7877
 2020-02-06 10:48:42 +01:00
Eleftheria Stein 84b8a5abd7 Unlock dependencies for next development version 
This reverts commit 064616f1ef.
 2020-02-05 15:53:04 +01:00
Eleftheria Stein 064616f1ef Lock dependencies for 5.3.0.RC1 2020-02-05 10:20:05 +01:00
Rob Winch 1d7208f8ef Add RSocket Authentication Extension Support 
Fixes gh-7935
 2020-02-04 23:36:47 -06:00
Josh Cummings 209c81d65d
Add BadOpaqueTokenException 
Updated NimbusOpaqueTokenIntrospector and
NimbusReactiveOpaqueTokenIntrospector to throw.
Updated OpaqueTokenAuthenticationProvider and
OpaqueTokenReactiveAuthenticationManager to catch.

Fixes gh-7902
 2020-02-04 17:33:08 -07:00
Josh Cummings 0c3754c811
Add BadJwtException 
Updated NimbusJwtDecoder and NimbusReactiveJwtDecoder to throw.
Updated JwtAuthenticationProvider and JwtReactiveAuthenticationManager
to catch.

Fixes gh-7885
 2020-02-04 17:33:08 -07:00
Josh Cummings 3e07b35611
Polish Bearer Token Error Handling 
Issue gh-7822
Issue gh-7823
 2020-02-03 17:54:39 -07:00
James ee6df1701b
Polish SessionManagementConfigurer 2020-01-31 11:24:36 -07:00
Josh Cummings cb9fd09150
Change AuthenticationWebFilter's constructor 
Fixes gh-7872
 2020-01-31 09:31:28 -07:00
Eleftheria Stein a512789a93 Fix requiresAuthenticationMatcher not being used 
The custom server requiresAuthenticationMatcher was not always picked up

Fixes: gh-7863
 2020-01-27 16:12:27 +01:00
Eleftheria Stein 29377545d9 Fix authenticationFailureHandler not being used 
The custom server authenticationFailureHandler was not always picked up

Fixes: gh-7782
 2020-01-27 13:10:03 +01:00
Johannes Edmeier bdc60a9128 Don't cache requests with `Accept: text/event-stream` by default. 
The eventstream requests is typically not directly invoked by the browser.
And even more unfortunately the Browser-Api doesn't allow the set additional headers as `XMLHttpRequest`..
 2020-01-17 10:42:16 -08:00
Josh Cummings f1f158b37e AuthenticationEventPublisher DSL Lookup 
Fixes gh-4400
 2020-01-14 12:07:46 -07:00
Josh Cummings 5579846263 AuthenticationEventPublisher Bean Lookup 
Issue gh-7793
Fixes gh-7515
 2020-01-14 12:07:46 -07:00
James Howe fc9b97c94a Typo in doc 2020-01-14 08:32:26 -07:00
Vincent Ricard f0856c83a9 Migrate LDAP integration tests groovy->java 
This commit also removes BaseSpringSpec

Issue: gh-4939
 2020-01-13 14:18:25 +01:00
Josh Cummings a35ce77451
Add missing PowerMockIgnore annotation 
WebSecurityConfigurerAdapterPowermockTests needs to exclude
javax.xml.transform.* from Powermock configuration.
 2020-01-09 15:48:08 -07:00
Josh Cummings ba21c156dd
Polish WebSecurityConfigurerAdapter tests 
Moved Powermock-dependent test over to
WebSecurityConfigurerAdapterPowermockTests.
 2020-01-09 13:51:19 -07:00
Eleftheria Stein fcc6457bef Unlock dependencies for next development version 
This reverts commit 93acf8f0f1.
 2020-01-08 22:15:17 +01:00
Eleftheria Stein 93acf8f0f1 Lock dependencies for 5.3.0.M1 2020-01-08 19:41:10 +01:00
Josh Cummings de87675f6d Add JwtIssuerAuthenticationManagerResolver 
Fixes gh-7724
 2020-01-07 23:30:42 -07:00
Eleftheria Stein-Kousathana 2df1099da5
Idiomatic Kotlin DSL for configuring HTTP security 
Issue: gh-5558
 2020-01-07 12:08:43 -05:00
Rob Winch 65981444f1 Use Version Ranges 
Fixes gh-7788
 2020-01-06 14:46:48 -06:00
Rob Winch 06d7443946 Use Gradle platform and constraints 
This was largely generated from the following script

wget bd9f8eb541/src/main/groovy/io/spring/gradle/convention/DependencySetPlugin.groovy ./dsp.gradle
cat gradle/dependency-management.gradle | grep 'management "' | cut -d ':' -f 2 | xargs -I{} sh -c "rg {} -l -g '*.gradle' -g '\!dependency-management.gradle' > /dev/null || echo {}" | xargs -I{} sed -iE '/.*{}.*/d' gradle/dependency-management.gradle
rm ./dps.gradle

Fixes gh-7787
 2020-01-06 14:46:36 -06:00
Eleftheria Stein 924b9e95a1 Polish MethodSecurityEvaluationContext 
Issue: gh-6224
 2020-01-03 20:08:52 -05:00
Eleftheria Stein 8b8267e1fe Fix typo in LDAP Javadoc 2020-01-02 10:58:44 -05:00
BELHAKEL Ammar b4619f31ee
Fix return type 
AbstractConfiguredSecurityBuilder.objectPostProcessor() should cast to
B, the type of SecurityBuilder, instead of O, the type of object being
built.

Without this change, calls like
http.objectPostProcessor(...).getFilters() will fail with a
ClassCastException.
 2019-12-30 12:01:56 -07:00
Eleftheria Stein 2c7f2c2117 Fix Javadoc error in oauth2ResourceServer 
Fixes: gh-7670
 2019-12-27 14:24:46 +01:00
Filip Hanik af415948b1 Allow configuration of AuthenticationManagerResolver in saml2Login() 
Fixes gh-7654

https://github.com/spring-projects/spring-security/issues/7654
 2019-12-17 13:34:27 -08:00
Filip Hanik 9aa333ca4d Use the custom ServerRequestCache that the user configures 
on for the default authentication entry point and authentication
success handler

Fixes gh-7721

https://github.com/spring-projects/spring-security/issues/7721

Set RequestCache on the Oauth2LoginSpec default authentication success handler

import static ReflectionTestUtils.getField

Feedback incorporated per

https://github.com/spring-projects/spring-security/pull/7734#pullrequestreview-332150359
 2019-12-17 13:33:56 -08:00
Josh Cummings 02f161aba7
Use OidcIdToken.Builder 
Issue gh-7592
 2019-12-12 07:37:15 -07:00
Joe Grandja c40a17b4d1 WebFlux oauth2Login() redirects on failed authentication 
Fixes gh-5562 gh-6484
 2019-12-05 16:50:43 -05:00
Alexey Nesterov d8d59e97ac Correctly configure authorization requests repository for OAuth2 login 
To use custom ServerAuthorizationRequestRepository both OAuth2AuthorizationRequestRedirectWebFilter and
OAuth2LoginAuthenticationWebFilter should use the same repo provided in the configuration. Currently the former filter is
correctly configured, but the latter always uses default, WebSession based repository. So authorization code created
before redirect to authorization endpoint will never be found to complete OAuth2 login when custom
ServerAuthorizationRequestRepository is used.

This change also makes OAuth2Client and OAuth2Login authentication converters consistent.

Fixes gh-7675
 2019-11-29 12:05:15 -05:00
Eleftheria Stein b7cb93f671 Fix WebFlux logout disabling 
Fixes: gh-7682
 2019-11-28 14:40:25 +01:00
Ruslan Stelmachenko c38e57fa42 Fix class and variable names 2019-11-28 09:23:38 +01:00
Ruslan Stelmachenko 8ebc7ca0ea Fix InitializeAuthenticationProviderBeanManagerConfigurer Javadoc 2019-11-28 09:23:38 +01:00
Eleftheria Stein 8a95e5798d Update @MessageMapping to match input/output cardinality 2019-11-22 15:07:38 -06:00
Pim Moerenhout cd0bec48de Fix typo in log message. 2019-11-21 15:55:27 -07:00
Paul Pazderski 0d35194b47 Add sessionFixation Javadoc 2019-11-15 12:17:05 +01:00
Adrian Pena ca8877c8c5 Updates javadoc for InitializeUserDetailsBeanManagerConfigurer 2019-11-13 10:34:10 +01:00
Eleftheria Stein 1188a3bb5f Polish RememberMeConfigurer 
Issue: gh-4140
 2019-11-07 15:26:59 +01:00
邓超 b13f750646 Retrieve remember-me key from service as fallback 
Fixes: gh-4140
 2019-11-07 13:55:39 +01:00
Yanming Zhou 9f6a36444a Add missing schemas 2019-11-06 08:24:20 -06:00
Josh Cummings 925bf48ec0
Polish OAuth2ResourceServerConfigurerTests 
To confirm that resource server only produces SCOPE_<scope>
authorities by default.

Issue gh-7596
 2019-11-04 11:39:54 -07:00
Filip Hanik 0cafcf37e2 Make the loginProcessingUrl configurable for saml2Login() 
Fixes gh-7565

https://github.com/spring-projects/spring-security/issues/7565
 2019-10-31 08:20:12 -07:00
Josh Cummings 5f17032ffd Restore Removed Throws Clauses 
In a recent clean-up, certain exceptions were removed from various
throws clauses.

This PR re-introduces throws clauses that are important for one of the
following reasons:

1. It's a method on a public interface
2. It's a method clearly designed for inheritance, for example, a
method stub, an abstract method, or indicated as such in the docs.

Fixes gh-7541
 2019-10-30 12:13:54 -06:00
Rob Winch 635f7e1edd CsrfWebFilter supports multipart/form-data 
Fixes gh-7576
 2019-10-28 14:06:10 -05:00
Vitalii Mahas 0ac5f5456f Fix typo 'is' -> 'if' in javadoc 2019-10-25 13:27:11 -06:00
Eleftheria Stein de7cbc82b5 Clarify in Javadoc that expressionHandler should not be null 
Fixes: gh-2665
 2019-10-23 15:10:39 -04:00
Rob Winch 3051a79188 Merge Add hasAnyAuthority method in AuthorizePayloadsSpec.Access 2019-09-30 14:33:41 -05:00
Rob Winch a911f3d52f Merge Add hasAnyRole method in AuthorizePayloadsSpec.Access 2019-09-30 14:14:59 -05:00
Rob Winch 3854afad61 Merge Add denyAll method in AuthorizePayloadsSpec.Access 2019-09-30 14:05:42 -05:00
Josh Cummings 758af54796
ObjectPostProcessor Tests groovy->java 
Issue gh-4939
 2019-09-27 16:36:33 -06:00
Josh Cummings a08be5bf6f
UrlAuthorizationsTests groovy->java 
Issue gh-4939
 2019-09-27 16:23:33 -06:00
Josh Cummings 870d83eb3e
PermitAllSupportTests groovy->java 
Issue gh-4939
 2019-09-27 16:23:33 -06:00
Luis Felipe Vega Calle 350bce761f Add hasAuthority method to RSocketSecurity 
Fixes gh-7435
 2019-09-27 16:48:25 -05:00
Josh Cummings 5f905232cb
Polish CurrentSecurityContextArgumentResolvers 
Fixes gh-7487
 2019-09-27 13:19:08 -06:00
Joe Grandja 5ef6e7ed6f Add author for SecurityReactorContextConfiguration 
Issue gh-7422
 2019-09-27 15:17:20 -04:00
Joe Grandja 0fea57d6a1 Optimize SecurityReactorContextConfiguration 
Issue gh-7422
 2019-09-27 14:46:39 -04:00
Josh Cummings 33ba292fed
Resource Server w/ SecurityReactorContextSubscriber 
Fixes gh-7423
 2019-09-27 11:01:04 -06:00
Joe Grandja 5a67971375 WebFluxSecurityConfiguration configures oauth2Client() by default 
Fixes gh-7470
 2019-09-27 10:04:19 -04:00
Joe Grandja 08d2c93713 Polish gh-7466 2019-09-26 22:11:53 -04:00
Roman Chigvintsev 9bae0a4dbd Allow to customize OAuth2AuthorizationRequestRedirectWebFilter in OAuth2LoginSpec 
Fixes gh-7466
 2019-09-26 17:19:32 -04:00
Joe Grandja 2a5bd6e719 Align Servlet ExchangeFilterFunction CoreSubscriber 
Fixes gh-7422
 2019-09-26 16:17:17 -04:00
Joe Grandja d3b7a47ef8 Polish gh-4442 2019-09-25 21:37:31 -04:00
Mark Heckler da9f027fa4 Add nonce to OIDC Authentication Request 
Fixes gh-4442
 2019-09-25 14:57:54 -04:00
Jesús Ascama ceab56f764 Fix AuthorizationPayloadInterceptor order using PayloadInterceptorOrder.AUTHORIZATION 
Fixes gh-7434
 2019-09-24 15:39:25 -05:00
Joe Grandja 9f18c2e21a OAuth2AuthorizationCodeGrantWebFilter matches on registered redirect-uri 
Fixes gh-7036
 2019-09-24 11:07:36 -04:00
Eleftheria Stein 98e75eb51a Fix Javadoc for anonymous 2019-09-23 11:06:28 -04:00
Rob Winch 00f8991fac Merge Remove Redudant Throws 
Fixes gh-7301
 2019-09-19 11:04:53 -05:00
Ebert Toribio 3a66191756 Add hasAnyAuthority method in AuthorizePayloadsSpec.Access 
See Fixes gh-7437

Co-authored-by: Eddú Meléndez <eddu.melendez@gmail.com>
 2019-09-18 21:17:09 -05:00
Onur Kagan Ozcan 034b5e9e93 Introduce LogoutSuccessEvent 
LogoutSuccessEvent is a simple AbstractAuthenticationEvent implementation which indicates successful logout.

By default, LogoutConfigurer will add a new LogoutHandler called LogoutSuccessEventPublishingLogoutHandler to publish this event.

This PR will also fix ConcurrentSessionFilter's composite logoutHandler, now will get LogoutHandler instances from LogoutConfigurer for consistency.

Fixes gh-2900
 2019-09-18 10:57:16 -05:00
Manuel Tejeda 9926ad68b8 add hasAnyRole method in AuthorizePayloadsSpec.Access 2019-09-18 07:59:20 -05:00
Jesús Ascama daf6b53e3a Add denyAll method in AuthorizePayloadsSpec.Access 
See gh-7437

Co-authored-by: Eddú Meléndez <eddu.melendez@gmail.com>
 2019-09-17 20:17:10 -05:00
Josh Cummings 05caf3d8fb
Use Jwt.Builder 
Fixes gh-7443
 2019-09-16 14:00:25 -06:00
Josh Cummings 1176d0cfdb
Polish DefaultFilters,Issue55Tests 
Formatted HttpSecurity and WebSecurity configuration stacks
Removed unnecessary code

Issue gh-4939
 2019-09-16 13:56:17 -06:00
kostya05983 950e6422a1
Migrate DefaultFilters,Issue55Tests groovy->java 
Issue gh-4939
 2019-09-16 13:37:22 -06:00
Josh Cummings 101e0a21a8 Bearer WebClient Filter Authentication Propagation 
Fixes: gh-7418
 2019-09-11 16:27:21 +01:00
Rob Winch 96d44cd4b7 Add Default RSocketSecurity 
Fixes gh-7361
 2019-09-09 16:10:55 -05:00
Rob Winch 5d0815bc76 Allow RSocketMessageHandlerITests to timeout 
Fixes gh-7415
 2019-09-09 16:10:50 -05:00
Rob Winch 6296e6e896 RSocketSecurity delegates to correct matcher 
Fixes gh-7414
 2019-09-09 16:09:23 -05:00
Rob Winch 1b699a49fb Polish RSocket packaging 
Fixes gh-7413
 2019-09-09 16:07:14 -05:00
Eleftheria Stein aa533c2565 Add missing javadoc to session fixation 2019-09-06 16:33:51 -04:00
Rob Winch 316380e622 Allow Custom PayloadInterceptor to be Added 
Fixes gh-7362
 2019-09-06 14:52:47 -05:00
Joe Grandja a60446836b OAuth2AuthorizeRequest supports attributes 
Fixes gh-7341
 2019-09-05 21:04:25 -04:00
Filip Hanik 08d50868c9
Merge pull request #7260 from fhanik/feature/saml2-sp-mvp 
Add SAML Service Provider Support
 2019-09-05 17:04:14 -07:00
Filip Hanik e9a44bc0ce HttpSecurity.saml2login() - MVP Core Code 
Implements minimal SAML 2.0 login/authentication functionality with the
following feature set:

  - Supports IDP initiated login at the default url of /login/saml2/sso/{registrationId}
  - Supports SP initiated login at the default url of /saml2/authenticate/{registrationId}
  - Supports basic java-configuration via DSL
  - Provides an integration sample using Spring Boot

Not implemented with this MVP

  - Single Logout
  - Dynamic Service Provider Metadata

Fixes gh-6019
 2019-09-05 14:40:08 -07:00
Rob Winch 9639962e27 Fix RSocket Package Tangle 
Issue gh-7360
 2019-09-05 16:27:57 -05:00
Rob Winch 7ad641d106 RSocket Tests use Available Port 
Issue gh-7360
 2019-09-05 09:16:07 -05:00
Josh Cummings 26a65249f9
Remove invalid characters 2019-09-05 04:32:34 -06:00
Rob Winch 5a4eded696 Add RSocket Support 
Fixes gh-7360
 2019-09-04 19:24:01 -05:00
Joe Grandja dcd997ea43 Add support for Resource Owner Password Credentials grant 
Fixes gh-6003
 2019-09-04 14:07:45 -04:00
Josh Cummings de672e3ae9
Polish oauth2ResourceServer() Error Messaging 
Fixes: gh-6876
 2019-09-04 11:49:22 -06:00
Josh Cummings 1fc5b27fa2
Update LogoutConfigurerClearSiteData Tests 
Issue gh-7347
 2019-09-04 03:30:37 -06:00
Josh Cummings 068f4f0147 Polish Opaque Token 
Use OAuth2AuthenticatedPrincipal
Use BearerTokenAuthentication
Update names to reflect more generic approach.

Fixes gh-7344
Fixes gh-7345
 2019-09-03 15:58:05 -06:00
Eddú Meléndez 8773c7994f Allow to set default securityContextRepository for each authentication mechanisms 
Fixes gh-7249
 2019-09-03 07:46:59 -06:00
kostya05983 f6c650db47
Replace Streams with Loops 
First version of replacing streams

fix wwwAuthenticate and codestyle

fix errors in implementation to pass tests

Fix review notes

Remove uneccessary final to align with cb

Short circuit way to authorize

Simplify error message, make code readably

Return error while duplicate key found

Delete check for duplicate, checkstyle issues

Return duplicate error

Fixes gh-7154
 2019-09-02 15:30:48 -06:00
Josh Cummings d6d0d89ff8
NamespaceRememberMeTests groovy->java 
Issue gh-4939
 2019-09-02 13:08:21 -06:00
Josh Cummings bf5b693549
NamespaceHttpOpenIDLoginTests groovy->java 
Issue gh-4939
 2019-08-30 15:54:43 -06:00
Lars Grefer 95511331fa fix checkstyle 2019-08-26 22:42:26 +02:00
watsta 2c2e8e5f24 Remove internal Optional usage in favor of null checks 
Issue gh-7155
 2019-08-26 09:27:40 -04:00
Lars Grefer 34dd5fea30 Remove redundant throws clauses 
Removes exceptions that are declared in a method's signature but never thrown by the method itself or its implementations/derivatives.
 2019-08-23 01:03:54 +02:00
Joe Grandja 46756d2e6b Introduce Reactive OAuth2AuthorizedClient Manager/Provider 
Fixes gh-7116
 2019-08-21 14:12:38 -04:00
John Lin 9876b66f99
Polish GlobalMethodSecurityConfiguration 
Initialize ExpressionBasedPreInvocationAdvice for
PreInvocationAuthorizationAdviceVoter only when needed.
 2019-08-17 16:35:30 -06:00
Rob Winch 71444ff5dc RequestCache ignores multipart requests 
Fixes gh-7060
 2019-08-15 09:21:41 -05:00
Rob Winch 08ea2348d6 Polish RequestCache ignores multipart requests 2019-08-15 09:20:45 -05:00
Ahmed Sayed 1ab05dae02 added test 2019-08-14 21:35:34 +02:00
Rob Winch abc90280e0
Add unbounid support in xml 
Add unbounid support in xml

Fixes gh-6011
 2019-08-14 10:05:49 -05:00
Lars Grefer cb4f3d2f44 Use UTF-8 for Java sources and XML 2019-08-14 08:47:00 -05:00
Eddú Meléndez 2e63def05b Add tests 2019-08-14 00:56:26 -05:00
Eddú Meléndez 93142f3e30 Remove unboundid dependency 2019-08-13 20:39:25 -05:00
Eddú Meléndez c03fb701ce Improve logic to pick embedded server 2019-08-13 20:36:46 -05:00
Eddú Meléndez 3511c0ea4f Update xsd 2019-08-13 20:17:51 -05:00
Josh Cummings 4ed197e515 Rename OAuth2TokenIntrospectionClient 
Renamed to OpaqueTokenIntrospector

Fixes gh-7245
 2019-08-12 18:05:28 -04:00
Rob Winch c1db1aad91
Cleanup Code Style Issues 
Cleanup Code Style Issues
 2019-08-12 13:06:49 -05:00
Eddú Meléndez 9b2af944fa Add unbounid support in xml 
Currently, spring-security provides apacheds integration by default. This
commit introduces a new `mode` in the `ldap-server` tag which allows to choose
beetween `apacheds` and `unboundid`. In order to keep backward compatibility
if `mode` is not set and apacheds jars are in the classpath apacheds is used
as a embedded ldap.

Fixes gh-6011
Currently, unboundid was added as a support for embbeded LDAP and it
is used on the Java Config. This commit introduces support from XML side.
Also, give the chance to users to move from apacheds to unboundid using
a new attribute `mode`.

Fixes gh-6011
 2019-08-10 19:07:45 -05:00
Francesco Chicchiriccò 0410bac559 Add support for oauth2Login().securityContextRepository(...) 
Fixes gh-7222
 2019-08-10 15:56:20 -04:00
Lars Grefer ff1070df36 remove redundant modifiers found by checkstyle 2019-08-10 00:18:56 +02:00
Lars Grefer bbefc491b2 unused imports 2019-08-09 16:59:07 -05:00
Lars Grefer 38de737663 Java 8: Statement lambda can be replaced with expression lambda 2019-08-09 16:59:07 -05:00
Lars Grefer 3a5d8ba696 Java 8: Collections.sort() can be replaced with List.sort() 2019-08-09 16:59:07 -05:00
Lars Grefer 91c846756e Java 5: Unnecessary Boxing 2019-08-09 16:59:07 -05:00
Lars Grefer 578d628774 'Collection.toArray()' call style 2019-08-09 16:57:31 -05:00
Lars Grefer 40bee457f9 Unnecessary enum modifier 2019-08-09 00:42:07 +02:00
Lars Grefer eddcd1622f Type parameter extends Object 
Reports any type parameters and wildcard type arguments explicitly declared to extend java.lang.Object.
 2019-08-09 00:40:13 +02:00
Lars Grefer fb39d9c255 Anonymous type can be replaced with lambda 2019-08-08 17:09:09 -04:00
Lars Grefer 05f42a4995 Remove unused imports 2019-08-08 14:22:31 -04:00
Josh Cummings 65f6025cef
Polish OAuth2LoginConfigurer 
Improve way of accessing ApplicationContext to ensure backward
compatibility.

Issue gh-7232
 2019-08-07 13:25:38 -06:00
Josh Cummings a00ad37168
OAuth2LoginConfigurer UserService Beans 
Fixes gh-7232
 2019-08-07 10:58:23 -06:00
Lars Grefer f5cd0ec302 Use try-with-resources instead of try-finally 2019-08-06 15:33:04 -05:00
Lars Grefer 2056834432 Cleanup unnecessary unboxing 
Unboxing is unnecessary under Java 5 and newer, and can be safely removed.
 2019-08-06 10:17:38 -04:00
Lars Grefer 2306d987e9 Cleanup unnecessary boxing 2019-08-06 10:17:38 -04:00
Eddú Meléndez 2c836a171a Add authenticationFailureHandler method in OAuth2LoginSpec 
Allow to customize the failure handler.

Fixes gh-7051
 2019-08-05 14:09:11 -05:00
Lars Grefer 776a4c3760 Use org.mockito.ArgumentMatchers in favor of org.mockito.Matchers 2019-08-03 12:28:37 -04:00
Eddú Meléndez 50adb6abcb Fix javadoc 2019-07-31 15:36:30 -04:00
Sam Simmons e88c5c0eee Fix CSRF session authentication strategy since version 2019-07-31 07:45:51 -05:00
Ahmed Sayed 0591403dea ignore Multipart requests in HttpSessionRequestCache.requestMatcher 2019-07-31 12:17:55 +02:00
Eleftheria Stein 0b4502b2c5 Remove exceptions from lambda security configuration 
Fixes: gh-7128
 2019-07-30 08:31:37 -05:00
Joe Grandja c05b0765c1 Introduce OAuth2AuthorizedClient Manager/Provider 
Fixes gh-6845
 2019-07-25 11:12:54 -04:00
Eleftheria Stein 7e845409f1 Fix Javadoc for headers configurer methods 
Fixes: gh-7123
 2019-07-24 09:11:44 -04:00
Eleftheria Stein a288ce4b00 Support nested builder in DSL for reactive apps 
Fixes: gh-7107
 2019-07-23 15:57:10 -05:00
Eleftheria Stein d5e5ac0503 Add JavaDoc to reactive oauth2ResourceServer 2019-07-18 10:48:47 -04:00
Eleftheria Stein fbf6d22343 Add JavaDoc to reactive oauth2Login 2019-07-18 08:49:08 -04:00
Édouard Hue e8dd1325fd Fixed misleading OAuth2 error messages 
Error messages sent by BearerTokenAccessDeniedHandler included
information about the scopes of the rejected token instead of
the scopes required by the resource.
* Removal of token scopes from error_description attribute.
* Removal of scope attribute from WWW-Authenticate response header.

Fixes gh-7089
 2019-07-18 07:01:33 -04:00
Eleftheria Stein b153d92b23 Fix JavaDoc for formLogin in ServerHttpSecurity 2019-07-18 06:23:04 -04:00
Michael Vitz 09e8ae42ed Allow configuration of SessionAuthenticationStrategy for CSRF 
Closes gh-5300
 2019-07-16 07:47:13 -05:00
Rob Winch ea54d9014d
DSL nested builder for HTTP security 
DSL nested builder for HTTP security

Fixes gh-5557
 2019-07-12 16:09:19 -05:00
Eleftheria Stein 7961b819aa Allow configuration of session fixation and concurrency through nested builder 
Issue: gh-5557
 2019-07-12 13:53:55 -04:00
Clement Ng 28855e9cd6 Changed docs to reflect that init should apply configurers 2019-07-10 11:54:56 -05:00
Lars Grefer 3ea9d376b2 Cleanup explicit type arguments 2019-07-10 09:32:41 -05:00
Lars Grefer c5b5cc507c Cleanup redundant type casts 2019-07-10 09:31:09 -05:00
Eleftheria Stein 4b2539df10 Allow configuration of oauth2 resource server through nested builder 
Issue: gh-5557
 2019-07-09 16:11:26 -04:00
Eleftheria Stein 415760838f Allow configuration of oauth2 client through nested builder 
Issue: gh-5557
 2019-07-09 16:03:46 -04:00
Eleftheria Stein e47389e60b Allow configuration of oauth2 login through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein bf1bbd14e9 Allow configuration of openid login through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein c3dad06ea6 Allow configuration of request matchers through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 1ad9f15e19 Allow configuration of requires channel through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein ae8e12f049 Allow configuration of anonymous through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein a5943fbafb Allow configuration of servlet api through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 04e0dcfe61 Allow configuration of security context through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 81d3cf1e7b Allow configuration of authorize requests through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 1445d1b012 Allow configuration of request cache through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein fcb119b94e Allow configuration of remember me through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein ae9eb6f56b Allow configuration of x509 through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein bfc9538da1 Allow configuration of jee through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 86f0f84740 Allow configuration of port mapper through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 6fbea88e1e Allow configuration of session management through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 6fd515813c Allow configuration of cors through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein a9a1f8ee53 Allow configuration of form login through nested builder 
Issue: gh-5557
 2019-07-09 15:37:28 -04:00
Eleftheria Stein 758397f102 Allow configuration of headers through nested builder 
Issue: gh-5557
 2019-07-09 15:35:37 -04:00
Eleftheria Stein 6986cf3ef3 Allow configuration of csrf through nested builder 
Issue: gh-5557
 2019-07-09 10:14:18 -04:00
Eleftheria Stein 1a31376dda Allow configuration of exception handling through nested builder 
Issue: gh-5557
 2019-07-09 10:14:18 -04:00
Eleftheria Stein 92314b0956 Allow configuration of logout through nested builder 
Issue: gh-5557
 2019-07-09 10:14:18 -04:00
Eleftheria Stein d66d895e60 Migrate ServletApiConfigurerTests groovy->java 
Issue: gh-4939
 2019-07-04 12:14:49 -04:00
Clement Ng 491da9db03 Added OAuth2TokenAttributes to wrap attributes 
To simplify access to OAuth 2.0 token attributes

Fixes gh-6498
 2019-07-02 07:45:56 -06:00
Josh Cummings ee8182dceb
NamespaceSessionManagementTests groovy->java 
Issue: gh-4939
 2019-07-02 07:34:36 -06:00
Tadaya Tsuyukubo 7782e29a58 Allow custom ReactiveAuthenticationManager for basic and form auth 
Prior to this change, "HttpBasicSpec#authenticationManager" and
"FormLoginSpec#authenticationManager" were always overridden by
"ServerHttpSecurity#authenticationManager".

This commit makes sure override only happens when custom authentication
manager was not specified.

Fixes: gh-5660
 2019-06-28 11:04:21 -05:00
Eleftheria Stein 39ba1006ba Migrate FormLoginConfigurerSpec groovy->java 
Issue: gh-4939
 2019-06-27 11:53:32 -04:00
Eleftheria Stein 3c240d0ce3 Migrate DefaultLoginPageConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-24 10:38:20 -04:00
Eleftheria Stein 12da990b6b Allow configuration of HTTP basic through nested builder 
Issue: gh-5557
Fixes: gh-6885
 2019-06-20 13:58:13 -05:00
Joe Grandja 6e76df8f1d Revert OAuth2AuthorizationCodeGrantWebFilter works with /{action}/ 
Issue #5856
Commit 385bdfc055

NOTE: This commit 'partially' reverts #5856. Only the ServerWebExchangeMatcher for OAuth2LoginSpec is reverted.

Fixes gh-6890
 2019-06-19 16:06:38 -04:00
Joe Grandja 06943d2d39 Revert OAuth2LoginAuthenticationFilter should ignore authenticated requests 
Issue #5915
Commit 93ca455405

Fixes gh-6890
 2019-06-19 16:06:38 -04:00
Rafiullah Hamedy f6ed1db702 Introduced ReactiveAuthenticationManagerResolver 
Suitable for multi-tenant reactive applications needing to branch
authentication strategies based on request details.
 2019-06-13 08:52:19 -06:00
Eleftheria Stein 759e47ba84 Migrate OpenIDLoginConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-12 15:23:47 -04:00
Eleftheria Stein e6ace0891f Migrate X509ConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-11 17:31:53 -04:00
Eleftheria Stein 6ad46da426 Migrate ExpressionUrlAuthorizationConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-11 15:46:37 -04:00
Eleftheria Stein 56b716d9f7 Migrate SessionManagementConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-11 09:24:42 -04:00
Eleftheria Stein 1ec040e554 Disable bean proxying in configuration classes 
Fixes gh-6967
 2019-06-10 20:40:06 -05:00
Eleftheria Stein 371a3b9c7f Migrate CorsConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-10 16:36:38 -04:00
Eleftheria Stein-Kousathana c4dd800653
Merge pull request #6944 from eleftherias/gh-4939-channel-security-groovy-to-java 
Migrate ChannelSecurityConfigurerTests groovy->java
 2019-06-10 15:28:42 -04:00
Vishal Raj b6e8997e95 Updates OAuth2ResourceServer configuration tests 
Refactores collapsed imports
 2019-06-07 11:56:03 -06:00
Eleftheria Stein d285c6ab4c Migrate JeeConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-07 12:05:25 -05:00
Eleftheria Stein 8e6db95048 Fix HttpSecurity Javadoc for jee() method 
Fixes: gh-6958
 2019-06-07 11:21:05 -05:00
Daniel Meier fcd8a38f0b Add success handler modification of OAuth2LoginSpec 
Add the ability to modify the success handler used in OAuth2LoginSpec. The
default success handler remains unchanged.

Closes #6863
 2019-06-05 13:25:34 -04:00
Eleftheria Stein abe7da6b85 Migrate RememberMeConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-04 15:12:11 -05:00
Eleftheria Stein 06d3b60947 Replace bean method calls with injection 
This is so that our configuration classes do not rely on CGLIB to proxy bean methods.

Fixes gh-6818
 2019-06-03 15:45:28 -05:00
Eleftheria Stein 4f042a4ff1 Migrate ChannelSecurityConfigurerTests groovy->java 
Issue: gh-4939
 2019-06-03 11:09:49 -04:00
Eleftheria Stein be651d9d16 Migrate CsrfConfigurerTests groovy->java 
Issue: gh-4939
 2019-05-31 13:18:55 -06:00
Eleftheria Stein 6148eef689 Migrate SecurityContextConfigurerTests groovy->java 
Issue: gh-4939
 2019-05-31 12:07:28 -06:00
Eleftheria Stein 16b0d782f4 Migrate HeadersConfigurerTests groovy->java 
Issue: gh-4939
 2019-05-31 11:57:01 -06:00
Eleftheria Stein 7806ac21aa Migrate RequestMatcherConfigurerTests groovy->java 
Issue: gh-4939
 2019-05-31 11:48:34 -06:00
Florian Aumeier 9fe8949883 Add @transient to OAuth2IntrospectionAuthenticationToken 
fixes gh-6829
 2019-05-29 08:42:09 -06:00
Eleftheria Stein e15922322e Migrate LogoutConfigurerTests groovy->java 
Issue: gh-4939
 2019-05-27 22:53:51 -06:00
Eleftheria Stein d660084538 Migrate HttpBasicConfigurerTests groovy->java 
Issue: gh-4939
 2019-05-23 09:24:58 -06:00
Eleftheria Stein f5f965b6aa Fix JavaDoc for defaultSuccessUrl 
Fixes gh-3337
 2019-05-17 10:50:30 -05:00
Josh Cummings 1ed9e3a1c6
Resource Server AuthenticationManager 
Making the authentication manager for jwt() and opaqueToken()
configurable.

Fixes: gh-6832
Fixes: gh-6849
 2019-05-07 17:04:51 -06:00
Joe Grandja 5aa50500cf oauth2Login does not auto-redirect for XHR request 
Fixes gh-6812
 2019-05-02 16:04:09 -04:00
Tadaya Tsuyukubo aef3f514fe Set "rolePrefix" in ReactiveMethodSecurityConfiguration 
Currently, `GrantedAuthorityDefaults` is not considered in
`ReactiveMethodSecurityConfiguration`.
This commit updates the configuration to be aware of
`GrantedAuthorityDefaults` and update `rolePrefix` when the bean is
available.

Also, use the same instance of `DefaultMethodSecurityExpressionHandler`
when constructing `ExpressionBasedAnnotationAttributeFactory`.
 2019-05-02 10:46:27 -05:00
Josh Cummings cf0c5f9026
Various NamespaceHttp*Tests groovy->java 
Issue: gh-4939
 2019-04-29 23:36:06 -06:00
Josh Cummings b1195e7789 Opaque Token Intermediate Type 
Introducing OAuth2TokenIntrospectionClient and also
ReactiveOAuth2TokenIntrospectionClient as configuration points.

The DSL looks in the application context for these types in the same
way it looks for JwtDecoder and ReactiveJwtDecoder, and exposes
similar configuration methods.

Fixes: gh-6632
 2019-04-29 13:39:53 -06:00
Alexey Nesterov 9a67441507 Add x509 support for Reactive Security 
[gh #5038]
 2019-04-26 12:15:18 -05:00
Joe Grandja 5aacd0c955 Expose bean setters in @Configuration used by @EnableWebFluxSecurity 
Fixes gh-6624
 2019-04-23 11:46:09 -04:00
Josh Cummings 1c25fe26c9 Introduce Support for Reading RSA Keys 
Fixes: gh-6494
 2019-04-13 19:39:11 -06:00
Dan Zheng 570eb01733 review phase1 2019-04-13 19:22:44 -06:00
Dan Zheng 678e0b19e0 Introduce @CurrentSecurityContext for method arguments 2019-04-13 19:22:44 -06:00
Denis Babochenko 21f7148e7a Update filters documentation 
Fixes: gh-5553
 2019-04-13 19:21:10 -06:00
Josh Cummings 7e8aadeb96 Multi-tenancy for Resource Server 
Fixes: gh-5351
 2019-03-29 15:00:48 -06:00
Joe Grandja 4e9c37b1ae Manual URL Cleanup 2019-03-29 13:24:11 -04:00
Rafiullah Hamedy 3617fd257e Introduced placeholder support for Headers tag attributes 
Added the functionality to allow the disabled and defaults-disabled
attribute of <header> tag to accept a placeholder and resolve it during
parsing.

- Updated the spring-security .rnc files starting from 4.2 up to 5.2
with xsd:token type instead of boolean
- Added unit tests for headers.disabled and headers.defaults-disabled
attributes with placeholder
- Modified the HeadersBeanDefinitionParser to support resolving
placeholders
- Updated spring.schemas to point to latest spring-security-5.2.xsd

Fixes gh-6547
 2019-03-21 17:25:48 -06:00