ba50c50b4b
Add remaining methods from ExpressionUrlAuthorizationConfigurer to MessageMatcherDelegatingAuthorizationManager
...
- Added fullyAuthenticated
- Added rememberMe
- Added anonymous
Closes gh-11509
2022-08-16 15:14:08 -06:00
5ecd513a57
Add remaining methods from ExpressionUrlAuthorizationConfigurer to MessageMatcherDelegatingAuthorizationManager
...
- Added fullyAuthenticated
- Added rememberMe
- Added anonymous
Closes gh-11509
2022-08-16 15:12:47 -06:00
5cf42b1f2e
Defer CsrfFilter Session Access
...
Closes gh-11456
2022-08-16 13:48:20 -05:00
8ad20b1768
Add CsrfFilter.csrfRequestAttributeName
...
Previously the CsrfToken was set on the request attribute with the name
equal to CsrfToken.getParameterName(). This didn't really make a lot of
sense because the CsrfToken.getParameterName() is intended to be used as
the HTTP parameter that the CSRF token was provided. What's more is it
meant that the CsrfToken needed to be read for every request to place it
as an HttpServletRequestAttribute. This causes unnecessary HttpSession
access which can decrease performance for applications.
This commit allows setting CsrfFilter.csrfReqeustAttributeName to
remove the dual purposing of CsrfToken.parameterName and to allow deferal
of reading the CsrfToken to prevent unnecessary HttpSession access.
Issue gh-11699
2022-08-16 13:47:31 -05:00
5b64526ba9
Add CsrfFilter.csrfRequestAttributeName
...
Previously the CsrfToken was set on the request attribute with the name
equal to CsrfToken.getParameterName(). This didn't really make a lot of
sense because the CsrfToken.getParameterName() is intended to be used as
the HTTP parameter that the CSRF token was provided. What's more is it
meant that the CsrfToken needed to be read for every request to place it
as an HttpServletRequestAttribute. This causes unnecessary HttpSession
access which can decrease performance for applications.
This commit allows setting CsrfFilter.csrfReqeustAttributeName to
remove the dual purposing of CsrfToken.parameterName and to allow deferal
of reading the CsrfToken to prevent unnecessary HttpSession access.
Issue gh-11699
2022-08-15 17:07:02 -05:00
002a770f13
NamespaceLdapAuthenticationProviderTests use Dynamic Port
...
Closes gh-11710
2022-08-15 15:26:12 -05:00
ce778b0e20
NamespaceLdapAuthenticationProviderTests use Dynamic Port
...
Closes gh-11710
2022-08-15 15:25:15 -05:00
425b3501b7
Remove `@Configuration` from `@Enable*` Annotations
...
This removes `@Configuration` from all `@Enable` Annotations and explicitly
adds `@Configuration` to wherever the `@Enable*` Annotations are used.
Closes gh-11653
2022-08-09 17:00:24 -05:00
a5069d7e35
Fix Add @Configuration to @Enable*Security Usage
...
Issue gh-6613
2022-08-09 17:00:16 -05:00
2e66b9f6cc
Allow customization of redirect strategy
...
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.
Closes gh-11373
2022-08-08 15:44:01 -05:00
efaee4e56b
Allow customization of redirect strategy
...
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.
Closes gh-11373
2022-08-08 15:35:49 -05:00
ed58ac7d78
Add Conditions to Generating AuthnRequest
...
Closes gh-11657
2022-08-03 17:49:48 -06:00
9e8a04d414
Polish Tests
...
Issue gh-11657
2022-08-03 17:49:46 -06:00
c2d79fcbd6
Add Conditions to Generating AuthnRequest
...
Closes gh-11657
2022-08-03 17:34:31 -06:00
aa225943d2
Polish Tests
...
Issue gh-11657
2022-08-03 17:34:26 -06:00
f8971742f2
Remove FilterSecurityInterceptor from WebSecurity
...
Closes gh-11325
2022-08-02 15:34:02 -03:00
040111ae9e
Remove Configuration meta-annotation from Enable* annotations
...
Before, Spring Security's @Enable* annotations were meta-annotated with @Configuration.
While convenient, this is not consistent with the rest of the Spring projects and most notably
Spring Framework's @Enable annotations. Additionally, the introduction of support for
@Configuration(proxyBeanMethods=false) in Spring Framework provides a compelling reason to
remove @Configuration meta-annotation from Spring Security's @Enable annotations and allow
users to opt into their preferred configuration mode.
Closes gh-6613
Signed-off-by: Joshua Sattler <joshua.sattler@mailbox.org>
2022-07-30 03:48:42 +02:00
07ea139ebf
Polish HttpSecurity
2022-07-29 17:42:39 -05:00
67544f36f9
Remove references to WebSecurityConfigurerAdapter
...
* AbstractAuthenticationFilterConfigurer
* DefaultLoginPageConfigurer
* EnableGlobalAuthentication
* FormLoginConfigurer
* HeadersConfigurer
* HttpSecurity
* OpenIDLoginConfigurer
* RememberMeConfigurer
* WebSecurity
* WebSecurityConfiguration
* WebSecurityConfigurer
* X509Configurer
Closes gh-11288
2022-07-29 17:42:39 -05:00
05725af4d8
Remove references to WebSecurityConfigurerAdapter in EnableWebSecurity
...
Closes gh-11277
2022-07-29 17:42:39 -05:00
15f525c614
Polish HttpSecurity
2022-07-29 17:42:20 -05:00
0c0c75ce22
Remove references to WebSecurityConfigurerAdapter
...
* AbstractAuthenticationFilterConfigurer
* DefaultLoginPageConfigurer
* EnableGlobalAuthentication
* FormLoginConfigurer
* HeadersConfigurer
* HttpSecurity
* OpenIDLoginConfigurer
* RememberMeConfigurer
* WebSecurity
* WebSecurityConfiguration
* WebSecurityConfigurer
* X509Configurer
Closes gh-11288
2022-07-29 17:42:20 -05:00
9861769b02
Remove references to WebSecurityConfigurerAdapter in EnableWebSecurity
...
Closes gh-11277
2022-07-29 17:42:20 -05:00
7f2c797086
Add Deprecated annotation to WebSecurity#securityInterceptor
...
Closes gh-11634
2022-07-27 14:39:56 -03:00
e5ae35ab71
Add Deprecated annotation to WebSecurity#securityInterceptor
...
Closes gh-11634
2022-07-27 14:39:33 -03:00
1f26f8c419
Update spring-data-jpa to 3.0.0-M5
...
Closes gh-11540
2022-07-15 14:37:24 -03:00
0c14a36ad6
Update Kotlin to 1.7.10
...
Closes gh-11374, gh-11534
2022-07-15 14:10:52 -03:00
d27322c9e0
Polish HttpSecurity Formatting
...
Issue gh-11360
2022-07-14 13:00:08 -06:00
c4b0e9bd74
Add remaining methods from ExpressionUrlAuthorizationConfigurer to AuthorizeHttpRequestsConfigurer
...
- Added fullyAuthenticated
- Added rememberMe
- Added anonymous
Closes gh-11360
2022-07-14 13:00:07 -06:00
5dff157755
Polish HttpSecurity Formatting
...
Issue gh-11360
2022-07-14 12:50:40 -06:00
400cd60368
Add remaining methods from ExpressionUrlAuthorizationConfigurer to AuthorizeHttpRequestsConfigurer
...
- Added fullyAuthenticated
- Added rememberMe
- Added anonymous
Closes gh-11360
2022-07-14 12:48:39 -06:00
42683693c0
Remove deprecated CustomUserTypesOAuth2UserService
...
Closes gh-11511
2022-07-14 14:28:41 -04:00
35fc437559
Add AuthorizationManager for protect-pointcut
...
Closes gh-11323
2022-07-14 09:25:49 -06:00
9b43316f4d
Polish InterceptMethodsBeanDefinitionDecorator
...
Issue gh-11328
2022-07-14 09:25:16 -06:00
a3326fc0ee
Remove deprecated implicit authorization grant type
...
Closes gh-11506
2022-07-14 10:05:15 -04:00
624fdfa731
Add AuthorizationManager for protect-pointcut
...
Closes gh-11323
2022-07-13 17:58:16 -06:00
51475e2583
Polish InterceptMethodsBeanDefinitionDecorator
...
Issue gh-11328
2022-07-13 17:57:38 -06:00
d3b8bacc3c
Polish InterceptMethodsBeanDefinitionDecorator
2022-07-13 11:38:50 -05:00
d85abc7bbb
Update javadoc in CommonOAuth2Provider
...
Closes gh-11490
2022-07-13 11:20:04 -04:00
7abea4a964
Add RuntimeHints suffix for RuntimeHintsRegistrar
...
Closes gh-11497
2022-07-13 10:14:43 -03:00
177baba8c9
RuntimeHintsPredicates moved to predicate package
2022-07-12 16:00:50 -04:00
6455e98745
FilterSecurityInterceptor applies to every request by default
...
Closes gh-11466
2022-07-12 10:53:03 -03:00
60652afb32
Polish InterceptMethodsBeanDefinitionDecorator
...
Issue gh-11328
2022-07-11 16:54:59 -06:00
7560a32460
Polish InterceptMethodsBeanDefinitionDecorator
...
Issue gh-11328
2022-07-11 16:39:41 -06:00
d2d5313bba
Fix Formatting
...
Issue gh-11327
2022-07-08 09:21:53 -05:00
c9a3d21b9b
Add Configuration Test
...
Issue gh-11327
2022-07-07 14:46:37 -06:00
e8a7b654b4
Add Configuration Test
...
Issue gh-11327
2022-07-07 14:42:07 -06:00
01ffc93062
Add AuthorizationFilter to filter chain validator
...
Closes gh-11327
2022-07-07 14:40:53 -06:00
ec8c13392c
Clarify variable names
...
Issue gh-11327
2022-07-07 14:26:40 -06:00
d27d431bbc
Add AuthorizationFilter to filter chain validator
...
Closes gh-11327
2022-07-07 13:52:36 -06:00
cdafa4ee21
Clarify variable names
...
Issue gh-11327
2022-07-07 13:38:42 -06:00
0c48b6bc7f
Use relative schema location for tests
...
Issue gh-11328
Issue gh-11353
Issue gh-11365
2022-07-07 13:03:20 -05:00
696da87478
Use relative schema location for tests
...
Issue gh-11328
Issue gh-11353
Issue gh-11365
2022-07-07 13:00:04 -05:00
148c926de0
Support AuthorizationManager for intercept-methods Element
...
Closes gh-11328
2022-07-06 13:01:57 -06:00
74a007dc91
Support AuthorizationManager for intercept-methods Element
...
Closes gh-11328
2022-07-06 12:54:05 -06:00
d96b4a0463
Set the useTrailingSlashMatch to true for tests
...
The Spring MVC changed the default behavior for trailing slash match
with https://github.com/spring-projects/spring-framework/issues/28552 .
This causes failures in Spring Security's tests.
Setting the `useTrailingSlashMatch` to `true` ensures that Spring
Security will work for users who have modified the default configuration.
Specifing the request mapper with trailing slash path ensures that the tests
are successful when default behavior is used.
Closes gh-11451
2022-07-05 11:29:36 -06:00
05b788d1ac
Use SecurityContextHolderStrategy for Concurrency Filter
...
Issue gh-11060
Issue gh-11061
2022-06-28 15:33:05 -06:00
03a5c3b08a
Use SecurityContextHolderStrategy for Concurrency Filter
...
Issue gh-11060
Issue gh-11061
2022-06-28 15:32:05 -06:00
d24a89ad53
Pick up SecurityContextHolderStrategy for WebClient integration
...
Issue gh-11061
2022-06-28 15:07:16 -06:00
e8723f1f43
Pick up SecurityContextHolderStrategy for WebClient integration
...
Issue gh-11061
2022-06-28 14:58:53 -06:00
a218d3e140
Use SecurityContextHolderStrategy for Async Requests
...
Issue gh-11060
Issue gh-11061
2022-06-28 14:56:55 -06:00
27de315e5e
Use SecurityContextHolderStrategy for Async Requests
...
Issue gh-11060
Issue gh-11061
2022-06-28 14:46:52 -06:00
83b3bb3209
Add SecurityContextHolderStrategy to Pre-authenticated scenarios
...
Issue gh-11060
Issue gh-11061
2022-06-28 12:10:07 -06:00
97cb2a7d91
Polish SecurityContextHolderStrategy XML Configuration for Defaults
...
Issue gh-11061
2022-06-28 12:09:56 -06:00
98995f2225
Add SecurityContextHolderStrategy to Pre-authenticated scenarios
...
Issue gh-11060
Issue gh-11061
2022-06-28 12:04:37 -06:00
b3be35da31
Polish SecurityContextHolderStrategy XML Configuration for Defaults
...
Issue gh-11061
2022-06-28 12:04:37 -06:00
944f565c16
Use SecurityContextHolderStrategy for Remember-me
...
Issue gh-11060
Isuse gh-11061
2022-06-28 11:09:38 -06:00
4a2d77d3f2
Use SecurityContextHolderStrategy for Remember-me
...
Issue gh-11060
Isuse gh-11061
2022-06-28 11:08:57 -06:00
b316a3217b
Add SecurityContextHolderStrategy for Jaas
...
Issue gh-11060
Issue gh-11061
2022-06-28 09:35:54 -06:00
ee66850aed
Add SecurityContextHolderStrategy for Jaas
...
Issue gh-11060
Issue gh-11061
2022-06-28 09:26:05 -06:00
bffe08465a
Add SecurityContextHolderStrategy XML Configuration for Messaging
...
Issue gh-11061
2022-06-27 16:24:27 -06:00
484f35ca39
Add SecurityContextHolderStrategy Java Configuration for Messaging
...
Issue gh-11061
2022-06-27 16:17:29 -06:00
74167d62b1
Add SecurityContextHolderStrategy XML Configuration for Messaging
...
Issue gh-11061
2022-06-27 15:55:28 -06:00
9292a13146
Add SecurityContextHolderStrategy Java Configuration for Messaging
...
Issue gh-11061
2022-06-27 15:55:28 -06:00
5e4e7abf15
Add SecurityContextHolderStrategy XML Configuration for Method Security
...
Issue gh-11061
2022-06-27 13:40:55 -06:00
74d646f569
Add SecurityContextHolderStrategy Java Configuration for Method Security
...
Issue gh-11061
2022-06-27 13:17:46 -06:00
ef29d3944e
Polish SecurityContextHolderStrategy Java Configuration for Defaults
...
Issue gh-11061
2022-06-27 13:17:44 -06:00
c29b91cec7
Polish SecurityContextHolderStrategy XML Configuration for Defaults
...
Issue gh-11061
2022-06-27 13:17:43 -06:00
652c35db2f
Add SecurityContextHolderStrategy XML Configuration for OAuth2
...
Issue gh-11061
2022-06-27 13:05:13 -06:00
1d22316574
Add SecurityContextHolderStrategy Java Configuration for OAuth2
...
Issue gh-11061
2022-06-27 13:05:13 -06:00
6c16ac101a
Add SecurityContextHolderStrategy XML Configuration for Saml2
...
Issue gh-11061
2022-06-27 13:05:12 -06:00
97253c9293
Add SecurityContextHolderStrategy Java Configuration for Saml2
...
Issue gh-11061
2022-06-27 13:05:11 -06:00
9cd7c7b046
Add SecurityContextHolderStrategy XML Configuration for Method Security
...
Issue gh-11061
2022-06-27 13:05:07 -06:00
da57bac061
Add SecurityContextHolderStrategy Java Configuration for Method Security
...
Issue gh-11061
2022-06-27 13:03:11 -06:00
fa0086d3b0
Polish SecurityContextHolderStrategy Java Configuration for Defaults
...
Issue gh-11061
2022-06-27 13:01:22 -06:00
8d681b3b80
Polish SecurityContextHolderStrategy XML Configuration for Defaults
...
Issue gh-11061
2022-06-27 13:00:20 -06:00
a8c30f79e6
Add Core, MVC and MethodSecurity runtime hints
...
Closes gh-11431
2022-06-27 09:25:49 -03:00
150b81d008
Add SecurityContextHolderStrategy XML Configuration for Defaults
...
Issue gh-11061
2022-06-17 12:21:10 -06:00
ce218c78f9
Add SecurityContextHolderStrategy Java Configuration for Defaults
...
Issue gh-11061
2022-06-17 11:58:38 -06:00
2a70707c35
Add SecurityContextHolderStrategy XML Configuration for Defaults
...
Issue gh-11061
2022-06-17 11:28:10 -06:00
2c09a300b6
Add SecurityContextHolderStrategy Java Configuration for Defaults
...
Issue gh-11061
2022-06-17 11:28:10 -06:00
79c2b8709b
Allow form login when single OAuth2 Provider is configured
...
Closes gh-6802
2022-06-15 14:05:55 -05:00
a061191bd2
Allow form login when single OAuth2 Provider is configured
...
Closes gh-6802
2022-06-15 13:42:06 -05:00
d18291676f
Update copyright year
...
Issue gh-11372
2022-06-15 13:14:07 -05:00
c7df39a3e6
Fix tests using root cause for exception messages
...
Closes gh-11372
2022-06-14 17:12:15 -05:00
3ca4b06612
Support multiple SingleLogoutService bindings.
...
Closes gh-11286
2022-06-09 12:56:16 -06:00
89989722d0
Support multiple SingleLogoutService bindings.
...
Closes gh-11286
2022-06-09 12:50:33 -06:00
f4049c18b1
add SAML authentication request support to login configurer
...
Closes gh-8873
2022-06-06 08:05:33 -06:00
4d65d96b8a
Fix saml2Tests always running after a single test
...
This commit makes the check task depend on the saml2Tests task.
The test task was also configured to run after saml2Tests, to make sure that the
compileTestJava runs after the compileSaml2TestJava
Issue gh-10816
2022-06-03 11:22:46 -03:00
3dd54bcda7
Run SAML 2.0 tests in an exclusive task
...
Issue gh-10816
2022-06-02 19:24:42 +02:00
Evgeniy Cheban
Rob Winch
Igor Bolic
Josh Cummings
Marcus Da Coregio
Joshua Sattler
Steve Riesenberg
Anbu Sampath
Joe Grandja
Jared Rufer
Houssem BELHADJ AHMED