Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Upgrade to Spring Security 5.4.0-SNAPSHOT

Browse Source 
See gh-22668
This commit is contained in:
Brian Clozel
2020-08-04 13:27:04 +02:00
parent 94148e9b54
commit 3354e0f030
5 changed files with 32 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyRegistrationConfiguration.java
View File

@@ -20,7 +20,6 @@ import java.io.InputStream;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.interfaces.RSAPrivateKey;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;
@@ -34,8 +33,7 @@ import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.Resource;
import org.springframework.security.converter.RsaKeyConverters;
import org.springframework.security.saml2.credentials.Saml2X509Credential;
import org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType;
import org.springframework.security.saml2.core.Saml2X509Credential;
import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
@@ -69,15 +67,19 @@ class Saml2RelyingPartyRegistrationConfiguration {
boolean signRequest = properties.getIdentityprovider().getSinglesignon().isSignRequest();
validateSigningCredentials(properties, signRequest);
RelyingPartyRegistration.Builder builder = RelyingPartyRegistration.withRegistrationId(id);
builder.assertionConsumerServiceUrlTemplate(
builder.assertionConsumerServiceLocation(
"{baseUrl}" + Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI);
builder.providerDetails(
(details) -> details.webSsoUrl(properties.getIdentityprovider().getSinglesignon().getUrl()));
builder.providerDetails((details) -> details.entityId(properties.getIdentityprovider().getEntityId()));
builder.providerDetails(
(details) -> details.binding(properties.getIdentityprovider().getSinglesignon().getBinding()));
builder.providerDetails((details) -> details.signAuthNRequest(signRequest));
builder.credentials((credentials) -> credentials.addAll(asCredentials(properties)));
builder.assertingPartyDetails((details) -> {
details.singleSignOnServiceLocation(properties.getIdentityprovider().getSinglesignon().getUrl());
details.entityId(properties.getIdentityprovider().getEntityId());
details.singleSignOnServiceBinding(properties.getIdentityprovider().getSinglesignon().getBinding());
details.wantAuthnRequestsSigned(signRequest);
});
builder.signingX509Credentials((credentials) -> properties.getSigning().getCredentials().stream()
.map(this::asSigningCredential).forEach(credentials::add));
builder.assertingPartyDetails((details) -> details
.verificationX509Credentials((credentials) -> properties.getIdentityprovider().getVerification()
.getCredentials().stream().map(this::asVerificationCredential).forEach(credentials::add)));
return builder.build();
}
@@ -88,25 +90,17 @@ class Saml2RelyingPartyRegistrationConfiguration {
}
}
private List<Saml2X509Credential> asCredentials(Registration properties) {
List<Saml2X509Credential> credentials = new ArrayList<>();
properties.getSigning().getCredentials().stream().map(this::asSigningCredential).forEach(credentials::add);
properties.getIdentityprovider().getVerification().getCredentials().stream().map(this::asVerificationCredential)
.forEach(credentials::add);
return credentials;
}
private Saml2X509Credential asSigningCredential(Signing.Credential properties) {
RSAPrivateKey privateKey = readPrivateKey(properties.getPrivateKeyLocation());
X509Certificate certificate = readCertificate(properties.getCertificateLocation());
return new Saml2X509Credential(privateKey, certificate, Saml2X509CredentialType.SIGNING,
Saml2X509CredentialType.DECRYPTION);
return new Saml2X509Credential(privateKey, certificate, Saml2X509Credential.Saml2X509CredentialType.SIGNING,
Saml2X509Credential.Saml2X509CredentialType.DECRYPTION);
}
private Saml2X509Credential asVerificationCredential(Verification.Credential properties) {
X509Certificate certificate = readCertificate(properties.getCertificateLocation());
return new Saml2X509Credential(certificate, Saml2X509CredentialType.ENCRYPTION,
Saml2X509CredentialType.VERIFICATION);
return new Saml2X509Credential(certificate, Saml2X509Credential.Saml2X509CredentialType.ENCRYPTION,
Saml2X509Credential.Saml2X509CredentialType.VERIFICATION);
}
private RSAPrivateKey readPrivateKey(Resource location) {

2
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java
View File

@@ -105,7 +105,7 @@ class ReactiveOAuth2ResourceServerAutoConfigurationTests {
"spring.security.oauth2.resourceserver.jwt.jws-algorithm=RS512")
.run((context) -> {
NimbusReactiveJwtDecoder nimbusReactiveJwtDecoder = context.getBean(NimbusReactiveJwtDecoder.class);
assertThat(nimbusReactiveJwtDecoder).extracting("jwtProcessor.arg$2")
assertThat(nimbusReactiveJwtDecoder).extracting("jwtProcessor.arg$2.arg$1.jwsAlgs")
.matches((algorithms) -> ((Set<JWSAlgorithm>) algorithms).contains(JWSAlgorithm.RS512));
});
}

6
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java
View File

@@ -98,7 +98,8 @@ class OAuth2ResourceServerAutoConfigurationTests {
JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class);
Object processor = ReflectionTestUtils.getField(jwtDecoder, "jwtProcessor");
Object keySelector = ReflectionTestUtils.getField(processor, "jwsKeySelector");
assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlg", JWSAlgorithm.RS256);
assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlgs",
Collections.singleton(JWSAlgorithm.RS256));
});
}
@@ -111,7 +112,8 @@ class OAuth2ResourceServerAutoConfigurationTests {
JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class);
Object processor = ReflectionTestUtils.getField(jwtDecoder, "jwtProcessor");
Object keySelector = ReflectionTestUtils.getField(processor, "jwsKeySelector");
assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlg", JWSAlgorithm.RS384);
assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlgs",
Collections.singleton(JWSAlgorithm.RS384));
assertThat(getBearerTokenFilter(context)).isNotNull();
});
}

16
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyAutoConfigurationTests.java
View File

@@ -80,16 +80,18 @@ public class Saml2RelyingPartyAutoConfigurationTests {
this.contextRunner.withPropertyValues(getPropertyValues()).run((context) -> {
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
assertThat(registration.getProviderDetails().getWebSsoUrl())
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceLocation())
.isEqualTo("https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php");
assertThat(registration.getProviderDetails().getEntityId())
assertThat(registration.getAssertingPartyDetails().getEntityId())
.isEqualTo("https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php");
assertThat(registration.getAssertionConsumerServiceUrlTemplate())
assertThat(registration.getAssertionConsumerServiceLocation())
.isEqualTo("{baseUrl}" + Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI);
assertThat(registration.getProviderDetails().getBinding()).isEqualTo(Saml2MessageBinding.POST);
assertThat(registration.getProviderDetails().isSignAuthNRequest()).isEqualTo(false);
assertThat(registration.getSigningCredentials()).isNotNull();
assertThat(registration.getVerificationCredentials()).isNotNull();
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding())
.isEqualTo(Saml2MessageBinding.POST);
assertThat(registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()).isEqualTo(false);
assertThat(registration.getSigningX509Credentials()).isNotNull();
assertThat(registration.getAssertingPartyDetails().getVerificationX509Credentials()).isNotNull();
});
}

2
spring-boot-project/spring-boot-dependencies/build.gradle
View File

@@ -1616,7 +1616,7 @@ bom {
]
}
}
library("Spring Security", "5.4.0-M1") {
library("Spring Security", "5.4.0-SNAPSHOT") {
group("org.springframework.security") {
imports = [
"spring-security-bom"