From 3354e0f030134aa4d571ac5f874143902cf46c8a Mon Sep 17 00:00:00 2001 From: Brian Clozel Date: Tue, 4 Aug 2020 13:27:04 +0200 Subject: [PATCH] Upgrade to Spring Security 5.4.0-SNAPSHOT See gh-22668 --- ...RelyingPartyRegistrationConfiguration.java | 40 ++++++++----------- ...2ResourceServerAutoConfigurationTests.java | 2 +- ...2ResourceServerAutoConfigurationTests.java | 6 ++- ...ml2RelyingPartyAutoConfigurationTests.java | 16 ++++---- .../spring-boot-dependencies/build.gradle | 2 +- 5 files changed, 32 insertions(+), 34 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyRegistrationConfiguration.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyRegistrationConfiguration.java index a7368e5e46..efb9c290c8 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyRegistrationConfiguration.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyRegistrationConfiguration.java @@ -20,7 +20,6 @@ import java.io.InputStream; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import java.security.interfaces.RSAPrivateKey; -import java.util.ArrayList; import java.util.List; import java.util.Map; import java.util.stream.Collectors; @@ -34,8 +33,7 @@ import org.springframework.context.annotation.Conditional; import org.springframework.context.annotation.Configuration; import org.springframework.core.io.Resource; import org.springframework.security.converter.RsaKeyConverters; -import org.springframework.security.saml2.credentials.Saml2X509Credential; -import org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType; +import org.springframework.security.saml2.core.Saml2X509Credential; import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; @@ -69,15 +67,19 @@ class Saml2RelyingPartyRegistrationConfiguration { boolean signRequest = properties.getIdentityprovider().getSinglesignon().isSignRequest(); validateSigningCredentials(properties, signRequest); RelyingPartyRegistration.Builder builder = RelyingPartyRegistration.withRegistrationId(id); - builder.assertionConsumerServiceUrlTemplate( + builder.assertionConsumerServiceLocation( "{baseUrl}" + Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI); - builder.providerDetails( - (details) -> details.webSsoUrl(properties.getIdentityprovider().getSinglesignon().getUrl())); - builder.providerDetails((details) -> details.entityId(properties.getIdentityprovider().getEntityId())); - builder.providerDetails( - (details) -> details.binding(properties.getIdentityprovider().getSinglesignon().getBinding())); - builder.providerDetails((details) -> details.signAuthNRequest(signRequest)); - builder.credentials((credentials) -> credentials.addAll(asCredentials(properties))); + builder.assertingPartyDetails((details) -> { + details.singleSignOnServiceLocation(properties.getIdentityprovider().getSinglesignon().getUrl()); + details.entityId(properties.getIdentityprovider().getEntityId()); + details.singleSignOnServiceBinding(properties.getIdentityprovider().getSinglesignon().getBinding()); + details.wantAuthnRequestsSigned(signRequest); + }); + builder.signingX509Credentials((credentials) -> properties.getSigning().getCredentials().stream() + .map(this::asSigningCredential).forEach(credentials::add)); + builder.assertingPartyDetails((details) -> details + .verificationX509Credentials((credentials) -> properties.getIdentityprovider().getVerification() + .getCredentials().stream().map(this::asVerificationCredential).forEach(credentials::add))); return builder.build(); } @@ -88,25 +90,17 @@ class Saml2RelyingPartyRegistrationConfiguration { } } - private List asCredentials(Registration properties) { - List credentials = new ArrayList<>(); - properties.getSigning().getCredentials().stream().map(this::asSigningCredential).forEach(credentials::add); - properties.getIdentityprovider().getVerification().getCredentials().stream().map(this::asVerificationCredential) - .forEach(credentials::add); - return credentials; - } - private Saml2X509Credential asSigningCredential(Signing.Credential properties) { RSAPrivateKey privateKey = readPrivateKey(properties.getPrivateKeyLocation()); X509Certificate certificate = readCertificate(properties.getCertificateLocation()); - return new Saml2X509Credential(privateKey, certificate, Saml2X509CredentialType.SIGNING, - Saml2X509CredentialType.DECRYPTION); + return new Saml2X509Credential(privateKey, certificate, Saml2X509Credential.Saml2X509CredentialType.SIGNING, + Saml2X509Credential.Saml2X509CredentialType.DECRYPTION); } private Saml2X509Credential asVerificationCredential(Verification.Credential properties) { X509Certificate certificate = readCertificate(properties.getCertificateLocation()); - return new Saml2X509Credential(certificate, Saml2X509CredentialType.ENCRYPTION, - Saml2X509CredentialType.VERIFICATION); + return new Saml2X509Credential(certificate, Saml2X509Credential.Saml2X509CredentialType.ENCRYPTION, + Saml2X509Credential.Saml2X509CredentialType.VERIFICATION); } private RSAPrivateKey readPrivateKey(Resource location) { diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java index cf25c54444..82dafa732f 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java @@ -105,7 +105,7 @@ class ReactiveOAuth2ResourceServerAutoConfigurationTests { "spring.security.oauth2.resourceserver.jwt.jws-algorithm=RS512") .run((context) -> { NimbusReactiveJwtDecoder nimbusReactiveJwtDecoder = context.getBean(NimbusReactiveJwtDecoder.class); - assertThat(nimbusReactiveJwtDecoder).extracting("jwtProcessor.arg$2") + assertThat(nimbusReactiveJwtDecoder).extracting("jwtProcessor.arg$2.arg$1.jwsAlgs") .matches((algorithms) -> ((Set) algorithms).contains(JWSAlgorithm.RS512)); }); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java index ef781ceb0e..23b2372080 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java @@ -98,7 +98,8 @@ class OAuth2ResourceServerAutoConfigurationTests { JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class); Object processor = ReflectionTestUtils.getField(jwtDecoder, "jwtProcessor"); Object keySelector = ReflectionTestUtils.getField(processor, "jwsKeySelector"); - assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlg", JWSAlgorithm.RS256); + assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlgs", + Collections.singleton(JWSAlgorithm.RS256)); }); } @@ -111,7 +112,8 @@ class OAuth2ResourceServerAutoConfigurationTests { JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class); Object processor = ReflectionTestUtils.getField(jwtDecoder, "jwtProcessor"); Object keySelector = ReflectionTestUtils.getField(processor, "jwsKeySelector"); - assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlg", JWSAlgorithm.RS384); + assertThat(keySelector).hasFieldOrPropertyWithValue("jwsAlgs", + Collections.singleton(JWSAlgorithm.RS384)); assertThat(getBearerTokenFilter(context)).isNotNull(); }); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyAutoConfigurationTests.java index 9ac9f7fad5..b0d55b02e5 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyAutoConfigurationTests.java @@ -80,16 +80,18 @@ public class Saml2RelyingPartyAutoConfigurationTests { this.contextRunner.withPropertyValues(getPropertyValues()).run((context) -> { RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class); RelyingPartyRegistration registration = repository.findByRegistrationId("foo"); - assertThat(registration.getProviderDetails().getWebSsoUrl()) + + assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceLocation()) .isEqualTo("https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php"); - assertThat(registration.getProviderDetails().getEntityId()) + assertThat(registration.getAssertingPartyDetails().getEntityId()) .isEqualTo("https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php"); - assertThat(registration.getAssertionConsumerServiceUrlTemplate()) + assertThat(registration.getAssertionConsumerServiceLocation()) .isEqualTo("{baseUrl}" + Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI); - assertThat(registration.getProviderDetails().getBinding()).isEqualTo(Saml2MessageBinding.POST); - assertThat(registration.getProviderDetails().isSignAuthNRequest()).isEqualTo(false); - assertThat(registration.getSigningCredentials()).isNotNull(); - assertThat(registration.getVerificationCredentials()).isNotNull(); + assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding()) + .isEqualTo(Saml2MessageBinding.POST); + assertThat(registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()).isEqualTo(false); + assertThat(registration.getSigningX509Credentials()).isNotNull(); + assertThat(registration.getAssertingPartyDetails().getVerificationX509Credentials()).isNotNull(); }); } diff --git a/spring-boot-project/spring-boot-dependencies/build.gradle b/spring-boot-project/spring-boot-dependencies/build.gradle index d3146569cb..6eb9a278f1 100644 --- a/spring-boot-project/spring-boot-dependencies/build.gradle +++ b/spring-boot-project/spring-boot-dependencies/build.gradle @@ -1616,7 +1616,7 @@ bom { ] } } - library("Spring Security", "5.4.0-M1") { + library("Spring Security", "5.4.0-SNAPSHOT") { group("org.springframework.security") { imports = [ "spring-security-bom"