Add auto-config and starter for reactive security

Closes gh-9925

spring-boot-samples/spring-boot-sample-secure-webflux/src/main/java/sample/secure/webflux/EchoHandler.java

@@ -0,0 +1,32 @@
+/*
+ * Copyright 2012-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.webflux;
+
+import reactor.core.publisher.Mono;
+
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.ServerRequest;
+import org.springframework.web.reactive.function.server.ServerResponse;
+
+@Component
+public class EchoHandler {
+
+	public Mono<ServerResponse> echo(ServerRequest request) {
+		return ServerResponse.ok().body(request.bodyToMono(String.class), String.class);
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-webflux/src/main/java/sample/secure/webflux/SampleSecureWebFluxApplication.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2012-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.webflux;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.core.userdetails.MapUserDetailsRepository;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsRepository;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.ServerResponse;
+
+import static org.springframework.web.reactive.function.server.RequestPredicates.POST;
+import static org.springframework.web.reactive.function.server.RouterFunctions.route;
+
+@SpringBootApplication
+public class SampleSecureWebFluxApplication {
+
+	public static void main(String[] args) throws Exception {
+		SpringApplication.run(SampleSecureWebFluxApplication.class);
+	}
+
+	@Bean
+	public RouterFunction<ServerResponse> monoRouterFunction(EchoHandler echoHandler) {
+		return route(POST("/echo"), echoHandler::echo);
+	}
+
+	@Bean
+	public UserDetailsRepository userDetailsRepository() {
+		UserDetails user = User.withUsername("foo").password("password").roles("USER").build();
+		return new MapUserDetailsRepository(user);
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-webflux/src/main/java/sample/secure/webflux/WelcomeController.java

@@ -0,0 +1,32 @@
+/*
+ * Copyright 2012-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.webflux;
+
+import java.security.Principal;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class WelcomeController {
+
+	@GetMapping("/")
+	public String welcome(Principal principal) {
+		return "Hello " + principal.getName();
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-webflux/src/test/java/sample/secure/webflux/SampleSecureWebFluxApplicationTests.java

@@ -0,0 +1,77 @@
+/*
+ * Copyright 2012-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.webflux;
+
+import java.util.Base64;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.web.reactive.server.WebTestClient;
+
+/**
+ * Integration tests for a secure reactive application.
+ *
+ * @author Madhura Bhave
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@DirtiesContext
+public class SampleSecureWebFluxApplicationTests {
+
+	@Autowired
+	private WebTestClient webClient;
+
+	@Test
+	public void userDefinedMappingsSecureByDefault() {
+		this.webClient.get().uri("/").accept(MediaType.APPLICATION_JSON).exchange()
+				.expectStatus().isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Test
+	public void actuatorsSecureByDefault() {
+		this.webClient.get().uri("/application/status").accept(MediaType.APPLICATION_JSON)
+				.exchange().expectStatus().isUnauthorized();
+	}
+
+	@Test
+	public void userDefinedMappingsAccessibleOnLogin() {
+		this.webClient.get().uri("/").accept(MediaType.APPLICATION_JSON)
+				.header("Authorization", "basic " + getBasicAuth())
+				.exchange()
+				.expectBody(String.class).isEqualTo("Hello foo");
+	}
+
+	@Test
+	public void actuatorsAccessibleOnLogin() {
+		this.webClient.get().uri("/application/status").accept(MediaType.APPLICATION_JSON)
+				.header("Authorization", "basic " + getBasicAuth())
+				.exchange()
+				.expectBody(String.class).isEqualTo("{\"status\":\"UP\"}");
+	}
+
+	private String getBasicAuth() {
+		return new String(Base64.getEncoder().encode(("foo:password").getBytes()));
+	}
+
+}