Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove unused properties and constants

Browse Source 
Since the autoconfig totally backs off in the presence
of a WebSecurityConfigurerAdapter, there is no need to
order them ahead of/after the one provided by Spring Boot.

See gh-7958
This commit is contained in:
Madhura Bhave
2017-08-28 15:53:35 -07:00
parent f6134a8862
commit 919dfd3f90
12 changed files with 5 additions and 342 deletions
Download Patch File Download Diff File Expand all files Collapse all files

105
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/web/ManagementServerProperties.java
View File

@@ -17,14 +17,8 @@
package org.springframework.boot.actuate.autoconfigure.web;
import java.net.InetAddress;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import javax.servlet.http.HttpSession;
import org.springframework.boot.autoconfigure.security.SecurityPrerequisite;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.context.properties.NestedConfigurationProperty;
@@ -43,26 +37,6 @@ import org.springframework.util.StringUtils;
@ConfigurationProperties(prefix = "management", ignoreUnknownFields = true)
public class ManagementServerProperties implements SecurityPrerequisite {
/**
* Order applied to the WebSecurityConfigurerAdapter that is used to configure basic
* authentication for management endpoints. If you want to add your own authentication
* for all or some of those endpoints the best thing to do is to add your own
* WebSecurityConfigurerAdapter with lower order, for instance by using
* {@code ACCESS_OVERRIDE_ORDER}.
*/
public static final int BASIC_AUTH_ORDER = SecurityProperties.BASIC_AUTH_ORDER - 5;
/**
* Order before the basic authentication access control provided automatically for the
* management endpoints. This is a useful place to put user-defined access rules if
* you want to override the default access rules for the management endpoints. If you
* want to keep the default rules for management endpoints but want to override the
* security for the rest of the application, use
* {@code SecurityProperties.ACCESS_OVERRIDE_ORDER} instead.
*/
public static final int ACCESS_OVERRIDE_ORDER = ManagementServerProperties.BASIC_AUTH_ORDER
- 1;
/**
* Management endpoint HTTP port. Use the same port as the application by default.
*/
@@ -86,8 +60,6 @@ public class ManagementServerProperties implements SecurityPrerequisite {
*/
private boolean addApplicationContextHeader = false;
private final Security security = new Security();
/**
* Returns the management port or {@code null} if the
* {@link ServerProperties#getPort() server port} should be used.
@@ -144,10 +116,6 @@ public class ManagementServerProperties implements SecurityPrerequisite {
return contextPath;
}
public Security getSecurity() {
return this.security;
}
public boolean getAddApplicationContextHeader() {
return this.addApplicationContextHeader;
}
@@ -156,77 +124,4 @@ public class ManagementServerProperties implements SecurityPrerequisite {
this.addApplicationContextHeader = addApplicationContextHeader;
}
/**
* Security configuration.
*/
public static class Security {
/**
* Enable security.
*/
private boolean enabled = true;
/**
* Comma-separated list of roles that can access the management endpoint.
*/
private List<String> roles = new ArrayList<>(
Collections.singletonList("ACTUATOR"));
/**
* Session creating policy for security use (always, never, if_required,
* stateless).
*/
private SessionCreationPolicy sessions = SessionCreationPolicy.STATELESS;
public SessionCreationPolicy getSessions() {
return this.sessions;
}
public void setSessions(SessionCreationPolicy sessions) {
this.sessions = sessions;
}
public void setRoles(List<String> roles) {
this.roles = roles;
}
public List<String> getRoles() {
return this.roles;
}
public boolean isEnabled() {
return this.enabled;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
}
public enum SessionCreationPolicy {
/**
* Always create an {@link HttpSession}.
*/
ALWAYS,
/**
* Never create an {@link HttpSession}, but use any {@link HttpSession} that
* already exists.
*/
NEVER,
/**
* Only create an {@link HttpSession} if required.
*/
IF_REQUIRED,
/**
* Never create an {@link HttpSession}.
*/
STATELESS
}
}

69
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/web/ManagementServerPropertiesNoSecurityTests.java
View File

@@ -1,69 +0,0 @@
/*
* Copyright 2012-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.actuate.autoconfigure.web;
import org.junit.After;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.test.util.TestPropertyValues;
import org.springframework.boot.testsupport.runner.classpath.ClassPathExclusions;
import org.springframework.boot.testsupport.runner.classpath.ModifiedClassPathRunner;
import org.springframework.context.annotation.AnnotationConfigApplicationContext;
import static org.assertj.core.api.Assertions.assertThat;
/**
* Tests for {@link ManagementServerProperties} when Spring Security is not present.
*
* @author Stephane Nicoll
*/
@RunWith(ModifiedClassPathRunner.class)
@ClassPathExclusions("spring-security-*.jar")
public class ManagementServerPropertiesNoSecurityTests {
private AnnotationConfigApplicationContext context;
@After
public void close() {
if (this.context != null) {
this.context.close();
}
}
@Test
public void securitySettingsIgnoredWithoutSpringSecurity() {
ManagementServerProperties properties = load("management.security.enabled=false");
assertThat(properties.getSecurity().isEnabled()).isFalse();
}
public ManagementServerProperties load(String... environment) {
AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext();
TestPropertyValues.of(environment).applyTo(context);
context.register(Config.class);
context.refresh();
this.context = context;
return this.context.getBean(ManagementServerProperties.class);
}
@EnableConfigurationProperties(ManagementServerProperties.class)
protected static class Config {
}
}

13
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/web/ManagementServerPropertiesTests.java
View File

@@ -73,19 +73,6 @@ public class ManagementServerPropertiesTests {
assertThat(properties.getContextPath()).isEqualTo("");
}
@Test
public void managementRolesSetMultipleRoles() {
ManagementServerProperties properties = load(
"management.security.roles=FOO,BAR,BIZ");
assertThat(properties.getSecurity().getRoles()).containsOnly("FOO", "BAR", "BIZ");
}
@Test
public void managementRolesAllowsIndexedAccess() {
ManagementServerProperties properties = load("management.security.roles[0]=FOO");
assertThat(properties.getSecurity().getRoles()).containsOnly("FOO");
}
public ManagementServerProperties load(String... environment) {
AnnotationConfigApplicationContext ctx = new AnnotationConfigApplicationContext();
TestPropertyValues.of(environment).applyTo(ctx);