Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Extract actuator security into separate classes

Browse Source 
So spring-security + a web app is secure by default
(you don't need the actuator).
This commit is contained in:
Dave Syer
2013-11-20 17:54:59 +00:00
parent 285dd5b270
commit bd26b28aa5
28 changed files with 663 additions and 313 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/CrshAutoConfigurationTests.java
View File

@@ -33,6 +33,7 @@ import org.crsh.processor.term.ProcessorIOHandler;
import org.crsh.vfs.Resource;
import org.junit.After;
import org.junit.Test;
import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.mock.env.MockEnvironment;

73
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/SecurityAutoConfigurationTests.java → spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/ManagementSecurityAutoConfigurationTests.java
View File

@@ -18,26 +18,37 @@ package org.springframework.boot.actuate.autoconfigure;
import org.junit.Test;
import org.springframework.boot.TestUtils;
import org.springframework.boot.autoconfigure.AutoConfigurationReportLoggingInitializer;
import org.springframework.boot.autoconfigure.PropertyPlaceholderAutoConfiguration;
import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration;
import org.springframework.boot.context.initializer.LoggingApplicationContextInitializer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.event.ContextRefreshedEvent;
import org.springframework.mock.web.MockServletContext;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.test.util.ReflectionTestUtils;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
/**
* Tests for {@link SecurityAutoConfiguration}.
* Tests for {@link ManagementSecurityAutoConfiguration}.
*
* @author Dave Syer
*/
public class SecurityAutoConfigurationTests {
public class ManagementSecurityAutoConfigurationTests {
private AnnotationConfigWebApplicationContext context;
@@ -46,21 +57,50 @@ public class SecurityAutoConfigurationTests {
this.context = new AnnotationConfigWebApplicationContext();
this.context.setServletContext(new MockServletContext());
this.context.register(SecurityAutoConfiguration.class,
EndpointAutoConfiguration.class,
ManagementSecurityAutoConfiguration.class,
EndpointAutoConfiguration.class, EndpointWebMvcAutoConfiguration.class,
ManagementServerPropertiesAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class);
this.context.refresh();
assertNotNull(this.context.getBean(AuthenticationManager.class));
// 4 for static resources, one for management endpoints and one for the rest
assertEquals(6, this.context.getBean(FilterChainProxy.class).getFilterChains()
// 6 for static resources, one for management endpoints and one for the rest
assertEquals(8, this.context.getBean(FilterChainProxy.class).getFilterChains()
.size());
}
@Test
public void testWebConfigurationWithExtraRole() throws Exception {
this.context = new AnnotationConfigWebApplicationContext();
this.context.setServletContext(new MockServletContext());
this.context.register(EndpointAutoConfiguration.class,
EndpointWebMvcAutoConfiguration.class,
ManagementServerPropertiesAutoConfiguration.class,
SecurityAutoConfiguration.class,
ManagementSecurityAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class);
debugRefresh(this.context);
UserDetails user = getUser();
assertTrue(user.getAuthorities().containsAll(
AuthorityUtils
.commaSeparatedStringToAuthorityList("ROLE_USER,ROLE_ADMIN")));
}
private UserDetails getUser() {
ProviderManager manager = this.context.getBean(ProviderManager.class);
DaoAuthenticationProvider provider = (DaoAuthenticationProvider) manager
.getProviders().get(0);
UserDetailsService service = (UserDetailsService) ReflectionTestUtils.getField(
provider, "userDetailsService");
UserDetails user = service.loadUserByUsername("user");
return user;
}
@Test
public void testDisableIgnoredStaticApplicationPaths() throws Exception {
this.context = new AnnotationConfigWebApplicationContext();
this.context.setServletContext(new MockServletContext());
this.context.register(SecurityAutoConfiguration.class,
ManagementSecurityAutoConfiguration.class,
EndpointAutoConfiguration.class,
ManagementServerPropertiesAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class);
@@ -76,13 +116,14 @@ public class SecurityAutoConfigurationTests {
this.context = new AnnotationConfigWebApplicationContext();
this.context.setServletContext(new MockServletContext());
this.context.register(SecurityAutoConfiguration.class,
EndpointAutoConfiguration.class,
ManagementSecurityAutoConfiguration.class,
EndpointAutoConfiguration.class, EndpointWebMvcAutoConfiguration.class,
ManagementServerPropertiesAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class);
TestUtils.addEnviroment(this.context, "security.basic.enabled:false");
this.context.refresh();
// Just the management endpoints and default ignores now
assertEquals(5, this.context.getBean(FilterChainProxy.class).getFilterChains()
// Just the management endpoints (one filter) and ignores now
assertEquals(7, this.context.getBean(FilterChainProxy.class).getFilterChains()
.size());
}
@@ -90,7 +131,9 @@ public class SecurityAutoConfigurationTests {
public void testOverrideAuthenticationManager() throws Exception {
this.context = new AnnotationConfigWebApplicationContext();
this.context.setServletContext(new MockServletContext());
this.context.register(TestConfiguration.class, SecurityAutoConfiguration.class,
this.context.register(TestConfiguration.class,
SecurityAutoConfiguration.class, ManagementSecurityAutoConfiguration.class,
EndpointAutoConfiguration.class,
ManagementServerPropertiesAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class);
@@ -99,6 +142,18 @@ public class SecurityAutoConfigurationTests {
this.context.getBean(AuthenticationManager.class));
}
private static AnnotationConfigWebApplicationContext debugRefresh(
AnnotationConfigWebApplicationContext context) {
TestUtils.addEnviroment(context, "debug:true");
LoggingApplicationContextInitializer logging = new LoggingApplicationContextInitializer();
logging.initialize(context);
AutoConfigurationReportLoggingInitializer initializer = new AutoConfigurationReportLoggingInitializer();
initializer.initialize(context);
context.refresh();
initializer.onApplicationEvent(new ContextRefreshedEvent(context));
return context;
}
@Configuration
protected static class TestConfiguration {

116
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/properties/SecurityPropertiesTests.java
View File

@@ -1,116 +0,0 @@
/*
* Copyright 2012-2013 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.actuate.properties;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import org.junit.Test;
import org.springframework.beans.MutablePropertyValues;
import org.springframework.boot.bind.RelaxedDataBinder;
import org.springframework.core.convert.support.DefaultConversionService;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
/**
* Tests for {@link SecurityProperties}.
*
* @author Dave Syer
*/
public class SecurityPropertiesTests {
@Test
public void testBindingIgnoredSingleValued() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "/css/**")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(1, security.getIgnored().size());
}
@Test
public void testBindingIgnoredEmpty() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.setConversionService(new DefaultConversionService());
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(0, security.getIgnored().size());
}
@Test
public void testBindingIgnoredDisable() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.setConversionService(new DefaultConversionService());
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "none")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(1, security.getIgnored().size());
}
@Test
public void testBindingIgnoredMultiValued() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.setConversionService(new DefaultConversionService());
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "/css/**,/images/**")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(2, security.getIgnored().size());
}
@Test
public void testBindingIgnoredMultiValuedList() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.setConversionService(new DefaultConversionService());
Map<String, String> map = new HashMap<String, String>();
map.put("security.ignored[0]", "/css/**");
map.put("security.ignored[1]", "/foo/**");
binder.bind(new MutablePropertyValues(map));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(2, security.getIgnored().size());
assertTrue(security.getIgnored().contains("/foo/**"));
}
@Test
public void testDefaultPasswordAutogeneratedIfUnresolovedPlaceholder() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.user.password", "${ADMIN_PASSWORD}")));
assertFalse(binder.getBindingResult().hasErrors());
assertTrue(security.getUser().isDefaultPassword());
}
@Test
public void testDefaultPasswordAutogeneratedIfEmpty() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.user.password", "")));
assertFalse(binder.getBindingResult().hasErrors());
assertTrue(security.getUser().isDefaultPassword());
}
}