Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[bs-138] Make it easy to secure only the management endpoints

Browse Source 
Example: web UI with publicly available static assets

    # application.properties:
    security.ignored: /css/**,/script/**

Example: web UI with publicly available everything, but secure
management endpoints.

    # application.properties:
    # Empty path for basic security (default is /**)
    security.basic.path=

[Fixes #50721675]
This commit is contained in:
Dave Syer
2013-05-30 15:37:49 +01:00
parent 7b0ec252dd
commit e011312c68
12 changed files with 244 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
spring-bootstrap-actuator/src/main/java/org/springframework/bootstrap/actuate/autoconfigure/ManagementServerConfiguration.java
View File

@@ -16,12 +16,22 @@
package org.springframework.bootstrap.actuate.autoconfigure;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.beans.factory.HierarchicalBeanFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.bootstrap.actuate.endpoint.error.ErrorEndpoint;
import org.springframework.bootstrap.actuate.properties.ManagementServerProperties;
import org.springframework.bootstrap.context.annotation.ConditionalOnBean;
import org.springframework.bootstrap.context.annotation.ConditionalOnClass;
import org.springframework.bootstrap.context.embedded.ConfigurableEmbeddedServletContainerFactory;
import org.springframework.bootstrap.context.embedded.EmbeddedServletContainerCustomizer;
import org.springframework.bootstrap.context.embedded.EmbeddedServletContainerFactory;
@@ -31,8 +41,10 @@ import org.springframework.bootstrap.context.embedded.tomcat.TomcatEmbeddedServl
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import org.springframework.context.support.PropertySourcesPlaceholderConfigurer;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.GenericFilterBean;
import org.springframework.web.servlet.DispatcherServlet;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
@@ -43,6 +55,7 @@ import org.springframework.web.servlet.config.annotation.EnableWebMvc;
*/
@Configuration
@EnableWebMvc
@Import(ManagementSecurityConfiguration.class)
public class ManagementServerConfiguration {
@Bean
@@ -100,3 +113,28 @@ public class ManagementServerConfiguration {
}
}
@Configuration
@ConditionalOnClass(name = {
"org.springframework.security.config.annotation.web.EnableWebSecurity",
"javax.servlet.Filter" })
class ManagementSecurityConfiguration {
@Bean
// TODO: enable and get rid of the empty filter when @ConditionalOnBean works
// @ConditionalOnBean(name = "springSecurityFilterChain")
public Filter springSecurityFilterChain(HierarchicalBeanFactory beanFactory) {
BeanFactory parent = beanFactory.getParentBeanFactory();
if (parent != null && parent.containsBean("springSecurityFilterChain")) {
return parent.getBean("springSecurityFilterChain", Filter.class);
}
return new GenericFilterBean() {
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
chain.doFilter(request, response);
}
};
}
}

71
spring-bootstrap-actuator/src/main/java/org/springframework/bootstrap/actuate/autoconfigure/SecurityAutoConfiguration.java
View File

@@ -16,6 +16,11 @@
package org.springframework.bootstrap.actuate.autoconfigure;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.springframework.beans.factory.BeanFactoryUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.bootstrap.actuate.properties.EndpointsProperties;
import org.springframework.bootstrap.actuate.properties.SecurityProperties;
@@ -23,11 +28,16 @@ import org.springframework.bootstrap.context.annotation.ConditionalOnClass;
import org.springframework.bootstrap.context.annotation.ConditionalOnMissingBean;
import org.springframework.bootstrap.context.annotation.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Condition;
import org.springframework.context.annotation.ConditionContext;
import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.type.AnnotatedTypeMetadata;
import org.springframework.security.authentication.AuthenticationEventPublisher;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.config.BeanIds;
import org.springframework.security.config.annotation.authentication.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.EnableWebSecurity;
import org.springframework.security.config.annotation.web.HttpConfiguration;
@@ -58,6 +68,7 @@ public class SecurityAutoConfiguration {
}
@Bean
@ConditionalOnMissingBean({ BoostrapWebSecurityConfigurerAdapter.class })
public WebSecurityConfigurerAdapter webSecurityConfigurerAdapter() {
return new BoostrapWebSecurityConfigurerAdapter();
}
@@ -76,20 +87,42 @@ public class SecurityAutoConfiguration {
@Override
protected void configure(HttpConfiguration http) throws Exception {
if (this.security.isRequireSsl()) {
http.requiresChannel().antMatchers("/**").requiresSecure();
http.requiresChannel().anyRequest().requiresSecure();
}
if (this.security.getBasic().isEnabled()) {
HttpConfiguration matcher = http.antMatcher(this.security.getBasic()
.getPath());
matcher.authenticationEntryPoint(entryPoint()).antMatcher("/**")
.httpBasic().authenticationEntryPoint(entryPoint()).and()
.anonymous().disable();
matcher.authorizeUrls().antMatchers("/**")
String[] paths = getSecurePaths();
HttpConfiguration matcher = http.requestMatchers().antMatchers(paths);
matcher.authenticationEntryPoint(entryPoint()).httpBasic()
.authenticationEntryPoint(entryPoint()).and().anonymous()
.disable();
matcher.authorizeUrls().anyRequest()
.hasRole(this.security.getBasic().getRole());
}
// No cookies for service endpoints by default
http.sessionManagement().sessionCreationPolicy(this.security.getSessions());
}
private String[] getSecurePaths() {
List<String> list = new ArrayList<String>();
for (String path : this.security.getBasic().getPath()) {
path = path == null ? "" : path.trim();
if (path.equals("/**")) {
return new String[] { path };
}
if (!path.equals("")) {
list.add(path);
}
}
list.addAll(Arrays.asList(this.endpoints.getSecurePaths()));
return list.toArray(new String[list.size()]);
}
private AuthenticationEntryPoint entryPoint() {
@@ -100,9 +133,8 @@ public class SecurityAutoConfiguration {
@Override
public void configure(WebSecurityBuilder builder) throws Exception {
builder.ignoring().antMatchers(this.endpoints.getHealth().getPath(),
this.endpoints.getInfo().getPath(),
this.endpoints.getError().getPath());
builder.ignoring().antMatchers(this.security.getIgnored())
.antMatchers(this.endpoints.getOpenPaths());
}
@Override
@@ -117,7 +149,7 @@ public class SecurityAutoConfiguration {
}
@ConditionalOnMissingBean(AuthenticationManager.class)
@Conditional(NoUserSuppliedAuthenticationManager.class)
@Configuration
public static class AuthenticationManagerConfiguration {
@@ -130,4 +162,21 @@ public class SecurityAutoConfiguration {
}
private static class NoUserSuppliedAuthenticationManager implements Condition {
@Override
public boolean matches(ConditionContext context, AnnotatedTypeMetadata metadata) {
String[] beans = BeanFactoryUtils.beanNamesForTypeIncludingAncestors(
context.getBeanFactory(), AuthenticationManager.class, false, false);
for (String bean : beans) {
if (!BeanIds.AUTHENTICATION_MANAGER.equals(bean)) {
// Not the one supplied by Spring Security automatically
return false;
}
}
return true;
}
}
}

11
spring-bootstrap-actuator/src/main/java/org/springframework/bootstrap/actuate/properties/SecurityProperties.java
View File

@@ -33,7 +33,8 @@ public class SecurityProperties {
private SessionCreationPolicy sessions = SessionCreationPolicy.stateless;
private String[] ignored = new String[0];
private String[] ignored = new String[] { "/css/**", "/js/**", "/images/**",
"/**/favicon.ico" };
public SessionCreationPolicy getSessions() {
return this.sessions;
@@ -73,7 +74,7 @@ public class SecurityProperties {
private String realm = "Spring";
private String path = "/**";
private String[] path = new String[] { "/**" };
private String role = "USER";
@@ -93,12 +94,12 @@ public class SecurityProperties {
this.realm = realm;
}
public String getPath() {
public String[] getPath() {
return this.path;
}
public void setPath(String path) {
this.path = path;
public void setPath(String... paths) {
this.path = paths;
}
public String getRole() {

9
spring-bootstrap-actuator/src/test/java/org/springframework/bootstrap/actuate/autoconfigure/ManagementConfigurationTests.java
View File

@@ -16,6 +16,7 @@
package org.springframework.bootstrap.actuate.autoconfigure;
import javax.servlet.Filter;
import javax.servlet.Servlet;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
@@ -133,6 +134,14 @@ public class ManagementConfigurationTests {
public Dynamic addServlet(String servletName, Servlet servlet) {
return Mockito.mock(Dynamic.class);
}
@Override
public javax.servlet.FilterRegistration.Dynamic addFilter(
String filterName, Filter filter) {
// TODO: remove this when @ConditionalOnBean works
return Mockito
.mock(javax.servlet.FilterRegistration.Dynamic.class);
}
};
for (ServletContextInitializer initializer : initializers) {
try {

55
spring-bootstrap-actuator/src/test/java/org/springframework/bootstrap/actuate/properties/SecurityPropertiesTests.java Normal file
View File

@@ -0,0 +1,55 @@
/*
* Copyright 2012-2013 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.bootstrap.actuate.properties;
import java.util.Collections;
import org.junit.Test;
import org.springframework.beans.MutablePropertyValues;
import org.springframework.bootstrap.bind.RelaxedDataBinder;
import org.springframework.core.convert.support.DefaultConversionService;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
/**
* @author Dave Syer
*
*/
public class SecurityPropertiesTests {
@Test
public void testBindingIgnoredSingleValued() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "/css/**")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(1, security.getIgnored().length);
}
@Test
public void testBindingIgnoredMultiValued() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.setConversionService(new DefaultConversionService());
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "/css/**,/images/**")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(2, security.getIgnored().length);
}
}