Spring/spring-integration
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Namespace support for endpoint interceptor security

Browse Source
This commit is contained in:
Jonas Partner
2008-07-03 14:21:08 +00:00
parent c59bbe767a
commit 27ac25ed33
12 changed files with 270 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/config/SecurityPropagatingChannelsParser.java
View File

@@ -16,23 +16,16 @@
package org.springframework.integration.security.channel.config;
import java.util.ArrayList;
import java.util.List;
import org.w3c.dom.Element;
import org.w3c.dom.NodeList;
import org.springframework.beans.factory.BeanDefinitionStoreException;
import org.springframework.beans.factory.config.ConstructorArgumentValues.ValueHolder;
import org.springframework.beans.factory.support.AbstractBeanDefinition;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.integration.security.config.IncludeExcludePattern;
import org.springframework.integration.security.config.IncludeExcludePatternParser;
import org.springframework.integration.security.config.OrderedIncludeExcludeList;
import org.springframework.security.context.SecurityContext;
import org.springframework.util.StringUtils;
import org.w3c.dom.Element;
/**
* Interprets the <secure-channels> element which controls default

2
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java
View File

@@ -19,6 +19,7 @@ package org.springframework.integration.security.config;
import org.springframework.beans.factory.xml.NamespaceHandlerSupport;
import org.springframework.integration.security.channel.config.SecuredChannelsParser;
import org.springframework.integration.security.channel.config.SecurityPropagatingChannelsParser;
import org.springframework.integration.security.endpoint.config.SecurityEndpointInterceptorParser;
/**
* Namespace handler for the security namespace.
@@ -30,6 +31,7 @@ public class IntegrationSecurityNamespaceHandler extends NamespaceHandlerSupport
public void init() {
registerBeanDefinitionParser("secured-channels", new SecuredChannelsParser());
registerBeanDefinitionParser("security-propagating-channels", new SecurityPropagatingChannelsParser());
registerBeanDefinitionParser("endpoint-security-policy", new SecurityEndpointInterceptorParser());
}
}

8
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/spring-integration-security-1.0.xsd
View File

@@ -28,7 +28,7 @@
</xsd:element>
<xsd:element name="secured-targets">
<xsd:element name="endpoint-security-policy">
<xsd:complexType>
<xsd:annotation>
<xsd:documentation>
@@ -36,10 +36,7 @@
Targets
</xsd:documentation>
</xsd:annotation>
<xsd:sequence>
<xsd:element name="targetNamePattern" type="xsd:string" />
</xsd:sequence>
<xsd:attribute name="access" type="xsd:string" />
<xsd:attribute name="access" type="xsd:string" use="required"/>
<xsd:attribute name="access-decision-manager"
type="xsd:string" default="accessDecisionManager" />
@@ -48,7 +45,6 @@
<xsd:element name="security-propagating-channels">
<xsd:complexType>
<xsd:annotation>
<xsd:documentation>
Defines a bean post processor which propagates the

11
org.springframework.integration.security/src/main/java/org/springframework/integration/security/endpoint/SecurityEndpointInterceptor.java
View File

@@ -17,7 +17,6 @@
package org.springframework.integration.security.endpoint;
import org.aopalliance.intercept.MethodInvocation;
import org.springframework.integration.endpoint.interceptor.EndpointInterceptorAdapter;
import org.springframework.integration.message.Message;
import org.springframework.integration.security.SecurityContextUtils;
@@ -35,7 +34,6 @@ public class SecurityEndpointInterceptor extends EndpointInterceptorAdapter {
private final AccessDecisionManager accessDecisionManager;
public SecurityEndpointInterceptor(ConfigAttributeDefinition endpointSecurityAttributes,
AccessDecisionManager accessDecisionManager) {
super();
@@ -43,7 +41,6 @@ public class SecurityEndpointInterceptor extends EndpointInterceptorAdapter {
this.accessDecisionManager = accessDecisionManager;
}
@Override
public boolean aroundInvoke(MethodInvocation invocation) throws Throwable {
Message<?> message = (Message<?>) invocation.getArguments()[0];
@@ -54,8 +51,8 @@ public class SecurityEndpointInterceptor extends EndpointInterceptorAdapter {
if (securityContext != null) {
try {
SecurityContextHolder.setContext(securityContext);
this.accessDecisionManager.decide(SecurityContextHolder.getContext().getAuthentication(),
invocation.getThis(), this.targetSecurityAttributes);
this.accessDecisionManager.decide(SecurityContextHolder.getContext().getAuthentication(), invocation
.getThis(), this.targetSecurityAttributes);
return (Boolean) invocation.proceed();
}
finally {
@@ -63,8 +60,8 @@ public class SecurityEndpointInterceptor extends EndpointInterceptorAdapter {
}
}
else {
this.accessDecisionManager.decide(SecurityContextHolder.getContext().getAuthentication(),
invocation.getThis(), this.targetSecurityAttributes);
this.accessDecisionManager.decide(SecurityContextHolder.getContext().getAuthentication(), invocation
.getThis(), this.targetSecurityAttributes);
return (Boolean) invocation.proceed();
}
}

68
org.springframework.integration.security/src/main/java/org/springframework/integration/security/endpoint/config/SecurityEndpointInterceptorParser.java Normal file
View File

@@ -0,0 +1,68 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.endpoint.config;
import org.springframework.beans.BeanMetadataAttribute;
import org.springframework.beans.factory.config.RuntimeBeanReference;
import org.springframework.beans.factory.config.ConstructorArgumentValues.ValueHolder;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.support.BeanDefinitionReaderUtils;
import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.integration.security.endpoint.SecurityEndpointInterceptor;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
import org.w3c.dom.Element;
public class SecurityEndpointInterceptorParser extends AbstractSingleBeanDefinitionParser {
public SecurityEndpointInterceptorParser() {
super();
}
@Override
protected boolean shouldGenerateId() {
return true;
}
@Override
protected boolean shouldGenerateIdAsFallback() {
return true;
}
protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
String access = element.getAttribute("access");
Assert.hasText(access, "Access attribute is required for element endpoint-security-policy");
String accessDecisionManager = element.getAttribute("access-decision-manager");
Assert.hasText(accessDecisionManager, "A non null value for the access-decision-manager is required");
ConfigAttributeDefinition accessDefintion = new ConfigAttributeDefinition(StringUtils.tokenizeToStringArray(
access, ","));
builder.getBeanDefinition().getConstructorArgumentValues().addGenericArgumentValue(
new ValueHolder(accessDefintion));
builder.getBeanDefinition().getConstructorArgumentValues().addGenericArgumentValue(
new RuntimeBeanReference(accessDecisionManager));
builder.getBeanDefinition().setBeanClass(SecurityEndpointInterceptor.class);
String beanName = BeanDefinitionReaderUtils.registerWithGeneratedName(builder.getBeanDefinition(),
parserContext.getRegistry());
builder.getBeanDefinition().addMetadataAttribute(new BeanMetadataAttribute("interceptorName", beanName));
}
}

2
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityTestUtil.java → org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityTestUtil.java
View File

@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
package org.springframework.integration.security;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;

13
org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/config/SecurityPropagatingChannelsParserTests-noPropagationByDefaultContext.xml
View File

@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/integration"
xmlns:si-security="http://www.springframework.org/schema/integration-security"
xmlns:si-security="http://www.springframework.org/schema/integration-security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
@@ -11,10 +11,15 @@
http://www.springframework.org/schema/integration-security http://www.springframework.org/schema/integration/spring-integration-security-1.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
<si-security:security-propagating-channels propagate-by-default="false">
<si-security:security-propagating-channels
propagate-by-default="false">
<si-security:propagation-patterns>
<si-security:excludePattern>adminSpecial</si-security:excludePattern>
<si-security:excludePattern>admin.*</si-security:excludePattern>
<si-security:excludePattern>
adminSpecial
</si-security:excludePattern>
<si-security:includePattern>
admin.*
</si-security:includePattern>
</si-security:propagation-patterns>
</si-security:security-propagating-channels>

49
org.springframework.integration.security/src/test/java/org/springframework/integration/security/endpoint/EnpointSecurityIntegrationTest-context.xml Normal file
View File

@@ -0,0 +1,49 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/integration"
xmlns:si-security="http://www.springframework.org/schema/integration-security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
http://www.springframework.org/schema/integration-security http://www.springframework.org/schema/integration/spring-integration-security-1.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
<message-bus auto-create-channels="false" />
<beans:bean id="testTarget"
class="org.springframework.integration.security.endpoint.TestTarget" />
<direct-channel id="testChannel"></direct-channel>
<target-endpoint target="testTarget" input-channel="testChannel">
<interceptors>
<si-security:endpoint-security-policy access="ROLE_ADMIN" />
</interceptors>
</target-endpoint>
<beans:bean id="accessDecisionManager"
class="org.springframework.security.vote.AffirmativeBased">
<beans:property name="allowIfAllAbstainDecisions" value="true" />
<beans:property name="decisionVoters">
<beans:list>
<beans:bean
class="org.springframework.security.vote.RoleVoter" />
</beans:list>
</beans:property>
</beans:bean>
<security:authentication-provider
user-service-ref="userDetailsService" />
<security:user-service id="userDetailsService">
<security:user name="jimi" password="jimispassword"
authorities="ROLE_USER, ROLE_ADMIN" />
<security:user name="bob" password="bobspassword"
authorities="ROLE_USER" />
</security:user-service>
</beans:beans>

71
org.springframework.integration.security/src/test/java/org/springframework/integration/security/endpoint/EnpointSecurityIntegrationTest.java Normal file
View File

@@ -0,0 +1,71 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.endpoint;
import static org.junit.Assert.assertEquals;
import org.junit.After;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.integration.channel.MessageChannel;
import org.springframework.integration.message.StringMessage;
import org.springframework.integration.security.SecurityTestUtil;
import org.springframework.security.AccessDeniedException;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.test.annotation.DirtiesContext;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests;
@ContextConfiguration
public class EnpointSecurityIntegrationTest extends AbstractJUnit4SpringContextTests {
@Autowired
MessageChannel channel;
@Autowired
TestTarget testTarget;
@After
public void tearDown() {
SecurityContextHolder.clearContext();
}
@Test
@DirtiesContext
public void testWithPermision() {
login("bob", "bobspassword", "ROLE_ADMIN");
channel.send(new StringMessage("test"));
assertEquals("Wrong size of message list in target ", 1, testTarget.sentMessages.size());
}
/**
*
*/
@Test(expected = AccessDeniedException.class)
@DirtiesContext
public void testWithoutPermision() {
login("bob", "bobspassword", "ROLE_USER");
channel.send(new StringMessage("test"));
assertEquals("Wrong size of message list in target ", 1, testTarget.sentMessages.size());
}
public void login(String username, String password, String... roles) {
SecurityContext context = SecurityTestUtil.createContext(username, password, roles);
SecurityContextHolder.setContext(context);
}
}

2
org.springframework.integration.security/src/test/java/org/springframework/integration/security/endpoint/SecurityEndpointInterceptorTests.java
View File

@@ -25,7 +25,7 @@ import org.junit.Test;
import org.springframework.integration.message.Message;
import org.springframework.integration.message.StringMessage;
import org.springframework.integration.security.SecurityContextUtils;
import org.springframework.integration.security.config.SecurityTestUtil;
import org.springframework.integration.security.SecurityTestUtil;
import org.springframework.security.AccessDecisionManager;
import org.springframework.security.AccessDeniedException;
import org.springframework.security.ConfigAttributeDefinition;

34
org.springframework.integration.security/src/test/java/org/springframework/integration/security/endpoint/TestTarget.java Normal file
View File

@@ -0,0 +1,34 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.endpoint;
import java.util.ArrayList;
import java.util.List;
import org.springframework.integration.message.Message;
import org.springframework.integration.message.MessageTarget;
public class TestTarget implements MessageTarget {
public List<Message<?>> sentMessages = new ArrayList<Message<?>>();
public boolean send(Message<?> message) {
sentMessages.add(message);
return true;
}
}