Added support for secured channels and SecurityContext propagation within messages (INT-117).

org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptorTests.java

@@ -0,0 +1,147 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotSame;
+import static org.junit.Assert.assertNull;
+
+import org.junit.Test;
+
+import org.springframework.integration.handler.MessageHandler;
+import org.springframework.integration.message.Message;
+import org.springframework.integration.message.StringMessage;
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContext;
+import org.springframework.security.context.SecurityContextHolder;
+
+/**
+ * @author Jonas Partner
+ */
+public class SecurityContextAssociatingHandlerInterceptorTests {
+
+	@Test
+	public void testMessageWithSecurityContext() {
+		final StubSecurityContext securityContext = new StubSecurityContext();
+		StringMessage message = new StringMessage("test");
+		message.getHeader().setAttribute(
+				SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext);
+		MessageHandler handler = new MessageHandler() {
+			public Message<?> handle(Message<?> message) {
+				SecurityContext associatedContext = SecurityContextHolder.getContext();
+				assertEquals("Wrong security context", securityContext, associatedContext);
+				return null;
+			}
+		};
+		SecurityContextAssociatingHandlerInterceptor associatingInterceptor =
+				new SecurityContextAssociatingHandlerInterceptor(handler);
+		associatingInterceptor.handle(message);
+		assertNull("Security context still present after handler returned",
+				SecurityContextHolder.getContext().getAuthentication());
+	}
+
+	@Test(expected = AccessDeniedException.class)
+	public void testForSecurityLeakageIfHandlerThrowsException() {
+		final StubSecurityContext securityContext = new StubSecurityContext();
+		StringMessage message = new StringMessage("test");
+		message.getHeader().setAttribute(
+				SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext);
+		MessageHandler handler = new MessageHandler() {
+			public Message<?> handle(Message<?> message) {
+				SecurityContext associatedContext = SecurityContextHolder.getContext();
+				assertEquals("Wrong security context", securityContext, associatedContext);
+				throw new AccessDeniedException("Not allowed");
+			}
+		};
+		SecurityContextAssociatingHandlerInterceptor associatingInterceptor = 
+				new SecurityContextAssociatingHandlerInterceptor(handler);
+		try {
+			associatingInterceptor.handle(message);
+		}
+		finally {
+			assertNull("Security context still present after handler threw exception",
+					SecurityContextHolder.getContext().getAuthentication());
+		}
+	}
+
+	@Test
+	public void testMessageWithoutSecurityContext() {
+		final StubSecurityContext securityContext = new StubSecurityContext();
+		StringMessage message = new StringMessage("test");
+		MessageHandler handler = new MessageHandler() {
+			public Message<?> handle(Message<?> message) {
+				SecurityContext associatedContext = SecurityContextHolder.getContext();
+				assertNotSame("Wrong security context", securityContext, associatedContext);
+				return null;
+			}
+		};
+		SecurityContextAssociatingHandlerInterceptor associatingInterceptor =
+				new SecurityContextAssociatingHandlerInterceptor(handler);
+		associatingInterceptor.handle(message);
+		assertNull("Security context still present after handler returned",
+				SecurityContextHolder.getContext().getAuthentication());
+	}
+
+
+	@SuppressWarnings("serial")
+	private static class StubSecurityContext implements SecurityContext {
+
+		StubAuthentication stubAuthentication = new StubAuthentication();
+
+		public Authentication getAuthentication() {
+			return stubAuthentication;
+		}
+
+		public void setAuthentication(Authentication authentication) {
+		}
+	}
+
+
+	@SuppressWarnings("serial")
+	private static class StubAuthentication implements Authentication {
+
+		public GrantedAuthority[] getAuthorities() {
+			return null;
+		}
+
+		public Object getCredentials() {
+			return null;
+		}
+
+		public Object getDetails() {
+			return null;
+		}
+
+		public Object getPrincipal() {
+			return null;
+		}
+
+		public boolean isAuthenticated() {
+			return false;
+		}
+
+		public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
+		}
+
+		public String getName() {
+			return null;
+		}
+	}
+
+}

org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptorTests.java

@@ -0,0 +1,133 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import org.springframework.integration.channel.QueueChannel;
+import org.springframework.integration.message.MessageHeader;
+import org.springframework.integration.message.StringMessage;
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContext;
+import org.springframework.security.context.SecurityContextHolder;
+
+/**
+ * @author Jonas Partner
+ */
+public class SecurityContextPropagatingChannelInterceptorTests {
+	
+	private QueueChannel channel;
+
+	private SecurityContextPropagatingChannelInterceptor securityPropogatingChannelInterceptor;
+	
+	private StubSecurityContext securityContext;
+
+
+	@Before
+	public void setUp() {
+		this.channel = new QueueChannel();
+		this.securityPropogatingChannelInterceptor = new SecurityContextPropagatingChannelInterceptor();
+		this.channel.addInterceptor(securityPropogatingChannelInterceptor);
+		this.securityContext = new StubSecurityContext();
+	}
+
+	@After
+	public void tearDown(){
+		SecurityContextHolder.clearContext();
+	}
+
+
+	@Test
+	public void testPropogationWhenSecurityContextExists() {
+		this.associateContextWithThread();
+		StringMessage message = new StringMessage("test");
+		this.channel.send(message);
+		message = (StringMessage) channel.receive(0);
+		MessageHeader header = message.getHeader();
+		assertTrue("No security context attribute found in header.",
+				header.getAttributeNames().contains(SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE));
+		SecurityContext contextFromHeader = (SecurityContext) header.getAttribute(
+				SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE);
+		assertEquals("Incorrect security context in message header.", securityContext, contextFromHeader);
+	}	
+
+	@Test
+	public void testHeaderNotSetWhenNoSecurityContextExists() {
+		StringMessage message = new StringMessage("test");
+		channel.send(message);
+		message = (StringMessage) channel.receive(0);
+		MessageHeader header = message.getHeader();
+		assertFalse("Security context header found when no security context existed.",
+				header.getAttributeNames().contains(SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE));
+	}
+
+
+	private void associateContextWithThread(){
+		SecurityContextHolder.setContext(securityContext);
+	}	
+
+
+	@SuppressWarnings("serial")
+	private static class StubSecurityContext implements SecurityContext{
+
+		private Authentication authentication = new Authentication() {
+
+			public GrantedAuthority[] getAuthorities() {
+				return null;
+			}
+
+			public Object getCredentials() {
+				return null;
+			}
+
+			public Object getDetails() {
+				return null;
+			}
+
+			public Object getPrincipal() {
+				return null;
+			}
+
+			public boolean isAuthenticated() {
+				return false;
+			}
+
+			public void setAuthenticated(boolean isAuthenticated)
+					throws IllegalArgumentException {
+			}
+
+			public String getName() {
+				return null;
+			}
+		};
+
+		public Authentication getAuthentication() {
+			return authentication;
+		}
+
+		public void setAuthentication(Authentication authentication) {
+		}
+	}
+
+}

org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptorTests.java

@@ -0,0 +1,150 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security;
+
+import static org.junit.Assert.assertEquals;
+
+import org.junit.Before;
+import org.junit.Test;
+
+import org.springframework.integration.channel.QueueChannel;
+import org.springframework.integration.message.StringMessage;
+import org.springframework.security.AccessDecisionManager;
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.Authentication;
+import org.springframework.security.ConfigAttribute;
+import org.springframework.security.ConfigAttributeDefinition;
+import org.springframework.security.InsufficientAuthenticationException;
+
+/**
+ * @author Jonas Partner
+ */
+public class SecurityEnforcingChannelInterceptorTests {
+
+	private QueueChannel channel;
+
+	private SecurityEnforcingChannelInterceptor securityChannelInterceptor;
+
+
+	@Before
+	public void setUp() {
+		channel = new QueueChannel();
+	}
+
+
+	@Test(expected = AccessDeniedException.class)
+	public void testSendSecuredAndAccessDenied() {
+		try {
+			Runnable decision = new Runnable() {
+				public void run() {
+					throw new AccessDeniedException("nope");
+				}
+			};
+			this.registerInterceptor(new ConfigurableAccessDecisionManager(decision));
+			this.securityChannelInterceptor.setSendSecurityAttributes(new ConfigAttributeDefinition("ROLE_ADMIN"));
+			this.channel.send(new StringMessage("test"));
+		}
+		finally {
+			assertEquals("Wrong message count after refused send.", 0, channel.clear().size());
+		}
+	}
+
+	@Test
+	public void testUnsecuredSend() {
+		this.registerInterceptor(new ConfigurableAccessDecisionManager(null));
+		this.channel.send(new StringMessage("test"));
+		assertEquals("Wrong message count after send.", 1,channel.clear().size());
+	}
+
+	@Test
+	public void testSendSecuredAndAllowed() {
+		Runnable decision = new Runnable() {
+			public void run() {
+			}
+		};
+		this.registerInterceptor(new ConfigurableAccessDecisionManager(decision));
+		this.securityChannelInterceptor.setSendSecurityAttributes(new ConfigAttributeDefinition("ROLE_ADMIN"));
+		this.channel.send(new StringMessage("test"));
+		assertEquals("Wrong message count after send", 1, channel.clear().size());
+	}
+
+	@Test
+	public void testReceiveSecuredAndAllowed() {
+		Runnable decision = new Runnable() {
+			public void run() {
+			}
+		};
+		this.registerInterceptor(new ConfigurableAccessDecisionManager(decision));
+		this.securityChannelInterceptor.setReceiveSecurityAttributes(new ConfigAttributeDefinition("ROLE_ADMIN"));
+		this.channel.receive(0);
+	}
+
+	@Test(expected = AccessDeniedException.class)
+	public void testReceiveSecuredAndAccessDenied() {
+		Runnable decision = new Runnable() {
+			public void run() {
+				throw new AccessDeniedException("nope");
+			}
+		};
+		this.registerInterceptor(new ConfigurableAccessDecisionManager(decision));
+		this.securityChannelInterceptor.setReceiveSecurityAttributes(new ConfigAttributeDefinition("ROLE_ADMIN"));
+		this.channel.receive(0);
+	}
+
+	@Test
+	public void testReceiveUnsecured() {
+		Runnable decision = new Runnable() {
+			public void run() {
+				throw new AccessDeniedException("nope");
+			}
+		};
+		this.registerInterceptor(new ConfigurableAccessDecisionManager(decision));
+		this.channel.receive(0);
+	}
+
+
+	private void registerInterceptor(AccessDecisionManager accessDecisionManager) {
+		securityChannelInterceptor = new SecurityEnforcingChannelInterceptor(
+				accessDecisionManager, channel);
+	
+	}
+
+
+	private static class ConfigurableAccessDecisionManager implements AccessDecisionManager {
+
+		private Runnable decisionRunner;
+
+		public ConfigurableAccessDecisionManager(Runnable decision) {
+			this.decisionRunner = decision;
+		}
+
+		public void decide(Authentication authentication, Object object, ConfigAttributeDefinition config)
+				throws AccessDeniedException, InsufficientAuthenticationException {
+			this.decisionRunner.run();
+		}
+
+		public boolean supports(ConfigAttribute attribute) {
+			return true;
+		}
+
+		@SuppressWarnings("unchecked")
+		public boolean supports(Class clazz) {
+			return true;
+		}
+	}
+
+}

org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-noPropagationByDefaultContext.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans:beans xmlns="http://www.springframework.org/schema/integration"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+              http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
+              http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
+              http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
+
+	<beans:import resource="commonSecurityConfiguration.xml"/>
+
+	<message-bus/>
+
+	<channel id="propagationDefault"/>
+
+	<channel id="excludedFromPropagation">
+		<secured propagate="false"/>
+	</channel>
+
+</beans:beans>

org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-propagateByDefaultContext.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans:beans xmlns="http://www.springframework.org/schema/integration"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+              http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
+              http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
+              http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
+
+	<beans:import resource="commonSecurityConfiguration.xml"/>
+
+	<message-bus/>
+
+	<secure-channels propagate="true"/>
+
+	<channel id="propagationDefault"/>
+
+	<channel id="excludedFromPropagation">
+		<secured propagate="false"/>
+	</channel>
+
+	<channel id="includedInProaogation">
+		<secured propagate="true"/>
+	</channel>
+
+</beans:beans>

org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests.java

@@ -0,0 +1,103 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.config;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.After;
+import org.junit.Test;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.beans.factory.config.AutowireCapableBeanFactory;
+import org.springframework.context.support.ClassPathXmlApplicationContext;
+import org.springframework.integration.channel.MessageChannel;
+import org.springframework.integration.message.StringMessage;
+import org.springframework.security.context.SecurityContext;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.context.SecurityContextImpl;
+import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
+
+/**
+ * @author Jonas Partner
+ */
+public class SecureChannelsParserTests {
+
+	private ClassPathXmlApplicationContext applicationContext;
+
+	@Autowired
+	@Qualifier("propagationDefault")
+	MessageChannel propagationDefault;
+
+	@Autowired
+	@Qualifier("excludedFromPropagation")
+	MessageChannel excludedFromPropagation;
+
+
+	@After
+	public void tearDown() {
+		if (applicationContext != null) {
+			applicationContext.close();
+		}
+	}
+
+
+	@Test
+	public void testPropagationByDefault() {
+		loadApplicationContext(this.getClass().getSimpleName() + "-propagateByDefaultContext.xml");
+		assertTrue("security context did not propagate by setting message bus level default",
+				channelPropagatesSecurityContext(propagationDefault));
+	}
+
+	@Test
+	public void testNoPropagationOnExcludedChannel() {
+		loadApplicationContext(this.getClass().getSimpleName() + "-propagateByDefaultContext.xml");
+		assertFalse("security context propagated when channel was explicitly excluded",
+				channelPropagatesSecurityContext(excludedFromPropagation));
+	}
+
+	@Test
+	public void testNoPropagationWithNoDefaultPropagation() {
+		loadApplicationContext(this.getClass().getSimpleName() + "-noPropagationByDefaultContext.xml");
+		assertFalse("security context propagated when channel default was false and no secured tag present",
+				channelPropagatesSecurityContext(propagationDefault));
+	}
+
+
+	private boolean channelPropagatesSecurityContext(MessageChannel channel) {
+		login("bob", "bobspassword");
+		channel.send(new StringMessage("testMessage"));
+		SecurityContext context = (SecurityContext)
+				channel.receive(-1).getHeader().getAttribute("SPRING_SECURITY_CONTEXT");
+		return context != null;
+	}
+
+	private void login(String username, String password) {
+		UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(username, password);
+		SecurityContext context = new SecurityContextImpl();
+		context.setAuthentication(authToken);
+		SecurityContextHolder.setContext(context);
+	}
+
+	private void loadApplicationContext(String resource) {
+		this.applicationContext = new ClassPathXmlApplicationContext(resource, this.getClass());
+		AutowireCapableBeanFactory beanFactory = this.applicationContext.getAutowireCapableBeanFactory();
+		beanFactory.autowireBean(this);
+	}
+
+}

org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests-context.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans:beans xmlns="http://www.springframework.org/schema/integration"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+              http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
+              http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
+              http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
+
+	<beans:import resource="commonSecurityConfiguration.xml"/>
+
+	<message-bus/>
+
+	<channel id="unsecured" />	 
+
+	<channel id="adminRequiredForSend" >
+		<secured send-access="ROLE_ADMIN" />
+	</channel>
+
+	<channel id="adminRequiredForReceive" >
+		<secured receive-access="ROLE_ADMIN" />
+	</channel>
+
+	<channel id="adminRequiredForSendAndReceive">
+		<secured send-access="ROLE_ADMIN" receive-access="ROLE_ADMIN" />
+	</channel>
+
+</beans:beans>

org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests.java

@@ -0,0 +1,137 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.config;
+
+import static org.junit.Assert.assertNotNull;
+
+import org.junit.After;
+import org.junit.Test;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.integration.channel.MessageChannel;
+import org.springframework.integration.message.StringMessage;
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.context.SecurityContext;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.context.SecurityContextImpl;
+import org.springframework.security.providers.AuthenticationProvider;
+import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests;
+
+/**
+ * @author Jonas Partner
+ */
+@ContextConfiguration
+public class SecuredParserTests extends AbstractJUnit4SpringContextTests{
+
+	@Autowired
+	private AuthenticationProvider provider;
+	
+	@Autowired
+	@Qualifier("unsecured")
+	public MessageChannel unsecuredChannel;
+	
+	@Autowired
+	@Qualifier("adminRequiredForSend")
+	public MessageChannel adminRequiredForSend;
+	
+	@Autowired
+	@Qualifier("adminRequiredForReceive")
+	public MessageChannel adminRequiredForReceive;
+	
+	@Autowired
+	@Qualifier("adminRequiredForSendAndReceive")
+	public MessageChannel adminRequiredForSendAndReceive;
+
+
+	@After
+	public void tearDown() {
+		SecurityContextHolder.clearContext();
+	}
+
+
+	@Test
+	public void testNoSecurityRestrictionsOnChannel() {
+		unsecuredChannel.send(new StringMessage("testUnsecured"));
+		assertNotNull("Message not received ", unsecuredChannel.receive(0));
+	}
+
+	@Test
+	public void testAdminRequiredForSendWithAccessGranted() {
+		login("jimi", "jimispassword");
+		adminRequiredForSend.send(new StringMessage("testmessage"));
+		SecurityContextHolder.clearContext();
+		assertNotNull("Message not received", adminRequiredForSend.receive(0));
+	}
+
+	@Test(expected=AccessDeniedException.class)
+	public void testAdminRequiredForSendWithAccessDenied() {
+		login("bob", "bobspassword");
+		adminRequiredForSend.send(new StringMessage("testmessage"));
+	}
+
+	@Test
+	public void testAdminRequiredForReceiveWithAccessGranted(){
+		adminRequiredForReceive.send(new StringMessage("testmessage"));
+		login("jimi", "jimispassword");
+		assertNotNull("Message not received", adminRequiredForReceive.receive(0));
+	}
+
+	@Test(expected=AccessDeniedException.class)
+	public void testAdminRequiredForReceiveWithAccessDenied() {
+		adminRequiredForReceive.send(new StringMessage("testmessage"));
+		login("bob", "bobspassword");
+		adminRequiredForReceive.receive(0);
+	}
+
+	@Test
+	public void testAdminRequiredForSendAndReceiveWithSendAccessGranted() {
+		login("jimi", "jimispassword");
+		adminRequiredForSendAndReceive.send(new StringMessage("test"));
+	}
+
+	@Test(expected=AccessDeniedException.class)
+	public void testAdminRequiredForSendAndReceiveWithSendAccessDenied() {
+		login("bob", "bobspassword");
+		adminRequiredForSendAndReceive.send(new StringMessage("test"));
+	}
+
+	@Test
+	public void testAdminRequiredForSendAndReceiveWithReceiveAccessGranted() {
+		login("jimi", "jimispassword");
+		adminRequiredForSendAndReceive.send(new StringMessage("test"));
+		assertNotNull("Message not received", adminRequiredForSendAndReceive.receive(0));
+	}
+
+	@Test(expected=AccessDeniedException.class)
+	public void testAdminRequiredForSendAndReceiveWithReceiveAccessDenied() {
+		login("bob","bobspassword");
+		adminRequiredForSendAndReceive.receive(0);
+	}
+
+
+	private void login(String username, String password) {
+		UsernamePasswordAuthenticationToken authToken = (UsernamePasswordAuthenticationToken)
+				provider.authenticate(new UsernamePasswordAuthenticationToken(username, password));
+		SecurityContext context = new SecurityContextImpl();
+		context.setAuthentication(authToken);
+		SecurityContextHolder.setContext(context);
+	}
+
+}

org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/commonSecurityConfiguration.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans:beans xmlns="http://www.springframework.org/schema/integration"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+              http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
+              http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
+              http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
+
+	<context:annotation-config/>	
+
+	<beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
+		<beans:property name="allowIfAllAbstainDecisions" value="true"/>
+		<beans:property name="decisionVoters">
+			<beans:list>
+				<beans:bean class="org.springframework.security.vote.RoleVoter"/>
+			</beans:list>
+		</beans:property>
+	</beans:bean>
+
+	<security:authentication-provider user-service-ref="userDetailsService"/>
+
+	<security:user-service id="userDetailsService">
+		<security:user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN"/>
+		<security:user name="bob" password="bobspassword" authorities="ROLE_USER"/>
+	</security:user-service>
+
+</beans:beans>

org.springframework.integration.security/src/test/resources/log4j.properties

@@ -0,0 +1,8 @@
+log4j.rootCategory=WARN, stdout
+
+log4j.appender.stdout=org.apache.log4j.ConsoleAppender
+log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
+log4j.appender.stdout.layout.ConversionPattern=%c{1}: %m%n
+
+log4j.category.org.springframework.integration.security=DEBUG
+log4j.category.org.springframework.integration=INFO