diff --git a/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelAccessPolicy.java b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelAccessPolicy.java index 6019ffce72..2f1c7e1014 100644 --- a/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelAccessPolicy.java +++ b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelAccessPolicy.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2008 the original author or authors. + * Copyright 2002-2010 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,72 +13,21 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.integration.security.channel; import java.util.Collection; -import java.util.Collections; -import java.util.HashSet; import org.springframework.security.access.ConfigAttribute; -import org.springframework.security.access.SecurityConfig; -import org.springframework.util.Assert; -import org.springframework.util.StringUtils; /** - * Creates the {@link ConfigAttribute}s for secured channel - * send and receive operations based on simple String values. + * Interface to encapsulate {@link ConfigAttribute}s for secured channel + * send and receive operations. * - * @author Mark Fisher * @author Oleg Zhurakousky + * @since 2.0 */ -public class ChannelAccessPolicy { +public interface ChannelAccessPolicy { + public Collection getConfigAttributesForSend(); - private final Collection configAttributeDefinitionForSend; - - private final Collection configAttributeDefinitionForReceive; - - - /** - * Create an access policy instance. The provided 'sendAccess' and 'receiveAccess' - * values may be a single String or a comma-delimited list of values. All whitespace - * will be trimmed. A null value indicates that the policy does not - * apply for either send or receive access type. At most one of the values may be null. - */ - @SuppressWarnings("unchecked") - public ChannelAccessPolicy(String sendAccess, String receiveAccess) { - boolean sendAccessDefined = StringUtils.hasText(sendAccess); - boolean recieveAccessDefined = StringUtils.hasText(receiveAccess); - Assert.isTrue(sendAccessDefined || recieveAccessDefined, - "At least one of 'sendAccess' and 'receiveAccess' must not be null."); - - if (sendAccessDefined){ - String[] sendAccessValues = StringUtils.commaDelimitedListToStringArray(sendAccess); - configAttributeDefinitionForSend = new HashSet(); - for (String sendAccessValue : sendAccessValues) { - configAttributeDefinitionForSend.add(new SecurityConfig(StringUtils.trimAllWhitespace(sendAccessValue))); - } - } else { - configAttributeDefinitionForSend = Collections.EMPTY_SET; - } - if (recieveAccessDefined){ - String[] receiveAccessValues = StringUtils.commaDelimitedListToStringArray(receiveAccess); - configAttributeDefinitionForReceive = new HashSet(); - for (String receiveAccessValue : receiveAccessValues) { - configAttributeDefinitionForReceive.add(new SecurityConfig(StringUtils.trimAllWhitespace(receiveAccessValue))); - } - } else { - configAttributeDefinitionForReceive = Collections.EMPTY_SET; - } - } - - - public Collection getConfigAttributeDefinitionForSend() { - return this.configAttributeDefinitionForSend; - } - - public Collection getConfigAttributeDefinitionForReceive() { - return this.configAttributeDefinitionForReceive; - } - -} + public Collection getConfigAttributesForReceive(); +} \ No newline at end of file diff --git a/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelInvocationDefinitionSource.java b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelInvocationDefinitionSource.java index f1f92cc6f4..70a3a5cda7 100644 --- a/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelInvocationDefinitionSource.java +++ b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelInvocationDefinitionSource.java @@ -72,13 +72,13 @@ public class ChannelInvocationDefinitionSource implements SecurityMetadataSource ChannelAccessPolicy accessPolicy = mapping.getValue(); if (pattern.matcher(channelName).matches()) { if (invocation.isSend()) { - Collection definition = accessPolicy.getConfigAttributeDefinitionForSend(); + Collection definition = accessPolicy.getConfigAttributesForSend(); if (definition != null) { attributes.addAll(definition); } } else if (invocation.isReceive()) { - Collection definition = accessPolicy.getConfigAttributeDefinitionForReceive(); + Collection definition = accessPolicy.getConfigAttributesForReceive(); if (definition != null) { attributes.addAll(definition); } @@ -92,9 +92,9 @@ public class ChannelInvocationDefinitionSource implements SecurityMetadataSource Set allAttributes = new HashSet(); for (ChannelAccessPolicy policy : patternMappings.values()) { - Collection receiveAttributes = policy.getConfigAttributeDefinitionForReceive(); + Collection receiveAttributes = policy.getConfigAttributesForReceive(); allAttributes.addAll(receiveAttributes); - Collection sendAttributes = policy.getConfigAttributeDefinitionForSend(); + Collection sendAttributes = policy.getConfigAttributesForSend(); allAttributes.addAll(sendAttributes); } diff --git a/spring-integration-security/src/main/java/org/springframework/integration/security/channel/DefaultChannelAccessPolicy.java b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/DefaultChannelAccessPolicy.java new file mode 100644 index 0000000000..1237788b25 --- /dev/null +++ b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/DefaultChannelAccessPolicy.java @@ -0,0 +1,84 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security.channel; + +import java.util.Collection; +import java.util.Collections; +import java.util.HashSet; + +import org.springframework.security.access.ConfigAttribute; +import org.springframework.security.access.SecurityConfig; +import org.springframework.util.Assert; +import org.springframework.util.StringUtils; + +/** + * Creates the {@link ConfigAttribute}s for secured channel + * send and receive operations based on simple String values. + * + * @author Mark Fisher + * @author Oleg Zhurakousky + */ +public class DefaultChannelAccessPolicy implements ChannelAccessPolicy { + + private final Collection configAttributeDefinitionForSend; + + private final Collection configAttributeDefinitionForReceive; + + + /** + * Create an access policy instance. The provided 'sendAccess' and 'receiveAccess' + * values may be a single String or a comma-delimited list of values. All whitespace + * will be trimmed. A null value indicates that the policy does not + * apply for either send or receive access type. At most one of the values may be null. + */ + @SuppressWarnings("unchecked") + public DefaultChannelAccessPolicy(String sendAccess, String receiveAccess) { + boolean sendAccessDefined = StringUtils.hasText(sendAccess); + boolean recieveAccessDefined = StringUtils.hasText(receiveAccess); + Assert.isTrue(sendAccessDefined || recieveAccessDefined, + "At least one of 'sendAccess' and 'receiveAccess' must not be null."); + + if (sendAccessDefined){ + String[] sendAccessValues = StringUtils.commaDelimitedListToStringArray(sendAccess); + configAttributeDefinitionForSend = new HashSet(); + for (String sendAccessValue : sendAccessValues) { + configAttributeDefinitionForSend.add(new SecurityConfig(StringUtils.trimAllWhitespace(sendAccessValue))); + } + } else { + configAttributeDefinitionForSend = Collections.EMPTY_SET; + } + if (recieveAccessDefined){ + String[] receiveAccessValues = StringUtils.commaDelimitedListToStringArray(receiveAccess); + configAttributeDefinitionForReceive = new HashSet(); + for (String receiveAccessValue : receiveAccessValues) { + configAttributeDefinitionForReceive.add(new SecurityConfig(StringUtils.trimAllWhitespace(receiveAccessValue))); + } + } else { + configAttributeDefinitionForReceive = Collections.EMPTY_SET; + } + } + + + public Collection getConfigAttributesForSend() { + return this.configAttributeDefinitionForSend; + } + + public Collection getConfigAttributesForReceive() { + return this.configAttributeDefinitionForReceive; + } + +} diff --git a/spring-integration-security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java b/spring-integration-security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java index 0eb5a4fa49..5bb69d63d3 100644 --- a/spring-integration-security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java +++ b/spring-integration-security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java @@ -83,7 +83,7 @@ public class SecuredChannelsParser extends AbstractSingleBeanDefinitionParser { "At least one of 'send-access' or 'receive-access' must be provided.", accessPolicyElement); } BeanDefinitionBuilder accessPolicyBuilder = BeanDefinitionBuilder.genericBeanDefinition( - BASE_PACKAGE_NAME + ".channel.ChannelAccessPolicy"); + BASE_PACKAGE_NAME + ".channel.DefaultChannelAccessPolicy"); accessPolicyBuilder.addConstructorArgValue(sendAccess); accessPolicyBuilder.addConstructorArgValue(receiveAccess); accessPolicyBuilder.getBeanDefinition().setRole(BeanDefinition.ROLE_SUPPORT); diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorBeanPostProcessorTests.java b/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorBeanPostProcessorTests.java index c982624230..0c42d0943a 100644 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorBeanPostProcessorTests.java +++ b/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorBeanPostProcessorTests.java @@ -36,7 +36,7 @@ public class ChannelSecurityInterceptorBeanPostProcessorTests { @Test public void securedChannelIsProxied() { ChannelInvocationDefinitionSource objectDefinitionSource = new ChannelInvocationDefinitionSource(); - objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new ChannelAccessPolicy("ROLE_ADMIN", null)); + objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new DefaultChannelAccessPolicy("ROLE_ADMIN", null)); ChannelSecurityInterceptor interceptor = new ChannelSecurityInterceptor(objectDefinitionSource); ChannelSecurityInterceptorBeanPostProcessor postProcessor = new ChannelSecurityInterceptorBeanPostProcessor(interceptor); QueueChannel securedChannel = new QueueChannel(); @@ -48,7 +48,7 @@ public class ChannelSecurityInterceptorBeanPostProcessorTests { @Test public void nonsecuredChannelIsNotProxied() { ChannelInvocationDefinitionSource objectDefinitionSource = new ChannelInvocationDefinitionSource(); - objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new ChannelAccessPolicy("ROLE_ADMIN", null)); + objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new DefaultChannelAccessPolicy("ROLE_ADMIN", null)); ChannelSecurityInterceptor interceptor = new ChannelSecurityInterceptor(objectDefinitionSource); ChannelSecurityInterceptorBeanPostProcessor postProcessor = new ChannelSecurityInterceptorBeanPostProcessor(interceptor); QueueChannel channel = new QueueChannel(); diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java b/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java index 608991d2fd..1a245ba125 100644 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java +++ b/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java @@ -80,7 +80,7 @@ public class ChannelSecurityInterceptorTests { private static ChannelSecurityInterceptor createInterceptor(String role) throws Exception { ChannelInvocationDefinitionSource objectDefinitionSource = new ChannelInvocationDefinitionSource(); - objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new ChannelAccessPolicy(role, null)); + objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new DefaultChannelAccessPolicy(role, null)); ChannelSecurityInterceptor interceptor = new ChannelSecurityInterceptor(objectDefinitionSource); AffirmativeBased accessDecisionManager = new AffirmativeBased(); diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java b/spring-integration-security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java index 410e02ff1d..fbcd19d48c 100644 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java +++ b/spring-integration-security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java @@ -43,7 +43,6 @@ import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertNotNull; -import static org.junit.Assert.assertNull; import static org.junit.Assert.assertTrue; /** @@ -73,8 +72,8 @@ public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice(); ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor); assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy); - Collection sendDefinition = policy.getConfigAttributeDefinitionForSend(); - Collection receiveDefinition = policy.getConfigAttributeDefinitionForReceive(); + Collection sendDefinition = policy.getConfigAttributesForSend(); + Collection receiveDefinition = policy.getConfigAttributesForReceive(); assertTrue("ROLE_ADMIN not found as send attribute", this.getRolesFromDefintion(sendDefinition).contains("ROLE_ADMIN")); assertTrue("Policy applies to receive", receiveDefinition.size() == 0); } @@ -91,8 +90,8 @@ public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice(); ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor); assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy); - Collection sendDefinition = policy.getConfigAttributeDefinitionForSend(); - Collection receiveDefinition = policy.getConfigAttributeDefinitionForReceive(); + Collection sendDefinition = policy.getConfigAttributesForSend(); + Collection receiveDefinition = policy.getConfigAttributesForReceive(); Collection sendRoles = this.getRolesFromDefintion(sendDefinition); assertTrue("ROLE_ADMIN not found as send attribute", sendRoles.contains("ROLE_ADMIN")); assertTrue("ROLE_USER not found as send attribute", sendRoles.contains("ROLE_USER")); @@ -111,8 +110,8 @@ public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice(); ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor); assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy); - Collection sendDefinition = policy.getConfigAttributeDefinitionForSend(); - Collection receiveDefinition = policy.getConfigAttributeDefinitionForReceive(); + Collection sendDefinition = policy.getConfigAttributesForSend(); + Collection receiveDefinition = policy.getConfigAttributesForReceive(); Collection receiveRoles = this.getRolesFromDefintion(receiveDefinition); assertTrue("ROLE_ADMIN not found as receive attribute", receiveRoles.contains("ROLE_ADMIN")); assertTrue("Policy applies to receive", sendDefinition.size() == 0); @@ -130,8 +129,8 @@ public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice(); ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor); assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy); - Collection sendDefinition = policy.getConfigAttributeDefinitionForSend(); - Collection receiveDefinition = policy.getConfigAttributeDefinitionForReceive(); + Collection sendDefinition = policy.getConfigAttributesForSend(); + Collection receiveDefinition = policy.getConfigAttributesForReceive(); Collection receiveRoles = this.getRolesFromDefintion(receiveDefinition); assertTrue("ROLE_ADMIN not found as receive attribute", receiveRoles.contains("ROLE_ADMIN")); assertTrue("ROLE_USER not found as receive attribute", receiveRoles.contains("ROLE_USER")); @@ -150,8 +149,8 @@ public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice(); ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor); assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy); - Collection sendDefinition = policy.getConfigAttributeDefinitionForSend(); - Collection receiveDefinition = policy.getConfigAttributeDefinitionForReceive(); + Collection sendDefinition = policy.getConfigAttributesForSend(); + Collection receiveDefinition = policy.getConfigAttributesForReceive(); assertNotNull("Pattern does not apply to 'send'", sendDefinition); assertNotNull("Pattern does not apply to 'receive'", receiveDefinition); Collection sendRoles = this.getRolesFromDefintion(sendDefinition);