diff --git a/org.springframework.integration.security/ivy.xml b/org.springframework.integration.security/ivy.xml index 10b8e7fb45..c75f711826 100644 --- a/org.springframework.integration.security/ivy.xml +++ b/org.springframework.integration.security/ivy.xml @@ -23,8 +23,10 @@ + + diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessor.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessor.java new file mode 100644 index 0000000000..f576150049 --- /dev/null +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessor.java @@ -0,0 +1,80 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security; + +import java.util.ArrayList; +import java.util.List; +import java.util.regex.Pattern; + +import org.springframework.beans.BeansException; +import org.springframework.beans.factory.config.BeanPostProcessor; +import org.springframework.core.Ordered; +import org.springframework.integration.channel.AbstractMessageChannel; +import org.springframework.integration.channel.ChannelInterceptor; + +/** + * Registers the provided {@link ChannelInterceptor} instance with any + * {@link AbstractMessageChannel} with a name matching the provided pattern + * @author Jonas Partner + * + */ +public class ChannelInterceptorRegisteringBeanPostProcessor implements BeanPostProcessor, Ordered { + + private final ChannelInterceptor channelInterceptor; + + private final List regexpPatterns; + + private int order; + + public ChannelInterceptorRegisteringBeanPostProcessor(ChannelInterceptor channelInterceptor, List patterns) { + this.channelInterceptor = channelInterceptor; + + this.regexpPatterns = new ArrayList(); + for (String stringPattern : patterns) { + regexpPatterns.add(Pattern.compile(stringPattern)); + } + } + + public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException { + if (AbstractMessageChannel.class.isAssignableFrom(bean.getClass()) && matchesPattern(beanName)) { + ((AbstractMessageChannel) bean).addInterceptor(channelInterceptor); + } + return bean; + } + + public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException { + return bean; + } + + public int getOrder() { + return order; + } + + public void setOrder(int order) { + this.order = order; + } + + protected boolean matchesPattern(String beanName) { + for (Pattern regexpPattern : regexpPatterns) { + if (regexpPattern.matcher(beanName).matches()) { + return true; + } + } + return false; + } + +} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptor.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptor.java index 5ebb38677f..fb7a7b47e8 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptor.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptor.java @@ -23,44 +23,42 @@ import org.springframework.security.context.SecurityContext; import org.springframework.security.context.SecurityContextHolder; /** - * Associates the {@link SecurityContext} propagated in the message header - * with the thread executing the handle call to a {@link MessageHandler}. + * Associates the {@link SecurityContext} propagated in the message header with + * the thread executing the handle call to a {@link MessageHandler}. * * @author Jonas Partner */ public class SecurityContextAssociatingHandlerInterceptor extends InterceptingMessageHandler { /** - * One time only set the strategy to be stack based to allow use of direct channels where push and pop is required rather than set and clear + * One time only set the strategy to be stack based to allow use of direct + * channels where push and pop is required rather than set and clear */ static { SecurityContextHolder.setStrategyName(StackBasedSecurityContextHolderStrategy.class.getName()); } - + public SecurityContextAssociatingHandlerInterceptor(MessageHandler target) { super(target); } - @Override public Message handle(Message message, MessageHandler target) { - if (message.getHeader().getAttributeNames().contains( - SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE)) { + if (message.getHeader().getAttributeNames().contains(SecurityContextUtils.SECURITY_CONTEXT_HEADER_ATTRIBUTE)) { return handleInSecurityContext(message, target); } return target.handle(message); } private Message handleInSecurityContext(Message message, MessageHandler target) { - SecurityContext context = (SecurityContext) message.getHeader().getAttribute( - SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE); + SecurityContext context = SecurityContextUtils.getSecurityContextFromHeader(message); SecurityContextHolder.setContext(context); - try{ + try { return target.handle(message); } finally { SecurityContextHolder.clearContext(); } - } + } } diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptor.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptor.java index 8f537afd78..e69de29bb2 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptor.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptor.java @@ -1,58 +0,0 @@ -/* - * Copyright 2002-2008 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security; - -import org.apache.commons.logging.Log; -import org.apache.commons.logging.LogFactory; - -import org.springframework.integration.channel.MessageChannel; -import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter; -import org.springframework.integration.message.Message; -import org.springframework.security.context.SecurityContext; -import org.springframework.security.context.SecurityContextHolder; - -/** - * Propagates the {@ link SecurityContext} associated with the current - * thread (if any) by adding it to the header of sent messages. - * - * @author Jonas Partner - */ -public class SecurityContextPropagatingChannelInterceptor extends ChannelInterceptorAdapter { - - public static final String SECURITY_CONTEXT_HEADER_ATTRIBUTE = "SPRING_SECURITY_CONTEXT"; - - - private final Log logger = LogFactory.getLog(this.getClass()); - - - @Override - public boolean preSend(Message message, MessageChannel channel) { - this.setSecurityContextAttribute(message); - return true; - } - - protected void setSecurityContextAttribute(Message message){ - SecurityContext securityContext = SecurityContextHolder.getContext(); - if (securityContext.getAuthentication() != null) { - message.getHeader().setAttribute(SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext); - } - else if (logger.isInfoEnabled()) { - logger.info("No security context found"); - } - } - -} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextUtils.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextUtils.java new file mode 100644 index 0000000000..753e6320cd --- /dev/null +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextUtils.java @@ -0,0 +1,38 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security; + +import org.springframework.integration.message.Message; +import org.springframework.security.context.SecurityContext; + +/** + * @author Jonas Partner + * + */ +public class SecurityContextUtils { + + public static final String SECURITY_CONTEXT_HEADER_ATTRIBUTE = "SPRING_SECURITY_CONTEXT"; + + public static SecurityContext getSecurityContextFromHeader(Message message) { + return (SecurityContext) message.getHeader().getAttribute(SECURITY_CONTEXT_HEADER_ATTRIBUTE); + } + + public static void setSecurityContextHeader(SecurityContext sctx, Message message) { + message.getHeader().setAttribute(SECURITY_CONTEXT_HEADER_ATTRIBUTE, sctx); + } + +} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptor.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptor.java index 1df1ff8c78..e69de29bb2 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptor.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptor.java @@ -1,102 +0,0 @@ -/* - * Copyright 2002-2008 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security; - -import org.springframework.integration.channel.AbstractMessageChannel; -import org.springframework.integration.channel.MessageChannel; -import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter; -import org.springframework.integration.message.Message; -import org.springframework.security.AccessDecisionManager; -import org.springframework.security.ConfigAttributeDefinition; -import org.springframework.security.context.SecurityContextHolder; -import org.springframework.util.Assert; - -/** - * Delegates to the provided instance of {@link AccessDecisionManager} to - * enforce the security on the send and receive calls on the {@ MessageChannel}. - * - * @author Jonas Partner - */ -public class SecurityEnforcingChannelInterceptor extends ChannelInterceptorAdapter{ - - private final AccessDecisionManager accessDecisionManger; - - private final String channelName; - - private volatile ConfigAttributeDefinition sendSecurityAttributes; - - private volatile ConfigAttributeDefinition receiveSecurityAttributes; - - - public SecurityEnforcingChannelInterceptor(AccessDecisionManager accessDecisionManager, AbstractMessageChannel channelToSecure) { - Assert.notNull(accessDecisionManager, "AccessDecisionManager must not be null"); - Assert.notNull(channelToSecure, "channel to secure must not be null"); - this.accessDecisionManger = accessDecisionManager; - this.channelName = channelToSecure.getName(); - channelToSecure.addInterceptor(this); - } - - - public ConfigAttributeDefinition getSendSecurityAttributes() { - return this.sendSecurityAttributes; - } - - public void setSendSecurityAttributes(ConfigAttributeDefinition sendSecurityAttributes) { - this.sendSecurityAttributes = sendSecurityAttributes; - } - - public ConfigAttributeDefinition getReceiveSecurityAttributes() { - return this.receiveSecurityAttributes; - } - - public void setReceiveSecurityAttributes(ConfigAttributeDefinition receiveSecurityAttributes) { - this.receiveSecurityAttributes = receiveSecurityAttributes; - } - - @Override - public boolean preSend(Message message, MessageChannel channel) { - this.checkSend(channel); - return true; - } - - @Override - public boolean preReceive(MessageChannel channel) { - this.checkReceive(channel); - return super.preReceive(channel); - } - - private void checkSend(MessageChannel channel){ - this.checkPermission(channel, this.sendSecurityAttributes); - } - - private void checkReceive(MessageChannel channel){ - this.checkPermission(channel, this.receiveSecurityAttributes); - } - - private void checkPermission(MessageChannel messageChannel, ConfigAttributeDefinition securityAttributes){ - if (securityAttributes != null) { - this.accessDecisionManger.decide(SecurityContextHolder.getContext().getAuthentication(), - messageChannel, securityAttributes); - } - } - - @Override - public String toString() { - return getClass().getName() + " for channel '" + this.channelName + "'"; - } - -} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptor.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptor.java new file mode 100644 index 0000000000..7a28af9c7e --- /dev/null +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptor.java @@ -0,0 +1,55 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security.channel; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + +import org.springframework.integration.channel.MessageChannel; +import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter; +import org.springframework.integration.message.Message; +import org.springframework.integration.security.SecurityContextUtils; +import org.springframework.security.context.SecurityContext; +import org.springframework.security.context.SecurityContextHolder; + +/** + * Propagates the {@ link SecurityContext} associated with the current thread + * (if any) by adding it to the header of sent messages. + * + * @author Jonas Partner + */ +public class SecurityContextPropagatingChannelInterceptor extends ChannelInterceptorAdapter { + + private final Log logger = LogFactory.getLog(this.getClass()); + + @Override + public boolean preSend(Message message, MessageChannel channel) { + this.setSecurityContextAttribute(message); + return true; + } + + protected void setSecurityContextAttribute(Message message) { + SecurityContext securityContext = SecurityContextHolder.getContext(); + if (securityContext.getAuthentication() != null) { + SecurityContextUtils.setSecurityContextHeader(securityContext, message); + } + else if (logger.isInfoEnabled()) { + logger.info("No security context found"); + } + } + +} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptor.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptor.java new file mode 100644 index 0000000000..e58993386c --- /dev/null +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptor.java @@ -0,0 +1,90 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security.channel; + +import org.springframework.integration.channel.AbstractMessageChannel; +import org.springframework.integration.channel.MessageChannel; +import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter; +import org.springframework.integration.message.Message; +import org.springframework.security.AccessDecisionManager; +import org.springframework.security.ConfigAttributeDefinition; +import org.springframework.security.context.SecurityContextHolder; +import org.springframework.util.Assert; + +/** + * Delegates to the provided instance of {@link AccessDecisionManager} to + * enforce the security on the send and receive calls on the {@ MessageChannel}. + * + * @author Jonas Partner + */ +public class SecurityEnforcingChannelInterceptor extends ChannelInterceptorAdapter { + + private final AccessDecisionManager accessDecisionManger; + + private volatile ConfigAttributeDefinition sendSecurityAttributes; + + private volatile ConfigAttributeDefinition receiveSecurityAttributes; + + public SecurityEnforcingChannelInterceptor(AccessDecisionManager accessDecisionManager) { + Assert.notNull(accessDecisionManager, "AccessDecisionManager must not be null"); + this.accessDecisionManger = accessDecisionManager; + } + + public ConfigAttributeDefinition getSendSecurityAttributes() { + return this.sendSecurityAttributes; + } + + public void setSendSecurityAttributes(ConfigAttributeDefinition sendSecurityAttributes) { + this.sendSecurityAttributes = sendSecurityAttributes; + } + + public ConfigAttributeDefinition getReceiveSecurityAttributes() { + return this.receiveSecurityAttributes; + } + + public void setReceiveSecurityAttributes(ConfigAttributeDefinition receiveSecurityAttributes) { + this.receiveSecurityAttributes = receiveSecurityAttributes; + } + + @Override + public boolean preSend(Message message, MessageChannel channel) { + this.checkSend(channel); + return true; + } + + @Override + public boolean preReceive(MessageChannel channel) { + this.checkReceive(channel); + return super.preReceive(channel); + } + + private void checkSend(MessageChannel channel) { + this.checkPermission(channel, this.sendSecurityAttributes); + } + + private void checkReceive(MessageChannel channel) { + this.checkPermission(channel, this.receiveSecurityAttributes); + } + + private void checkPermission(MessageChannel messageChannel, ConfigAttributeDefinition securityAttributes) { + if (securityAttributes != null) { + this.accessDecisionManger.decide(SecurityContextHolder.getContext().getAuthentication(), messageChannel, + securityAttributes); + } + } + +} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java index 0aa9efeb44..0f27f472d5 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java @@ -26,8 +26,8 @@ import org.springframework.beans.factory.xml.NamespaceHandlerSupport; public class IntegrationSecurityNamespaceHandler extends NamespaceHandlerSupport { public void init() { - registerBeanDefinitionParser("secured", new SecuredParser()); - registerBeanDefinitionParser("secure-channels", new SecureChannelsParser()); + registerBeanDefinitionParser("secured-channels", new SecuredChannelsParser()); + registerBeanDefinitionParser("security-propagating-channels", new SecurityPropagatingChannelsParser()); } } diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecureChannelsParser.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecureChannelsParser.java index 5ae74315b9..e69de29bb2 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecureChannelsParser.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecureChannelsParser.java @@ -1,56 +0,0 @@ -/* - * Copyright 2002-2008 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security.config; - -import org.w3c.dom.Element; - -import org.springframework.beans.factory.BeanDefinitionStoreException; -import org.springframework.beans.factory.support.AbstractBeanDefinition; -import org.springframework.beans.factory.support.BeanDefinitionBuilder; -import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser; -import org.springframework.beans.factory.xml.ParserContext; -import org.springframework.security.context.SecurityContext; -import org.springframework.util.StringUtils; - -/** - * Interprets the <secure-channels> element which controls default - * {@link SecurityContext} propagation behaviour. - * - * @author Jonas Partner - */ -public class SecureChannelsParser extends AbstractSingleBeanDefinitionParser { - - @Override - protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) { - builder.getBeanDefinition().setAbstract(true); - String propagation = element.getAttribute("propagate"); - boolean propagateByDefault = true; - if (StringUtils.hasText(propagation)) { - propagateByDefault = Boolean.parseBoolean(propagation); - } - if (propagateByDefault) { - SecurityPropagatingBeanPostProcessorDefinitionHelper.setPropagationDefault(true, parserContext); - } - } - - @Override - protected String resolveId(Element element, AbstractBeanDefinition definition, ParserContext parserContext) - throws BeanDefinitionStoreException { - return "internal.integration.SecureChannels"; - } - -} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java new file mode 100644 index 0000000000..5ff3346b10 --- /dev/null +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java @@ -0,0 +1,126 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security.config; + +import java.util.ArrayList; +import java.util.List; + +import org.springframework.beans.factory.config.BeanDefinition; +import org.springframework.beans.factory.config.ConstructorArgumentValues.ValueHolder; +import org.springframework.beans.factory.support.BeanDefinitionBuilder; +import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser; +import org.springframework.beans.factory.xml.ParserContext; +import org.springframework.integration.security.ChannelInterceptorRegisteringBeanPostProcessor; +import org.springframework.integration.security.channel.SecurityEnforcingChannelInterceptor; +import org.springframework.security.ConfigAttributeDefinition; +import org.springframework.security.context.SecurityContext; +import org.springframework.util.StringUtils; +import org.w3c.dom.Element; +import org.w3c.dom.NodeList; + +/** + * Determines {@link SecurityContext} propagation behaviour for the parent + * element channel, and creates a {@link SecurityEnforcingChannelInterceptor} to + * control send and receive access if send-access and/or receive-access is + * specified. + * + * @author Jonas Partner + */ +public class SecuredChannelsParser extends AbstractSingleBeanDefinitionParser { + + public SecuredChannelsParser() { + super(); + } + + @Override + protected boolean shouldGenerateId() { + return true; + } + + @Override + protected boolean shouldGenerateIdAsFallback() { + return true; + } + + @Override + protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) { + String receiveAccess = element.getAttribute("receive-access"); + String sendAccess = element.getAttribute("send-access"); + String accessDecisionManager = element.getAttribute("access-decision-manager"); + String propagation = element.getAttribute("propagate"); + + BeanDefinition interceptorBeanDefinition = createSecurityEnforcingChannelInterceptor(accessDecisionManager, + sendAccess, receiveAccess); + + List patternList = processPatterns(element.getElementsByTagNameNS(element.getNamespaceURI(), + "channel-name-pattern")); + + builder.getBeanDefinition().setBeanClass(ChannelInterceptorRegisteringBeanPostProcessor.class); + builder.getBeanDefinition().getConstructorArgumentValues().addGenericArgumentValue( + new ValueHolder(interceptorBeanDefinition)); + builder.getBeanDefinition().getConstructorArgumentValues() + .addGenericArgumentValue(new ValueHolder(patternList)); + + setPropagation(Boolean.parseBoolean(propagation), patternList, parserContext); + } + + protected List processPatterns(NodeList patternList) { + List patterns = new ArrayList(); + for (int i = 0; i < patternList.getLength(); i++) { + Element patternElement = (Element) patternList.item(i); + patterns.add(patternElement.getTextContent()); + } + return patterns; + + } + + protected void setPropagation(boolean propagation, List patterns, ParserContext parserContext) { + for (String pattern : patterns) { + if (propagation) { + SecurityPropagatingBeanPostProcessorDefinitionHelper.addToIncludeChannelList(pattern, parserContext); + } + else { + SecurityPropagatingBeanPostProcessorDefinitionHelper.addToExcludeChannelList(pattern, parserContext); + } + } + + } + + protected BeanDefinition createSecurityEnforcingChannelInterceptor(String accessDecisionManager, String sendAccess, + String receiveAccess) { + if (!StringUtils.hasText(accessDecisionManager)) { + accessDecisionManager = "accessDecisionManager"; + } + BeanDefinitionBuilder beanDefinitionBuilder = BeanDefinitionBuilder + .genericBeanDefinition(SecurityEnforcingChannelInterceptor.class); + beanDefinitionBuilder.addConstructorArgReference(accessDecisionManager); + + if (StringUtils.hasText(sendAccess)) { + ConfigAttributeDefinition sendDefinition = new ConfigAttributeDefinition(StringUtils.tokenizeToStringArray( + sendAccess, ",")); + beanDefinitionBuilder.addPropertyValue("sendSecurityAttributes", sendDefinition); + } + if (StringUtils.hasText(receiveAccess)) { + ConfigAttributeDefinition receiveDefinition = new ConfigAttributeDefinition(StringUtils + .tokenizeToStringArray(receiveAccess, ",")); + beanDefinitionBuilder.addPropertyValue("receiveSecurityAttributes", receiveDefinition); + } + return beanDefinitionBuilder.getBeanDefinition(); + + } + +} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredParser.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredParser.java index 9f67858142..e69de29bb2 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredParser.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredParser.java @@ -1,84 +0,0 @@ -/* - * Copyright 2002-2008 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security.config; - -import org.w3c.dom.Element; - -import org.springframework.beans.factory.support.BeanDefinitionBuilder; -import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser; -import org.springframework.beans.factory.xml.ParserContext; -import org.springframework.integration.security.SecurityEnforcingChannelInterceptor; -import org.springframework.security.ConfigAttributeDefinition; -import org.springframework.security.context.SecurityContext; -import org.springframework.util.StringUtils; - -/** - * Determines {@link SecurityContext} propagation behaviour for the parent element - * channel, and creates a {@link SecurityEnforcingChannelInterceptor} to control - * send and receive access if send-access and/or receive-access is specified. - * - * @author Jonas Partner - */ -public class SecuredParser extends AbstractSingleBeanDefinitionParser { - - @Override - protected boolean shouldGenerateId() { - return false; - } - - @Override - protected boolean shouldGenerateIdAsFallback() { - return true; - } - - @Override - protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) { - String receiveAccess = element.getAttribute("receive-access"); - String sendAccess = element.getAttribute("send-access"); - String accessDecisionManager = element.getAttribute("access-decision-manager"); - String propagation = element.getAttribute("propagate"); - String channelName = ((Element)element.getParentNode()).getAttribute("id"); - if (channelName == null) { - parserContext.getReaderContext().error("The secured element requires a channel parent id.", element); - } - builder.getBeanDefinition().setBeanClass(SecurityEnforcingChannelInterceptor.class); - if (!StringUtils.hasText(accessDecisionManager)) { - accessDecisionManager = "accessDecisionManager"; - } - builder.addConstructorArgReference(accessDecisionManager); - builder.addConstructorArgReference(channelName); - if (StringUtils.hasText(sendAccess)) { - ConfigAttributeDefinition sendDefinition = new ConfigAttributeDefinition(sendAccess); - builder.addPropertyValue("sendSecurityAttributes", sendDefinition); - } - if (StringUtils.hasText(receiveAccess)) { - ConfigAttributeDefinition receiveDefinition = new ConfigAttributeDefinition(receiveAccess); - builder.addPropertyValue("receiveSecurityAttributes", receiveDefinition); - } - boolean propagationValue = true; - if (StringUtils.hasText(propagation)) { - propagationValue = Boolean.parseBoolean(propagation); - } - if (propagationValue) { - SecurityPropagatingBeanPostProcessorDefinitionHelper.addToIncludeChannelList(channelName, parserContext); - } - else { - SecurityPropagatingBeanPostProcessorDefinitionHelper.addToExcludeChannelList(channelName, parserContext); - } - } - -} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessor.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessor.java index 035d0512b0..ba2cef2efb 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessor.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessor.java @@ -18,40 +18,38 @@ package org.springframework.integration.security.config; import java.util.ArrayList; import java.util.List; +import java.util.regex.Pattern; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; - import org.springframework.beans.BeansException; import org.springframework.beans.factory.config.BeanPostProcessor; import org.springframework.core.Ordered; import org.springframework.integration.channel.AbstractMessageChannel; -import org.springframework.integration.security.SecurityContextPropagatingChannelInterceptor; +import org.springframework.integration.security.channel.SecurityContextPropagatingChannelInterceptor; /** * Post processes channels applying appropriate propagation behaviour. If - * default propagation is specified with a secure-channels tag, that will - * be applied in the absence of a secured tag for the channel. If the - * secured tag is specified, it will always determine propagation behaviour. + * default propagation is specified with a secure-channels tag, that will be + * applied in the absence of a secured tag for the channel. If the secured tag + * is specified, it will always determine propagation behaviour. * * @author Jonas Partner */ public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor, Ordered { - protected static final String SECURITY_PROPAGATING_BEAN_POST_PROCESSOR_NAME = SecurityPropagatingBeanPostProcessor.class.getName(); + protected static final String SECURITY_PROPAGATING_BEAN_POST_PROCESSOR_NAME = SecurityPropagatingBeanPostProcessor.class + .getName(); - - private final SecurityContextPropagatingChannelInterceptor interceptor = - new SecurityContextPropagatingChannelInterceptor(); + private final SecurityContextPropagatingChannelInterceptor interceptor = new SecurityContextPropagatingChannelInterceptor(); private boolean propagateByDefault; private final Log logger = LogFactory.getLog(this.getClass()); - private List channelsToInclude = new ArrayList(); - - private List channelsToExclude = new ArrayList(); + private List channelsToInclude = new ArrayList(); + private List channelsToExclude = new ArrayList(); public boolean isPropagateByDefault() { return this.propagateByDefault; @@ -61,19 +59,19 @@ public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor, this.propagateByDefault = propagateByDefault; } - public List getChannelsToInclude() { + public List getChannelsToInclude() { return this.channelsToInclude; } - public void setChannelsToInclude(List channelsToInclude) { + public void setChannelsToInclude(List channelsToInclude) { this.channelsToInclude = channelsToInclude; } - public List getChannelsToExclude() { + public List getChannelsToExclude() { return this.channelsToExclude; } - public void setChannelsToExclude(List channelsToExclude) { + public void setChannelsToExclude(List channelsToExclude) { this.channelsToExclude = channelsToExclude; } @@ -88,8 +86,7 @@ public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor, public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException { if (AbstractMessageChannel.class.isAssignableFrom(bean.getClass())) { AbstractMessageChannel channel = (AbstractMessageChannel) bean; - if(this.channelsToInclude.contains(beanName) || - (this.propagateByDefault && !this.channelsToExclude.contains(beanName))) { + if (isIncluded(beanName) || (this.propagateByDefault && !isExcluded(beanName))) { channel.addInterceptor(this.interceptor); if (logger.isDebugEnabled()) { logger.debug("Channel '" + beanName + "' will propagate a SecurityContext."); @@ -102,4 +99,21 @@ public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor, return bean; } + protected boolean isExcluded(String str) { + return matchesOnePattern(channelsToExclude, str); + } + + protected boolean isIncluded(String str) { + return matchesOnePattern(channelsToInclude, str); + } + + protected boolean matchesOnePattern(List patterns, String str) { + for (Pattern pattern : patterns) { + if (pattern.matcher(str).matches()) { + return true; + } + } + return false; + } + } diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessorDefinitionHelper.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessorDefinitionHelper.java index 9a5a50d3f3..9b895a84bc 100644 --- a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessorDefinitionHelper.java +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessorDefinitionHelper.java @@ -41,10 +41,10 @@ public class SecurityPropagatingBeanPostProcessorDefinitionHelper { private static final String PROPAGATE_BY_DEFAULT = "propagateByDefault"; - public static void setPropagationDefault(boolean valueForPropagationDefault, ParserContext context) { BeanDefinition beanDefintion = getOrCreateSecurityPropagatingBeanPostProcessor(context); - beanDefintion.getPropertyValues().addPropertyValue(PROPAGATE_BY_DEFAULT, Boolean.valueOf(valueForPropagationDefault)); + beanDefintion.getPropertyValues().addPropertyValue(PROPAGATE_BY_DEFAULT, + Boolean.valueOf(valueForPropagationDefault)); } @SuppressWarnings("unchecked") @@ -52,7 +52,8 @@ public class SecurityPropagatingBeanPostProcessorDefinitionHelper { BeanDefinition beanDefintion = getOrCreateSecurityPropagatingBeanPostProcessor(context); List channelsToExclude; if (beanDefintion.getPropertyValues().contains(CHANNELS_TO_EXCLUDE)) { - channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_EXCLUDE).getValue(); + channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_EXCLUDE) + .getValue(); } else { channelsToExclude = new ArrayList(); @@ -62,15 +63,16 @@ public class SecurityPropagatingBeanPostProcessorDefinitionHelper { } @SuppressWarnings("unchecked") - public static void addToIncludeChannelList(String channelName, ParserContext context){ + public static void addToIncludeChannelList(String channelName, ParserContext context) { BeanDefinition beanDefintion = getOrCreateSecurityPropagatingBeanPostProcessor(context); List channelsToExclude; if (beanDefintion.getPropertyValues().contains(CHANNELS_TO_INCLUDE)) { - channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_INCLUDE).getValue(); + channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_INCLUDE) + .getValue(); } else { channelsToExclude = new ArrayList(); - beanDefintion.getPropertyValues().addPropertyValue(CHANNELS_TO_INCLUDE,channelsToExclude); + beanDefintion.getPropertyValues().addPropertyValue(CHANNELS_TO_INCLUDE, channelsToExclude); } channelsToExclude.add(channelName); } diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParser.java b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParser.java new file mode 100644 index 0000000000..91fc4d758a --- /dev/null +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParser.java @@ -0,0 +1,56 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security.config; + +import org.w3c.dom.Element; + +import org.springframework.beans.factory.BeanDefinitionStoreException; +import org.springframework.beans.factory.support.AbstractBeanDefinition; +import org.springframework.beans.factory.support.BeanDefinitionBuilder; +import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser; +import org.springframework.beans.factory.xml.ParserContext; +import org.springframework.security.context.SecurityContext; +import org.springframework.util.StringUtils; + +/** + * Interprets the <secure-channels> element which controls default + * {@link SecurityContext} propagation behaviour. + * + * @author Jonas Partner + */ +public class SecurityPropagatingChannelsParser extends AbstractSingleBeanDefinitionParser { + + @Override + protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) { + builder.getBeanDefinition().setAbstract(true); + String propagation = element.getAttribute("propagate"); + boolean propagateByDefault = true; + if (StringUtils.hasText(propagation)) { + propagateByDefault = Boolean.parseBoolean(propagation); + } + if (propagateByDefault) { + SecurityPropagatingBeanPostProcessorDefinitionHelper.setPropagationDefault(true, parserContext); + } + } + + @Override + protected String resolveId(Element element, AbstractBeanDefinition definition, ParserContext parserContext) + throws BeanDefinitionStoreException { + return "internal.integration.SecureChannels"; + } + +} diff --git a/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/spring-integration-security-1.0.xsd b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/spring-integration-security-1.0.xsd new file mode 100644 index 0000000000..ad732c8684 --- /dev/null +++ b/org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/spring-integration-security-1.0.xsd @@ -0,0 +1,62 @@ + + + + + + + + + + + + Defines security requirements for one or more + message channels + + + + + + + + + + + + + + + + + + Defines security requirements for one or more + Targets + + + + + + + + + + + + + + + + Defines a bean post processor which propagates the + security context. + + + + + + + \ No newline at end of file diff --git a/org.springframework.integration.security/src/main/resources/META-INF/spring-integration.parsers b/org.springframework.integration.security/src/main/resources/META-INF/spring-integration.parsers index 2269b399d6..e69de29bb2 100644 --- a/org.springframework.integration.security/src/main/resources/META-INF/spring-integration.parsers +++ b/org.springframework.integration.security/src/main/resources/META-INF/spring-integration.parsers @@ -1,2 +0,0 @@ -secured=org.springframework.integration.security.config.SecuredParser -secure-channels=org.springframework.integration.security.config.SecureChannelsParser \ No newline at end of file diff --git a/org.springframework.integration.security/src/main/resources/META-INF/spring.handlers b/org.springframework.integration.security/src/main/resources/META-INF/spring.handlers new file mode 100644 index 0000000000..340dbcfb29 --- /dev/null +++ b/org.springframework.integration.security/src/main/resources/META-INF/spring.handlers @@ -0,0 +1 @@ +http\://www.springframework.org/schema/integration-security=org.springframework.integration.security.config.IntegrationSecurityNamespaceHandler \ No newline at end of file diff --git a/org.springframework.integration.security/src/main/resources/META-INF/spring.schemas b/org.springframework.integration.security/src/main/resources/META-INF/spring.schemas new file mode 100644 index 0000000000..43e1214119 --- /dev/null +++ b/org.springframework.integration.security/src/main/resources/META-INF/spring.schemas @@ -0,0 +1 @@ +http\://www.springframework.org/schema/integration/spring-integration-security-1.0.xsd=org/springframework/integration/security/config/spring-integration-security-1.0.xsd \ No newline at end of file diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessorTests.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessorTests.java new file mode 100644 index 0000000000..fe3e6174de --- /dev/null +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessorTests.java @@ -0,0 +1,139 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security; + +import static org.junit.Assert.assertNotNull; + +import java.util.ArrayList; +import java.util.List; + +import org.easymock.EasyMock; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.springframework.integration.channel.AbstractMessageChannel; +import org.springframework.integration.channel.ChannelInterceptor; +import org.springframework.integration.channel.MessageChannel; +import org.springframework.integration.message.Message; +import org.springframework.integration.message.selector.MessageSelector; + +/** + * + * @author Jonas Partner + * + */ +public class ChannelInterceptorRegisteringBeanPostProcessorTests { + + public ArrayList matchAll; + + @Before + public void setUp() { + matchAll = new ArrayList(); + matchAll.add(".*"); + + } + + @Test + public void testWithAbstractMessageChannel() { + ChannelInterceptorRegisteringBeanPostProcessor postprocessor = new ChannelInterceptorRegisteringBeanPostProcessor( + new TestInterceptor(), matchAll); + TestChannel channel = new TestChannel(); + postprocessor.postProcessAfterInitialization(channel, "shouldNotMatter"); + assertNotNull("No channel interceptor present after post processing", channel.channelInterceptor); + } + + @Test + public void testWithAbstractMessageChannelAndPatternThatDoes() { + ChannelInterceptorRegisteringBeanPostProcessor postprocessor = new ChannelInterceptorRegisteringBeanPostProcessor( + new TestInterceptor(), matchAll); + TestChannel channel = new TestChannel(); + postprocessor.postProcessAfterInitialization(channel, "shouldNotMatter"); + assertNotNull("No channel interceptor present after post processing", channel.channelInterceptor); + } + + @Test + public void testWithMockMessageChanne() { + MessageChannel channel = EasyMock.createStrictMock(MessageChannel.class); + EasyMock.replay(channel); + ChannelInterceptorRegisteringBeanPostProcessor postprocessor = new ChannelInterceptorRegisteringBeanPostProcessor( + new TestInterceptor(), matchAll); + postprocessor.postProcessAfterInitialization(channel, "shouldNotMatter"); + EasyMock.verify(channel); + } + + static class TestInterceptor implements ChannelInterceptor { + + public void postReceive(Message message, MessageChannel channel) { + // TODO Auto-generated method stub + + } + + public void postSend(Message message, MessageChannel channel, boolean sent) { + // TODO Auto-generated method stub + + } + + public boolean preReceive(MessageChannel channel) { + // TODO Auto-generated method stub + return false; + } + + public boolean preSend(Message message, MessageChannel channel) { + // TODO Auto-generated method stub + return false; + } + } + + static class TestChannel extends AbstractMessageChannel { + + ChannelInterceptor channelInterceptor; + + public TestChannel() { + super(null); + } + + @Override + public void addInterceptor(ChannelInterceptor interceptor) { + channelInterceptor = interceptor; + super.addInterceptor(interceptor); + } + + @Override + protected Message doReceive(long timeout) { + // TODO Auto-generated method stub + return null; + } + + @Override + protected boolean doSend(Message message, long timeout) { + // TODO Auto-generated method stub + return false; + } + + public List> clear() { + // TODO Auto-generated method stub + return null; + } + + public List> purge(MessageSelector selector) { + // TODO Auto-generated method stub + return null; + } + + } + +} diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptorTests.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptorTests.java index f4ef54b97a..08f47937ad 100644 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptorTests.java +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptorTests.java @@ -45,8 +45,7 @@ public class SecurityContextAssociatingHandlerInterceptorTests { public void testMessageWithSecurityContext() { final StubSecurityContext securityContext = new StubSecurityContext(); StringMessage message = new StringMessage("test"); - message.getHeader().setAttribute( - SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext); + SecurityContextUtils.setSecurityContextHeader(securityContext, message); MessageHandler handler = new MessageHandler() { public Message handle(Message message) { SecurityContext associatedContext = SecurityContextHolder.getContext(); @@ -65,8 +64,7 @@ public class SecurityContextAssociatingHandlerInterceptorTests { public void testForSecurityLeakageIfHandlerThrowsException() { final StubSecurityContext securityContext = new StubSecurityContext(); StringMessage message = new StringMessage("test"); - message.getHeader().setAttribute( - SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext); + SecurityContextUtils.setSecurityContextHeader(securityContext, message); MessageHandler handler = new MessageHandler() { public Message handle(Message message) { SecurityContext associatedContext = SecurityContextHolder.getContext(); diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptorTests.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptorTests.java similarity index 88% rename from org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptorTests.java rename to org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptorTests.java index a29bc9ef31..d90d34032b 100644 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptorTests.java +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptorTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.integration.security; +package org.springframework.integration.security.channel; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertFalse; @@ -26,6 +26,7 @@ import org.junit.Test; import org.springframework.integration.channel.QueueChannel; import org.springframework.integration.message.MessageHeader; import org.springframework.integration.message.StringMessage; +import org.springframework.integration.security.SecurityContextUtils; import org.springframework.security.Authentication; import org.springframework.security.GrantedAuthority; import org.springframework.security.context.SecurityContext; @@ -65,9 +66,8 @@ public class SecurityContextPropagatingChannelInterceptorTests { message = (StringMessage) channel.receive(0); MessageHeader header = message.getHeader(); assertTrue("No security context attribute found in header.", - header.getAttributeNames().contains(SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE)); - SecurityContext contextFromHeader = (SecurityContext) header.getAttribute( - SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE); + header.getAttributeNames().contains(SecurityContextUtils.SECURITY_CONTEXT_HEADER_ATTRIBUTE)); + SecurityContext contextFromHeader = SecurityContextUtils.getSecurityContextFromHeader(message); assertEquals("Incorrect security context in message header.", securityContext, contextFromHeader); } @@ -78,7 +78,7 @@ public class SecurityContextPropagatingChannelInterceptorTests { message = (StringMessage) channel.receive(0); MessageHeader header = message.getHeader(); assertFalse("Security context header found when no security context existed.", - header.getAttributeNames().contains(SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE)); + header.getAttributeNames().contains(SecurityContextUtils.SECURITY_CONTEXT_HEADER_ATTRIBUTE)); } diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptorTests.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptorTests.java similarity index 95% rename from org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptorTests.java rename to org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptorTests.java index 02cc4d8c58..d3d8885e00 100644 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptorTests.java +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptorTests.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.integration.security; +package org.springframework.integration.security.channel; import static org.junit.Assert.assertEquals; @@ -24,6 +24,7 @@ import org.junit.Test; import org.springframework.integration.channel.QueueChannel; import org.springframework.integration.message.StringMessage; +import org.springframework.integration.security.channel.SecurityEnforcingChannelInterceptor; import org.springframework.security.AccessDecisionManager; import org.springframework.security.AccessDeniedException; import org.springframework.security.Authentication; @@ -124,9 +125,8 @@ public class SecurityEnforcingChannelInterceptorTests { private void registerInterceptor(AccessDecisionManager accessDecisionManager) { - securityChannelInterceptor = new SecurityEnforcingChannelInterceptor( - accessDecisionManager, channel); - + securityChannelInterceptor = new SecurityEnforcingChannelInterceptor(accessDecisionManager); + channel.addInterceptor(securityChannelInterceptor); } diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-noPropagationByDefaultContext.xml b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-noPropagationByDefaultContext.xml deleted file mode 100644 index 5ec08169cb..0000000000 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-noPropagationByDefaultContext.xml +++ /dev/null @@ -1,22 +0,0 @@ - - - - - - - - - - - - - - \ No newline at end of file diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests-context.xml b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests-context.xml new file mode 100644 index 0000000000..19862d8a17 --- /dev/null +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests-context.xml @@ -0,0 +1,43 @@ + + + + + + + + adminRequiredForSend + + + + adminOrUserRequiredForSend + + + + adminRequiredForReceive + + + + adminOrUserRequiredForReceive + + + + adminForSendAndReceive + + + + + + + + + \ No newline at end of file diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java new file mode 100644 index 0000000000..e73a7663bb --- /dev/null +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java @@ -0,0 +1,140 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.integration.security.config; + +import static org.junit.Assert.*; + +import java.util.ArrayList; +import java.util.List; + +import org.junit.Before; +import org.junit.Test; +import org.springframework.context.support.ClassPathXmlApplicationContext; +import org.springframework.integration.channel.AbstractMessageChannel; +import org.springframework.integration.channel.ChannelInterceptor; +import org.springframework.integration.message.Message; +import org.springframework.integration.message.selector.MessageSelector; +import org.springframework.integration.security.channel.SecurityEnforcingChannelInterceptor; +import org.springframework.security.ConfigAttribute; +import org.springframework.security.ConfigAttributeDefinition; +import org.springframework.security.SecurityConfig; +import org.springframework.test.context.ContextConfiguration; +import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests; + +/** + * @author Jonas Partner + */ +@ContextConfiguration +public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests{ + + TestMessageChannel messageChannel ; + + @Before + public void setUp(){ + messageChannel = new TestMessageChannel(); + } + + @Test + public void testAdminRequiredForSend(){ + applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminRequiredForSend"); + assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size()); + SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0); + assertTrue("ROLE_ADMIN not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN"))); + assertNull("Receive security attribute were not null", interceptor.getReceiveSecurityAttributes()); + } + + @Test + public void testAdminOrUserRequiredForSend(){ + applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminOrUserRequiredForSend"); + assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size()); + SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0); + assertTrue("ROLE_ADMIN not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN"))); + assertTrue("ROLE_USER not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_USER"))); + assertNull("Receive security attribute were not null", interceptor.getReceiveSecurityAttributes()); + } + + @Test + public void testAdminRequiredForReceive(){ + applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminRequiredForReceive"); + assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size()); + SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0); + assertTrue("ROLE_ADMIN not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN"))); + assertNull("Send security attribute were not null", interceptor.getSendSecurityAttributes()); + } + + @Test + public void testAdminOrUserRequiredForReceive(){ + applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminOrUserRequiredForReceive"); + assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size()); + SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0); + assertTrue("ROLE_ADMIN not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN"))); + assertTrue("ROLE_USER not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_USER"))); + assertNull("Send security attribute were not null", interceptor.getSendSecurityAttributes()); + } + + @Test + public void testAdminRequiredForSendAndReceive(){ + applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminForSendAndReceive"); + assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size()); + SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0); + assertTrue("ROLE_ADMIN not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN"))); + assertTrue("ROLE_USER not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN"))); + } + + + + + + + static class TestMessageChannel extends AbstractMessageChannel { + + List interceptors = new ArrayList(); + + public TestMessageChannel() { + super(null); + } + + @Override + protected Message doReceive(long timeout) { + // TODO Auto-generated method stub + return null; + } + + @Override + protected boolean doSend(Message message, long timeout) { + // TODO Auto-generated method stub + return false; + } + + public List> clear() { + // TODO Auto-generated method stub + return null; + } + + public List> purge(MessageSelector selector) { + // TODO Auto-generated method stub + return null; + } + + @Override + public void addInterceptor(ChannelInterceptor interceptor) { + interceptors.add(interceptor); + } + + } + +} diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests-context.xml b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests-context.xml deleted file mode 100644 index 63c8a9a5d4..0000000000 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests-context.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests.java deleted file mode 100644 index e129b7582b..0000000000 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests.java +++ /dev/null @@ -1,136 +0,0 @@ -/* - * Copyright 2002-2008 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security.config; - -import static org.junit.Assert.assertNotNull; - -import org.junit.After; -import org.junit.Test; - -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Qualifier; -import org.springframework.integration.channel.MessageChannel; -import org.springframework.integration.message.StringMessage; -import org.springframework.security.AccessDeniedException; -import org.springframework.security.context.SecurityContext; -import org.springframework.security.context.SecurityContextHolder; -import org.springframework.security.context.SecurityContextImpl; -import org.springframework.security.providers.AuthenticationProvider; -import org.springframework.security.providers.UsernamePasswordAuthenticationToken; -import org.springframework.test.context.ContextConfiguration; -import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests; - -/** - * @author Jonas Partner - */ -@ContextConfiguration -public class SecuredParserTests extends AbstractJUnit4SpringContextTests{ - - @Autowired - private AuthenticationProvider provider; - - @Autowired - @Qualifier("unsecured") - public MessageChannel unsecuredChannel; - - @Autowired - @Qualifier("adminRequiredForSend") - public MessageChannel adminRequiredForSend; - - @Autowired - @Qualifier("adminRequiredForReceive") - public MessageChannel adminRequiredForReceive; - - @Autowired - @Qualifier("adminRequiredForSendAndReceive") - public MessageChannel adminRequiredForSendAndReceive; - - - @After - public void tearDown() { - SecurityContextHolder.clearContext(); - } - - - @Test - public void testNoSecurityRestrictionsOnChannel() { - unsecuredChannel.send(new StringMessage("testUnsecured")); - assertNotNull("Message not received ", unsecuredChannel.receive(0)); - } - - @Test - public void testAdminRequiredForSendWithAccessGranted() { - login("jimi", "jimispassword"); - adminRequiredForSend.send(new StringMessage("testmessage")); - assertNotNull("Message not received", adminRequiredForSend.receive(0)); - } - - @Test(expected=AccessDeniedException.class) - public void testAdminRequiredForSendWithAccessDenied() { - login("bob", "bobspassword"); - adminRequiredForSend.send(new StringMessage("testmessage")); - } - - @Test - public void testAdminRequiredForReceiveWithAccessGranted(){ - adminRequiredForReceive.send(new StringMessage("testmessage")); - login("jimi", "jimispassword"); - assertNotNull("Message not received", adminRequiredForReceive.receive(0)); - } - - @Test(expected=AccessDeniedException.class) - public void testAdminRequiredForReceiveWithAccessDenied() { - adminRequiredForReceive.send(new StringMessage("testmessage")); - login("bob", "bobspassword"); - adminRequiredForReceive.receive(0); - } - - @Test - public void testAdminRequiredForSendAndReceiveWithSendAccessGranted() { - login("jimi", "jimispassword"); - adminRequiredForSendAndReceive.send(new StringMessage("test")); - } - - @Test(expected=AccessDeniedException.class) - public void testAdminRequiredForSendAndReceiveWithSendAccessDenied() { - login("bob", "bobspassword"); - adminRequiredForSendAndReceive.send(new StringMessage("test")); - } - - @Test - public void testAdminRequiredForSendAndReceiveWithReceiveAccessGranted() { - login("jimi", "jimispassword"); - adminRequiredForSendAndReceive.send(new StringMessage("test")); - assertNotNull("Message not received", adminRequiredForSendAndReceive.receive(0)); - } - - @Test(expected=AccessDeniedException.class) - public void testAdminRequiredForSendAndReceiveWithReceiveAccessDenied() { - login("bob","bobspassword"); - adminRequiredForSendAndReceive.receive(0); - } - - - private void login(String username, String password) { - UsernamePasswordAuthenticationToken authToken = (UsernamePasswordAuthenticationToken) - provider.authenticate(new UsernamePasswordAuthenticationToken(username, password)); - SecurityContext context = new SecurityContextImpl(); - context.setAuthentication(authToken); - SecurityContextHolder.setContext(context); - } - -} diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-propagateByDefaultContext.xml b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-noPropagationByDefaultContext.xml similarity index 61% rename from org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-propagateByDefaultContext.xml rename to org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-noPropagationByDefaultContext.xml index 7cafb33911..44dd6fc3e4 100644 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-propagateByDefaultContext.xml +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-noPropagationByDefaultContext.xml @@ -1,5 +1,6 @@ - - - - - + + adminRequiredForSend + - - - + + + excludedFromPropagation + + + + + \ No newline at end of file diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-propagateByDefaultContext.xml b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-propagateByDefaultContext.xml new file mode 100644 index 0000000000..dfc3200316 --- /dev/null +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-propagateByDefaultContext.xml @@ -0,0 +1,42 @@ + + + + + + + + + + + + + + + excludedFromPropagation + + + + + + includedInPropagation + + + + + + + + + + + \ No newline at end of file diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests.java similarity index 98% rename from org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests.java rename to org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests.java index cdf89863cb..68dfb6425d 100644 --- a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests.java +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests.java @@ -36,7 +36,7 @@ import org.springframework.security.providers.UsernamePasswordAuthenticationToke /** * @author Jonas Partner */ -public class SecureChannelsParserTests { +public class SecurityPropagatingChannelsParserTests { private ClassPathXmlApplicationContext applicationContext; diff --git a/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityTestUtil.java b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityTestUtil.java new file mode 100644 index 0000000000..02be693193 --- /dev/null +++ b/org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityTestUtil.java @@ -0,0 +1,46 @@ +/* + * Copyright 2002-2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.integration.security.config; + +import org.springframework.security.GrantedAuthority; +import org.springframework.security.GrantedAuthorityImpl; +import org.springframework.security.context.SecurityContext; +import org.springframework.security.context.SecurityContextImpl; +import org.springframework.security.providers.UsernamePasswordAuthenticationToken; + +/** + * + * @author Jonas Partner + * + */ +public class SecurityTestUtil { + + public static SecurityContext createContext(String username, String password, String... roles){ + SecurityContextImpl ctxImpl = new SecurityContextImpl(); + UsernamePasswordAuthenticationToken authToken; + if(roles != null && roles.length > 0){ + GrantedAuthority[] authorities = new GrantedAuthority[roles.length]; + for (int i =0; i < roles.length; i++) { + authorities[i] = new GrantedAuthorityImpl(roles[i]); + } + authToken = new UsernamePasswordAuthenticationToken(username,password,authorities); + } else { + authToken = new UsernamePasswordAuthenticationToken(username, password); + } + ctxImpl.setAuthentication(authToken); + return ctxImpl; + } +}