Spring/spring-integration
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

refactored security namespace to use separate schema

Browse Source
This commit is contained in:
Jonas Partner
2008-06-25 17:29:32 +00:00
parent a2a40bca4d
commit 5709c4e144
32 changed files with 997 additions and 549 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
org.springframework.integration.security/src/main/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessor.java Normal file
View File

@@ -0,0 +1,80 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security;
import java.util.ArrayList;
import java.util.List;
import java.util.regex.Pattern;
import org.springframework.beans.BeansException;
import org.springframework.beans.factory.config.BeanPostProcessor;
import org.springframework.core.Ordered;
import org.springframework.integration.channel.AbstractMessageChannel;
import org.springframework.integration.channel.ChannelInterceptor;
/**
* Registers the provided {@link ChannelInterceptor} instance with any
* {@link AbstractMessageChannel} with a name matching the provided pattern
* @author Jonas Partner
*
*/
public class ChannelInterceptorRegisteringBeanPostProcessor implements BeanPostProcessor, Ordered {
private final ChannelInterceptor channelInterceptor;
private final List<Pattern> regexpPatterns;
private int order;
public ChannelInterceptorRegisteringBeanPostProcessor(ChannelInterceptor channelInterceptor, List<String> patterns) {
this.channelInterceptor = channelInterceptor;
this.regexpPatterns = new ArrayList<Pattern>();
for (String stringPattern : patterns) {
regexpPatterns.add(Pattern.compile(stringPattern));
}
}
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
if (AbstractMessageChannel.class.isAssignableFrom(bean.getClass()) && matchesPattern(beanName)) {
((AbstractMessageChannel) bean).addInterceptor(channelInterceptor);
}
return bean;
}
public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
return bean;
}
public int getOrder() {
return order;
}
public void setOrder(int order) {
this.order = order;
}
protected boolean matchesPattern(String beanName) {
for (Pattern regexpPattern : regexpPatterns) {
if (regexpPattern.matcher(beanName).matches()) {
return true;
}
}
return false;
}
}

20
org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptor.java
View File

@@ -23,44 +23,42 @@ import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
/**
* Associates the {@link SecurityContext} propagated in the message header
* with the thread executing the handle call to a {@link MessageHandler}.
* Associates the {@link SecurityContext} propagated in the message header with
* the thread executing the handle call to a {@link MessageHandler}.
*
* @author Jonas Partner
*/
public class SecurityContextAssociatingHandlerInterceptor extends InterceptingMessageHandler {
/**
* One time only set the strategy to be stack based to allow use of direct channels where push and pop is required rather than set and clear
* One time only set the strategy to be stack based to allow use of direct
* channels where push and pop is required rather than set and clear
*/
static {
SecurityContextHolder.setStrategyName(StackBasedSecurityContextHolderStrategy.class.getName());
}
public SecurityContextAssociatingHandlerInterceptor(MessageHandler target) {
super(target);
}
@Override
public Message<?> handle(Message<?> message, MessageHandler target) {
if (message.getHeader().getAttributeNames().contains(
SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE)) {
if (message.getHeader().getAttributeNames().contains(SecurityContextUtils.SECURITY_CONTEXT_HEADER_ATTRIBUTE)) {
return handleInSecurityContext(message, target);
}
return target.handle(message);
}
private Message<?> handleInSecurityContext(Message<?> message, MessageHandler target) {
SecurityContext context = (SecurityContext) message.getHeader().getAttribute(
SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE);
SecurityContext context = SecurityContextUtils.getSecurityContextFromHeader(message);
SecurityContextHolder.setContext(context);
try{
try {
return target.handle(message);
}
finally {
SecurityContextHolder.clearContext();
}
}
}
}

58
org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptor.java
View File

@@ -1,58 +0,0 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.integration.channel.MessageChannel;
import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter;
import org.springframework.integration.message.Message;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
/**
* Propagates the {@ link SecurityContext} associated with the current
* thread (if any) by adding it to the header of sent messages.
*
* @author Jonas Partner
*/
public class SecurityContextPropagatingChannelInterceptor extends ChannelInterceptorAdapter {
public static final String SECURITY_CONTEXT_HEADER_ATTRIBUTE = "SPRING_SECURITY_CONTEXT";
private final Log logger = LogFactory.getLog(this.getClass());
@Override
public boolean preSend(Message<?> message, MessageChannel channel) {
this.setSecurityContextAttribute(message);
return true;
}
protected void setSecurityContextAttribute(Message<?> message){
SecurityContext securityContext = SecurityContextHolder.getContext();
if (securityContext.getAuthentication() != null) {
message.getHeader().setAttribute(SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext);
}
else if (logger.isInfoEnabled()) {
logger.info("No security context found");
}
}
}

38
org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityContextUtils.java Normal file
View File

@@ -0,0 +1,38 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security;
import org.springframework.integration.message.Message;
import org.springframework.security.context.SecurityContext;
/**
* @author Jonas Partner
*
*/
public class SecurityContextUtils {
public static final String SECURITY_CONTEXT_HEADER_ATTRIBUTE = "SPRING_SECURITY_CONTEXT";
public static SecurityContext getSecurityContextFromHeader(Message<?> message) {
return (SecurityContext) message.getHeader().getAttribute(SECURITY_CONTEXT_HEADER_ATTRIBUTE);
}
public static void setSecurityContextHeader(SecurityContext sctx, Message<?> message) {
message.getHeader().setAttribute(SECURITY_CONTEXT_HEADER_ATTRIBUTE, sctx);
}
}

102
org.springframework.integration.security/src/main/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptor.java
View File

@@ -1,102 +0,0 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security;
import org.springframework.integration.channel.AbstractMessageChannel;
import org.springframework.integration.channel.MessageChannel;
import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter;
import org.springframework.integration.message.Message;
import org.springframework.security.AccessDecisionManager;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.util.Assert;
/**
* Delegates to the provided instance of {@link AccessDecisionManager} to
* enforce the security on the send and receive calls on the {@ MessageChannel}.
*
* @author Jonas Partner
*/
public class SecurityEnforcingChannelInterceptor extends ChannelInterceptorAdapter{
private final AccessDecisionManager accessDecisionManger;
private final String channelName;
private volatile ConfigAttributeDefinition sendSecurityAttributes;
private volatile ConfigAttributeDefinition receiveSecurityAttributes;
public SecurityEnforcingChannelInterceptor(AccessDecisionManager accessDecisionManager, AbstractMessageChannel channelToSecure) {
Assert.notNull(accessDecisionManager, "AccessDecisionManager must not be null");
Assert.notNull(channelToSecure, "channel to secure must not be null");
this.accessDecisionManger = accessDecisionManager;
this.channelName = channelToSecure.getName();
channelToSecure.addInterceptor(this);
}
public ConfigAttributeDefinition getSendSecurityAttributes() {
return this.sendSecurityAttributes;
}
public void setSendSecurityAttributes(ConfigAttributeDefinition sendSecurityAttributes) {
this.sendSecurityAttributes = sendSecurityAttributes;
}
public ConfigAttributeDefinition getReceiveSecurityAttributes() {
return this.receiveSecurityAttributes;
}
public void setReceiveSecurityAttributes(ConfigAttributeDefinition receiveSecurityAttributes) {
this.receiveSecurityAttributes = receiveSecurityAttributes;
}
@Override
public boolean preSend(Message<?> message, MessageChannel channel) {
this.checkSend(channel);
return true;
}
@Override
public boolean preReceive(MessageChannel channel) {
this.checkReceive(channel);
return super.preReceive(channel);
}
private void checkSend(MessageChannel channel){
this.checkPermission(channel, this.sendSecurityAttributes);
}
private void checkReceive(MessageChannel channel){
this.checkPermission(channel, this.receiveSecurityAttributes);
}
private void checkPermission(MessageChannel messageChannel, ConfigAttributeDefinition securityAttributes){
if (securityAttributes != null) {
this.accessDecisionManger.decide(SecurityContextHolder.getContext().getAuthentication(),
messageChannel, securityAttributes);
}
}
@Override
public String toString() {
return getClass().getName() + " for channel '" + this.channelName + "'";
}
}

55
org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptor.java Normal file
View File

@@ -0,0 +1,55 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.channel;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.integration.channel.MessageChannel;
import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter;
import org.springframework.integration.message.Message;
import org.springframework.integration.security.SecurityContextUtils;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
/**
* Propagates the {@ link SecurityContext} associated with the current thread
* (if any) by adding it to the header of sent messages.
*
* @author Jonas Partner
*/
public class SecurityContextPropagatingChannelInterceptor extends ChannelInterceptorAdapter {
private final Log logger = LogFactory.getLog(this.getClass());
@Override
public boolean preSend(Message<?> message, MessageChannel channel) {
this.setSecurityContextAttribute(message);
return true;
}
protected void setSecurityContextAttribute(Message<?> message) {
SecurityContext securityContext = SecurityContextHolder.getContext();
if (securityContext.getAuthentication() != null) {
SecurityContextUtils.setSecurityContextHeader(securityContext, message);
}
else if (logger.isInfoEnabled()) {
logger.info("No security context found");
}
}
}

90
org.springframework.integration.security/src/main/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptor.java Normal file
View File

@@ -0,0 +1,90 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.channel;
import org.springframework.integration.channel.AbstractMessageChannel;
import org.springframework.integration.channel.MessageChannel;
import org.springframework.integration.channel.interceptor.ChannelInterceptorAdapter;
import org.springframework.integration.message.Message;
import org.springframework.security.AccessDecisionManager;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.util.Assert;
/**
* Delegates to the provided instance of {@link AccessDecisionManager} to
* enforce the security on the send and receive calls on the {@ MessageChannel}.
*
* @author Jonas Partner
*/
public class SecurityEnforcingChannelInterceptor extends ChannelInterceptorAdapter {
private final AccessDecisionManager accessDecisionManger;
private volatile ConfigAttributeDefinition sendSecurityAttributes;
private volatile ConfigAttributeDefinition receiveSecurityAttributes;
public SecurityEnforcingChannelInterceptor(AccessDecisionManager accessDecisionManager) {
Assert.notNull(accessDecisionManager, "AccessDecisionManager must not be null");
this.accessDecisionManger = accessDecisionManager;
}
public ConfigAttributeDefinition getSendSecurityAttributes() {
return this.sendSecurityAttributes;
}
public void setSendSecurityAttributes(ConfigAttributeDefinition sendSecurityAttributes) {
this.sendSecurityAttributes = sendSecurityAttributes;
}
public ConfigAttributeDefinition getReceiveSecurityAttributes() {
return this.receiveSecurityAttributes;
}
public void setReceiveSecurityAttributes(ConfigAttributeDefinition receiveSecurityAttributes) {
this.receiveSecurityAttributes = receiveSecurityAttributes;
}
@Override
public boolean preSend(Message<?> message, MessageChannel channel) {
this.checkSend(channel);
return true;
}
@Override
public boolean preReceive(MessageChannel channel) {
this.checkReceive(channel);
return super.preReceive(channel);
}
private void checkSend(MessageChannel channel) {
this.checkPermission(channel, this.sendSecurityAttributes);
}
private void checkReceive(MessageChannel channel) {
this.checkPermission(channel, this.receiveSecurityAttributes);
}
private void checkPermission(MessageChannel messageChannel, ConfigAttributeDefinition securityAttributes) {
if (securityAttributes != null) {
this.accessDecisionManger.decide(SecurityContextHolder.getContext().getAuthentication(), messageChannel,
securityAttributes);
}
}
}

4
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java
View File

@@ -26,8 +26,8 @@ import org.springframework.beans.factory.xml.NamespaceHandlerSupport;
public class IntegrationSecurityNamespaceHandler extends NamespaceHandlerSupport {
public void init() {
registerBeanDefinitionParser("secured", new SecuredParser());
registerBeanDefinitionParser("secure-channels", new SecureChannelsParser());
registerBeanDefinitionParser("secured-channels", new SecuredChannelsParser());
registerBeanDefinitionParser("security-propagating-channels", new SecurityPropagatingChannelsParser());
}
}

56
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecureChannelsParser.java
View File

@@ -1,56 +0,0 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
import org.w3c.dom.Element;
import org.springframework.beans.factory.BeanDefinitionStoreException;
import org.springframework.beans.factory.support.AbstractBeanDefinition;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.security.context.SecurityContext;
import org.springframework.util.StringUtils;
/**
* Interprets the &lt;secure-channels&gt; element which controls default
* {@link SecurityContext} propagation behaviour.
*
* @author Jonas Partner
*/
public class SecureChannelsParser extends AbstractSingleBeanDefinitionParser {
@Override
protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
builder.getBeanDefinition().setAbstract(true);
String propagation = element.getAttribute("propagate");
boolean propagateByDefault = true;
if (StringUtils.hasText(propagation)) {
propagateByDefault = Boolean.parseBoolean(propagation);
}
if (propagateByDefault) {
SecurityPropagatingBeanPostProcessorDefinitionHelper.setPropagationDefault(true, parserContext);
}
}
@Override
protected String resolveId(Element element, AbstractBeanDefinition definition, ParserContext parserContext)
throws BeanDefinitionStoreException {
return "internal.integration.SecureChannels";
}
}

126
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java Normal file
View File

@@ -0,0 +1,126 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
import java.util.ArrayList;
import java.util.List;
import org.springframework.beans.factory.config.BeanDefinition;
import org.springframework.beans.factory.config.ConstructorArgumentValues.ValueHolder;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.integration.security.ChannelInterceptorRegisteringBeanPostProcessor;
import org.springframework.integration.security.channel.SecurityEnforcingChannelInterceptor;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.context.SecurityContext;
import org.springframework.util.StringUtils;
import org.w3c.dom.Element;
import org.w3c.dom.NodeList;
/**
* Determines {@link SecurityContext} propagation behaviour for the parent
* element channel, and creates a {@link SecurityEnforcingChannelInterceptor} to
* control send and receive access if send-access and/or receive-access is
* specified.
*
* @author Jonas Partner
*/
public class SecuredChannelsParser extends AbstractSingleBeanDefinitionParser {
public SecuredChannelsParser() {
super();
}
@Override
protected boolean shouldGenerateId() {
return true;
}
@Override
protected boolean shouldGenerateIdAsFallback() {
return true;
}
@Override
protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
String receiveAccess = element.getAttribute("receive-access");
String sendAccess = element.getAttribute("send-access");
String accessDecisionManager = element.getAttribute("access-decision-manager");
String propagation = element.getAttribute("propagate");
BeanDefinition interceptorBeanDefinition = createSecurityEnforcingChannelInterceptor(accessDecisionManager,
sendAccess, receiveAccess);
List<String> patternList = processPatterns(element.getElementsByTagNameNS(element.getNamespaceURI(),
"channel-name-pattern"));
builder.getBeanDefinition().setBeanClass(ChannelInterceptorRegisteringBeanPostProcessor.class);
builder.getBeanDefinition().getConstructorArgumentValues().addGenericArgumentValue(
new ValueHolder(interceptorBeanDefinition));
builder.getBeanDefinition().getConstructorArgumentValues()
.addGenericArgumentValue(new ValueHolder(patternList));
setPropagation(Boolean.parseBoolean(propagation), patternList, parserContext);
}
protected List<String> processPatterns(NodeList patternList) {
List<String> patterns = new ArrayList<String>();
for (int i = 0; i < patternList.getLength(); i++) {
Element patternElement = (Element) patternList.item(i);
patterns.add(patternElement.getTextContent());
}
return patterns;
}
protected void setPropagation(boolean propagation, List<String> patterns, ParserContext parserContext) {
for (String pattern : patterns) {
if (propagation) {
SecurityPropagatingBeanPostProcessorDefinitionHelper.addToIncludeChannelList(pattern, parserContext);
}
else {
SecurityPropagatingBeanPostProcessorDefinitionHelper.addToExcludeChannelList(pattern, parserContext);
}
}
}
protected BeanDefinition createSecurityEnforcingChannelInterceptor(String accessDecisionManager, String sendAccess,
String receiveAccess) {
if (!StringUtils.hasText(accessDecisionManager)) {
accessDecisionManager = "accessDecisionManager";
}
BeanDefinitionBuilder beanDefinitionBuilder = BeanDefinitionBuilder
.genericBeanDefinition(SecurityEnforcingChannelInterceptor.class);
beanDefinitionBuilder.addConstructorArgReference(accessDecisionManager);
if (StringUtils.hasText(sendAccess)) {
ConfigAttributeDefinition sendDefinition = new ConfigAttributeDefinition(StringUtils.tokenizeToStringArray(
sendAccess, ","));
beanDefinitionBuilder.addPropertyValue("sendSecurityAttributes", sendDefinition);
}
if (StringUtils.hasText(receiveAccess)) {
ConfigAttributeDefinition receiveDefinition = new ConfigAttributeDefinition(StringUtils
.tokenizeToStringArray(receiveAccess, ","));
beanDefinitionBuilder.addPropertyValue("receiveSecurityAttributes", receiveDefinition);
}
return beanDefinitionBuilder.getBeanDefinition();
}
}

84
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecuredParser.java
View File

@@ -1,84 +0,0 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
import org.w3c.dom.Element;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.integration.security.SecurityEnforcingChannelInterceptor;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.context.SecurityContext;
import org.springframework.util.StringUtils;
/**
* Determines {@link SecurityContext} propagation behaviour for the parent element
* channel, and creates a {@link SecurityEnforcingChannelInterceptor} to control
* send and receive access if send-access and/or receive-access is specified.
*
* @author Jonas Partner
*/
public class SecuredParser extends AbstractSingleBeanDefinitionParser {
@Override
protected boolean shouldGenerateId() {
return false;
}
@Override
protected boolean shouldGenerateIdAsFallback() {
return true;
}
@Override
protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
String receiveAccess = element.getAttribute("receive-access");
String sendAccess = element.getAttribute("send-access");
String accessDecisionManager = element.getAttribute("access-decision-manager");
String propagation = element.getAttribute("propagate");
String channelName = ((Element)element.getParentNode()).getAttribute("id");
if (channelName == null) {
parserContext.getReaderContext().error("The secured element requires a channel parent id.", element);
}
builder.getBeanDefinition().setBeanClass(SecurityEnforcingChannelInterceptor.class);
if (!StringUtils.hasText(accessDecisionManager)) {
accessDecisionManager = "accessDecisionManager";
}
builder.addConstructorArgReference(accessDecisionManager);
builder.addConstructorArgReference(channelName);
if (StringUtils.hasText(sendAccess)) {
ConfigAttributeDefinition sendDefinition = new ConfigAttributeDefinition(sendAccess);
builder.addPropertyValue("sendSecurityAttributes", sendDefinition);
}
if (StringUtils.hasText(receiveAccess)) {
ConfigAttributeDefinition receiveDefinition = new ConfigAttributeDefinition(receiveAccess);
builder.addPropertyValue("receiveSecurityAttributes", receiveDefinition);
}
boolean propagationValue = true;
if (StringUtils.hasText(propagation)) {
propagationValue = Boolean.parseBoolean(propagation);
}
if (propagationValue) {
SecurityPropagatingBeanPostProcessorDefinitionHelper.addToIncludeChannelList(channelName, parserContext);
}
else {
SecurityPropagatingBeanPostProcessorDefinitionHelper.addToExcludeChannelList(channelName, parserContext);
}
}
}

50
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessor.java
View File

@@ -18,40 +18,38 @@ package org.springframework.integration.security.config;
import java.util.ArrayList;
import java.util.List;
import java.util.regex.Pattern;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.BeansException;
import org.springframework.beans.factory.config.BeanPostProcessor;
import org.springframework.core.Ordered;
import org.springframework.integration.channel.AbstractMessageChannel;
import org.springframework.integration.security.SecurityContextPropagatingChannelInterceptor;
import org.springframework.integration.security.channel.SecurityContextPropagatingChannelInterceptor;
/**
* Post processes channels applying appropriate propagation behaviour. If
* default propagation is specified with a secure-channels tag, that will
* be applied in the absence of a secured tag for the channel. If the
* secured tag is specified, it will always determine propagation behaviour.
* default propagation is specified with a secure-channels tag, that will be
* applied in the absence of a secured tag for the channel. If the secured tag
* is specified, it will always determine propagation behaviour.
*
* @author Jonas Partner
*/
public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor, Ordered {
protected static final String SECURITY_PROPAGATING_BEAN_POST_PROCESSOR_NAME = SecurityPropagatingBeanPostProcessor.class.getName();
protected static final String SECURITY_PROPAGATING_BEAN_POST_PROCESSOR_NAME = SecurityPropagatingBeanPostProcessor.class
.getName();
private final SecurityContextPropagatingChannelInterceptor interceptor =
new SecurityContextPropagatingChannelInterceptor();
private final SecurityContextPropagatingChannelInterceptor interceptor = new SecurityContextPropagatingChannelInterceptor();
private boolean propagateByDefault;
private final Log logger = LogFactory.getLog(this.getClass());
private List<String> channelsToInclude = new ArrayList<String>();
private List<String> channelsToExclude = new ArrayList<String>();
private List<Pattern> channelsToInclude = new ArrayList<Pattern>();
private List<Pattern> channelsToExclude = new ArrayList<Pattern>();
public boolean isPropagateByDefault() {
return this.propagateByDefault;
@@ -61,19 +59,19 @@ public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor,
this.propagateByDefault = propagateByDefault;
}
public List<String> getChannelsToInclude() {
public List<Pattern> getChannelsToInclude() {
return this.channelsToInclude;
}
public void setChannelsToInclude(List<String> channelsToInclude) {
public void setChannelsToInclude(List<Pattern> channelsToInclude) {
this.channelsToInclude = channelsToInclude;
}
public List<String> getChannelsToExclude() {
public List<Pattern> getChannelsToExclude() {
return this.channelsToExclude;
}
public void setChannelsToExclude(List<String> channelsToExclude) {
public void setChannelsToExclude(List<Pattern> channelsToExclude) {
this.channelsToExclude = channelsToExclude;
}
@@ -88,8 +86,7 @@ public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor,
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
if (AbstractMessageChannel.class.isAssignableFrom(bean.getClass())) {
AbstractMessageChannel channel = (AbstractMessageChannel) bean;
if(this.channelsToInclude.contains(beanName) ||
(this.propagateByDefault && !this.channelsToExclude.contains(beanName))) {
if (isIncluded(beanName) || (this.propagateByDefault && !isExcluded(beanName))) {
channel.addInterceptor(this.interceptor);
if (logger.isDebugEnabled()) {
logger.debug("Channel '" + beanName + "' will propagate a SecurityContext.");
@@ -102,4 +99,21 @@ public class SecurityPropagatingBeanPostProcessor implements BeanPostProcessor,
return bean;
}
protected boolean isExcluded(String str) {
return matchesOnePattern(channelsToExclude, str);
}
protected boolean isIncluded(String str) {
return matchesOnePattern(channelsToInclude, str);
}
protected boolean matchesOnePattern(List<Pattern> patterns, String str) {
for (Pattern pattern : patterns) {
if (pattern.matcher(str).matches()) {
return true;
}
}
return false;
}
}

14
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingBeanPostProcessorDefinitionHelper.java
View File

@@ -41,10 +41,10 @@ public class SecurityPropagatingBeanPostProcessorDefinitionHelper {
private static final String PROPAGATE_BY_DEFAULT = "propagateByDefault";
public static void setPropagationDefault(boolean valueForPropagationDefault, ParserContext context) {
BeanDefinition beanDefintion = getOrCreateSecurityPropagatingBeanPostProcessor(context);
beanDefintion.getPropertyValues().addPropertyValue(PROPAGATE_BY_DEFAULT, Boolean.valueOf(valueForPropagationDefault));
beanDefintion.getPropertyValues().addPropertyValue(PROPAGATE_BY_DEFAULT,
Boolean.valueOf(valueForPropagationDefault));
}
@SuppressWarnings("unchecked")
@@ -52,7 +52,8 @@ public class SecurityPropagatingBeanPostProcessorDefinitionHelper {
BeanDefinition beanDefintion = getOrCreateSecurityPropagatingBeanPostProcessor(context);
List channelsToExclude;
if (beanDefintion.getPropertyValues().contains(CHANNELS_TO_EXCLUDE)) {
channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_EXCLUDE).getValue();
channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_EXCLUDE)
.getValue();
}
else {
channelsToExclude = new ArrayList<RuntimeBeanNameReference>();
@@ -62,15 +63,16 @@ public class SecurityPropagatingBeanPostProcessorDefinitionHelper {
}
@SuppressWarnings("unchecked")
public static void addToIncludeChannelList(String channelName, ParserContext context){
public static void addToIncludeChannelList(String channelName, ParserContext context) {
BeanDefinition beanDefintion = getOrCreateSecurityPropagatingBeanPostProcessor(context);
List channelsToExclude;
if (beanDefintion.getPropertyValues().contains(CHANNELS_TO_INCLUDE)) {
channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_INCLUDE).getValue();
channelsToExclude = (List) beanDefintion.getPropertyValues().getPropertyValue(CHANNELS_TO_INCLUDE)
.getValue();
}
else {
channelsToExclude = new ArrayList<RuntimeBeanNameReference>();
beanDefintion.getPropertyValues().addPropertyValue(CHANNELS_TO_INCLUDE,channelsToExclude);
beanDefintion.getPropertyValues().addPropertyValue(CHANNELS_TO_INCLUDE, channelsToExclude);
}
channelsToExclude.add(channelName);
}

56
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParser.java Normal file
View File

@@ -0,0 +1,56 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
import org.w3c.dom.Element;
import org.springframework.beans.factory.BeanDefinitionStoreException;
import org.springframework.beans.factory.support.AbstractBeanDefinition;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.security.context.SecurityContext;
import org.springframework.util.StringUtils;
/**
* Interprets the &lt;secure-channels&gt; element which controls default
* {@link SecurityContext} propagation behaviour.
*
* @author Jonas Partner
*/
public class SecurityPropagatingChannelsParser extends AbstractSingleBeanDefinitionParser {
@Override
protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
builder.getBeanDefinition().setAbstract(true);
String propagation = element.getAttribute("propagate");
boolean propagateByDefault = true;
if (StringUtils.hasText(propagation)) {
propagateByDefault = Boolean.parseBoolean(propagation);
}
if (propagateByDefault) {
SecurityPropagatingBeanPostProcessorDefinitionHelper.setPropagationDefault(true, parserContext);
}
}
@Override
protected String resolveId(Element element, AbstractBeanDefinition definition, ParserContext parserContext)
throws BeanDefinitionStoreException {
return "internal.integration.SecureChannels";
}
}

62
org.springframework.integration.security/src/main/java/org/springframework/integration/security/config/spring-integration-security-1.0.xsd Normal file
View File

@@ -0,0 +1,62 @@
<?xml version="1.0" encoding="UTF-8"?>
<xsd:schema xmlns="http://www.springframework.org/schema/integration-security"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:tool="http://www.springframework.org/schema/tool"
targetNamespace="http://www.springframework.org/schema/integration-security"
elementFormDefault="qualified" attributeFormDefault="unqualified">
<xsd:import namespace="http://www.springframework.org/schema/beans" />
<xsd:import namespace="http://www.springframework.org/schema/tool" />
<xsd:element name="secured-channels">
<xsd:complexType>
<xsd:annotation>
<xsd:documentation>
Defines security requirements for one or more
message channels
</xsd:documentation>
</xsd:annotation>
<xsd:sequence>
<xsd:element name="channel-name-pattern" type="xsd:string" minOccurs="1" maxOccurs="unbounded"/>
</xsd:sequence>
<xsd:attribute name="receive-access" type="xsd:string" />
<xsd:attribute name="send-access" type="xsd:string" />
<xsd:attribute name="access-decision-manager" type="xsd:string" default="accessDecisionManager"/>
<xsd:attribute name="propagate" type="xsd:boolean" default="true" />
</xsd:complexType>
</xsd:element>
<xsd:element name="secured-targets">
<xsd:complexType>
<xsd:annotation>
<xsd:documentation>
Defines security requirements for one or more
Targets
</xsd:documentation>
</xsd:annotation>
<xsd:sequence>
<xsd:element name="targetNamePattern" type="xsd:string" />
</xsd:sequence>
<xsd:attribute name="access" type="xsd:string" />
<xsd:attribute name="access-decision-manager"
type="xsd:string" default="accessDecisionManager" />
</xsd:complexType>
</xsd:element>
<xsd:element name="security-propagating-channels">
<xsd:complexType>
<xsd:annotation>
<xsd:documentation>
Defines a bean post processor which propagates the
security context.
</xsd:documentation>
</xsd:annotation>
<xsd:attribute name="propagate" type="xsd:boolean" default="true" />
</xsd:complexType>
</xsd:element>
</xsd:schema>

2
org.springframework.integration.security/src/main/resources/META-INF/spring-integration.parsers
View File

@@ -1,2 +0,0 @@
secured=org.springframework.integration.security.config.SecuredParser
secure-channels=org.springframework.integration.security.config.SecureChannelsParser

1
org.springframework.integration.security/src/main/resources/META-INF/spring.handlers Normal file
View File

@@ -0,0 +1 @@
http\://www.springframework.org/schema/integration-security=org.springframework.integration.security.config.IntegrationSecurityNamespaceHandler

1
org.springframework.integration.security/src/main/resources/META-INF/spring.schemas Normal file
View File

@@ -0,0 +1 @@
http\://www.springframework.org/schema/integration/spring-integration-security-1.0.xsd=org/springframework/integration/security/config/spring-integration-security-1.0.xsd

139
org.springframework.integration.security/src/test/java/org/springframework/integration/security/ChannelInterceptorRegisteringBeanPostProcessorTests.java Normal file
View File

@@ -0,0 +1,139 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security;
import static org.junit.Assert.assertNotNull;
import java.util.ArrayList;
import java.util.List;
import org.easymock.EasyMock;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
import org.springframework.integration.channel.AbstractMessageChannel;
import org.springframework.integration.channel.ChannelInterceptor;
import org.springframework.integration.channel.MessageChannel;
import org.springframework.integration.message.Message;
import org.springframework.integration.message.selector.MessageSelector;
/**
*
* @author Jonas Partner
*
*/
public class ChannelInterceptorRegisteringBeanPostProcessorTests {
public ArrayList<String> matchAll;
@Before
public void setUp() {
matchAll = new ArrayList<String>();
matchAll.add(".*");
}
@Test
public void testWithAbstractMessageChannel() {
ChannelInterceptorRegisteringBeanPostProcessor postprocessor = new ChannelInterceptorRegisteringBeanPostProcessor(
new TestInterceptor(), matchAll);
TestChannel channel = new TestChannel();
postprocessor.postProcessAfterInitialization(channel, "shouldNotMatter");
assertNotNull("No channel interceptor present after post processing", channel.channelInterceptor);
}
@Test
public void testWithAbstractMessageChannelAndPatternThatDoes() {
ChannelInterceptorRegisteringBeanPostProcessor postprocessor = new ChannelInterceptorRegisteringBeanPostProcessor(
new TestInterceptor(), matchAll);
TestChannel channel = new TestChannel();
postprocessor.postProcessAfterInitialization(channel, "shouldNotMatter");
assertNotNull("No channel interceptor present after post processing", channel.channelInterceptor);
}
@Test
public void testWithMockMessageChanne() {
MessageChannel channel = EasyMock.createStrictMock(MessageChannel.class);
EasyMock.replay(channel);
ChannelInterceptorRegisteringBeanPostProcessor postprocessor = new ChannelInterceptorRegisteringBeanPostProcessor(
new TestInterceptor(), matchAll);
postprocessor.postProcessAfterInitialization(channel, "shouldNotMatter");
EasyMock.verify(channel);
}
static class TestInterceptor implements ChannelInterceptor {
public void postReceive(Message<?> message, MessageChannel channel) {
// TODO Auto-generated method stub
}
public void postSend(Message<?> message, MessageChannel channel, boolean sent) {
// TODO Auto-generated method stub
}
public boolean preReceive(MessageChannel channel) {
// TODO Auto-generated method stub
return false;
}
public boolean preSend(Message<?> message, MessageChannel channel) {
// TODO Auto-generated method stub
return false;
}
}
static class TestChannel extends AbstractMessageChannel {
ChannelInterceptor channelInterceptor;
public TestChannel() {
super(null);
}
@Override
public void addInterceptor(ChannelInterceptor interceptor) {
channelInterceptor = interceptor;
super.addInterceptor(interceptor);
}
@Override
protected Message<?> doReceive(long timeout) {
// TODO Auto-generated method stub
return null;
}
@Override
protected boolean doSend(Message<?> message, long timeout) {
// TODO Auto-generated method stub
return false;
}
public List<Message<?>> clear() {
// TODO Auto-generated method stub
return null;
}
public List<Message<?>> purge(MessageSelector selector) {
// TODO Auto-generated method stub
return null;
}
}
}

6
org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextAssociatingHandlerInterceptorTests.java
View File

@@ -45,8 +45,7 @@ public class SecurityContextAssociatingHandlerInterceptorTests {
public void testMessageWithSecurityContext() {
final StubSecurityContext securityContext = new StubSecurityContext();
StringMessage message = new StringMessage("test");
message.getHeader().setAttribute(
SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext);
SecurityContextUtils.setSecurityContextHeader(securityContext, message);
MessageHandler handler = new MessageHandler() {
public Message<?> handle(Message<?> message) {
SecurityContext associatedContext = SecurityContextHolder.getContext();
@@ -65,8 +64,7 @@ public class SecurityContextAssociatingHandlerInterceptorTests {
public void testForSecurityLeakageIfHandlerThrowsException() {
final StubSecurityContext securityContext = new StubSecurityContext();
StringMessage message = new StringMessage("test");
message.getHeader().setAttribute(
SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE, securityContext);
SecurityContextUtils.setSecurityContextHeader(securityContext, message);
MessageHandler handler = new MessageHandler() {
public Message<?> handle(Message<?> message) {
SecurityContext associatedContext = SecurityContextHolder.getContext();

10
org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityContextPropagatingChannelInterceptorTests.java → org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityContextPropagatingChannelInterceptorTests.java
View File

@@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.integration.security;
package org.springframework.integration.security.channel;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
@@ -26,6 +26,7 @@ import org.junit.Test;
import org.springframework.integration.channel.QueueChannel;
import org.springframework.integration.message.MessageHeader;
import org.springframework.integration.message.StringMessage;
import org.springframework.integration.security.SecurityContextUtils;
import org.springframework.security.Authentication;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.context.SecurityContext;
@@ -65,9 +66,8 @@ public class SecurityContextPropagatingChannelInterceptorTests {
message = (StringMessage) channel.receive(0);
MessageHeader header = message.getHeader();
assertTrue("No security context attribute found in header.",
header.getAttributeNames().contains(SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE));
SecurityContext contextFromHeader = (SecurityContext) header.getAttribute(
SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE);
header.getAttributeNames().contains(SecurityContextUtils.SECURITY_CONTEXT_HEADER_ATTRIBUTE));
SecurityContext contextFromHeader = SecurityContextUtils.getSecurityContextFromHeader(message);
assertEquals("Incorrect security context in message header.", securityContext, contextFromHeader);
}
@@ -78,7 +78,7 @@ public class SecurityContextPropagatingChannelInterceptorTests {
message = (StringMessage) channel.receive(0);
MessageHeader header = message.getHeader();
assertFalse("Security context header found when no security context existed.",
header.getAttributeNames().contains(SecurityContextPropagatingChannelInterceptor.SECURITY_CONTEXT_HEADER_ATTRIBUTE));
header.getAttributeNames().contains(SecurityContextUtils.SECURITY_CONTEXT_HEADER_ATTRIBUTE));
}

8
org.springframework.integration.security/src/test/java/org/springframework/integration/security/SecurityEnforcingChannelInterceptorTests.java → org.springframework.integration.security/src/test/java/org/springframework/integration/security/channel/SecurityEnforcingChannelInterceptorTests.java
View File

@@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.integration.security;
package org.springframework.integration.security.channel;
import static org.junit.Assert.assertEquals;
@@ -24,6 +24,7 @@ import org.junit.Test;
import org.springframework.integration.channel.QueueChannel;
import org.springframework.integration.message.StringMessage;
import org.springframework.integration.security.channel.SecurityEnforcingChannelInterceptor;
import org.springframework.security.AccessDecisionManager;
import org.springframework.security.AccessDeniedException;
import org.springframework.security.Authentication;
@@ -124,9 +125,8 @@ public class SecurityEnforcingChannelInterceptorTests {
private void registerInterceptor(AccessDecisionManager accessDecisionManager) {
securityChannelInterceptor = new SecurityEnforcingChannelInterceptor(
accessDecisionManager, channel);
securityChannelInterceptor = new SecurityEnforcingChannelInterceptor(accessDecisionManager);
channel.addInterceptor(securityChannelInterceptor);
}

22
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-noPropagationByDefaultContext.xml
View File

@@ -1,22 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/integration"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
<beans:import resource="commonSecurityConfiguration.xml"/>
<message-bus/>
<channel id="propagationDefault"/>
<channel id="excludedFromPropagation">
<secured propagate="false"/>
</channel>
</beans:beans>

43
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests-context.xml Normal file
View File

@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/integration"
xmlns:si-security="http://www.springframework.org/schema/integration-security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
http://www.springframework.org/schema/integration-security http://www.springframework.org/schema/integration/spring-integration-security-1.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
<beans:import resource="commonSecurityConfiguration.xml"/>
<si-security:secured-channels send-access="ROLE_ADMIN" propagate="false">
<si-security:channel-name-pattern>adminRequiredForSend</si-security:channel-name-pattern>
</si-security:secured-channels>
<si-security:secured-channels send-access="ROLE_ADMIN, ROLE_USER" propagate="false">
<si-security:channel-name-pattern>adminOrUserRequiredForSend</si-security:channel-name-pattern>
</si-security:secured-channels>
<si-security:secured-channels receive-access="ROLE_ADMIN" propagate="false">
<si-security:channel-name-pattern>adminRequiredForReceive</si-security:channel-name-pattern>
</si-security:secured-channels>
<si-security:secured-channels receive-access="ROLE_ADMIN, ROLE_USER" propagate="false">
<si-security:channel-name-pattern>adminOrUserRequiredForReceive</si-security:channel-name-pattern>
</si-security:secured-channels>
<si-security:secured-channels receive-access="ROLE_ADMIN" send-access="ROLE_ADMIN" propagate="false">
<si-security:channel-name-pattern>adminForSendAndReceive</si-security:channel-name-pattern>
</si-security:secured-channels>
</beans:beans>

140
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java Normal file
View File

@@ -0,0 +1,140 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
import static org.junit.Assert.*;
import java.util.ArrayList;
import java.util.List;
import org.junit.Before;
import org.junit.Test;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.integration.channel.AbstractMessageChannel;
import org.springframework.integration.channel.ChannelInterceptor;
import org.springframework.integration.message.Message;
import org.springframework.integration.message.selector.MessageSelector;
import org.springframework.integration.security.channel.SecurityEnforcingChannelInterceptor;
import org.springframework.security.ConfigAttribute;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.SecurityConfig;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests;
/**
* @author Jonas Partner
*/
@ContextConfiguration
public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests{
TestMessageChannel messageChannel ;
@Before
public void setUp(){
messageChannel = new TestMessageChannel();
}
@Test
public void testAdminRequiredForSend(){
applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminRequiredForSend");
assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size());
SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0);
assertTrue("ROLE_ADMIN not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN")));
assertNull("Receive security attribute were not null", interceptor.getReceiveSecurityAttributes());
}
@Test
public void testAdminOrUserRequiredForSend(){
applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminOrUserRequiredForSend");
assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size());
SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0);
assertTrue("ROLE_ADMIN not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN")));
assertTrue("ROLE_USER not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_USER")));
assertNull("Receive security attribute were not null", interceptor.getReceiveSecurityAttributes());
}
@Test
public void testAdminRequiredForReceive(){
applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminRequiredForReceive");
assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size());
SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0);
assertTrue("ROLE_ADMIN not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN")));
assertNull("Send security attribute were not null", interceptor.getSendSecurityAttributes());
}
@Test
public void testAdminOrUserRequiredForReceive(){
applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminOrUserRequiredForReceive");
assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size());
SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0);
assertTrue("ROLE_ADMIN not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN")));
assertTrue("ROLE_USER not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_USER")));
assertNull("Send security attribute were not null", interceptor.getSendSecurityAttributes());
}
@Test
public void testAdminRequiredForSendAndReceive(){
applicationContext.getAutowireCapableBeanFactory().applyBeanPostProcessorsAfterInitialization(messageChannel, "adminForSendAndReceive");
assertEquals("Wrong count of interceptors ", 1, messageChannel.interceptors.size());
SecurityEnforcingChannelInterceptor interceptor = (SecurityEnforcingChannelInterceptor)messageChannel.interceptors.get(0);
assertTrue("ROLE_ADMIN not found as receive attribute", interceptor.getReceiveSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN")));
assertTrue("ROLE_USER not found as send attribute", interceptor.getSendSecurityAttributes().contains(new SecurityConfig("ROLE_ADMIN")));
}
static class TestMessageChannel extends AbstractMessageChannel {
List<ChannelInterceptor> interceptors = new ArrayList<ChannelInterceptor>();
public TestMessageChannel() {
super(null);
}
@Override
protected Message<?> doReceive(long timeout) {
// TODO Auto-generated method stub
return null;
}
@Override
protected boolean doSend(Message<?> message, long timeout) {
// TODO Auto-generated method stub
return false;
}
public List<Message<?>> clear() {
// TODO Auto-generated method stub
return null;
}
public List<Message<?>> purge(MessageSelector selector) {
// TODO Auto-generated method stub
return null;
}
@Override
public void addInterceptor(ChannelInterceptor interceptor) {
interceptors.add(interceptor);
}
}
}

30
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests-context.xml
View File

@@ -1,30 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/integration"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
<beans:import resource="commonSecurityConfiguration.xml"/>
<message-bus/>
<channel id="unsecured" />
<channel id="adminRequiredForSend" >
<secured send-access="ROLE_ADMIN" />
</channel>
<channel id="adminRequiredForReceive" >
<secured receive-access="ROLE_ADMIN" />
</channel>
<channel id="adminRequiredForSendAndReceive">
<secured send-access="ROLE_ADMIN" receive-access="ROLE_ADMIN" />
</channel>
</beans:beans>

136
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecuredParserTests.java
View File

@@ -1,136 +0,0 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
import static org.junit.Assert.assertNotNull;
import org.junit.After;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.integration.channel.MessageChannel;
import org.springframework.integration.message.StringMessage;
import org.springframework.security.AccessDeniedException;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.context.SecurityContextImpl;
import org.springframework.security.providers.AuthenticationProvider;
import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests;
/**
* @author Jonas Partner
*/
@ContextConfiguration
public class SecuredParserTests extends AbstractJUnit4SpringContextTests{
@Autowired
private AuthenticationProvider provider;
@Autowired
@Qualifier("unsecured")
public MessageChannel unsecuredChannel;
@Autowired
@Qualifier("adminRequiredForSend")
public MessageChannel adminRequiredForSend;
@Autowired
@Qualifier("adminRequiredForReceive")
public MessageChannel adminRequiredForReceive;
@Autowired
@Qualifier("adminRequiredForSendAndReceive")
public MessageChannel adminRequiredForSendAndReceive;
@After
public void tearDown() {
SecurityContextHolder.clearContext();
}
@Test
public void testNoSecurityRestrictionsOnChannel() {
unsecuredChannel.send(new StringMessage("testUnsecured"));
assertNotNull("Message not received ", unsecuredChannel.receive(0));
}
@Test
public void testAdminRequiredForSendWithAccessGranted() {
login("jimi", "jimispassword");
adminRequiredForSend.send(new StringMessage("testmessage"));
assertNotNull("Message not received", adminRequiredForSend.receive(0));
}
@Test(expected=AccessDeniedException.class)
public void testAdminRequiredForSendWithAccessDenied() {
login("bob", "bobspassword");
adminRequiredForSend.send(new StringMessage("testmessage"));
}
@Test
public void testAdminRequiredForReceiveWithAccessGranted(){
adminRequiredForReceive.send(new StringMessage("testmessage"));
login("jimi", "jimispassword");
assertNotNull("Message not received", adminRequiredForReceive.receive(0));
}
@Test(expected=AccessDeniedException.class)
public void testAdminRequiredForReceiveWithAccessDenied() {
adminRequiredForReceive.send(new StringMessage("testmessage"));
login("bob", "bobspassword");
adminRequiredForReceive.receive(0);
}
@Test
public void testAdminRequiredForSendAndReceiveWithSendAccessGranted() {
login("jimi", "jimispassword");
adminRequiredForSendAndReceive.send(new StringMessage("test"));
}
@Test(expected=AccessDeniedException.class)
public void testAdminRequiredForSendAndReceiveWithSendAccessDenied() {
login("bob", "bobspassword");
adminRequiredForSendAndReceive.send(new StringMessage("test"));
}
@Test
public void testAdminRequiredForSendAndReceiveWithReceiveAccessGranted() {
login("jimi", "jimispassword");
adminRequiredForSendAndReceive.send(new StringMessage("test"));
assertNotNull("Message not received", adminRequiredForSendAndReceive.receive(0));
}
@Test(expected=AccessDeniedException.class)
public void testAdminRequiredForSendAndReceiveWithReceiveAccessDenied() {
login("bob","bobspassword");
adminRequiredForSendAndReceive.receive(0);
}
private void login(String username, String password) {
UsernamePasswordAuthenticationToken authToken = (UsernamePasswordAuthenticationToken)
provider.authenticate(new UsernamePasswordAuthenticationToken(username, password));
SecurityContext context = new SecurityContextImpl();
context.setAuthentication(authToken);
SecurityContextHolder.setContext(context);
}
}

21
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests-propagateByDefaultContext.xml → org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-noPropagationByDefaultContext.xml
View File

@@ -1,5 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/integration"
xmlns:si-security="http://www.springframework.org/schema/integration-security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
@@ -7,22 +8,26 @@
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
http://www.springframework.org/schema/integration-security http://www.springframework.org/schema/integration/spring-integration-security-1.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
<beans:import resource="commonSecurityConfiguration.xml"/>
<message-bus/>
<secure-channels propagate="true"/>
<channel id="propagationDefault"/>
<channel id="excludedFromPropagation">
<secured propagate="false"/>
</channel>
<si-security:secured-channels send-access="ROLE_ADMIN" >
<si-security:channel-name-pattern>adminRequiredForSend</si-security:channel-name-pattern>
</si-security:secured-channels>
<channel id="includedInProaogation">
<secured propagate="true"/>
</channel>
<si-security:secured-channels propagate="false">
<si-security:channel-name-pattern>excludedFromPropagation</si-security:channel-name-pattern>
</si-security:secured-channels>
<channel id="excludedFromPropagation"/>
</beans:beans>

42
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests-propagateByDefaultContext.xml Normal file
View File

@@ -0,0 +1,42 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/integration"
xmlns:si-security="http://www.springframework.org/schema/integration-security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-1.0.xsd
http://www.springframework.org/schema/integration-security http://www.springframework.org/schema/integration/spring-integration-security-1.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd">
<beans:import resource="commonSecurityConfiguration.xml"/>
<message-bus/>
<si-security:security-propagating-channels propagate="true"/>
<channel id="propagationDefault"/>
<channel id="excludedFromPropagation" />
<si-security:secured-channels propagate="false">
<si-security:channel-name-pattern>excludedFromPropagation</si-security:channel-name-pattern>
</si-security:secured-channels>
<channel id="includedInPropagation" />
<si-security:secured-channels propagate="true">
<si-security:channel-name-pattern>includedInPropagation</si-security:channel-name-pattern>
</si-security:secured-channels>
<security:authentication-provider user-service-ref="userDetailsService"/>
<security:user-service id="userDetailsService">
<security:user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN"/>
<security:user name="bob" password="bobspassword" authorities="ROLE_USER"/>
</security:user-service>
</beans:beans>

2
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecureChannelsParserTests.java → org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityPropagatingChannelsParserTests.java
View File

@@ -36,7 +36,7 @@ import org.springframework.security.providers.UsernamePasswordAuthenticationToke
/**
* @author Jonas Partner
*/
public class SecureChannelsParserTests {
public class SecurityPropagatingChannelsParserTests {
private ClassPathXmlApplicationContext applicationContext;

46
org.springframework.integration.security/src/test/java/org/springframework/integration/security/config/SecurityTestUtil.java Normal file
View File

@@ -0,0 +1,46 @@
/*
* Copyright 2002-2008 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.security.config;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextImpl;
import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
/**
*
* @author Jonas Partner
*
*/
public class SecurityTestUtil {
public static SecurityContext createContext(String username, String password, String... roles){
SecurityContextImpl ctxImpl = new SecurityContextImpl();
UsernamePasswordAuthenticationToken authToken;
if(roles != null && roles.length > 0){
GrantedAuthority[] authorities = new GrantedAuthority[roles.length];
for (int i =0; i < roles.length; i++) {
authorities[i] = new GrantedAuthorityImpl(roles[i]);
}
authToken = new UsernamePasswordAuthenticationToken(username,password,authorities);
} else {
authToken = new UsernamePasswordAuthenticationToken(username, password);
}
ctxImpl.setAuthentication(authToken);
return ctxImpl;
}
}