From bdefd8a6ec5a47f9b368102e9661c92e7357ec86 Mon Sep 17 00:00:00 2001 From: Artem Bilan Date: Tue, 17 Oct 2023 11:30:21 -0400 Subject: [PATCH] Deprecate `spring-integration-security` module The `SecurityContextPropagationChannelInterceptor` has been migrated to `spring-security-messaging`. Since it was only the class in the `spring-integration-security`, it is now fully considered as deprecated * Remove all the tests from `spring-integration-security` * Modify `HttpDslTests` to demonstrate the `spring-security-messaging` in action which has been replaced with whatever there was in `spring-integration-security` * Remove redundant `exclude group: 'org.springframework'` for security dependencies in `build.gradle` since all of them rely on the same SF deps as SI --- build.gradle | 26 +- .../integration/http/dsl/HttpDslTests.java | 35 +- ...yContextPropagationChannelInterceptor.java | 5 +- .../security/SecurityTestUtils.java | 56 --- .../integration/security/TestHandler.java | 36 -- ...dapterSecurityIntegrationTests-context.xml | 67 --- ...hannelAdapterSecurityIntegrationTests.java | 167 ------- .../ChannelSecurityInterceptorTests.java | 82 ---- .../ChannelSecurityAnnotationTests.java | 423 ------------------ .../src/test/resources/log4j2-test.xml | 15 - .../antora/modules/ROOT/pages/security.adoc | 39 +- .../antora/modules/ROOT/pages/whats-new.adoc | 6 + 12 files changed, 49 insertions(+), 908 deletions(-) delete mode 100644 spring-integration-security/src/test/java/org/springframework/integration/security/SecurityTestUtils.java delete mode 100644 spring-integration-security/src/test/java/org/springframework/integration/security/TestHandler.java delete mode 100644 spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests-context.xml delete mode 100644 spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests.java delete mode 100644 spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java delete mode 100644 spring-integration-security/src/test/java/org/springframework/integration/security/config/ChannelSecurityAnnotationTests.java delete mode 100644 spring-integration-security/src/test/resources/log4j2-test.xml diff --git a/build.gradle b/build.gradle index c335200201..149d7ae548 100644 --- a/build.gradle +++ b/build.gradle @@ -702,14 +702,10 @@ project('spring-integration-http') { optionalApi "com.rometools:rome:$romeToolsVersion" optionalApi 'org.springframework:spring-webflux' - testImplementation project(':spring-integration-security') testImplementation "org.hamcrest:hamcrest-core:$hamcrestVersion" - testImplementation('org.springframework.security:spring-security-config') { - exclude group: 'org.springframework' - } - testImplementation('org.springframework.security:spring-security-test') { - exclude group: 'org.springframework' - } + testImplementation 'org.springframework.security:spring-security-messaging' + testImplementation 'org.springframework.security:spring-security-config' + testImplementation 'org.springframework.security:spring-security-test' testImplementation 'com.fasterxml.jackson.core:jackson-databind' testRuntimeOnly "com.jayway.jsonpath:json-path:$jsonpathVersion" @@ -916,13 +912,9 @@ project('spring-integration-security') { description = 'Spring Integration Security Support' dependencies { api project(':spring-integration-core') - api('org.springframework.security:spring-security-messaging') { - exclude group: 'org.springframework' - } + api 'org.springframework.security:spring-security-messaging' - testImplementation('org.springframework.security:spring-security-config') { - exclude group: 'org.springframework' - } + testImplementation 'org.springframework.security:spring-security-config' } } @@ -1017,12 +1009,8 @@ project('spring-integration-webflux') { testImplementation "jakarta.servlet:jakarta.servlet-api:$servletApiVersion" testImplementation "org.hamcrest:hamcrest-core:$hamcrestVersion" testImplementation 'org.springframework:spring-webmvc' - testImplementation('org.springframework.security:spring-security-config') { - exclude group: 'org.springframework' - } - testImplementation('org.springframework.security:spring-security-test') { - exclude group: 'org.springframework' - } + testImplementation 'org.springframework.security:spring-security-config' + testImplementation 'org.springframework.security:spring-security-test' testImplementation 'com.fasterxml.jackson.core:jackson-databind' testImplementation 'io.micrometer:micrometer-observation-test' testImplementation('io.micrometer:micrometer-tracing-integration-test') { diff --git a/spring-integration-http/src/test/java/org/springframework/integration/http/dsl/HttpDslTests.java b/spring-integration-http/src/test/java/org/springframework/integration/http/dsl/HttpDslTests.java index 465656cf34..627320785d 100644 --- a/spring-integration-http/src/test/java/org/springframework/integration/http/dsl/HttpDslTests.java +++ b/spring-integration-http/src/test/java/org/springframework/integration/http/dsl/HttpDslTests.java @@ -36,14 +36,18 @@ import org.springframework.http.client.ClientHttpRequestFactory; import org.springframework.http.client.ClientHttpResponse; import org.springframework.integration.channel.DirectChannel; import org.springframework.integration.channel.FixedSubscriberChannel; +import org.springframework.integration.channel.QueueChannel; import org.springframework.integration.config.EnableIntegration; +import org.springframework.integration.dsl.DirectChannelSpec; import org.springframework.integration.dsl.IntegrationFlow; +import org.springframework.integration.dsl.MessageChannels; +import org.springframework.integration.dsl.QueueChannelSpec; import org.springframework.integration.dsl.context.IntegrationFlowContext; import org.springframework.integration.handler.AbstractReplyProducingMessageHandler; import org.springframework.integration.http.multipart.UploadedMultipartFile; import org.springframework.integration.http.outbound.HttpRequestExecutingMessageHandler; +import org.springframework.integration.scheduling.PollerMetadata; import org.springframework.messaging.Message; -import org.springframework.messaging.MessageChannel; import org.springframework.messaging.PollableChannel; import org.springframework.messaging.support.ErrorMessage; import org.springframework.mock.web.MockPart; @@ -56,6 +60,7 @@ import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.factory.PasswordEncoderFactories; import org.springframework.security.messaging.access.intercept.AuthorizationChannelInterceptor; +import org.springframework.security.messaging.context.SecurityContextPropagationChannelInterceptor; import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; @@ -330,21 +335,33 @@ public class HttpDslTests { .build(); } - @Bean - public MessageChannel transformSecuredChannel() { - DirectChannel directChannel = new DirectChannel(); - directChannel.addInterceptor( - new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasRole("ADMIN"))); - return directChannel; + @Bean(PollerMetadata.DEFAULT_POLLER) + PollerMetadata pollerMetadata() { + return new PollerMetadata(); } @Bean - public IntegrationFlow httpInternalServiceFlow() { + public QueueChannelSpec securityPropagationChannel() { + return MessageChannels.queue() + .interceptor(new SecurityContextPropagationChannelInterceptor()); + } + + @Bean + public DirectChannelSpec transformSecuredChannel() { + return MessageChannels.direct() + .interceptor(new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasRole("ADMIN"))); + } + + @Bean + public IntegrationFlow httpInternalServiceFlow(QueueChannel securityPropagationChannel, + DirectChannel transformSecuredChannel) { + return IntegrationFlow .from(Http.inboundGateway("/service/internal") .requestMapping(r -> r.params("name")) .payloadExpression("#requestParams.name")) - .channel(transformSecuredChannel()) + .channel(securityPropagationChannel) + .channel(transformSecuredChannel) ., String>transform(p -> p.get(0).toUpperCase()) .get(); } diff --git a/spring-integration-security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagationChannelInterceptor.java b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagationChannelInterceptor.java index 85557338f5..0aeb29305f 100644 --- a/spring-integration-security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagationChannelInterceptor.java +++ b/spring-integration-security/src/main/java/org/springframework/integration/security/channel/SecurityContextPropagationChannelInterceptor.java @@ -1,5 +1,5 @@ /* - * Copyright 2015-2019 the original author or authors. + * Copyright 2015-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -43,7 +43,10 @@ import org.springframework.security.core.context.SecurityContextHolder; * @since 4.2 * * @see ThreadStatePropagationChannelInterceptor + * + * @deprecated since 6.2 in favor of {@link org.springframework.security.messaging.context.SecurityContextPropagationChannelInterceptor} */ +@Deprecated(since = "6.2", forRemoval = true) public class SecurityContextPropagationChannelInterceptor extends ThreadStatePropagationChannelInterceptor { diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/SecurityTestUtils.java b/spring-integration-security/src/test/java/org/springframework/integration/security/SecurityTestUtils.java deleted file mode 100644 index 813917a1f0..0000000000 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/SecurityTestUtils.java +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Copyright 2002-2019 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security; - -import java.util.Arrays; - -import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; -import org.springframework.security.core.GrantedAuthority; -import org.springframework.security.core.authority.SimpleGrantedAuthority; -import org.springframework.security.core.context.SecurityContext; -import org.springframework.security.core.context.SecurityContextImpl; - -/** - * @author Jonas Partner - * @author Oleg Zhurakousky - * @author Gary Russell - */ -public class SecurityTestUtils { - - private SecurityTestUtils() { - super(); - } - - public static SecurityContext createContext(String username, String password, String... roles) { - SecurityContextImpl ctxImpl = new SecurityContextImpl(); - UsernamePasswordAuthenticationToken authToken; - if (roles != null && roles.length > 0) { - GrantedAuthority[] authorities = new GrantedAuthority[roles.length]; - for (int i = 0; i < roles.length; i++) { - authorities[i] = new SimpleGrantedAuthority(roles[i]); - } - authToken = new UsernamePasswordAuthenticationToken(username, password, - Arrays.asList(authorities)); - } - else { - authToken = new UsernamePasswordAuthenticationToken(username, password); - } - ctxImpl.setAuthentication(authToken); - return ctxImpl; - } - -} diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/TestHandler.java b/spring-integration-security/src/test/java/org/springframework/integration/security/TestHandler.java deleted file mode 100644 index 255a9ab88b..0000000000 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/TestHandler.java +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright 2002-2019 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security; - -import java.util.ArrayList; -import java.util.List; - -import org.springframework.messaging.Message; -import org.springframework.messaging.MessageHandler; - -/** - * @author Mark Fisher - */ -public class TestHandler implements MessageHandler { - - public List> sentMessages = new ArrayList>(); - - public void handleMessage(Message message) { - sentMessages.add(message); - } - -} diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests-context.xml b/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests-context.xml deleted file mode 100644 index 2a4be73dd6..0000000000 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests-context.xml +++ /dev/null @@ -1,67 +0,0 @@ - - - - - - - - - - - - - - - ADMIN - PRESIDENT - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests.java b/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests.java deleted file mode 100644 index 040d3d32d1..0000000000 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests.java +++ /dev/null @@ -1,167 +0,0 @@ -/* - * Copyright 2002-2022 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security.channel; - -import org.junit.jupiter.api.AfterEach; -import org.junit.jupiter.api.Test; - -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Qualifier; -import org.springframework.integration.security.SecurityTestUtils; -import org.springframework.integration.security.TestHandler; -import org.springframework.messaging.Message; -import org.springframework.messaging.MessageChannel; -import org.springframework.messaging.MessageDeliveryException; -import org.springframework.messaging.PollableChannel; -import org.springframework.messaging.support.GenericMessage; -import org.springframework.security.access.AccessDeniedException; -import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException; -import org.springframework.security.core.context.SecurityContext; -import org.springframework.security.core.context.SecurityContextHolder; -import org.springframework.test.annotation.DirtiesContext; -import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; - -import static org.assertj.core.api.Assertions.assertThat; -import static org.assertj.core.api.Assertions.assertThatExceptionOfType; - -/** - * @author Mark Fisher - * @author Oleg Zhurakousky - * @author Artem Bilan - */ -@SpringJUnitConfig -@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD) -public class ChannelAdapterSecurityIntegrationTests { - - @Autowired - @Qualifier("securedChannelAdapter") - MessageChannel securedChannelAdapter; - - @Autowired - @Qualifier("securedChannelAdapter") - MessageChannel securedChannelAdapter2; - - @Autowired - @Qualifier("unsecuredChannelAdapter") - MessageChannel unsecuredChannelAdapter; - - @Autowired - @Qualifier("queueChannel") - MessageChannel queueChannel; - - @Autowired - @Qualifier("securedChannelQueue") - PollableChannel securedChannelQueue; - - @Autowired - @Qualifier("errorChannel") - PollableChannel errorChannel; - - @Autowired - TestHandler testConsumer; - - - @AfterEach - public void tearDown() { - SecurityContextHolder.clearContext(); - } - - - @Test - public void testSecuredWithNotEnoughPermission() { - login("bob", "bobspassword", "ROLE_ADMINA"); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannelAdapter.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AccessDeniedException.class); - } - - @Test - public void testSecuredWithPermission() { - login("bob", "bobspassword", "ROLE_ADMIN", "ROLE_PRESIDENT"); - securedChannelAdapter.send(new GenericMessage<>("test")); - securedChannelAdapter2.send(new GenericMessage<>("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(2); - } - - @Test - public void testSecurityContextPropagation() { - login("bob", "bobspassword", "ROLE_ADMIN", "ROLE_PRESIDENT"); - this.queueChannel.send(new GenericMessage<>("test")); - Message receive = this.securedChannelQueue.receive(10000); - assertThat(receive).isNotNull(); - - SecurityContextHolder.clearContext(); - - this.queueChannel.send(new GenericMessage<>("test")); - Message errorMessage = this.errorChannel.receive(10000); - assertThat(errorMessage).isNotNull(); - Object payload = errorMessage.getPayload(); - assertThat(payload).isInstanceOf(MessageDeliveryException.class); - assertThat(((MessageDeliveryException) payload).getCause()) - .isInstanceOf(AuthenticationCredentialsNotFoundException.class); - } - - @Test - public void testSecuredWithoutPermission() { - login("bob", "bobspassword", "ROLE_USER"); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannelAdapter.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AccessDeniedException.class); - } - - @Test - public void testSecured2WithoutPermission() { - login("bob", "bobspassword", "ROLE_USER"); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannelAdapter2.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AccessDeniedException.class); - } - - @Test - public void testSecuredWithoutAuthenticating() { - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannelAdapter.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AuthenticationCredentialsNotFoundException.class); - } - - @Test - public void testUnsecuredAsAdmin() { - login("bob", "bobspassword", "ROLE_ADMIN"); - unsecuredChannelAdapter.send(new GenericMessage("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(1); - } - - @Test - public void testUnsecuredAsUser() { - login("bob", "bobspassword", "ROLE_USER"); - unsecuredChannelAdapter.send(new GenericMessage("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(1); - } - - @Test - public void testUnsecuredWithoutAuthenticating() { - unsecuredChannelAdapter.send(new GenericMessage("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(1); - } - - - private void login(String username, String password, String... roles) { - SecurityContext context = SecurityTestUtils.createContext(username, password, roles); - SecurityContextHolder.setContext(context); - } - -} diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java b/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java deleted file mode 100644 index 98fb95ee40..0000000000 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java +++ /dev/null @@ -1,82 +0,0 @@ -/* - * Copyright 2002-2022 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security.channel; - -import org.junit.jupiter.api.AfterEach; -import org.junit.jupiter.api.Test; - -import org.springframework.integration.channel.QueueChannel; -import org.springframework.integration.security.SecurityTestUtils; -import org.springframework.messaging.MessageChannel; -import org.springframework.messaging.MessageDeliveryException; -import org.springframework.messaging.support.GenericMessage; -import org.springframework.security.access.AccessDeniedException; -import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException; -import org.springframework.security.authorization.AuthorityAuthorizationManager; -import org.springframework.security.core.context.SecurityContext; -import org.springframework.security.core.context.SecurityContextHolder; -import org.springframework.security.messaging.access.intercept.AuthorizationChannelInterceptor; - -import static org.assertj.core.api.Assertions.assertThatExceptionOfType; - -/** - * @author Mark Fisher - * @author Oleg Zhurakousky - * @author Artem Bilan - */ -public class ChannelSecurityInterceptorTests { - - @AfterEach - public void clearSecurityContext() { - SecurityContextHolder.clearContext(); - } - - @Test - public void securedSendWithoutAuthentication() { - MessageChannel channel = getSecuredChannel(); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> channel.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AuthenticationCredentialsNotFoundException.class); - } - - @Test - public void securedSendWithoutRole() { - MessageChannel channel = getSecuredChannel(); - SecurityContext context = SecurityTestUtils.createContext("test", "pwd", "ROLE_USER"); - SecurityContextHolder.setContext(context); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> channel.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AccessDeniedException.class); - } - - @Test - public void securedSendWithRole() { - MessageChannel channel = getSecuredChannel(); - SecurityContext context = SecurityTestUtils.createContext("test", "pwd", "ROLE_ADMIN"); - SecurityContextHolder.setContext(context); - channel.send(new GenericMessage<>("test")); - } - - - private static MessageChannel getSecuredChannel() { - QueueChannel channel = new QueueChannel(); - channel.setBeanName("securedChannel"); - channel.addInterceptor(new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasRole("ADMIN"))); - return channel; - } - -} diff --git a/spring-integration-security/src/test/java/org/springframework/integration/security/config/ChannelSecurityAnnotationTests.java b/spring-integration-security/src/test/java/org/springframework/integration/security/config/ChannelSecurityAnnotationTests.java deleted file mode 100644 index 034ac4f7fa..0000000000 --- a/spring-integration-security/src/test/java/org/springframework/integration/security/config/ChannelSecurityAnnotationTests.java +++ /dev/null @@ -1,423 +0,0 @@ -/* - * Copyright 2014-2022 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.integration.security.config; - -import java.util.concurrent.Executors; -import java.util.concurrent.Future; -import java.util.concurrent.TimeUnit; - -import org.junit.jupiter.api.AfterEach; -import org.junit.jupiter.api.Test; - -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Qualifier; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.context.support.PropertySourcesPlaceholderConfigurer; -import org.springframework.core.task.AsyncTaskExecutor; -import org.springframework.core.task.SimpleAsyncTaskExecutor; -import org.springframework.integration.IntegrationMessageHeaderAccessor; -import org.springframework.integration.annotation.BridgeTo; -import org.springframework.integration.annotation.Gateway; -import org.springframework.integration.annotation.IntegrationComponentScan; -import org.springframework.integration.annotation.MessagingGateway; -import org.springframework.integration.annotation.Poller; -import org.springframework.integration.annotation.ServiceActivator; -import org.springframework.integration.channel.DirectChannel; -import org.springframework.integration.channel.ExecutorChannel; -import org.springframework.integration.channel.PublishSubscribeChannel; -import org.springframework.integration.channel.QueueChannel; -import org.springframework.integration.config.EnableIntegration; -import org.springframework.integration.config.GlobalChannelInterceptor; -import org.springframework.integration.handler.BridgeHandler; -import org.springframework.integration.security.SecurityTestUtils; -import org.springframework.integration.security.TestHandler; -import org.springframework.integration.security.channel.SecurityContextPropagationChannelInterceptor; -import org.springframework.messaging.Message; -import org.springframework.messaging.MessageChannel; -import org.springframework.messaging.MessageDeliveryException; -import org.springframework.messaging.MessageHandler; -import org.springframework.messaging.MessageHeaders; -import org.springframework.messaging.PollableChannel; -import org.springframework.messaging.SubscribableChannel; -import org.springframework.messaging.support.ChannelInterceptor; -import org.springframework.messaging.support.GenericMessage; -import org.springframework.scheduling.TaskScheduler; -import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler; -import org.springframework.security.access.AccessDeniedException; -import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException; -import org.springframework.security.authorization.AuthorityAuthorizationManager; -import org.springframework.security.core.context.SecurityContext; -import org.springframework.security.core.context.SecurityContextHolder; -import org.springframework.security.core.userdetails.User; -import org.springframework.security.core.userdetails.UserDetailsService; -import org.springframework.security.messaging.access.intercept.AuthorizationChannelInterceptor; -import org.springframework.security.provisioning.InMemoryUserDetailsManager; -import org.springframework.security.task.DelegatingSecurityContextAsyncTaskExecutor; -import org.springframework.test.annotation.DirtiesContext; -import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; - -import static org.assertj.core.api.Assertions.assertThat; -import static org.assertj.core.api.Assertions.assertThatExceptionOfType; - -/** - * @author Artem Bilan - * - * @since 4.0 - */ -@SpringJUnitConfig -@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD) -public class ChannelSecurityAnnotationTests { - - @Autowired - MessageChannel securedChannel; - - @Autowired - MessageChannel securedChannel2; - - @Autowired - MessageChannel unsecuredChannel; - - @Autowired - @Qualifier("queueChannel") - MessageChannel queueChannel; - - @Autowired - @Qualifier("securedChannelQueue") - PollableChannel securedChannelQueue; - - @Autowired - @Qualifier("executorChannel") - MessageChannel executorChannel; - - @Autowired - @Qualifier("publishSubscribeChannel") - PublishSubscribeChannel publishSubscribeChannel; - - @Autowired - @Qualifier("securedChannelQueue2") - PollableChannel securedChannelQueue2; - - @Autowired - @Qualifier("errorChannel") - PollableChannel errorChannel; - - @Autowired - TestHandler testConsumer; - - @Autowired - TestGateway testGateway; - - @AfterEach - public void tearDown() { - SecurityContextHolder.clearContext(); - } - - - @Test - public void testSecuredWithNotEnoughPermission() { - login("bob", "bobspassword", "ROLE_ADMINA"); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannel.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AccessDeniedException.class); - } - - @Test - public void testSecuredWithPermission() { - login("bob", "bobspassword", "ROLE_ADMIN", "ROLE_PRESIDENT"); - securedChannel.send(new GenericMessage<>("test")); - securedChannel2.send(new GenericMessage<>("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(2); - } - - @Test - public void testSecuredWithoutPermision() { - login("bob", "bobspassword", "ROLE_USER"); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannel.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AccessDeniedException.class); - } - - @Test - public void testSecured2WithoutPermision() { - login("bob", "bobspassword", "ROLE_USER"); - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannel2.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AccessDeniedException.class); - } - - @Test - public void testSecuredWithoutAuthenticating() { - assertThatExceptionOfType(MessageDeliveryException.class) - .isThrownBy(() -> this.securedChannel2.send(new GenericMessage<>("test"))) - .withRootCauseExactlyInstanceOf(AuthenticationCredentialsNotFoundException.class); - } - - @Test - public void testUnsecuredAsAdmin() { - login("bob", "bobspassword", "ROLE_ADMIN"); - unsecuredChannel.send(new GenericMessage<>("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(1); - } - - @Test - public void testUnsecuredAsUser() { - login("bob", "bobspassword", "ROLE_USER"); - unsecuredChannel.send(new GenericMessage<>("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(1); - } - - @Test - public void testUnsecuredWithoutAuthenticating() { - unsecuredChannel.send(new GenericMessage<>("test")); - assertThat(testConsumer.sentMessages.size()).as("Wrong size of message list in target").isEqualTo(1); - } - - @Test - public void testSecurityContextPropagationQueueChannel() { - login("bob", "bobspassword", "ROLE_ADMIN", "ROLE_PRESIDENT"); - this.queueChannel.send(new GenericMessage<>("test")); - Message receive = this.securedChannelQueue.receive(10000); - assertThat(receive).isNotNull(); - - SecurityContextHolder.clearContext(); - - this.queueChannel.send(new GenericMessage<>("test")); - Message errorMessage = this.errorChannel.receive(10000); - assertThat(errorMessage).isNotNull(); - Object payload = errorMessage.getPayload(); - assertThat(payload).isInstanceOf(MessageDeliveryException.class); - assertThat(((MessageDeliveryException) payload).getCause()) - .isInstanceOf(AuthenticationCredentialsNotFoundException.class); - } - - @Test - public void testSecurityContextPropagationExecutorChannel() { - login("bob", "bobspassword", "ROLE_ADMIN", "ROLE_PRESIDENT"); - this.executorChannel.send(new GenericMessage<>("test")); - Message receive = this.securedChannelQueue.receive(10000); - assertThat(receive).isNotNull(); - - SecurityContextHolder.clearContext(); - - this.executorChannel.send(new GenericMessage<>("test")); - Message errorMessage = this.errorChannel.receive(10000); - assertThat(errorMessage).isNotNull(); - Object payload = errorMessage.getPayload(); - assertThat(payload).isInstanceOf(MessageDeliveryException.class); - assertThat(((MessageDeliveryException) payload).getCause()) - .isInstanceOf(AuthenticationCredentialsNotFoundException.class); - } - - @Test - public void testSecurityContextPropagationPublishSubscribeChannel() { - login("bob", "bobspassword", "ROLE_ADMIN", "ROLE_PRESIDENT"); - - this.publishSubscribeChannel.send(new GenericMessage<>("test")); - - Message receive = this.securedChannelQueue.receive(10000); - assertThat(receive).isNotNull(); - IntegrationMessageHeaderAccessor headerAccessor = new IntegrationMessageHeaderAccessor(receive); - assertThat(headerAccessor.getSequenceNumber()).isEqualTo(0); - - receive = this.securedChannelQueue2.receive(10000); - assertThat(receive).isNotNull(); - headerAccessor = new IntegrationMessageHeaderAccessor(receive); - assertThat(headerAccessor.getSequenceNumber()).isEqualTo(0); - - this.publishSubscribeChannel.setApplySequence(true); - - this.publishSubscribeChannel.send(new GenericMessage<>("test")); - - receive = this.securedChannelQueue.receive(10000); - assertThat(receive).isNotNull(); - headerAccessor = new IntegrationMessageHeaderAccessor(receive); - assertThat(headerAccessor.getSequenceNumber()).isEqualTo(1); - - receive = this.securedChannelQueue2.receive(10000); - assertThat(receive).isNotNull(); - headerAccessor = new IntegrationMessageHeaderAccessor(receive); - assertThat(headerAccessor.getSequenceNumber()).isEqualTo(2); - - this.publishSubscribeChannel.setApplySequence(false); - - SecurityContextHolder.clearContext(); - - this.publishSubscribeChannel.send(new GenericMessage<>("test")); - Message errorMessage = this.errorChannel.receive(10000); - assertThat(errorMessage).isNotNull(); - Object payload = errorMessage.getPayload(); - assertThat(payload).isInstanceOf(MessageDeliveryException.class); - assertThat(((MessageDeliveryException) payload).getCause()) - .isInstanceOf(AuthenticationCredentialsNotFoundException.class); - } - - @Test - public void testSecurityContextPropagationAsyncGateway() throws Exception { - login("bob", "bobspassword", "ROLE_ADMIN", "ROLE_PRESIDENT"); - Future future = this.testGateway.test("foo"); - Message receive = this.securedChannelQueue.receive(10000); - assertThat(receive).isNotNull(); - - MessageChannel replyChannel = receive.getHeaders().get(MessageHeaders.REPLY_CHANNEL, MessageChannel.class); - replyChannel.send(new GenericMessage<>("bar")); - - String result = future.get(10, TimeUnit.SECONDS); - assertThat(result).isNotNull(); - assertThat(result).isEqualTo("bar"); - } - - private void login(String username, String password, String... roles) { - SecurityContext context = SecurityTestUtils.createContext(username, password, roles); - SecurityContextHolder.setContext(context); - } - - - @Configuration - @EnableIntegration - @IntegrationComponentScan - public static class ContextConfiguration { - - @Bean - UserDetailsService userDetailsService() { - return new InMemoryUserDetailsManager( - User.withUsername("jimi") - .password("jimispassword") - .authorities("ROLE_USER", "ROLE_ADMIN") - .build(), - User.withUsername("bob") - .password("bobspassword") - .authorities("ROLE_USER") - .build()); - } - - @Bean - public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() { - return new PropertySourcesPlaceholderConfigurer(); - } - - @Bean - @GlobalChannelInterceptor(patterns = "secured*") - AuthorizationChannelInterceptor authorizationChannelInterceptor() { - return new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole("ADMIN", "PRESIDENT")); - } - - @Bean - public SubscribableChannel securedChannel() { - return new DirectChannel(); - } - - @Bean - public SubscribableChannel securedChannel2() { - return new DirectChannel(); - } - - @Bean - public SubscribableChannel unsecuredChannel() { - return new DirectChannel(); - } - - @Bean - @GlobalChannelInterceptor(patterns = { - "#{'queueChannel'}", - "${security.channel:executorChannel}", - "publishSubscribeChannel"}) - public ChannelInterceptor securityContextPropagationInterceptor() { - return new SecurityContextPropagationChannelInterceptor(); - } - - @Bean - @BridgeTo(value = "securedChannelQueue", poller = @Poller(fixedDelay = "1000")) - public PollableChannel queueChannel() { - return new QueueChannel(); - } - - @Bean - public PollableChannel securedChannelQueue() { - return new QueueChannel(); - } - - @Bean - @BridgeTo("securedChannelQueue") - public SubscribableChannel executorChannel() { - return new ExecutorChannel(Executors.newSingleThreadExecutor()); - } - - - @Bean - public PublishSubscribeChannel publishSubscribeChannel() { - return new PublishSubscribeChannel(Executors.newCachedThreadPool()); - } - - @Bean - @ServiceActivator(inputChannel = "publishSubscribeChannel") - public MessageHandler securedChannelQueueBridge() { - BridgeHandler handler = new BridgeHandler(); - handler.setOutputChannel(securedChannelQueue()); - handler.setOrder(1); - return handler; - } - - @Bean - public PollableChannel securedChannelQueue2() { - return new QueueChannel(); - } - - @Bean - @ServiceActivator(inputChannel = "publishSubscribeChannel") - public MessageHandler securedChannelQueue2Bridge() { - BridgeHandler handler = new BridgeHandler(); - handler.setOutputChannel(securedChannelQueue2()); - handler.setOrder(2); - return handler; - } - - @Bean - public TaskScheduler taskScheduler() { - return new ThreadPoolTaskScheduler(); - } - - @Bean - public PollableChannel errorChannel() { - return new QueueChannel(); - } - - @Bean - public TestHandler testHandler() { - TestHandler testHandler = new TestHandler(); - this.securedChannel().subscribe(testHandler); - this.securedChannel2().subscribe(testHandler); - this.unsecuredChannel().subscribe(testHandler); - return testHandler; - } - - @Bean - public AsyncTaskExecutor securityContextExecutor() { - return new DelegatingSecurityContextAsyncTaskExecutor(new SimpleAsyncTaskExecutor()); - } - - } - - @MessagingGateway(asyncExecutor = "securityContextExecutor") - public interface TestGateway { - - @Gateway(requestChannel = "queueChannel") - Future test(String payload); - - } - -} diff --git a/spring-integration-security/src/test/resources/log4j2-test.xml b/spring-integration-security/src/test/resources/log4j2-test.xml deleted file mode 100644 index 1576469df4..0000000000 --- a/spring-integration-security/src/test/resources/log4j2-test.xml +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/src/reference/antora/modules/ROOT/pages/security.adoc b/src/reference/antora/modules/ROOT/pages/security.adoc index dbe8fecb43..f015cdb01f 100644 --- a/src/reference/antora/modules/ROOT/pages/security.adoc +++ b/src/reference/antora/modules/ROOT/pages/security.adoc @@ -10,30 +10,10 @@ Spring Integration, together with https://projects.spring.io/spring-security/[Sp Starting with version 6.0, the `ChannelSecurityInterceptor` as well as its configuration via `@SecuredChannel` annotation and XML `` have been deprecation in favor of using `AuthorizationChannelInterceptor` from the `spring-security-messaging` module. The respective `AuthorizationManager` infrastructure fully covers the previously supported role-based authentication, plus it allows the configuration of any other possible authorization strategies. -The only remaining Spring Integration feature is a `SecurityContextPropagationChannelInterceptor` which may be promoted to the mentioned `spring-security-messaging` module in the future as well. +The only remaining Spring Integration `SecurityContextPropagationChannelInterceptor` class has been deprecated and promoted to the mentioned `spring-security-messaging` module as an `org.springframework.security.messaging.context.SecurityContextPropagationChannelInterceptor` class. -You need to include this dependency into your project: - -[tabs] -====== -Maven:: -+ -[source, xml, subs="normal", role="primary"] ----- - - org.springframework.integration - spring-integration-security - {project-version} - ----- - -Gradle:: -+ -[source, groovy, subs="normal", role="secondary"] ----- -compile "org.springframework.integration:spring-integration-security:{project-version}" ----- -====== +Therefore, starting with version `6.2` the whole `spring-integration-security` module is considered as deprecated in favor of an API proposed by the more common `spring-security-messaging` library. +This module is scheduled for removal in the next `6.3` version. [[securing-channels]] == Securing channels @@ -98,19 +78,12 @@ In order to support such scenarios, we have two choices: * Transfer an `Authentication` object within the message headers and extract and authenticate it on the other side before secured object access. * Propagate the `SecurityContext` to the thread that receives the transferred message. -Version 4.2 introduced `SecurityContext` propagation. -It is implemented as a `SecurityContextPropagationChannelInterceptor`, which you can add to any `MessageChannel` or configure as a `@GlobalChannelInterceptor`. +This is implemented as a `org.springframework.security.messaging.context.SecurityContextPropagationChannelInterceptor` in the `spring-security-messaging` module, which can be added to any `MessageChannel` or configured as a `@GlobalChannelInterceptor`. The logic of this interceptor is based on the `SecurityContext` extraction from the current thread (from the `preSend()` method) and its populating to another thread from the `postReceive()` (`beforeHandle()`) method. -Actually, this interceptor is an extension of the more generic `ThreadStatePropagationChannelInterceptor`, which wraps the message to send with the state to propagate in an internal `Message` extension (`MessageWithThreadState`) on one side and extracts the original message and the state to propagate on the other side. -You can extend the `ThreadStatePropagationChannelInterceptor` for any context propagation use case, and `SecurityContextPropagationChannelInterceptor` is a good example of doing so. - -IMPORTANT: The logic of the `ThreadStatePropagationChannelInterceptor` is based on message modification (it returns an internal `MessageWithThreadState` object to send). -Consequently, you should be careful when combining this interceptor with any other that can also modify messages (for example, through the `MessageBuilder.withPayload(...)...build()`). -The state to propagate may be lost. -In most cases, to overcome the issue, you can order the interceptors for the channel and ensure the `ThreadStatePropagationChannelInterceptor` is the last one in the stack. +See the `SecurityContextPropagationChannelInterceptor` Javadocs for more information. Propagation and population of `SecurityContext` is just one half of the work. -Since the message is not an owner of the threads in the message flow and we should be sure that we are secure against any incoming messages, we have to clean up the `SecurityContext` from `ThreadLocal`. +Since the message is not an owner of the threads in the message flow, and the system should be sure that it is secured against any incoming messages, the `SecurityContext` has to be cleaned up from `ThreadLocal`. The `SecurityContextPropagationChannelInterceptor` provides the `afterMessageHandled()` interceptor method implementation. It cleans up operation by freeing the thread at the end of invocation from that propagated principal. This means that, when the thread that processes the handed-off message finishes processing the message (successful or otherwise), the context is cleared so that it cannot inadvertently be used when processing another message. diff --git a/src/reference/antora/modules/ROOT/pages/whats-new.adoc b/src/reference/antora/modules/ROOT/pages/whats-new.adoc index a0064dffbc..54bde9df33 100644 --- a/src/reference/antora/modules/ROOT/pages/whats-new.adoc +++ b/src/reference/antora/modules/ROOT/pages/whats-new.adoc @@ -83,3 +83,9 @@ See xref:ftp/inbound.adoc#ftp-inbound[FTP Inbound Channel Adapter], xref:sftp/in A new `DefaultSftpSessionFactory.createSftpClient(...)` method has been introduced to support a custom `SftpClient` when overridden. See xref:sftp/session-factory.adoc#sftp-session-factory[SFTP Session Factory] for more information. + +[[x6.2-security-changes]] +=== Security Support Changes + +The last class in `spring-integration-security` module `SecurityContextPropagationChannelInterceptor` has been deprecated in favor of similar class moved to `spring-security-messaging` module. +See xref:security.adoc[Security in Spring Integration] for more information. \ No newline at end of file