Add Security Tests

- Embedded LDAP
- Authorization Server
- Resource Server
- Security with MVC
- Security with WebFlux

security/security-ldap/src/appTest/java/com/example/security/ldap/SecurityLdapApplicationCheckpointTests.java

@@ -0,0 +1,43 @@
+package com.example.security.ldap;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.cr.smoketest.support.junit.ApplicationTest;
+import org.springframework.test.web.reactive.server.WebTestClient;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@ApplicationTest
+public class SecurityLdapApplicationCheckpointTests {
+
+	@Test
+	void anonymousShouldBeUnauthorizedWithoutCredentials(WebTestClient client) {
+		client.get().uri("/").exchange().expectStatus().isUnauthorized();
+	}
+
+	@Test
+	void homeShouldShowUsername(WebTestClient client) {
+		client.get()
+			.uri("/")
+			.headers((header) -> header.setBasicAuth("user", "password"))
+			.exchange()
+			.expectStatus()
+			.isOk()
+			.expectBody()
+			.consumeWith((result) -> assertThat(new String(result.getResponseBodyContent())).isEqualTo("Hello, user!"));
+	}
+
+	@Test
+	void friendlyShouldShowGivenName(WebTestClient client) {
+		client.get()
+			.uri("/friendly")
+			.headers((header) -> header.setBasicAuth("user", "password"))
+			.exchange()
+			.expectStatus()
+			.isOk()
+			.expectBody()
+			.consumeWith((result) -> assertThat(new String(result.getResponseBodyContent()))
+				.isEqualTo("Hello, Dianne Emu!"));
+	}
+
+}

security/security-ldap/src/main/java/com/example/security/ldap/MainController.java

@@ -0,0 +1,22 @@
+package com.example.security.ldap;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.ldap.userdetails.Person;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class MainController {
+
+	@GetMapping("/")
+	public String hello(Authentication authentication) {
+		return "Hello, " + authentication.getName() + "!";
+	}
+
+	@GetMapping("/friendly")
+	public String hello(@AuthenticationPrincipal Person person) {
+		return "Hello, " + person.getGivenName() + "!";
+	}
+
+}

security/security-ldap/src/main/java/com/example/security/ldap/SecurityConfig.java

@@ -0,0 +1,38 @@
+package com.example.security.ldap;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.ldap.core.support.BaseLdapPathContextSource;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.ldap.LdapBindAuthenticationManagerFactory;
+import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
+import org.springframework.security.ldap.server.UnboundIdContainer;
+import org.springframework.security.ldap.userdetails.PersonContextMapper;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+	@Bean
+	UnboundIdContainer ldapContainer() throws Exception {
+		UnboundIdContainer container = new UnboundIdContainer("dc=springframework,dc=org", "classpath:users.ldif");
+		container.setPort(0);
+		return container;
+	}
+
+	@Bean
+	BaseLdapPathContextSource contextSource(UnboundIdContainer container) {
+		int port = container.getPort();
+		return new DefaultSpringSecurityContextSource("ldap://localhost:" + port + "/dc=springframework,dc=org");
+	}
+
+	@Bean
+	AuthenticationManager ldapAuthenticationManager(BaseLdapPathContextSource contextSource) {
+		LdapBindAuthenticationManagerFactory factory = new LdapBindAuthenticationManagerFactory(contextSource);
+		factory.setUserDnPatterns("uid={0},ou=people");
+		factory.setUserDetailsContextMapper(new PersonContextMapper());
+		return factory.createAuthenticationManager();
+	}
+
+}

security/security-ldap/src/main/java/com/example/security/ldap/SecurityLdapApplication.java

@@ -0,0 +1,13 @@
+package com.example.security.ldap;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class SecurityLdapApplication {
+
+	public static void main(String[] args) throws Throwable {
+		SpringApplication.run(SecurityLdapApplication.class, args);
+	}
+
+}

security/security-ldap/src/main/resources/users.ldif

@@ -0,0 +1,43 @@
+dn: ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: groups
+
+dn: ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: people
+
+dn: uid=admin,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Rod Johnson
+sn: Johnson
+uid: admin
+userPassword: password
+
+dn: uid=user,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Dianne Emu
+sn: Emu
+uid: user
+userPassword: password
+givenName: Dianne Emu
+
+dn: cn=user,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: user
+member: uid=admin,ou=people,dc=springframework,dc=org
+member: uid=user,ou=people,dc=springframework,dc=org
+
+dn: cn=admin,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: admin
+member: uid=admin,ou=people,dc=springframework,dc=org

security/security-ldap/src/test/java/com/example/security/ldap/SecurityLdapApplicationTests.java

@@ -0,0 +1,48 @@
+package com.example.security.ldap;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.web.servlet.MockMvc;
+
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@SpringBootTest
+@AutoConfigureMockMvc
+public class SecurityLdapApplicationTests {
+
+	@Autowired
+	private MockMvc mvc;
+
+	@Test
+	void rootWhenAuthenticatedThenSaysHelloUser() throws Exception {
+		// @formatter:off
+		this.mvc.perform(get("/")
+						.with(httpBasic("user", "password")))
+				.andExpect(content().string("Hello, user!"));
+		// @formatter:on
+	}
+
+	@Test
+	void rootWhenUnauthenticatedThen401() throws Exception {
+		// @formatter:off
+		this.mvc.perform(get("/"))
+				.andExpect(status().isUnauthorized());
+		// @formatter:on
+	}
+
+	@Test
+	void tokenWhenBadCredentialsThen401() throws Exception {
+		// @formatter:off
+		this.mvc.perform(get("/")
+						.with(httpBasic("user", "passwerd")))
+				.andExpect(status().isUnauthorized());
+		// @formatter:on
+	}
+
+}