Add Security Tests

- Embedded LDAP
- Authorization Server
- Resource Server
- Security with MVC
- Security with WebFlux

security/security-webmvc/src/appTest/java/com/example/security/webmvc/SecurityWebMvcApplicationCheckpointTests.java

@@ -0,0 +1,111 @@
+/*
+ * Copyright 2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.security.webmvc;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.cr.smoketest.support.junit.ApplicationTest;
+import org.springframework.test.web.reactive.server.WebTestClient;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@ApplicationTest
+class SecurityWebMvcApplicationCheckpointTests {
+
+	@Test
+	void anonymousShouldBeAccessibleWithoutCredentials(WebTestClient client) {
+		client.get()
+			.uri("/rest/anonymous")
+			.exchange()
+			.expectStatus()
+			.isOk()
+			.expectBody()
+			.consumeWith((result) -> assertThat(new String(result.getResponseBodyContent())).isEqualTo("anonymous"));
+	}
+
+	@Test
+	void authorizedShouldBeProtectedWithoutCredentials(WebTestClient client) {
+		client.get().uri("/rest/authorized").exchange().expectStatus().isUnauthorized();
+	}
+
+	@Test
+	void authorizedShouldBeAccessibleWithCredentials(WebTestClient client) {
+		client.get()
+			.uri("/rest/authorized")
+			.headers((header) -> header.setBasicAuth("user", "password"))
+			.exchange()
+			.expectStatus()
+			.isOk()
+			.expectBody()
+			.consumeWith(
+					(result) -> assertThat(new String(result.getResponseBodyContent())).isEqualTo("authorized: user"));
+	}
+
+	@Test
+	void authorizedShouldBeProtectedWithWrongCredentials(WebTestClient client) {
+		client.get()
+			.uri("/rest/authorized")
+			.headers((header) -> header.setBasicAuth("wrong-user", "wrong-password"))
+			.exchange()
+			.expectStatus()
+			.isUnauthorized();
+	}
+
+	@Test
+	void adminShouldBeProtectedWithoutCredentials(WebTestClient client) {
+		client.get().uri("/rest/admin").exchange().expectStatus().isUnauthorized();
+	}
+
+	@Test
+	void adminShouldBeAccessibleWithCredentials(WebTestClient client) {
+		client.get()
+			.uri("/rest/admin")
+			.headers((header) -> header.setBasicAuth("admin", "password"))
+			.exchange()
+			.expectStatus()
+			.isOk()
+			.expectBody()
+			.consumeWith((result) -> assertThat(new String(result.getResponseBodyContent())).isEqualTo("admin: admin"));
+	}
+
+	@Test
+	void adminShouldBeProtectedWithWrongCredentials(WebTestClient client) {
+		client.get()
+			.uri("/rest/admin")
+			.headers((header) -> header.setBasicAuth("wrong-admin", "wrong-password"))
+			.exchange()
+			.expectStatus()
+			.isUnauthorized();
+	}
+
+	@Test
+	void adminShouldBeProtectedWithWrongRole(WebTestClient client) {
+		client.get()
+			.uri("/rest/admin")
+			.headers((header) -> header.setBasicAuth("user", "password"))
+			.exchange()
+			.expectStatus()
+			.isForbidden();
+	}
+
+	@Test
+	void staticResourcesShouldBeProtected(WebTestClient client) {
+		client.get().uri("/foo.html").exchange().expectStatus().isUnauthorized();
+		client.get().uri("/bar.html").exchange().expectStatus().isUnauthorized();
+	}
+
+}

security/security-webmvc/src/main/java/com/example/security/webmvc/SecurityWebMvcApplication.java

@@ -0,0 +1,13 @@
+package com.example.security.webmvc;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class SecurityWebMvcApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(SecurityWebMvcApplication.class, args);
+	}
+
+}

security/security-webmvc/src/main/java/com/example/security/webmvc/TestRestController.java

@@ -0,0 +1,29 @@
+package com.example.security.webmvc;
+
+import java.security.Principal;
+
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping(path = "/rest", produces = MediaType.TEXT_PLAIN_VALUE)
+public class TestRestController {
+
+	@GetMapping("/anonymous")
+	public String anonymous() {
+		return "anonymous";
+	}
+
+	@GetMapping("/authorized")
+	public String authorized(Principal principal) {
+		return "authorized: " + principal.getName();
+	}
+
+	@GetMapping("/admin")
+	public String admin(Principal principal) {
+		return "admin: " + principal.getName();
+	}
+
+}

security/security-webmvc/src/main/java/com/example/security/webmvc/WebSecurityConfig.java

@@ -0,0 +1,47 @@
+package com.example.security.webmvc;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+@EnableWebSecurity
+public class WebSecurityConfig {
+
+	@Bean
+	public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+		return http.authorizeHttpRequests(authorize -> authorize.forServletPattern("/",
+				(r) -> r.requestMatchers("/rest/anonymous")
+					.permitAll()
+					.requestMatchers("/rest/admin")
+					.hasRole("ADMIN")
+					.anyRequest()
+					.authenticated()))
+			.httpBasic(Customizer.withDefaults())
+			.build();
+	}
+
+	@Bean
+	public UserDetailsService userDetailsService() {
+		UserDetails user = User.withDefaultPasswordEncoder()
+			.username("user")
+			.password("password")
+			.roles("USER")
+			.build();
+		UserDetails admin = User.withDefaultPasswordEncoder()
+			.username("admin")
+			.password("password")
+			.roles("ADMIN")
+			.build();
+
+		return new InMemoryUserDetailsManager(user, admin);
+	}
+
+}

security/security-webmvc/src/main/resources/public/bar.html

@@ -0,0 +1 @@
+Bar

security/security-webmvc/src/main/resources/static/foo.html

@@ -0,0 +1 @@
+Foo