Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2781: Remove deprecations

Browse Source
This commit is contained in:
Rob Winch
2014-12-03 13:34:15 -06:00
parent 5bb0ce9a8f
commit 6e204fff72
177 changed files with 536 additions and 5022 deletions
Download Patch File Download Diff File Expand all files Collapse all files

128
taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java
View File

@@ -16,11 +16,7 @@
package org.springframework.security.taglibs.authz;
import java.io.IOException;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import javax.servlet.FilterChain;
import javax.servlet.ServletContext;
@@ -37,7 +33,6 @@ import org.springframework.expression.ParseException;
import org.springframework.security.access.expression.ExpressionUtils;
import org.springframework.security.access.expression.SecurityExpressionHandler;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.WebAttributes;
@@ -63,10 +58,6 @@ public abstract class AbstractAuthorizeTag {
private String access;
private String url;
private String method = "GET";
private String ifAllGranted;
private String ifAnyGranted;
private String ifNotGranted;
/**
* This method allows subclasses to provide a way to access the ServletRequest according to the rendering
* technology.
@@ -91,7 +82,6 @@ public abstract class AbstractAuthorizeTag {
* <ul>
* <li>access</li>
* <li>url, method</li>
* <li>ifAllGranted, ifAnyGranted, ifNotGranted</li>
* </ul>
* The above combinations are mutually exclusive and evaluated in the given order.
*
@@ -108,55 +98,13 @@ public abstract class AbstractAuthorizeTag {
isAuthorized = authorizeUsingUrlCheck();
} else {
isAuthorized = authorizeUsingGrantedAuthorities();
isAuthorized = false;
}
return isAuthorized;
}
/**
* Make an authorization decision by considering ifAllGranted, ifAnyGranted, and ifNotGranted. All 3 or any
* combination can be provided. All provided attributes must evaluate to true.
*
* @return the result of the authorization decision
*/
public boolean authorizeUsingGrantedAuthorities() {
boolean hasTextAllGranted = StringUtils.hasText(getIfAllGranted());
boolean hasTextAnyGranted = StringUtils.hasText(getIfAnyGranted());
boolean hasTextNotGranted = StringUtils.hasText(getIfNotGranted());
if ((!hasTextAllGranted) && (!hasTextAnyGranted) && (!hasTextNotGranted)) {
return false;
}
final Collection<? extends GrantedAuthority> granted = getPrincipalAuthorities();
final Set<String> grantedRoles = authoritiesToRoles(granted);
if (hasTextAllGranted) {
final Set<String> requiredRoles = splitRoles(getIfAllGranted());
if (!grantedRoles.containsAll(requiredRoles)) {
return false;
}
}
if (hasTextAnyGranted) {
final Set<String> expectOneOfRoles = splitRoles(getIfAnyGranted());
if (!containsAnyValue(grantedRoles, expectOneOfRoles)) {
return false;
}
}
if (hasTextNotGranted) {
final Set<String> expectNoneOfRoles = splitRoles(getIfNotGranted());
if (containsAnyValue(expectNoneOfRoles, grantedRoles)) {
return false;
}
}
return true;
}
/**
* Make an authorization decision based on a Spring EL expression. See the "Expression-Based Access Control" chapter
* in Spring Security for details on what expressions can be used.
@@ -234,82 +182,8 @@ public abstract class AbstractAuthorizeTag {
this.method = (method != null) ? method.toUpperCase() : null;
}
public String getIfAllGranted() {
return ifAllGranted;
}
public void setIfAllGranted(String ifAllGranted) {
this.ifAllGranted = ifAllGranted;
}
public String getIfAnyGranted() {
return ifAnyGranted;
}
public void setIfAnyGranted(String ifAnyGranted) {
this.ifAnyGranted = ifAnyGranted;
}
public String getIfNotGranted() {
return ifNotGranted;
}
public void setIfNotGranted(String ifNotGranted) {
this.ifNotGranted = ifNotGranted;
}
/*------------- Private helper methods -----------------*/
private Collection<? extends GrantedAuthority> getPrincipalAuthorities() {
Authentication currentUser = SecurityContextHolder.getContext().getAuthentication();
if (null == currentUser) {
return Collections.emptyList();
}
return currentUser.getAuthorities();
}
/**
* Splits the authorityString using "," as a delimiter into a Set.
* @param authorityString
* @return
*/
private Set<String> splitRoles(String authorityString) {
String[] rolesArray = StringUtils.tokenizeToStringArray(authorityString, ",");
Set<String> roles = new HashSet<String>(rolesArray.length);
for(String role : rolesArray) {
roles.add(role);
}
return roles;
}
/**
* Returns true if any of the values are contained in toTest. Otherwise, false.
* @param toTest Check this Set to see if any of the values are contained in it.
* @param values The values to check if they are in toTest.
* @return
*/
private boolean containsAnyValue(Set<String> toTest, Collection<String> values) {
for(String value : values) {
if(toTest.contains(value)) {
return true;
}
}
return false;
}
private Set<String> authoritiesToRoles(Collection<? extends GrantedAuthority> c) {
Set<String> target = new HashSet<String>();
for (GrantedAuthority authority : c) {
if (null == authority.getAuthority()) {
throw new IllegalArgumentException(
"Cannot process GrantedAuthority objects which return null from getAuthority() - attempting to process "
+ authority.toString());
}
target.add(authority.getAuthority());
}
return target;
}
@SuppressWarnings({ "unchecked", "rawtypes" })
private SecurityExpressionHandler<FilterInvocation> getExpressionHandler() throws IOException {
ApplicationContext appContext = WebApplicationContextUtils

76
taglibs/src/main/java/org/springframework/security/taglibs/velocity/Authz.java
View File

@@ -1,76 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.velocity;
import org.springframework.context.ApplicationContext;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
/**
* @author Wang Qi
*/
public interface Authz {
//~ Methods ========================================================================================================
/**
* all the listed roles must be granted to return true, otherwise false;
*
* @param roles - comma separate GrantedAuthoritys
*
* @return granted (true|false)
*/
boolean allGranted(String roles);
/**
* any the listed roles must be granted to return true, otherwise false;
*
* @param roles - comma separate GrantedAuthoritys
*
* @return granted (true|false)
*/
boolean anyGranted(String roles);
/**
* get Spring application context which contains
*
*/
ApplicationContext getAppCtx();
/**
* return the principal's name, supports the various type of principals that can exist in the {@link
* Authentication} object, such as a String or {@link UserDetails} instance
*
* @return string representation of principal's name
*/
String getPrincipal();
/**
* none the listed roles must be granted to return true, otherwise false;
*
* @param roles - comma separate GrantedAuthoritys
*
* @return granted (true|false)
*/
boolean noneGranted(String roles);
/**
* set Spring application context which contains Acegi related bean
*
*/
void setAppCtx(ApplicationContext appCtx);
}

140
taglibs/src/main/java/org/springframework/security/taglibs/velocity/AuthzImpl.java
View File

@@ -1,140 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.velocity;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.Tag;
import org.springframework.context.ApplicationContext;
import org.springframework.security.taglibs.authz.AuthenticationTag;
import org.springframework.security.taglibs.authz.JspAuthorizeTag;
/**
* I decided to wrap several JSP tag in one class, so I have to using inner class to wrap these JSP tag. To using
* this class, you need to inject Spring Context via SetAppCtx() method. AclTag need Spring Context to get AclManger
* bean.
*/
public class AuthzImpl implements Authz {
//~ Static fields/initializers =====================================================================================
static final int ALL_GRANTED = 1;
static final int ANY_GRANTED = 2;
static final int NONE_GRANTED = 3;
//~ Instance fields ================================================================================================
private ApplicationContext appCtx;
//~ Methods ========================================================================================================
public boolean allGranted(String roles) {
return ifGranted(roles, ALL_GRANTED);
}
public boolean anyGranted(String roles) {
return ifGranted(roles, ANY_GRANTED);
}
public ApplicationContext getAppCtx() {
return appCtx;
}
/**
* implementation of AuthenticationTag
*/
public String getPrincipal() {
MyAuthenticationTag authenticationTag = new MyAuthenticationTag();
authenticationTag.setProperty("name");
try {
authenticationTag.doEndTag();
} catch (JspException je) {
je.printStackTrace();
throw new IllegalArgumentException(je.getMessage());
}
return authenticationTag.getLastMessage();
}
/**
* implementation of JspAuthorizeTag
*/
private boolean ifGranted(String roles, int grantType) {
JspAuthorizeTag authorizeTag = new JspAuthorizeTag();
int result;
try {
switch (grantType) {
case ALL_GRANTED:
authorizeTag.setIfAllGranted(roles);
break;
case ANY_GRANTED:
authorizeTag.setIfAnyGranted(roles);
break;
case NONE_GRANTED:
authorizeTag.setIfNotGranted(roles);
break;
default:
throw new IllegalArgumentException("invalid granted type : " + grantType + " role=" + roles);
}
result = authorizeTag.doStartTag();
} catch (JspException je) {
throw new IllegalArgumentException(je.getMessage());
}
return Tag.EVAL_BODY_INCLUDE == result;
}
public boolean noneGranted(String roles) {
return ifGranted(roles, NONE_GRANTED);
}
/**
* test case can use this class to mock application context with aclManager bean in it.
*/
public void setAppCtx(ApplicationContext appCtx) {
this.appCtx = appCtx;
}
//~ Inner Classes ==================================================================================================
/**
* it must output somthing to JSP page, so have to override the writeMessage method to avoid JSP related
* operation. Get Idea from Acegi Test class.
*/
private class MyAuthenticationTag extends AuthenticationTag {
private static final long serialVersionUID = -1094246833893599161L;
String lastMessage = null;
public String getLastMessage() {
return lastMessage;
}
protected void writeMessage(String msg) throws JspException {
lastMessage = msg;
}
}
}

2
taglibs/src/main/java/org/springframework/security/taglibs/velocity/package-info.java
View File

@@ -1,2 +0,0 @@
package org.springframework.security.taglibs.velocity;

30
taglibs/src/main/resources/META-INF/security.tld
View File

@@ -74,36 +74,6 @@
<required>false</required>
<rtexprvalue>false</rtexprvalue>
</attribute>
<attribute>
<description>
A comma separated list of roles which the user must not have
for the body to be output. Deprecated in favour of the access expression.
</description>
<name>ifNotGranted</name>
<required>false</required>
<rtexprvalue>true</rtexprvalue>
</attribute>
<attribute>
<description>
A comma separated list of roles which the user must all
possess for the body to be output. Deprecated in favour of the access expression.
</description>
<name>ifAllGranted</name>
<required>false</required>
<rtexprvalue>true</rtexprvalue>
</attribute>
<attribute>
<description>
A comma separated list of roles, one of which the user must
possess for the body to be output. Deprecated in favour of the access expression.
</description>
<name>ifAnyGranted</name>
<required>false</required>
<rtexprvalue>true</rtexprvalue>
</attribute>
</tag>
<tag>

91
taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagAttributeTests.java
View File

@@ -1,91 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.authz;
import static org.junit.Assert.assertEquals;
import org.junit.*;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.Tag;
/**
* @author Francois Beausoleil
*/
public class AuthorizeTagAttributeTests {
//~ Instance fields ================================================================================================
private final JspAuthorizeTag authorizeTag = new JspAuthorizeTag();
//~ Methods ========================================================================================================
@Before
public void setUp() throws Exception {
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("abc", "123", "ROLE_SUPERVISOR", "ROLE_RESTRICTED"));
}
@After
public void tearDown() throws Exception {
SecurityContextHolder.clearContext();
}
@Test
public void testAssertsIfAllGrantedSecond() throws JspException {
authorizeTag.setIfAllGranted("ROLE_SUPERVISOR,ROLE_SUPERTELLER");
authorizeTag.setIfAnyGranted("ROLE_RESTRICTED");
assertEquals("prevents request - principal is missing ROLE_SUPERTELLER", Tag.SKIP_BODY,
authorizeTag.doStartTag());
}
@Test
public void testAssertsIfAnyGrantedLast() throws JspException {
authorizeTag.setIfAnyGranted("ROLE_BANKER");
assertEquals("prevents request - principal is missing ROLE_BANKER", Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testAssertsIfNotGrantedFirst() throws JspException {
authorizeTag.setIfNotGranted("ROLE_RESTRICTED");
authorizeTag.setIfAllGranted("ROLE_SUPERVISOR,ROLE_RESTRICTED");
authorizeTag.setIfAnyGranted("ROLE_SUPERVISOR");
assertEquals("prevents request - principal has ROLE_RESTRICTED", Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testAssertsIfNotGrantedIgnoresWhitespaceInAttribute()
throws JspException {
authorizeTag.setIfAnyGranted("\tROLE_SUPERVISOR \t, \r\n\t ROLE_TELLER ");
assertEquals("allows request - principal has ROLE_SUPERVISOR", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
@Test
public void testIfAllGrantedIgnoresWhitespaceInAttribute() throws JspException {
authorizeTag.setIfAllGranted("\nROLE_SUPERVISOR\t,ROLE_RESTRICTED\t\n\r ");
assertEquals("allows request - principal has ROLE_RESTRICTED " + "and ROLE_SUPERVISOR", Tag.EVAL_BODY_INCLUDE,
authorizeTag.doStartTag());
}
@Test
public void testIfNotGrantedIgnoresWhitespaceInAttribute() throws JspException {
authorizeTag.setIfNotGranted(" \t ROLE_TELLER \r");
assertEquals("allows request - principal does not have ROLE_TELLER", Tag.EVAL_BODY_INCLUDE,
authorizeTag.doStartTag());
}
}

131
taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagCustomGrantedAuthorityTests.java
View File

@@ -1,131 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.authz;
import static org.junit.Assert.*;
import org.junit.*;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.security.core.context.SecurityContextHolder;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.Tag;
import java.util.*;
/**
*
* @author Francois Beausoleil
*/
@SuppressWarnings("deprecation")
public class AuthorizeTagCustomGrantedAuthorityTests {
//~ Instance fields ================================================================================================
private final JspAuthorizeTag authorizeTag = new JspAuthorizeTag();
//~ Methods ========================================================================================================
@Before
public void setUp() {
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("abc", "123", "ROLE_TELLER"));
}
@After
public void tearDown() {
SecurityContextHolder.clearContext();
}
@Test
public void testAllowsRequestWhenCustomAuthorityPresentsCorrectRole() throws JspException {
authorizeTag.setIfAnyGranted("ROLE_TELLER");
assertEquals("authorized - ROLE_TELLER in both sets", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
@Test
@SuppressWarnings("serial")
public void testRejectsRequestWhenCustomAuthorityReturnsNull() throws JspException {
authorizeTag.setIfAnyGranted("ROLE_TELLER");
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new GrantedAuthority() {
public String getAuthority() {
return null;
}
});
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("abc", "123", authorities));
try {
authorizeTag.doStartTag();
fail("Failed to reject GrantedAuthority with NULL getAuthority()");
} catch (IllegalArgumentException expected) {
assertTrue("expected", true);
}
}
@Test
@SuppressWarnings("serial")
public void testAuthorizeCustomGrantedAuthority() throws JspException {
authorizeTag.setIfAnyGranted(null);
authorizeTag.setIfNotGranted(null);
authorizeTag.setIfAllGranted("ROLE_TEST");
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new GrantedAuthority() {
public String getAuthority() {
return "ROLE_TEST";
}
});
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("abc", "123", authorities));
assertEquals("Expected to be authorized", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
@Test
@SuppressWarnings("serial")
public void testAuthorizeExtendsGrantedAuthorityImpl() throws JspException {
authorizeTag.setIfAnyGranted(null);
authorizeTag.setIfNotGranted(null);
authorizeTag.setIfAllGranted("ROLE_TEST");
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new GrantedAuthorityImpl("ROLE_TEST") {});
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("abc", "123", authorities));
assertEquals("Expected to be authorized", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
// SEC-1900
@Test
public void testAuthorizeUsingGrantedAuthorityImpl() throws JspException {
authorizeTag.setIfAnyGranted(null);
authorizeTag.setIfNotGranted(null);
authorizeTag.setIfAllGranted("ROLE_TEST");
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new GrantedAuthorityImpl("ROLE_TEST"));
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("abc", "123", authorities));
assertEquals("Expected to be authorized", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
// SEC-1900
@Test
public void testNotAuthorizeUsingGrantedAuthorityImpl() throws JspException {
authorizeTag.setIfAnyGranted(null);
authorizeTag.setIfNotGranted(null);
authorizeTag.setIfAllGranted("ROLE_ADMIN");
List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new GrantedAuthorityImpl("ROLE_TEST"));
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("abc", "123", authorities));
assertEquals("Expected to not be authorized", Tag.SKIP_BODY, authorizeTag.doStartTag());
}
}

71
taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagTests.java
View File

@@ -145,77 +145,6 @@ public class AuthorizeTagTests {
assertEquals(Tag.SKIP_BODY, authorizeTag.doStartTag());
}
// Legacy attribute tests
@Test
public void testAlwaysReturnsUnauthorizedIfNoUserFound() throws JspException {
SecurityContextHolder.clearContext();
authorizeTag.setIfAllGranted("ROLE_TELLER");
assertEquals(Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testDefaultsToNotOutputtingBodyWhenNoRequiredAuthorities() throws JspException {
assertEquals(null, authorizeTag.getIfAllGranted());
assertEquals(null, authorizeTag.getIfAnyGranted());
assertEquals(null, authorizeTag.getIfNotGranted());
assertEquals(Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testDefaultsToNotOutputtingBodyWhenNoAuthoritiesProvided() throws JspException {
authorizeTag.setIfAllGranted("");
authorizeTag.setIfAnyGranted("");
authorizeTag.setIfNotGranted("");
assertEquals(Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testOutputsBodyIfOneRolePresent() throws JspException {
authorizeTag.setIfAnyGranted("ROLE_TELLER");
assertEquals(Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
@Test
public void testOutputsBodyWhenAllGranted() throws JspException {
authorizeTag.setIfAllGranted("ROLE SUPERVISOR, \nROLE_TELLER");
assertEquals(Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
@Test
public void testOutputsBodyWhenNotGrantedSatisfied() throws JspException {
authorizeTag.setIfNotGranted("ROLE_BANKER");
assertEquals(Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
}
@Test
public void testPreventsBodyOutputIfNoSecurityContext() throws JspException {
SecurityContextHolder.getContext().setAuthentication(null);
authorizeTag.setIfAnyGranted("ROLE_BANKER");
assertEquals(Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testSkipsBodyIfNoAnyRolePresent() throws JspException {
authorizeTag.setIfAnyGranted("ROLE_BANKER");
assertEquals(Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testSkipsBodyWhenMissingAnAllGranted() throws JspException {
authorizeTag.setIfAllGranted("ROLE SUPERVISOR, ROLE_TELLER,\n\rROLE_BANKER");
assertEquals(Tag.SKIP_BODY, authorizeTag.doStartTag());
}
@Test
public void testSkipsBodyWhenNotGrantedUnsatisfied() throws JspException {
authorizeTag.setIfNotGranted("ROLE_TELLER");
assertEquals("prevents request - principal has ROLE_TELLER", Tag.SKIP_BODY, authorizeTag.doStartTag());
}
public static class MockWebInvocationPrivilegeEvaluator implements WebInvocationPrivilegeEvaluator {
public boolean isAllowed(String uri, Authentication authentication) {

81
taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplAttributeTests.java
View File

@@ -1,81 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.velocity;
import junit.framework.TestCase;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import javax.servlet.jsp.JspException;
public class AuthzImplAttributeTests extends TestCase {
//~ Instance fields ================================================================================================
private final Authz authz = new AuthzImpl();
private TestingAuthenticationToken currentUser;
//~ Methods ========================================================================================================
protected void setUp() throws Exception {
SecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("abc", "123", "ROLE_SUPERVISOR","ROLE_RESTRICTED"));
}
protected void tearDown() throws Exception {
SecurityContextHolder.clearContext();
}
public void testAssertsIfAllGrantedSecond() {
boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_SUPERTELLER");
boolean r2 = authz.anyGranted("ROLE_RESTRICTED");
//prevents request - principal is missing ROLE_SUPERTELLE
assertFalse(r1 && r2);
}
public void testAssertsIfAnyGrantedLast() {
boolean r2 = authz.anyGranted("ROLE_BANKER");
// prevents request - principal is missing ROLE_BANKER
assertFalse(r2);
}
public void testAssertsIfNotGrantedFirst() {
boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_RESTRICTED");
boolean r2 = authz.noneGranted("ROLE_RESTRICTED");
boolean r3 = authz.anyGranted("ROLE_SUPERVISOR");
//prevents request - principal has ROLE_RESTRICTED
assertFalse(r1 && r2 && r3);
}
public void testAssertsIfNotGrantedIgnoresWhitespaceInAttribute() {
//allows request - principal has ROLE_SUPERVISOR
assertTrue(authz.anyGranted("\tROLE_SUPERVISOR \t, \r\n\t ROLE_TELLER "));
}
public void testIfAllGrantedIgnoresWhitespaceInAttribute() {
//allows request - principal has ROLE_RESTRICTED and ROLE_SUPERVISOR
assertTrue(authz.allGranted("\nROLE_SUPERVISOR\t,ROLE_RESTRICTED\t\n\r "));
}
public void testIfNotGrantedIgnoresWhitespaceInAttribute()
throws JspException {
//prevents request - principal does not have ROLE_TELLER
assertFalse(authz.allGranted(" \t ROLE_TELLER \r"));
}
}

88
taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplAuthorizeTagTests.java
View File

@@ -1,88 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.velocity;
import junit.framework.TestCase;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
public class AuthzImplAuthorizeTagTests extends TestCase {
//~ Instance fields ================================================================================================
private Authz authz = new AuthzImpl();
//~ Methods ========================================================================================================
protected void setUp() throws Exception {
SecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("abc", "123", "ROLE_SUPERVISOR", "ROLE_TELLER"));
}
protected void tearDown() throws Exception {
SecurityContextHolder.clearContext();
}
public void testAlwaysReturnsUnauthorizedIfNoUserFound() {
SecurityContextHolder.getContext().setAuthentication(null);
//prevents request - no principal in Context
assertFalse(authz.allGranted("ROLE_TELLER"));
}
public void testDefaultsToNotOutputtingBodyWhenNoRequiredAuthorities() {
//prevents body output - no authorities granted
assertFalse(authz.allGranted(""));
assertFalse(authz.anyGranted(""));
assertFalse(authz.noneGranted(""));
}
public void testOutputsBodyIfOneRolePresent() {
//authorized - ROLE_TELLER in both sets
assertTrue(authz.anyGranted("ROLE_TELLER"));
}
public void testOutputsBodyWhenAllGranted() {
// allows request - all required roles granted on principal
assertTrue(authz.allGranted("ROLE_SUPERVISOR,ROLE_TELLER"));
}
public void testOutputsBodyWhenNotGrantedSatisfied() {
// allows request - principal doesn't have ROLE_BANKER
assertTrue(authz.noneGranted("ROLE_BANKER"));
}
public void testPreventsBodyOutputIfNoSecureContext() {
SecurityContextHolder.getContext().setAuthentication(null);
// prevents output - no context defined
assertFalse(authz.anyGranted("ROLE_BANKER"));
}
public void testSkipsBodyIfNoAnyRolePresent() {
// unauthorized - ROLE_BANKER not in granted authorities
assertFalse(authz.anyGranted("ROLE_BANKER"));
}
public void testSkipsBodyWhenMissingAnAllGranted() {
// prevents request - missing ROLE_BANKER on principal
assertFalse(authz.allGranted("ROLE_SUPERVISOR,ROLE_TELLER,ROLE_BANKER"));
}
public void testSkipsBodyWhenNotGrantedUnsatisfied() {
// prevents request - principal has ROLE_TELLER
assertFalse(authz.noneGranted("ROLE_TELLER"));
}
}

63
taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplTests.java
View File

@@ -1,63 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.velocity;
import junit.framework.TestCase;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.User;
public class AuthzImplTests extends TestCase {
//~ Instance fields ================================================================================================
private Authz authz = new AuthzImpl();
//~ Methods ========================================================================================================
public void testOperationWhenPrincipalIsAString() {
Authentication auth = new TestingAuthenticationToken("rodAsString", "koala", AuthorityUtils.NO_AUTHORITIES );
SecurityContextHolder.getContext().setAuthentication(auth);
assertEquals("rodAsString", authz.getPrincipal());
}
public void testOperationWhenPrincipalIsAUserDetailsInstance() {
Authentication auth = new TestingAuthenticationToken(new User("rodUserDetails", "koala", true, true, true,
true, AuthorityUtils.NO_AUTHORITIES), "koala", AuthorityUtils.NO_AUTHORITIES);
SecurityContextHolder.getContext().setAuthentication(auth);
assertEquals("rodUserDetails", authz.getPrincipal());
}
public void testOperationWhenPrincipalIsNull() {
Authentication auth = new TestingAuthenticationToken(null, "koala", AuthorityUtils.NO_AUTHORITIES );
SecurityContextHolder.getContext().setAuthentication(auth);
assertNull(authz.getPrincipal());
}
public void testOperationWhenSecurityContextIsNull() {
SecurityContextHolder.getContext().setAuthentication(null);
assertEquals(null, authz.getPrincipal());
SecurityContextHolder.getContext().setAuthentication(null);
}
}