Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

OAuth2LoginAuthenticationFilter ignores authenticated Users

Browse Source 
This ensures that OAuth2 Client support works with the same log in URL as
oauth2 login.

Fixes: gh-5915
This commit is contained in:
Rob Winch
2018-10-12 16:29:27 -05:00
parent e8045838e3
commit 93ca455405
2 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurerTests.java
View File

@@ -27,6 +27,7 @@ import org.springframework.http.MediaType;
import org.springframework.mock.web.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@@ -35,6 +36,7 @@ import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
import org.springframework.security.core.context.SecurityContextImpl;
import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
@@ -154,6 +156,31 @@ public class OAuth2LoginConfigurerTests {
.isInstanceOf(OAuth2UserAuthority.class).hasToString("ROLE_USER");
}
@Test
public void oauth2LoginWhenAuthenticatedThenIgnored() throws Exception {
// setup application context
loadConfig(OAuth2LoginConfig.class);
// authenticate
TestingAuthenticationToken expectedAuthentication = new TestingAuthenticationToken("a",
"b", "ROLE_TEST");
this.request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, new SecurityContextImpl(expectedAuthentication));
// setup authentication parameters
this.request.setParameter("code", "code123");
this.request.setParameter("state", "state");
// perform test
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
// assertions
Authentication authentication = this.securityContextRepository
.loadContext(new HttpRequestResponseHolder(this.request, this.response))
.getAuthentication();
assertThat(authentication).isEqualTo(expectedAuthentication);
}
@Test
public void oauth2LoginCustomWithConfigurer() throws Exception {
// setup application context