Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use xml / javaconfig folders for samples

Browse Source 
Fixes gh-3752
This commit is contained in:
Joe Grandja
2016-04-11 10:47:06 -04:00
committed by Rob Winch
parent 2c85fb05d0
commit 945a21a3fb
543 changed files with 828 additions and 430 deletions
Download Patch File Download Diff File Expand all files Collapse all files

183
samples/xml/servletapi/pom.xml Normal file
View File

@@ -0,0 +1,183 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<modelVersion>4.0.0</modelVersion>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-samples-xml-servletapi</artifactId>
<version>4.1.0.BUILD-SNAPSHOT</version>
<packaging>war</packaging>
<name>spring-security-samples-xml-servletapi</name>
<description>spring-security-samples-xml-servletapi</description>
<url>http://spring.io/spring-security</url>
<organization>
<name>spring.io</name>
<url>http://spring.io/</url>
</organization>
<licenses>
<license>
<name>The Apache Software License, Version 2.0</name>
<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
<distribution>repo</distribution>
</license>
</licenses>
<developers>
<developer>
<id>rwinch</id>
<name>Rob Winch</name>
<email>rwinch@gopivotal.com</email>
</developer>
</developers>
<scm>
<connection>scm:git:git://github.com/spring-projects/spring-security</connection>
<developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
<url>https://github.com/spring-projects/spring-security</url>
</scm>
<properties>
<m2eclipse.wtp.contextRoot>/spring-security-samples-xml-servletapi</m2eclipse.wtp.contextRoot>
</properties>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-framework-bom</artifactId>
<version>4.2.5.RELEASE</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>javax.servlet.jsp.jstl</groupId>
<artifactId>javax.servlet.jsp.jstl-api</artifactId>
<version>1.2.1</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>4.1.0.BUILD-SNAPSHOT</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>4.1.0.BUILD-SNAPSHOT</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-beans</artifactId>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context</artifactId>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-web</artifactId>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.2</version>
<scope>compile</scope>
<optional>true</optional>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.0.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.1.2</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.apache.taglibs</groupId>
<artifactId>taglibs-standard-jstlel</artifactId>
<version>1.2.1</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
<version>1.7.7</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>4.1.0.BUILD-SNAPSHOT</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>4.1.0.BUILD-SNAPSHOT</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context-support</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.12</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
<version>2.2.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
<artifactId>mockito-core</artifactId>
<version>1.10.19</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<repositories>
<repository>
<id>spring-snapshot</id>
<url>https://repo.spring.io/snapshot</url>
</repository>
</repositories>
<build>
<plugins>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>1.7</source>
<target>1.7</target>
</configuration>
</plugin>
<plugin>
<artifactId>maven-war-plugin</artifactId>
<version>2.3</version>
<configuration>
<failOnMissingWebXml>false</failOnMissingWebXml>
</configuration>
</plugin>
</plugins>
</build>
</project>

34
samples/xml/servletapi/servletapi.gradle Normal file
View File

@@ -0,0 +1,34 @@
// Servlet API integration sample build file
apply plugin: 'war'
def excludeModules = ['spring-security-acl', 'jsr250-api', 'ehcache', 'spring-jdbc', 'spring-tx']
configurations {
excludeModules.each {name ->
runtime.exclude module: name
}
runtime.exclude group: 'org.aspectj'
}
dependencies {
providedCompile "javax.servlet:javax.servlet-api:$servletApiVersion"
compile project(':spring-security-core'),
project(':spring-security-web'),
"javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
"org.springframework:spring-beans:$springVersion",
"org.springframework:spring-context:$springVersion",
"org.springframework:spring-web:$springVersion",
"org.springframework:spring-webmvc:$springVersion"
runtime project(':spring-security-config'),
project(':spring-security-taglibs'),
"org.springframework:spring-context-support:$springVersion",
jstlDependencies,
"org.slf4j:jcl-over-slf4j:$slf4jVersion",
"ch.qos.logback:logback-classic:$logbackVersion"
}
eclipse.wtp.component.contextPath = "servletapi"

42
samples/xml/servletapi/src/main/java/org/springframework/security/samples/servletapi/mvc/LoginForm.java Normal file
View File

@@ -0,0 +1,42 @@
/*
* Copyright 2002-2016 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.samples.servletapi.mvc;
/**
*
* @author Rob Winch
*
*/
public class LoginForm {
private String username;
private String password;
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
}

214
samples/xml/servletapi/src/main/java/org/springframework/security/samples/servletapi/mvc/ServletApiController.java Normal file
View File

@@ -0,0 +1,214 @@
/*
* Copyright 2002-2016 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.samples.servletapi.mvc;
import java.io.IOException;
import java.security.Principal;
import javax.naming.AuthenticationException;
import javax.servlet.AsyncContext;
import javax.servlet.Servlet;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.access.ExceptionTranslationFilter;
import org.springframework.stereotype.Controller;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.mvc.support.RedirectAttributes;
/**
* A Spring MVC Controller that demonstrates Spring Security's integration with the
* standard Servlet API's. Specifically it demonstrates the following:
* <ul>
* <li>{@link #authenticate(HttpServletRequest, HttpServletResponse)} - Integration with
* {@link HttpServletRequest#authenticate(HttpServletResponse)}</li>
* <li>{@link #login(HttpServletRequest, HttpServletResponse, LoginForm, BindingResult)} -
* Integration with {@link HttpServletRequest#login(String, String)}</li>
* <li>{@link #logout(HttpServletRequest, HttpServletResponse, RedirectAttributes)} - Integration with
* {@link HttpServletRequest#logout()}</li>
* <li>{@link #remoteUser(HttpServletRequest)} - Integration with
* {@link HttpServletRequest#getRemoteUser()}</li>
* <li>{@link #userPrincipal(HttpServletRequest)} - Integration with
* {@link HttpServletRequest#getUserPrincipal()}</li>
* <li>{@link #authentication(Authentication)} - Spring MVC's ability to resolve the
* {@link Authentication} since it is found on
* {@link HttpServletRequest#getUserPrincipal()}</li>
* </ul>
*
* @author Rob Winch
*
*/
@Controller
public class ServletApiController {
/**
* Demonstrates that {@link HttpServletRequest#authenticate(HttpServletResponse)} will
* send the user to the log in page configured within Spring Security if the user is
* not already authenticated.
*
* @param request
* @param response
* @return
* @throws ServletException
* @throws IOException
*/
@RequestMapping("/authenticate")
public String authenticate(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
boolean authenticate = request.authenticate(response);
return authenticate ? "index" : null;
}
/**
* Demonstrates that you can authenticate with Spring Security using
* {@link HttpServletRequest#login(String, String)}.
*
* <p>
* If we fail to authenticate, a {@link ServletException} is thrown that wraps the
* original {@link AuthenticationException} from Spring Security. This means we can
* catch the {@link ServletException} to display the error message. Alternatively, we
* could allow the {@link ServletException} to propegate and Spring Security's
* {@link ExceptionTranslationFilter} would catch it and process it appropriately.
* </p>
* <p>
* In this method we choose to use Spring MVC's {@link ModelAttribute} to make things
* easier for our form. However, this is not necessary. We could have just as easily
* obtained the request parameters from the {@link HttpServletRequest} object.
* Remember all of these examples would work in a standard {@link Servlet} or anything
* with access to the {@link HttpServletRequest} and {@link HttpServletResponse}.
* </p>
*
* @param request
* @param response
* @param loginForm
* @param result
* @return
* @throws ServletException
*/
@RequestMapping(value = "/login", method = RequestMethod.POST)
public String login(HttpServletRequest request, HttpServletResponse response,
@ModelAttribute LoginForm loginForm, BindingResult result)
throws ServletException {
try {
request.login(loginForm.getUsername(), loginForm.getPassword());
}
catch (ServletException authenticationFailed) {
result.rejectValue(null, "authentication.failed",
authenticationFailed.getMessage());
return "login";
}
return "redirect:/";
}
/**
* Demonstrates that invoking {@link HttpServletRequest#logout()} will log the user
* out. Note that the response does not get processed, so you need to write something
* to the response.
* @param request
* @param response
* @param redirect
* @return
* @throws ServletException
*/
@RequestMapping("/logout")
public String logout(HttpServletRequest request, HttpServletResponse response,
RedirectAttributes redirect) throws ServletException {
request.logout();
return "redirect:/";
}
/**
* Demonstrates Spring Security with {@link AsyncContext#start(Runnable)}. Spring
* Security will automatically transfer the {@link SecurityContext} from the thread
* that {@link AsyncContext#start(Runnable)} is invoked to the new Thread that invokes
* the {@link Runnable}.
* @param request
* @param response
*/
@RequestMapping("/async")
public void asynch(HttpServletRequest request, HttpServletResponse response) {
final AsyncContext async = request.startAsync();
async.start(new Runnable() {
public void run() {
Authentication authentication = SecurityContextHolder.getContext()
.getAuthentication();
try {
final HttpServletResponse asyncResponse = (HttpServletResponse) async
.getResponse();
asyncResponse.setStatus(HttpServletResponse.SC_OK);
asyncResponse.getWriter().write(String.valueOf(authentication));
async.complete();
}
catch (Exception e) {
throw new RuntimeException(e);
}
}
});
}
/**
* Demonstrates that Spring Security automatically populates
* {@link HttpServletRequest#getRemoteUser()} with the current username.
* @param request
* @return
*/
@ModelAttribute("remoteUser")
public String remoteUser(HttpServletRequest request) {
return request.getRemoteUser();
}
/**
* Demonstrates that Spring Security automatically populates
* {@link HttpServletRequest#getUserPrincipal()} with the {@link Authentication} that
* is present on {@link SecurityContextHolder#getContext()}
* @param request
* @return
*/
@ModelAttribute("userPrincipal")
public Principal userPrincipal(HttpServletRequest request) {
return request.getUserPrincipal();
}
/**
* Spring MVC will automatically resolve any object that implements {@link Principal}
* using {@link HttpServletRequest#getUserPrincipal()}. This means you can easily
* resolve the {@link Authentication} just by adding it as an argument to your MVC
* controller. Alternatively, you could also have an argument of type
* {@link Principal} which would not couple your controller to Spring Security.
* @param authentication
* @return
*/
@ModelAttribute
public Authentication authentication(Authentication authentication) {
return authentication;
}
@RequestMapping("/")
public String welcome() {
return "index";
}
@RequestMapping(value = "/login", method = RequestMethod.GET)
public String login(@ModelAttribute LoginForm loginForm) {
return "login";
}
}

23
samples/xml/servletapi/src/main/resources/applicationContext-security.xml Normal file
View File

@@ -0,0 +1,23 @@
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd">
<http auto-config="true">
<intercept-url pattern="/**" access="permitAll"/>
</http>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="user" password="password" authorities="ROLE_USER" />
<user name="admin" password="password" authorities="ROLE_USER,ROLE_ADMIN"/>
</user-service>
</authentication-provider>
</authentication-manager>
</b:beans>

12
samples/xml/servletapi/src/main/resources/logback.xml Normal file
View File

@@ -0,0 +1,12 @@
<configuration>
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
<encoder>
<pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
</encoder>
</appender>
<root level="WARN">
<appender-ref ref="STDOUT" />
</root>
</configuration>

24
samples/xml/servletapi/src/main/webapp/WEB-INF/spring-servlet.xml Normal file
View File

@@ -0,0 +1,24 @@
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/mvc"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:b="http://www.springframework.org/schema/beans"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd">
<context:component-scan base-package="org.springframework.security.samples.servletapi.mvc" />
<!-- Enables the Spring MVC @Controller programming model -->
<annotation-driven/>
<!-- Handles HTTP GET requests for /resources/** by efficiently serving up static resources in the ${webappRoot}/resources/ directory -->
<resources mapping="/resources/**" location="/resources/" />
<!-- Resolves views selected for rendering by @Controllers to .jsp resources in the /WEB-INF/views directory -->
<b:bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"
p:prefix="/WEB-INF/views/"
p:suffix=".jsp" />
</b:beans>

44
samples/xml/servletapi/src/main/webapp/WEB-INF/views/index.jsp Normal file
View File

@@ -0,0 +1,44 @@
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head>
<title>Welcome</title>
</head>
<body>
<h1>Home Page</h1>
<p>
Anyone can view this page.
</p>
<sec:authorize access="authenticated" var="authenticated"/>
<c:if test="${authenticated}">
<p>You are currently authenticated</p>
<dl>
<dt>HttpServletRequest.getRemoteUser()</dt>
<dd><c:out value="${remoteUser}"/></dd>
<dt>HttpServletRequest.getUserPrincipal()</dt>
<dd><c:out value="${userPrincipal}"/></dd>
<dt>Authentication</dt>
<dd><c:out value="${authentication}"/></dd>
</dl>
</c:if>
<ul>
<li>
<a href="<c:url value="/authenticate"/>">HttpServletRequest.authenticate(HttpServletResponse)</a>
- if you are authenticated already will simply return true. Otherwise, will redirect you to the log in page configured in your Spring Security configuration.
</li>
<li>
<a href="<c:url value="/async"/>">AsyncContext.start(Runnable)</a>
- will automatically transfer the current SecurityContext to the new Thread
</li>
<c:choose>
<c:when test="${authenticated}">
<li><a href="<c:url value="/logout"/>">HttpServletRequest.logout()</a></li>
</c:when>
<c:otherwise>
<li><a href="<c:url value="/login"/>">Fill out log in form</a> - allows the user to invoke HttpServletRequest.login(String,String)</li>
</c:otherwise>
</c:choose>
</ul>
</body>
</html>

26
samples/xml/servletapi/src/main/webapp/WEB-INF/views/login.jsp Normal file
View File

@@ -0,0 +1,26 @@
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head>
<title>Please Log In</title>
</head>
<body>
<h1>Please Log In</h1>
<p>This page demonstrates the use of HttpServletRequest.login(String,String) integration with Spring Security.</p>
<form:form action="./login" method="post" modelAttribute="loginForm">
<form:errors/>
<p>
<label for="username">Username</label>
<form:input path="username"/>
</p>
<p>
<label for="password">Password</label>
<form:password path="password"/>
</p>
<p>
<input type="submit" value="Log In"/>
</p>
</form:form>
</body>
</html>

57
samples/xml/servletapi/src/main/webapp/WEB-INF/web.xml Normal file
View File

@@ -0,0 +1,57 @@
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">
<!--
- Location of the XML file that defines the root application context
- Applied by ContextLoaderListener.
-->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:applicationContext-security.xml
</param-value>
</context-param>
<!-- Nothing below here needs to be modified -->
<context-param>
<param-name>webAppRootKey</param-name>
<param-value>servletapi.root</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<async-supported>true</async-supported>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>ASYNC</dispatcher>
</filter-mapping>
<!--
- Loads the root application context of this web app at startup.
- The application context is then available via
- WebApplicationContextUtils.getWebApplicationContext(servletContext).
-->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
<servlet-name>spring</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
<async-supported>true</async-supported>
</servlet>
<servlet-mapping>
<servlet-name>spring</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
</web-app>