SEC-1232: Added the aspect library needed for <global-method-security mode="aspectj"/> and a small sample

samples/aspectj/src/main/java/sample/aspectj/SecuredService.java

@@ -0,0 +1,19 @@
+package sample.aspectj;
+
+import org.springframework.security.access.annotation.Secured;
+
+/**
+ * Service which is secured on the class level
+ *
+ * @author Mike Wiesner
+ * @since 3.0
+ * @version $Id$
+ */
+@Secured("ROLE_USER")
+public class SecuredService {
+
+    public void secureMethod() {
+        // nothing
+    }
+
+}

samples/aspectj/src/main/java/sample/aspectj/Service.java

@@ -0,0 +1,23 @@
+package sample.aspectj;
+
+import org.springframework.security.access.annotation.Secured;
+
+/**
+ * Service which is secured on method level
+ *
+ * @author Mike Wiesner
+ * @since 1.0
+ * @version $Id$
+ */
+public class Service {
+
+    @Secured("ROLE_USER")
+    public void secureMethod() {
+        // nothing
+    }
+
+    public void publicMethod() {
+        // nothing
+    }
+
+}

samples/aspectj/src/main/resources/aspectj-context.xml

@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd">
+
+    <bean id="aspectJSecurityInterceptor"
+        class="org.springframework.security.access.intercept.aspectj.AspectJSecurityInterceptor">
+        <property name="authenticationManager" ref="authenticationManager" />
+        <property name="accessDecisionManager" ref="accessDecisionManager" />
+        <property name="securityMetadataSource">
+            <bean
+                class="org.springframework.security.access.annotation.SecuredAnnotationSecurityMetadataSource" />
+        </property>
+    </bean>
+
+    <bean id="authenticationManager"
+        class="org.springframework.security.authentication.ProviderManager">
+        <property name="providers">
+            <bean
+                class="org.springframework.security.authentication.TestingAuthenticationProvider" />
+        </property>
+    </bean>
+
+    <bean id="accessDecisionManager"
+        class="org.springframework.security.access.vote.AffirmativeBased">
+        <property name="decisionVoters">
+            <list>
+                <bean
+                    class="org.springframework.security.access.vote.RoleVoter" />
+            </list>
+        </property>
+    </bean>
+
+    <bean
+        class="org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect"
+        factory-method="aspectOf">
+        <property name="securityInterceptor" ref="aspectJSecurityInterceptor" />
+    </bean>
+
+    <bean class="sample.aspectj.Service" />
+
+    <bean class="sample.aspectj.SecuredService" />
+
+</beans>

samples/aspectj/src/test/java/sample/aspectj/AspectJInterceptorTests.java

@@ -0,0 +1,78 @@
+package sample.aspectj;
+
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration(locations = "classpath:aspectj-context.xml")
+public class AspectJInterceptorTests {
+
+    @Autowired
+    private Service service;
+
+    @Autowired
+    private SecuredService securedService;
+
+    @Test
+    public void testPublicMethod() throws Exception {
+        service.publicMethod();
+    }
+
+    @Test(expected = AuthenticationCredentialsNotFoundException.class)
+    public void testSecuredMethodNotAuthenticated() throws Exception {
+        service.secureMethod();
+    }
+
+    @Test(expected = AccessDeniedException.class)
+    public void testSecuredMethodWrongRole() throws Exception {
+        Authentication token = new UsernamePasswordAuthenticationToken("test", "xxx", AuthorityUtils
+                .createAuthorityList("ROLE_ADMIN"));
+        SecurityContextHolder.getContext().setAuthentication(token);
+        service.secureMethod();
+    }
+
+    @Test
+    public void testSecuredMethodEverythingOk() throws Exception {
+        Authentication token = new UsernamePasswordAuthenticationToken("test", "xxx", AuthorityUtils
+                .createAuthorityList("ROLE_USER"));
+        SecurityContextHolder.getContext().setAuthentication(token);
+        service.secureMethod();
+    }
+
+    @Test(expected = AuthenticationCredentialsNotFoundException.class)
+    public void testSecuredClassNotAuthenticated() throws Exception {
+        securedService.secureMethod();
+    }
+
+    @Test(expected = AccessDeniedException.class)
+    public void testSecuredClassWrongRole() throws Exception {
+        Authentication token = new UsernamePasswordAuthenticationToken("test", "xxx", AuthorityUtils
+                .createAuthorityList("ROLE_ADMIN"));
+        SecurityContextHolder.getContext().setAuthentication(token);
+        securedService.secureMethod();
+    }
+
+    @Test
+    public void testSecuredClassEverythingOk() throws Exception {
+        Authentication token = new UsernamePasswordAuthenticationToken("test", "xxx", AuthorityUtils
+                .createAuthorityList("ROLE_USER"));
+        SecurityContextHolder.getContext().setAuthentication(token);
+        securedService.secureMethod();
+    }
+
+    @After
+    public void tearDown() {
+        SecurityContextHolder.clearContext();
+    }
+
+}