Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1231: Authentication.getAuthorities should be of type Collection<GrantedAuthority> and not List<GrantedAuthority>. Refactored the interface and related classes to match (UserDetails etc).

Browse Source
This commit is contained in:
Luke Taylor
2009-10-05 19:28:53 +00:00
parent 07d7c0ddae
commit caff3ee9ba
64 changed files with 296 additions and 355 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/src/main/java/org/springframework/security/access/expression/SecurityExpressionRoot.java
View File

@@ -1,7 +1,7 @@
package org.springframework.security.access.expression;
import java.util.Collection;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -96,7 +96,7 @@ public abstract class SecurityExpressionRoot {
private Set<String> getAuthoritySet() {
if (roles == null) {
roles = new HashSet<String>();
List<GrantedAuthority> userAuthorities = authentication.getAuthorities();
Collection<GrantedAuthority> userAuthorities = authentication.getAuthorities();
if (roleHierarchy != null) {
userAuthorities = roleHierarchy.getReachableGrantedAuthorities(userAuthorities);

4
core/src/main/java/org/springframework/security/access/hierarchicalroles/NullRoleHierarchy.java
View File

@@ -1,6 +1,6 @@
package org.springframework.security.access.hierarchicalroles;
import java.util.List;
import java.util.Collection;
import org.springframework.security.core.GrantedAuthority;
@@ -12,7 +12,7 @@ import org.springframework.security.core.GrantedAuthority;
*/
public final class NullRoleHierarchy implements RoleHierarchy {
public List<GrantedAuthority> getReachableGrantedAuthorities(List<GrantedAuthority> authorities) {
public Collection<GrantedAuthority> getReachableGrantedAuthorities(Collection<GrantedAuthority> authorities) {
return authorities;
}

4
core/src/main/java/org/springframework/security/access/hierarchicalroles/RoleHierarchy.java
View File

@@ -14,7 +14,7 @@
package org.springframework.security.access.hierarchicalroles;
import java.util.List;
import java.util.Collection;
import org.springframework.security.core.GrantedAuthority;
@@ -40,6 +40,6 @@ public interface RoleHierarchy {
* @param authorities - List of the directly assigned authorities.
* @return List of all reachable authorities given the assigned authorities.
*/
public List<GrantedAuthority> getReachableGrantedAuthorities(List<GrantedAuthority> authorities);
public Collection<GrantedAuthority> getReachableGrantedAuthorities(Collection<GrantedAuthority> authorities);
}

84
core/src/main/java/org/springframework/security/access/hierarchicalroles/RoleHierarchyImpl.java
View File

@@ -15,15 +15,21 @@
package org.springframework.security.access.hierarchicalroles;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
/**
* <p>
@@ -98,7 +104,7 @@ public class RoleHierarchyImpl implements RoleHierarchy {
buildRolesReachableInOneOrMoreStepsMap();
}
public List<GrantedAuthority> getReachableGrantedAuthorities(List<GrantedAuthority> authorities) {
public Collection<GrantedAuthority> getReachableGrantedAuthorities(Collection<GrantedAuthority> authorities) {
if (authorities == null || authorities.isEmpty()) {
return null;
}
@@ -125,40 +131,40 @@ public class RoleHierarchyImpl implements RoleHierarchy {
}
// SEC-863
private void addReachableRoles(Set<GrantedAuthority> reachableRoles,
GrantedAuthority authority) {
Iterator<GrantedAuthority> iterator = reachableRoles.iterator();
while (iterator.hasNext()) {
GrantedAuthority testAuthority = iterator.next();
String testKey = testAuthority.getAuthority();
if ((testKey != null) && (testKey.equals(authority.getAuthority()))) {
return;
}
}
reachableRoles.add(authority);
}
private void addReachableRoles(Set<GrantedAuthority> reachableRoles,
GrantedAuthority authority) {
Iterator<GrantedAuthority> iterator = reachableRoles.iterator();
while (iterator.hasNext()) {
GrantedAuthority testAuthority = iterator.next();
String testKey = testAuthority.getAuthority();
if ((testKey != null) && (testKey.equals(authority.getAuthority()))) {
return;
}
}
reachableRoles.add(authority);
}
// SEC-863
private Set<GrantedAuthority> getRolesReachableInOneOrMoreSteps(
GrantedAuthority authority) {
if (authority.getAuthority() == null) {
return null;
}
Iterator<GrantedAuthority> iterator = rolesReachableInOneOrMoreStepsMap.keySet().iterator();
while (iterator.hasNext()) {
GrantedAuthority testAuthority = iterator.next();
String testKey = testAuthority.getAuthority();
if ((testKey != null) && (testKey.equals(authority.getAuthority()))) {
return rolesReachableInOneOrMoreStepsMap.get(testAuthority);
}
}
return null;
}
private Set<GrantedAuthority> getRolesReachableInOneOrMoreSteps(
GrantedAuthority authority) {
if (authority.getAuthority() == null) {
return null;
}
Iterator<GrantedAuthority> iterator = rolesReachableInOneOrMoreStepsMap.keySet().iterator();
while (iterator.hasNext()) {
GrantedAuthority testAuthority = iterator.next();
String testKey = testAuthority.getAuthority();
if ((testKey != null) && (testKey.equals(authority.getAuthority()))) {
return rolesReachableInOneOrMoreStepsMap.get(testAuthority);
}
}
return null;
}
/**
* Parse input and build the map for the roles reachable in one step: the higher role will become a key that
* references a set of the reachable lower roles.

7
core/src/main/java/org/springframework/security/access/hierarchicalroles/UserDetailsWrapper.java
View File

@@ -14,8 +14,9 @@
package org.springframework.security.access.hierarchicalroles;
import java.util.List;
import java.util.Collection;
import org.springframework.security.access.vote.RoleHierarchyVoter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
@@ -48,7 +49,7 @@ public class UserDetailsWrapper implements UserDetails {
return userDetails.isAccountNonLocked();
}
public List<GrantedAuthority> getAuthorities() {
public Collection<GrantedAuthority> getAuthorities() {
return roleHierarchy.getReachableGrantedAuthorities(userDetails.getAuthorities());
}
@@ -72,4 +73,4 @@ public class UserDetailsWrapper implements UserDetails {
return userDetails;
}
}
}

5
core/src/main/java/org/springframework/security/access/intercept/RunAsUserToken.java
View File

@@ -16,8 +16,7 @@
package org.springframework.security.access.intercept;
import java.util.Arrays;
import java.util.List;
import java.util.Collection;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.Authentication;
@@ -45,7 +44,7 @@ public class RunAsUserToken extends AbstractAuthenticationToken {
this(key, principal, credentials, Arrays.asList(authorities), originalAuthentication);
}
public RunAsUserToken(String key, Object principal, Object credentials, List<GrantedAuthority> authorities,
public RunAsUserToken(String key, Object principal, Object credentials, Collection<GrantedAuthority> authorities,
Class<? extends Authentication> originalAuthentication) {
super(authorities);
this.keyHash = key.hashCode();

5
core/src/main/java/org/springframework/security/access/vote/LabelBasedAclVoter.java
View File

@@ -23,6 +23,7 @@ import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.util.Assert;
@@ -177,8 +178,8 @@ public class LabelBasedAclVoter extends AbstractAclVoter {
*/
List<String> userLabels = new ArrayList<String>();
for (int i = 0; i < authentication.getAuthorities().size(); i++) {
String userLabel = authentication.getAuthorities().get(i).getAuthority();
for (GrantedAuthority authority : authentication.getAuthorities()) {
String userLabel = authority.getAuthority();
if (labelMap.containsKey(userLabel)) {
userLabels.add(userLabel);
logger.debug("Adding " + userLabel + " to <<<" + authentication.getName()

4
core/src/main/java/org/springframework/security/access/vote/RoleHierarchyVoter.java
View File

@@ -1,6 +1,6 @@
package org.springframework.security.access.vote;
import java.util.List;
import java.util.Collection;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.core.Authentication;
@@ -26,7 +26,7 @@ public class RoleHierarchyVoter extends RoleVoter {
* Calls the <tt>RoleHierarchy</tt> to obtain the complete set of user authorities.
*/
@Override
List<GrantedAuthority> extractAuthorities(Authentication authentication) {
Collection<GrantedAuthority> extractAuthorities(Authentication authentication) {
return roleHierarchy.getReachableGrantedAuthorities(authentication.getAuthorities());
}
}

5
core/src/main/java/org/springframework/security/access/vote/RoleVoter.java
View File

@@ -15,6 +15,7 @@
package org.springframework.security.access.vote;
import java.util.Collection;
import java.util.List;
import org.springframework.security.access.AccessDecisionVoter;
@@ -94,7 +95,7 @@ public class RoleVoter implements AccessDecisionVoter {
public int vote(Authentication authentication, Object object, List<ConfigAttribute> attributes) {
int result = ACCESS_ABSTAIN;
List<GrantedAuthority> authorities = extractAuthorities(authentication);
Collection<GrantedAuthority> authorities = extractAuthorities(authentication);
for (ConfigAttribute attribute : attributes) {
if (this.supports(attribute)) {
@@ -112,7 +113,7 @@ public class RoleVoter implements AccessDecisionVoter {
return result;
}
List<GrantedAuthority> extractAuthorities(Authentication authentication) {
Collection<GrantedAuthority> extractAuthorities(Authentication authentication) {
return authentication.getAuthorities();
}
}

20
core/src/main/java/org/springframework/security/authentication/AbstractAuthenticationToken.java
View File

@@ -16,8 +16,9 @@
package org.springframework.security.authentication;
import java.security.Principal;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
@@ -37,7 +38,7 @@ public abstract class AbstractAuthenticationToken implements Authentication {
//~ Instance fields ================================================================================================
private Object details;
private final List<GrantedAuthority> authorities;
private final Collection<GrantedAuthority> authorities;
private boolean authenticated = false;
//~ Constructors ===================================================================================================
@@ -52,17 +53,18 @@ public abstract class AbstractAuthenticationToken implements Authentication {
* Authentication#getAuthorities()}<code>null</code> should only be
* presented if the principal has not been authenticated).
*/
public AbstractAuthenticationToken(List<GrantedAuthority> authorities) {
public AbstractAuthenticationToken(Collection<GrantedAuthority> authorities) {
if (authorities == null) {
this.authorities = null;
} else {
for (int i = 0; i < authorities.size(); i++) {
if(authorities.get(i) == null) {
throw new IllegalArgumentException("Granted authority element " + i
+ " is null - GrantedAuthority[] cannot contain any null elements");
for (GrantedAuthority a: authorities) {
if(a == null) {
throw new IllegalArgumentException("Authorities collection cannot contain any null elements");
}
}
this.authorities = Collections.unmodifiableList(authorities);
ArrayList<GrantedAuthority> temp = new ArrayList<GrantedAuthority>(authorities.size());
temp.addAll(authorities);
this.authorities = Collections.unmodifiableList(temp);
}
}
@@ -116,7 +118,7 @@ public abstract class AbstractAuthenticationToken implements Authentication {
return this.isAuthenticated() == test.isAuthenticated();
}
public List<GrantedAuthority> getAuthorities() {
public Collection<GrantedAuthority> getAuthorities() {
return authorities;
}

12
core/src/main/java/org/springframework/security/authentication/RememberMeAuthenticationToken.java
View File

@@ -16,8 +16,7 @@
package org.springframework.security.authentication;
import java.io.Serializable;
import java.util.Arrays;
import java.util.List;
import java.util.Collection;
import org.springframework.security.core.GrantedAuthority;
@@ -39,13 +38,6 @@ public class RememberMeAuthenticationToken extends AbstractAuthenticationToken i
//~ Constructors ===================================================================================================
/**
* @deprecated
*/
public RememberMeAuthenticationToken(String key, Object principal, GrantedAuthority[] authorities) {
this(key, principal, Arrays.asList(authorities));
}
/**
* Constructor.
*
@@ -55,7 +47,7 @@ public class RememberMeAuthenticationToken extends AbstractAuthenticationToken i
*
* @throws IllegalArgumentException if a <code>null</code> was passed
*/
public RememberMeAuthenticationToken(String key, Object principal, List<GrantedAuthority> authorities) {
public RememberMeAuthenticationToken(String key, Object principal, Collection<GrantedAuthority> authorities) {
super(authorities);
if ((key == null) || ("".equals(key)) || (principal == null) || "".equals(principal)) {

4
core/src/main/java/org/springframework/security/authentication/UsernamePasswordAuthenticationToken.java
View File

@@ -16,7 +16,7 @@
package org.springframework.security.authentication;
import java.util.Arrays;
import java.util.List;
import java.util.Collection;
import org.springframework.security.core.GrantedAuthority;
@@ -69,7 +69,7 @@ public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationT
* @param credentials
* @param authorities
*/
public UsernamePasswordAuthenticationToken(Object principal, Object credentials, List<GrantedAuthority> authorities) {
public UsernamePasswordAuthenticationToken(Object principal, Object credentials, Collection<GrantedAuthority> authorities) {
super(authorities);
this.principal = principal;
this.credentials = credentials;

4
core/src/main/java/org/springframework/security/authentication/rcp/RemoteAuthenticationManager.java
View File

@@ -15,6 +15,8 @@
package org.springframework.security.authentication.rcp;
import java.util.Collection;
import org.springframework.security.core.GrantedAuthority;
@@ -43,6 +45,6 @@ public interface RemoteAuthenticationManager {
*
* @throws RemoteAuthenticationException if the authentication failed.
*/
GrantedAuthority[] attemptAuthentication(String username, String password)
Collection<GrantedAuthority> attemptAuthentication(String username, String password)
throws RemoteAuthenticationException;
}

13
core/src/main/java/org/springframework/security/authentication/rcp/RemoteAuthenticationManagerImpl.java
View File

@@ -15,16 +15,13 @@
package org.springframework.security.authentication.rcp;
import java.util.List;
import java.util.Collection;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
@@ -48,14 +45,14 @@ public class RemoteAuthenticationManagerImpl implements RemoteAuthenticationMana
Assert.notNull(this.authenticationManager, "authenticationManager is required");
}
public GrantedAuthority[] attemptAuthentication(String username, String password)
public Collection<GrantedAuthority> attemptAuthentication(String username, String password)
throws RemoteAuthenticationException {
UsernamePasswordAuthenticationToken request = new UsernamePasswordAuthenticationToken(username, password);
try {
List<GrantedAuthority> authorities = authenticationManager.authenticate(request).getAuthorities();
Collection<GrantedAuthority> authorities = authenticationManager.authenticate(request).getAuthorities();
return authorities == null ? null : authorities.toArray(new GrantedAuthority[authorities.size()]);
return authorities;
} catch (AuthenticationException authEx) {
throw new RemoteAuthenticationException(authEx.getMessage());
}

11
core/src/main/java/org/springframework/security/authentication/rcp/RemoteAuthenticationProvider.java
View File

@@ -15,17 +15,14 @@
package org.springframework.security.authentication.rcp;
import java.util.Arrays;
import java.util.Collection;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
@@ -62,9 +59,9 @@ public class RemoteAuthenticationProvider implements AuthenticationProvider, Ini
throws AuthenticationException {
String username = authentication.getPrincipal().toString();
String password = authentication.getCredentials().toString();
GrantedAuthority[] authorities = remoteAuthenticationManager.attemptAuthentication(username, password);
Collection<GrantedAuthority> authorities = remoteAuthenticationManager.attemptAuthentication(username, password);
return new UsernamePasswordAuthenticationToken(username, password, Arrays.asList(authorities));
return new UsernamePasswordAuthenticationToken(username, password, authorities);
}
public RemoteAuthenticationManager getRemoteAuthenticationManager() {

4
core/src/main/java/org/springframework/security/core/Authentication.java
View File

@@ -18,7 +18,7 @@ package org.springframework.security.core;
import java.io.Serializable;
import java.security.Principal;
import java.util.List;
import java.util.Collection;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.context.SecurityContextHolder;
@@ -56,7 +56,7 @@ public interface Authentication extends Principal, Serializable {
*
* @return the authorities granted to the principal, or <code>null</code> if authentication has not been completed
*/
List<GrantedAuthority> getAuthorities();
Collection<GrantedAuthority> getAuthorities();
/**
* The credentials that prove the principal is correct. This is usually a password, but could be anything

7
core/src/main/java/org/springframework/security/core/authority/AuthorityUtils.java
View File

@@ -1,6 +1,7 @@
package org.springframework.security.core.authority;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
@@ -35,10 +36,10 @@ public abstract class AuthorityUtils {
* Converts an array of GrantedAuthority objects to a Set.
* @return a Set of the Strings obtained from each call to GrantedAuthority.getAuthority()
*/
public static Set<String> authorityListToSet(List<GrantedAuthority> authorities) {
Set<String> set = new HashSet<String>(authorities.size());
public static Set<String> authorityListToSet(Collection<GrantedAuthority> userAuthorities) {
Set<String> set = new HashSet<String>(userAuthorities.size());
for (GrantedAuthority authority: authorities) {
for (GrantedAuthority authority: userAuthorities) {
set.add(authority.getAuthority());
}

7
core/src/main/java/org/springframework/security/core/userdetails/User.java
View File

@@ -17,6 +17,7 @@ package org.springframework.security.core.userdetails;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.SortedSet;
@@ -80,7 +81,7 @@ public class User implements UserDetails {
* <code>GrantedAuthority[]</code> array
*/
public User(String username, String password, boolean enabled, boolean accountNonExpired,
boolean credentialsNonExpired, boolean accountNonLocked, List<GrantedAuthority> authorities) {
boolean credentialsNonExpired, boolean accountNonLocked, Collection<GrantedAuthority> authorities) {
if (((username == null) || "".equals(username)) || (password == null)) {
throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
@@ -118,7 +119,7 @@ public class User implements UserDetails {
&& (this.isEnabled() == user.isEnabled()));
}
public List<GrantedAuthority> getAuthorities() {
public Collection<GrantedAuthority> getAuthorities() {
return authorities;
}
@@ -182,7 +183,7 @@ public class User implements UserDetails {
return enabled;
}
private static List<GrantedAuthority> sortAuthorities(List<GrantedAuthority> authorities) {
private static List<GrantedAuthority> sortAuthorities(Collection<GrantedAuthority> authorities) {
Assert.notNull(authorities, "Cannot pass a null GrantedAuthority array");
// Ensure array iteration order is predictable (as per UserDetails.getAuthorities() contract and SEC-xxx)
SortedSet<GrantedAuthority> sorter = new TreeSet<GrantedAuthority>();

4
core/src/main/java/org/springframework/security/core/userdetails/UserDetails.java
View File

@@ -19,7 +19,7 @@ import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import java.io.Serializable;
import java.util.List;
import java.util.Collection;
/**
@@ -60,7 +60,7 @@ public interface UserDetails extends Serializable {
*
* @return the authorities, sorted by natural key (never <code>null</code>)
*/
List<GrantedAuthority> getAuthorities();
Collection<GrantedAuthority> getAuthorities();
/**
* Returns the password used to authenticate the user. Cannot return <code>null</code>.

14
core/src/main/java/org/springframework/security/provisioning/JdbcUserDetailsManager.java
View File

@@ -25,6 +25,7 @@ import org.apache.commons.logging.LogFactory;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Collection;
import java.util.List;
/**
@@ -171,9 +172,8 @@ public class JdbcUserDetailsManager extends JdbcDaoImpl implements UserDetailsMa
}
private void insertUserAuthorities(UserDetails user) {
for (int i=0; i < user.getAuthorities().size(); i++) {
getJdbcTemplate().update(createAuthoritySql,
new Object[] {user.getUsername(), user.getAuthorities().get(i).getAuthority()});
for (GrantedAuthority auth : user.getAuthorities()) {
getJdbcTemplate().update(createAuthoritySql, user.getUsername(), auth.getAuthority());
}
}
@@ -437,12 +437,12 @@ public class JdbcUserDetailsManager extends JdbcDaoImpl implements UserDetailsMa
validateAuthorities(user.getAuthorities());
}
private void validateAuthorities(List<GrantedAuthority> authorities) {
private void validateAuthorities(Collection<GrantedAuthority> authorities) {
Assert.notNull(authorities, "Authorities list must not be null");
for (int i=0; i < authorities.size(); i++) {
Assert.notNull(authorities.get(i), "Authorities list contains a null entry");
Assert.hasText(authorities.get(i).getAuthority(), "getAuthority() method must return a non-empty string");
for (GrantedAuthority authority : authorities) {
Assert.notNull(authority, "Authorities list contains a null entry");
Assert.hasText(authority.getAuthority(), "getAuthority() method must return a non-empty string");
}
}
}