Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove SaltSource

Browse Source 
Fixes gh-4681
This commit is contained in:
Rob Winch
2017-10-22 20:55:56 -05:00
parent d832213c6c
commit cdc992b132
16 changed files with 2 additions and 670 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/src/main/java/org/springframework/security/config/Elements.java
View File

@@ -55,7 +55,6 @@ public abstract class Elements {
public static final String FILTER_CHAIN = "filter-chain";
public static final String GLOBAL_METHOD_SECURITY = "global-method-security";
public static final String PASSWORD_ENCODER = "password-encoder";
public static final String SALT_SOURCE = "salt-source";
public static final String PORT_MAPPINGS = "port-mappings";
public static final String PORT_MAPPING = "port-mapping";
public static final String CUSTOM_FILTER = "custom-filter";

5
config/src/main/java/org/springframework/security/config/authentication/AuthenticationProviderBeanDefinitionParser.java
View File

@@ -47,11 +47,6 @@ public class AuthenticationProviderBeanDefinitionParser implements BeanDefinitio
PasswordEncoderParser pep = new PasswordEncoderParser(passwordEncoderElt, pc);
authProvider.getPropertyValues().addPropertyValue("passwordEncoder",
pep.getPasswordEncoder());
if (pep.getSaltSource() != null) {
authProvider.getPropertyValues().addPropertyValue("saltSource",
pep.getSaltSource());
}
}
Element userServiceElt = DomUtils.getChildElementByTagName(element,

23
config/src/main/java/org/springframework/security/config/authentication/PasswordEncoderParser.java
View File

@@ -14,7 +14,6 @@
* limitations under the License.
*/
package org.springframework.security.config.authentication;
import java.util.HashMap;
import java.util.Map;
@@ -35,8 +34,6 @@ import org.w3c.dom.Element;
/**
* Stateful parser for the <password-encoder> element.
*
* Will produce a PasswordEncoder and (optionally) a SaltSource.
*
* @author Luke Taylor
*/
public class PasswordEncoderParser {
@@ -55,7 +52,6 @@ public class PasswordEncoderParser {
private static final Log logger = LogFactory.getLog(PasswordEncoderParser.class);
private BeanMetadataElement passwordEncoder;
private BeanMetadataElement saltSource;
public PasswordEncoderParser(Element element, ParserContext parserContext) {
parse(element, parserContext);
@@ -79,21 +75,6 @@ public class PasswordEncoderParser {
((RootBeanDefinition) passwordEncoder).setSource(parserContext
.extractSource(element));
}
Element saltSourceElt = DomUtils.getChildElementByTagName(element,
Elements.SALT_SOURCE);
if (saltSourceElt != null) {
if (OPT_HASH_BCRYPT.equals(hash)) {
parserContext.getReaderContext().error(
Elements.SALT_SOURCE + " isn't compatible with bcrypt",
parserContext.extractSource(saltSourceElt));
}
else {
saltSource = new SaltSourceBeanDefinitionParser().parse(saltSourceElt,
parserContext);
}
}
}
public static BeanDefinition createPasswordEncoderBeanDefinition(String hash,
@@ -107,8 +88,4 @@ public class PasswordEncoderParser {
public BeanMetadataElement getPasswordEncoder() {
return passwordEncoder;
}
public BeanMetadataElement getSaltSource() {
return saltSource;
}
}

74
config/src/main/java/org/springframework/security/config/authentication/SaltSourceBeanDefinitionParser.java
View File

@@ -1,74 +0,0 @@
/*
* Copyright 2002-2016 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.config.authentication;
import org.springframework.beans.BeanMetadataElement;
import org.springframework.beans.factory.config.BeanDefinition;
import org.springframework.beans.factory.config.RuntimeBeanReference;
import org.springframework.beans.factory.support.RootBeanDefinition;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.security.authentication.dao.ReflectionSaltSource;
import org.springframework.security.authentication.dao.SystemWideSaltSource;
import org.springframework.security.config.Elements;
import org.springframework.util.StringUtils;
import org.w3c.dom.Element;
/**
* @author Luke Taylor
* @since 2.0
*/
class SaltSourceBeanDefinitionParser {
private static final String ATT_USER_PROPERTY = "user-property";
private static final String ATT_REF = "ref";
private static final String ATT_SYSTEM_WIDE = "system-wide";
public BeanMetadataElement parse(Element element, ParserContext parserContext) {
String ref = element.getAttribute(ATT_REF);
if (StringUtils.hasText(ref)) {
return new RuntimeBeanReference(ref);
}
String userProperty = element.getAttribute(ATT_USER_PROPERTY);
RootBeanDefinition saltSource;
if (StringUtils.hasText(userProperty)) {
saltSource = new RootBeanDefinition(ReflectionSaltSource.class);
saltSource.getPropertyValues().addPropertyValue("userPropertyToUse",
userProperty);
saltSource.setSource(parserContext.extractSource(element));
saltSource.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
return saltSource;
}
String systemWideSalt = element.getAttribute(ATT_SYSTEM_WIDE);
if (StringUtils.hasText(systemWideSalt)) {
saltSource = new RootBeanDefinition(SystemWideSaltSource.class);
saltSource.getPropertyValues().addPropertyValue("systemWideSalt",
systemWideSalt);
saltSource.setSource(parserContext.extractSource(element));
saltSource.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
return saltSource;
}
parserContext.getReaderContext().error(
Elements.SALT_SOURCE + " requires an attribute", element);
return null;
}
}

6
config/src/main/java/org/springframework/security/config/ldap/LdapProviderBeanDefinitionParser.java
View File

@@ -103,12 +103,6 @@ public class LdapProviderBeanDefinitionParser implements BeanDefinitionParser {
passwordEncoderElement, parserContext);
authenticatorBuilder.addPropertyValue("passwordEncoder",
pep.getPasswordEncoder());
if (pep.getSaltSource() != null) {
parserContext.getReaderContext().warning(
"Salt source information isn't valid when used with LDAP",
passwordEncoderElement);
}
}
else if (StringUtils.hasText(hash)) {
authenticatorBuilder.addPropertyValue("passwordEncoder",

12
config/src/main/resources/org/springframework/security/config/spring-security-5.0.rnc
View File

@@ -54,20 +54,10 @@ debug =
password-encoder =
## element which defines a password encoding strategy. Used by an authentication provider to convert submitted passwords to hashed versions, for example.
element password-encoder {password-encoder.attlist, salt-source?}
element password-encoder {password-encoder.attlist}
password-encoder.attlist &=
ref | (hash)
salt-source =
## Password salting strategy. A system-wide constant or a property from the UserDetails object can be used.
element salt-source {user-property | system-wide | ref}
user-property =
## A property of the UserDetails object which will be used as salt by a password encoder. Typically something like "username" might be used.
attribute user-property {xsd:token}
system-wide =
## A single value that will be used as the salt for a password encoder.
attribute system-wide {xsd:token}
role-prefix =
## A non-empty string prefix that will be added to role strings loaded from persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases where the default is non-empty.
attribute role-prefix {xsd:token}

78
config/src/main/resources/org/springframework/security/config/spring-security-5.0.xsd
View File

@@ -144,24 +144,6 @@
</xs:simpleType>
</xs:attribute>
</xs:attributeGroup>
<xs:attributeGroup name="user-property">
<xs:attribute name="user-property" use="required" type="xs:token">
<xs:annotation>
<xs:documentation>A property of the UserDetails object which will be used as salt by a password encoder.
Typically something like "username" might be used.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:attributeGroup>
<xs:attributeGroup name="system-wide">
<xs:attribute name="system-wide" use="required" type="xs:token">
<xs:annotation>
<xs:documentation>A single value that will be used as the salt for a password encoder.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:attributeGroup>
<xs:attributeGroup name="role-prefix">
<xs:attribute name="role-prefix" use="required" type="xs:token">
<xs:annotation>
@@ -2007,36 +1989,6 @@
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element minOccurs="0" name="salt-source">
<xs:annotation>
<xs:documentation>Password salting strategy. A system-wide constant or a property from the UserDetails
object can be used.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attribute name="user-property" type="xs:token">
<xs:annotation>
<xs:documentation>A property of the UserDetails object which will be used as salt by a password encoder.
Typically something like "username" might be used.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="system-wide" type="xs:token">
<xs:annotation>
<xs:documentation>A single value that will be used as the salt for a password encoder.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="ref" type="xs:token">
<xs:annotation>
<xs:documentation>Defines a reference to a Spring bean Id.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
</xs:sequence>
<xs:attributeGroup ref="security:password-encoder.attlist"/>
</xs:complexType>
</xs:element>
@@ -2066,36 +2018,6 @@
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element minOccurs="0" name="salt-source">
<xs:annotation>
<xs:documentation>Password salting strategy. A system-wide constant or a property from the UserDetails
object can be used.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attribute name="user-property" type="xs:token">
<xs:annotation>
<xs:documentation>A property of the UserDetails object which will be used as salt by a password encoder.
Typically something like "username" might be used.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="system-wide" type="xs:token">
<xs:annotation>
<xs:documentation>A single value that will be used as the salt for a password encoder.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="ref" type="xs:token">
<xs:annotation>
<xs:documentation>Defines a reference to a Spring bean Id.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
</xs:sequence>
<xs:attributeGroup ref="security:password-encoder.attlist"/>
</xs:complexType>
</xs:element>

20
config/src/test/java/org/springframework/security/config/authentication/AuthenticationProviderBeanDefinitionParserTests.java
View File

@@ -18,7 +18,6 @@ package org.springframework.security.config.authentication;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.authentication.dao.ReflectionSaltSource;
import org.springframework.security.config.BeanIds;
import org.springframework.security.config.util.InMemoryXmlApplicationContext;
import org.springframework.security.crypto.password.LdapShaPasswordEncoder;
@@ -80,25 +79,6 @@ public class AuthenticationProviderBeanDefinitionParserTests {
getProvider().authenticate(bob);
}
@Test(expected = BeanDefinitionParsingException.class)
public void bCryptAndSaltSourceRaisesException() throws Exception {
appContext = new InMemoryXmlApplicationContext(
""
+ " <authentication-manager>"
+ " <authentication-provider>"
+ " <password-encoder hash='bcrypt'>"
+ " <salt-source ref='saltSource'/>"
+ " </password-encoder>"
+ " <user-service>"
+ " <user name='bob' password='$2a$05$dRmjl1T05J7rvCPD2NgsHesCEJHww3pdmesUhjM3PD4m/gaEYyx/G' authorities='ROLE_A' />"
+ " </user-service>" + " </authentication-provider>"
+ " </authentication-manager>"
+ " <b:bean id='saltSource' class='"
+ ReflectionSaltSource.class.getName() + "'>"
+ " <b:property name='userPropertyToUse' value='username'/>"
+ " </b:bean>");
}
@Test
public void providerWithMd5PasswordEncoderWorks() throws Exception {
appContext = new InMemoryXmlApplicationContext(