Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove SaltSource

Browse Source 
Fixes gh-4681
This commit is contained in:
Rob Winch
2017-10-22 20:55:56 -05:00
parent d832213c6c
commit cdc992b132
16 changed files with 2 additions and 670 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
core/src/main/java/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java
View File

@@ -60,8 +60,6 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
*/
private String userNotFoundEncodedPassword;
private SaltSource saltSource;
private UserDetailsService userDetailsService;
public DaoAuthenticationProvider() {
@@ -75,12 +73,6 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
protected void additionalAuthenticationChecks(UserDetails userDetails,
UsernamePasswordAuthenticationToken authentication)
throws AuthenticationException {
Object salt = null;
if (this.saltSource != null) {
salt = this.saltSource.getSalt(userDetails);
}
if (authentication.getCredentials() == null) {
logger.debug("Authentication failed: no credentials provided");
@@ -155,26 +147,6 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
return passwordEncoder;
}
/**
* The source of salts to use when decoding passwords. <code>null</code> is a valid
* value, meaning the <code>DaoAuthenticationProvider</code> will present
* <code>null</code> to the relevant <code>PasswordEncoder</code>.
* <p>
* Instead, it is recommended that you use an encoder which uses a random salt and
* combines it with the password field. This is the default approach taken in the
* {@code org.springframework.security.crypto.password} package.
*
* @param saltSource to use when attempting to decode passwords via the
* <code>PasswordEncoder</code>
*/
public void setSaltSource(SaltSource saltSource) {
this.saltSource = saltSource;
}
protected SaltSource getSaltSource() {
return saltSource;
}
public void setUserDetailsService(UserDetailsService userDetailsService) {
this.userDetailsService = userDetailsService;
}

122
core/src/main/java/org/springframework/security/authentication/dao/ReflectionSaltSource.java
View File

@@ -1,122 +0,0 @@
/*
* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.authentication.dao;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.beans.BeanUtils;
import org.springframework.util.ReflectionUtils;
import org.springframework.util.Assert;
import java.lang.reflect.Method;
import java.beans.PropertyDescriptor;
/**
* Obtains a salt from a specified property of the
* {@link org.springframework.security.core.userdetails.User} object.
* <p>
* This allows you to subclass <code>User</code> and provide an additional bean getter for
* a salt. You should use a synthetic value that does not change, such as a database
* primary key. Do not use <code>username</code> if it is likely to change.
*
* @author Ben Alex
*/
public class ReflectionSaltSource implements SaltSource, InitializingBean {
// ~ Instance fields
// ================================================================================================
private String userPropertyToUse;
// ~ Methods
// ========================================================================================================
public void afterPropertiesSet() throws Exception {
Assert.hasText(userPropertyToUse, "A userPropertyToUse must be set");
}
/**
* Performs reflection on the passed <code>User</code> to obtain the salt.
* <p>
* The property identified by <code>userPropertyToUse</code> must be available from
* the passed <code>User</code> object. If it is not available, an
* {@link AuthenticationServiceException} will be thrown.
*
* @param user which contains the method identified by <code>userPropertyToUse</code>
*
* @return the result of invoking <tt>user.userPropertyToUse()</tt>, or if the method
* doesn't exist, <tt>user.getUserPropertyToUse()</tt>.
*
* @throws AuthenticationServiceException if reflection fails
*/
public Object getSalt(UserDetails user) {
Method saltMethod = findSaltMethod(user);
try {
return saltMethod.invoke(user);
}
catch (Exception exception) {
throw new AuthenticationServiceException(exception.getMessage(), exception);
}
}
private Method findSaltMethod(UserDetails user) {
Method saltMethod = ReflectionUtils.findMethod(user.getClass(),
userPropertyToUse, new Class[0]);
if (saltMethod == null) {
PropertyDescriptor pd = BeanUtils.getPropertyDescriptor(user.getClass(),
userPropertyToUse);
if (pd != null) {
saltMethod = pd.getReadMethod();
}
if (saltMethod == null) {
throw new AuthenticationServiceException(
"Unable to find salt method on user Object. Does the class '"
+ user.getClass().getName()
+ "' have a method or getter named '" + userPropertyToUse
+ "' ?");
}
}
return saltMethod;
}
protected String getUserPropertyToUse() {
return userPropertyToUse;
}
/**
* The method name to call to obtain the salt. Can be either a method name or a bean
* property name. If your <code>UserDetails</code> contains a
* <code>UserDetails.getSalt()</code> method, you should set this property to
* "getSalt" or "salt".
*
* @param userPropertyToUse the name of the <b>getter</b> to call to obtain the salt
* from the <code>UserDetails</code>
*/
public void setUserPropertyToUse(String userPropertyToUse) {
this.userPropertyToUse = userPropertyToUse;
}
public String toString() {
return "ReflectionSaltSource[ userPropertyToUse='" + userPropertyToUse + "'; ]";
}
}

38
core/src/main/java/org/springframework/security/authentication/dao/SaltSource.java
View File

@@ -1,38 +0,0 @@
/*
* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.authentication.dao;
import org.springframework.security.core.userdetails.UserDetails;
/**
* Provides alternative sources of the salt to use for encoding passwords.
*
* @author Ben Alex
*/
public interface SaltSource {
// ~ Methods
// ========================================================================================================
/**
* Returns the salt to use for the indicated user.
*
* @param user from the <code>AuthenticationDao</code>
*
* @return the salt to use for this <code>UserDetails</code>
*/
Object getSalt(UserDetails user);
}

70
core/src/main/java/org/springframework/security/authentication/dao/SystemWideSaltSource.java
View File

@@ -1,70 +0,0 @@
/*
* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.authentication.dao;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.beans.factory.InitializingBean;
/**
* Uses a static system-wide <code>String</code> as the salt.
* <P>
* Does not supply a different salt for each
* {@link org.springframework.security.core.userdetails.User}. This means users sharing
* the same password will still have the same digested password. Of benefit is the
* digested passwords will at least be more protected than if stored without any salt.
* </p>
*
* @author Ben Alex
*/
public class SystemWideSaltSource implements SaltSource, InitializingBean {
// ~ Instance fields
// ================================================================================================
private String systemWideSalt;
// ~ Methods
// ========================================================================================================
public void afterPropertiesSet() throws Exception {
if ((this.systemWideSalt == null) || "".equals(this.systemWideSalt)) {
throw new IllegalArgumentException("A systemWideSalt must be set");
}
}
public Object getSalt(UserDetails user) {
return this.systemWideSalt;
}
public String getSystemWideSalt() {
return this.systemWideSalt;
}
public void setSystemWideSalt(String systemWideSalt) {
this.systemWideSalt = systemWideSalt;
}
/**
* Displays the system wide salt
* @since 4.0
* @return
*/
@Override
public String toString() {
return systemWideSalt;
}
}

4
core/src/test/java/org/springframework/security/authentication/dao/DaoAuthenticationProviderTests.java
View File

@@ -394,10 +394,6 @@ public class DaoAuthenticationProviderTests {
assertThat(provider.getPasswordEncoder().getClass()).isEqualTo(
BCryptPasswordEncoder.class);
provider.setSaltSource(new SystemWideSaltSource());
assertThat(provider.getSaltSource().getClass()).isEqualTo(
SystemWideSaltSource.class);
provider.setUserCache(new EhCacheBasedUserCache());
assertThat(provider.getUserCache().getClass()).isEqualTo(
EhCacheBasedUserCache.class);

68
core/src/test/java/org/springframework/security/authentication/dao/salt/ReflectionSaltSourceTests.java
View File

@@ -1,68 +0,0 @@
/*
* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.authentication.dao.salt;
import static org.assertj.core.api.Assertions.*;
import org.junit.Test;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.dao.ReflectionSaltSource;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
/**
* Tests {@link ReflectionSaltSource}.
*
* @author Ben Alex
*/
public class ReflectionSaltSourceTests {
private UserDetails user = new User("scott", "wombat", true, true, true, true,
AuthorityUtils.createAuthorityList("HOLDER"));
// ~ Methods
// ========================================================================================================
@Test(expected = IllegalArgumentException.class)
public void detectsMissingUserPropertyToUse() throws Exception {
ReflectionSaltSource saltSource = new ReflectionSaltSource();
saltSource.afterPropertiesSet();
}
@Test(expected = AuthenticationServiceException.class)
public void exceptionIsThrownWhenInvalidPropertyRequested() throws Exception {
ReflectionSaltSource saltSource = new ReflectionSaltSource();
saltSource.setUserPropertyToUse("getDoesNotExist");
saltSource.afterPropertiesSet();
saltSource.getSalt(user);
}
@Test
public void methodNameAsPropertyToUseReturnsCorrectSaltValue() {
ReflectionSaltSource saltSource = new ReflectionSaltSource();
saltSource.setUserPropertyToUse("getUsername");
assertThat(saltSource.getSalt(user)).isEqualTo("scott");
}
@Test
public void propertyNameAsPropertyToUseReturnsCorrectSaltValue() {
ReflectionSaltSource saltSource = new ReflectionSaltSource();
saltSource.setUserPropertyToUse("password");
assertThat(saltSource.getSalt(user)).isEqualTo("wombat");
}
}

76
core/src/test/java/org/springframework/security/authentication/dao/salt/SystemWideSaltSourceTests.java
View File

@@ -1,76 +0,0 @@
/*
* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.authentication.dao.salt;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.fail;
import org.junit.Test;
import org.springframework.security.authentication.dao.SystemWideSaltSource;
/**
* Tests {@link SystemWideSaltSource}.
*
* @author Ben Alex
*/
public class SystemWideSaltSourceTests {
// ~ Constructors
// ===================================================================================================
public SystemWideSaltSourceTests() {
super();
}
// ~ Methods
// ========================================================================================================
@Test
public void testDetectsMissingSystemWideSalt() throws Exception {
SystemWideSaltSource saltSource = new SystemWideSaltSource();
try {
saltSource.afterPropertiesSet();
fail("Should have thrown IllegalArgumentException");
}
catch (IllegalArgumentException expected) {
assertThat(expected.getMessage()).isEqualTo("A systemWideSalt must be set");
}
}
@Test
public void testGettersSetters() {
SystemWideSaltSource saltSource = new SystemWideSaltSource();
saltSource.setSystemWideSalt("helloWorld");
assertThat(saltSource.getSystemWideSalt()).isEqualTo("helloWorld");
}
@Test
public void testNormalOperation() throws Exception {
SystemWideSaltSource saltSource = new SystemWideSaltSource();
saltSource.setSystemWideSalt("helloWorld");
saltSource.afterPropertiesSet();
assertThat(saltSource.getSalt(null)).isEqualTo("helloWorld");
}
// SEC-2173
@Test
public void testToString() {
String systemWideSalt = "helloWorld";
SystemWideSaltSource saltSource = new SystemWideSaltSource();
saltSource.setSystemWideSalt(systemWideSalt);
assertThat(saltSource.toString()).isEqualTo(systemWideSalt);
}
}