Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add AuthorizationResult support for AuthorizationManager

Browse Source 
Closes gh-14843
This commit is contained in:
Max Batischev
2024-10-11 15:43:19 +03:00
committed by Josh Cummings
parent 702538ebce
commit e7644925f8
25 changed files with 134 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
core/src/main/java/org/springframework/security/authorization/AuthorizationManager.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2020 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -50,8 +50,23 @@ public interface AuthorizationManager<T> {
* @param authentication the {@link Supplier} of the {@link Authentication} to check
* @param object the {@link T} object to check
* @return an {@link AuthorizationDecision} or null if no decision could be made
* @deprecated please use {@link #authorize(Supplier, Object)} instead
*/
@Nullable
@Deprecated
AuthorizationDecision check(Supplier<Authentication> authentication, T object);
/**
* Determines if access is granted for a specific authentication and object.
* @param authentication the {@link Supplier} of the {@link Authentication} to
* authorize
* @param object the {@link T} object to authorize
* @return an {@link AuthorizationResult}
* @since 6.4
*/
@Nullable
default AuthorizationResult authorize(Supplier<Authentication> authentication, T object) {
return check(authentication, object);
}
}

32
core/src/main/java/org/springframework/security/authorization/AuthorizationObservationContext.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -35,6 +35,8 @@ public class AuthorizationObservationContext<T> extends Observation.Context {
private AuthorizationDecision decision;
private AuthorizationResult authorizationResult;
public AuthorizationObservationContext(T object) {
Assert.notNull(object, "object cannot be null");
this.object = object;
@@ -71,17 +73,43 @@ public class AuthorizationObservationContext<T> extends Observation.Context {
/**
* Get the observed {@link AuthorizationDecision}
* @return the observed {@link AuthorizationDecision}
* @deprecated please use {@link #getAuthorizationResult()} instead
*/
@Deprecated
public AuthorizationDecision getDecision() {
return this.decision;
Assert.isInstanceOf(AuthorizationDecision.class, this.authorizationResult,
"Please call getAuthorizationResult instead. If you must call getDecision, please ensure that the result you provide is of type AuthorizationDecision");
return (AuthorizationDecision) this.authorizationResult;
}
/**
* Set the observed {@link AuthorizationDecision}
* @param decision the observed {@link AuthorizationDecision}
* @deprecated please use {@link #setAuthorizationResult(AuthorizationResult)} instead
*/
@Deprecated
public void setDecision(AuthorizationDecision decision) {
Assert.isInstanceOf(AuthorizationDecision.class, decision,
"Please call setAuthorizationResult instead. If you must call getDecision, please ensure that the result you provide is of type AuthorizationDecision");
this.decision = decision;
}
/**
* Get the observed {@link AuthorizationResult}
* @return the observed {@link AuthorizationResult}
* @since 6.4
*/
public AuthorizationResult getAuthorizationResult() {
return this.authorizationResult;
}
/**
* Set the observed {@link AuthorizationResult}
* @param authorizationResult the observed {@link AuthorizationResult}
* @since 6.4
*/
public void setAuthorizationResult(AuthorizationResult authorizationResult) {
this.authorizationResult = authorizationResult;
}
}

10
core/src/main/java/org/springframework/security/authorization/AuthorizationObservationConvention.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -100,10 +100,10 @@ public final class AuthorizationObservationConvention
}
private String getAuthorizationDecision(AuthorizationObservationContext<?> context) {
if (context.getDecision() == null) {
if (context.getAuthorizationResult() == null) {
return "unknown";
}
return String.valueOf(context.getDecision().isGranted());
return String.valueOf(context.getAuthorizationResult().isGranted());
}
private String getAuthorities(AuthorizationObservationContext<?> context) {
@@ -114,10 +114,10 @@ public final class AuthorizationObservationConvention
}
private String getDecisionDetails(AuthorizationObservationContext<?> context) {
if (context.getDecision() == null) {
if (context.getAuthorizationResult() == null) {
return "unknown";
}
AuthorizationDecision decision = context.getDecision();
AuthorizationResult decision = context.getAuthorizationResult();
return String.valueOf(decision);
}

4
core/src/main/java/org/springframework/security/authorization/ObservationAuthorizationManager.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2023 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -71,7 +71,7 @@ public final class ObservationAuthorizationManager<T>
Observation observation = Observation.createNotStarted(this.convention, () -> context, this.registry).start();
try (Observation.Scope scope = observation.openScope()) {
AuthorizationDecision decision = this.delegate.check(wrapped, object);
context.setDecision(decision);
context.setAuthorizationResult(decision);
if (decision != null && !decision.isGranted()) {
observation.error(new AccessDeniedException(
this.messages.getMessage("AbstractAccessDecisionManager.accessDenied", "Access Denied")));

4
core/src/main/java/org/springframework/security/authorization/ObservationReactiveAuthorizationManager.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2023 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -68,7 +68,7 @@ public final class ObservationReactiveAuthorizationManager<T>
.parentObservation(contextView.getOrDefault(ObservationThreadLocalAccessor.KEY, null))
.start();
return this.delegate.check(wrapped, object).doOnSuccess((decision) -> {
context.setDecision(decision);
context.setAuthorizationResult(decision);
if (decision == null || !decision.isGranted()) {
observation.error(new AccessDeniedException("Access Denied"));
}

15
core/src/main/java/org/springframework/security/authorization/ReactiveAuthorizationManager.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2017 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -36,7 +36,9 @@ public interface ReactiveAuthorizationManager<T> {
* @param authentication the Authentication to check
* @param object the object to check
* @return an decision or empty Mono if no decision could be made.
* @deprecated please use {@link #authorize(Mono, Object)} instead
*/
@Deprecated
Mono<AuthorizationDecision> check(Mono<Authentication> authentication, T object);
/**
@@ -55,4 +57,15 @@ public interface ReactiveAuthorizationManager<T> {
// @formatter:on
}
/**
* Determines if access is granted for a specific authentication and object.
* @param authentication the Authentication to authorize
* @param object the object to check
* @return an decision or empty Mono if no decision could be made.
* @since 6.4
*/
default Mono<AuthorizationResult> authorize(Mono<Authentication> authentication, T object) {
return check(authentication, object).cast(AuthorizationResult.class);
}
}

6
core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerAfterMethodInterceptor.java
View File

@@ -29,10 +29,10 @@ import org.springframework.core.log.LogMessage;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.authorization.AuthorizationDeniedException;
import org.springframework.security.authorization.AuthorizationEventPublisher;
import org.springframework.security.authorization.AuthorizationManager;
import org.springframework.security.authorization.AuthorizationResult;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.context.SecurityContextHolderStrategy;
@@ -182,7 +182,7 @@ public final class AuthorizationManagerAfterMethodInterceptor implements Authori
private Object attemptAuthorization(MethodInvocation mi, Object result) {
this.logger.debug(LogMessage.of(() -> "Authorizing method invocation " + mi));
MethodInvocationResult object = new MethodInvocationResult(mi, result);
AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, object);
AuthorizationResult decision = this.authorizationManager.authorize(this::getAuthentication, object);
this.eventPublisher.publishAuthorizationEvent(this::getAuthentication, object, decision);
if (decision != null && !decision.isGranted()) {
this.logger.debug(LogMessage.of(() -> "Failed to authorize " + mi + " with authorization manager "
@@ -193,7 +193,7 @@ public final class AuthorizationManagerAfterMethodInterceptor implements Authori
return result;
}
private Object handlePostInvocationDenied(MethodInvocationResult mi, AuthorizationDecision decision) {
private Object handlePostInvocationDenied(MethodInvocationResult mi, AuthorizationResult decision) {
if (this.authorizationManager instanceof MethodAuthorizationDeniedHandler deniedHandler) {
return deniedHandler.handleDeniedInvocationResult(mi, decision);
}

2
core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerAfterReactiveMethodInterceptor.java
View File

@@ -164,7 +164,7 @@ public final class AuthorizationManagerAfterReactiveMethodInterceptor implements
private Mono<Object> postAuthorize(Mono<Authentication> authentication, MethodInvocation mi, Object result) {
MethodInvocationResult invocationResult = new MethodInvocationResult(mi, result);
return this.authorizationManager.check(authentication, invocationResult)
return this.authorizationManager.authorize(authentication, invocationResult)
.switchIfEmpty(Mono.just(new AuthorizationDecision(false)))
.flatMap((decision) -> postProcess(decision, invocationResult));
}

5
core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerBeforeMethodInterceptor.java
View File

@@ -33,7 +33,6 @@ import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.authorization.AuthorizationDeniedException;
import org.springframework.security.authorization.AuthorizationEventPublisher;
import org.springframework.security.authorization.AuthorizationManager;
@@ -247,9 +246,9 @@ public final class AuthorizationManagerBeforeMethodInterceptor implements Author
private Object attemptAuthorization(MethodInvocation mi) throws Throwable {
this.logger.debug(LogMessage.of(() -> "Authorizing method invocation " + mi));
AuthorizationDecision decision;
AuthorizationResult decision;
try {
decision = this.authorizationManager.check(this::getAuthentication, mi);
decision = this.authorizationManager.authorize(this::getAuthentication, mi);
}
catch (AuthorizationDeniedException denied) {
return handle(mi, denied);

4
core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerBeforeReactiveMethodInterceptor.java
View File

@@ -140,7 +140,7 @@ public final class AuthorizationManagerBeforeReactiveMethodInterceptor implement
private Flux<Object> preAuthorized(MethodInvocation mi, Flux<Object> mapping) {
Mono<Authentication> authentication = ReactiveAuthenticationUtils.getAuthentication();
return this.authorizationManager.check(authentication, mi)
return this.authorizationManager.authorize(authentication, mi)
.switchIfEmpty(Mono.just(new AuthorizationDecision(false)))
.flatMapMany((decision) -> {
if (decision.isGranted()) {
@@ -153,7 +153,7 @@ public final class AuthorizationManagerBeforeReactiveMethodInterceptor implement
private Mono<Object> preAuthorized(MethodInvocation mi, Mono<Object> mapping) {
Mono<Authentication> authentication = ReactiveAuthenticationUtils.getAuthentication();
return this.authorizationManager.check(authentication, mi)
return this.authorizationManager.authorize(authentication, mi)
.switchIfEmpty(Mono.just(new AuthorizationDecision(false)))
.flatMap((decision) -> {
if (decision.isGranted()) {

1
core/src/main/java/org/springframework/security/authorization/method/NoOpAuthorizationEventPublisher.java
View File

@@ -39,6 +39,7 @@ final class NoOpAuthorizationEventPublisher implements AuthorizationEventPublish
@Override
public <T> void publishAuthorizationEvent(Supplier<Authentication> authentication, T object,
AuthorizationResult result) {
}
}