Spring/spring-webflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SWF-1182 Upgrade to Spring Security 3.0.2.RELEASE

Browse Source
This commit is contained in:
Rossen Stoyanchev
2010-04-21 13:09:07 +00:00
parent 18df5d1a5e
commit 120115ce54
13 changed files with 91 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
build-spring-webflow/resources/changelog.txt
View File

@@ -2,10 +2,19 @@ SPRING WEB FLOW CHANGELOG
=========================
http://www.springframework.org/webflow
Changes in version 2.1.0 ()
-------------------------------------
* Upgraded to Spring Framework 3.0.2.RELEASE, Portlet API 2.0.1, and Tiles 2.1.2 (SWF-1226)
* Upgraded to Spring Security 3.0.2.RELEASE (SWF-1182)
* Added support for cascaded attributes in AjaxTilesView (SWF-1053)
Changes in version 2.0.9 ()
-------------------------------------
* ViewState now ignores case where 'model' expression fails to evaluate (SWF-1176)
* Added calls to lock/unlock the coversation when a flow execution is launched (SWF-1213)
* Added serialization methods to FlowFacesMessageAdapter as workaround for issue in MyFaces (SWF-1187)
* Prevented the wrapping of a converter with ObjectToCollection in cases where the targetClass of the converter is already a collection (SWF-1229)
* Upgraded to Dojo 1.2.4 containing security fixes.
Changes in version 2.0.8 (2009.08.06)
-------------------------------------
@@ -683,4 +692,4 @@ Package org.springframework.webflow.samples
Package reference-manual
* Improved readability of reference manual in several sections (SWF-349).
* Added documentation on flow execution exception handling options (SWF-357).
* Added documentation on flow execution exception handling options (SWF-357).

4
spring-webflow-samples/booking-faces/ivy.xml
View File

@@ -42,7 +42,9 @@
<dependency org="org.springframework" name="org.springframework.transaction" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework" name="org.springframework.web" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework" name="org.springframework.web.servlet" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security" rev="2.0.4.A" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security.core" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security.config" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security.web" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.webflow" name="org.springframework.faces" rev="latest.integration" conf="compile->jsf12"/>
<dependency org="org.springframework.webflow" name="org.springframework.js" rev="latest.integration" conf="compile->runtime"/>
<dependency org="org.springframework.webflow" name="org.springframework.webflow" rev="latest.integration" conf="compile->runtime"/>

14
spring-webflow-samples/booking-faces/pom.xml
View File

@@ -104,8 +104,18 @@
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>org.springframework.security</artifactId>
<version>2.0.4.A</version>
<artifactId>org.springframework.security.core</artifactId>
<version>3.0.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>org.springframework.security.config</artifactId>
<version>3.0.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>org.springframework.security.web</artifactId>
<version>3.0.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.webflow</groupId>

27
spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml
View File

@@ -6,11 +6,12 @@
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-2.0.2.xsd">
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<!-- Configure Spring Security -->
<security:http auto-config="true">
<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" default-target-url="/spring/main" authentication-failure-url="/spring/login?login_error=1" />
<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess"
default-target-url="/spring/main" authentication-failure-url="/spring/login?login_error=1" />
<security:logout logout-url="/spring/logout" logout-success-url="/spring/logoutSuccess" />
</security:http>
@@ -23,14 +24,16 @@
jeremy/atlanta
scott/rochester
-->
<security:authentication-provider>
<security:password-encoder hash="md5" />
<security:user-service>
<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>
<security:authentication-manager>
<security:authentication-provider>
<security:password-encoder hash="md5" />
<security:user-service>
<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
</beans>

5
spring-webflow-samples/booking-mvc/ivy.xml
View File

@@ -47,8 +47,9 @@
<dependency org="org.springframework" name="org.springframework.transaction" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework" name="org.springframework.web" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework" name="org.springframework.web.servlet" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security" rev="2.0.4.A" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security.taglibs" rev="2.0.4.A" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security.core" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security.config" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security.taglibs" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.webflow" name="org.springframework.js" rev="latest.integration" conf="compile->runtime"/>
<dependency org="org.springframework.webflow" name="org.springframework.webflow" rev="latest.integration" conf="compile->runtime"/>

11
spring-webflow-samples/booking-mvc/pom.xml
View File

@@ -129,13 +129,18 @@
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>org.springframework.security</artifactId>
<version>2.0.4.A</version>
<artifactId>org.springframework.security.core</artifactId>
<version>3.0.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>org.springframework.security.config</artifactId>
<version>3.0.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>org.springframework.security.taglibs</artifactId>
<version>2.0.4.A</version>
<version>3.0.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.webflow</groupId>

25
spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml
View File

@@ -6,11 +6,12 @@
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-2.0.xsd">
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<!-- Configure Spring Security -->
<security:http auto-config="true">
<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" default-target-url="/spring/hotels/index" authentication-failure-url="/spring/login?login_error=1" />
<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess"
default-target-url="/spring/hotels/index" authentication-failure-url="/spring/login?login_error=1" />
<security:logout logout-url="/spring/logout" logout-success-url="/spring/logoutSuccess" />
</security:http>
@@ -23,14 +24,16 @@
jeremy/atlanta
scott/rochester
-->
<security:authentication-provider>
<security:password-encoder hash="md5" />
<security:user-service>
<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>
<security:authentication-manager>
<security:authentication-provider>
<security:password-encoder hash="md5" />
<security:user-service>
<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
</beans>

2
spring-webflow/.classpath
View File

@@ -45,6 +45,6 @@
<classpathentry kind="var" path="IVY_CACHE/org.springframework/org.springframework.web/3.0.2.RELEASE/org.springframework.web-3.0.2.RELEASE.jar" sourcepath="/IVY_CACHE/org.springframework/org.springframework.web/3.0.2.RELEASE/org.springframework.web-sources-3.0.2.RELEASE.jar"/>
<classpathentry kind="var" path="IVY_CACHE/org.springframework/org.springframework.web.servlet/3.0.2.RELEASE/org.springframework.web.servlet-3.0.2.RELEASE.jar" sourcepath="/IVY_CACHE/org.springframework/org.springframework.web.servlet/3.0.2.RELEASE/org.springframework.web.servlet-sources-3.0.2.RELEASE.jar"/>
<classpathentry kind="var" path="IVY_CACHE/org.springframework/org.springframework.web.portlet/3.0.2.RELEASE/org.springframework.web.portlet-3.0.2.RELEASE.jar" sourcepath="/IVY_CACHE/org.springframework/org.springframework.web.portlet/3.0.2.RELEASE/org.springframework.web.portlet-sources-3.0.2.RELEASE.jar"/>
<classpathentry kind="var" path="IVY_CACHE/org.springframework.security/org.springframework.security/2.0.4.A/org.springframework.security-2.0.4.A.jar" sourcepath="/IVY_CACHE/org.springframework.security/org.springframework.security/2.0.4.A/org.springframework.security-sources-2.0.4.A.jar"/>
<classpathentry kind="var" path="IVY_CACHE/org.springframework.security/org.springframework.security.core/3.0.2.RELEASE/org.springframework.security.core-3.0.2.RELEASE.jar" sourcepath="/IVY_CACHE/org.springframework.security/org.springframework.security.core/3.0.2.RELEASE/org.springframework.security.core-sources-3.0.2.RELEASE.jar"/>
<classpathentry kind="output" path="target/classes"/>
</classpath>

2
spring-webflow/ivy.xml
View File

@@ -38,7 +38,7 @@
<dependency org="org.springframework" name="org.springframework.web" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework" name="org.springframework.web.portlet" rev="3.0.2.RELEASE" conf="optional->runtime" />
<dependency org="org.springframework" name="org.springframework.web.servlet" rev="3.0.2.RELEASE" conf="compile->runtime"/>
<dependency org="org.springframework.security" name="org.springframework.security" rev="2.0.4.A" conf="optional->runtime" />
<dependency org="org.springframework.security" name="org.springframework.security.core" rev="3.0.2.RELEASE" conf="optional->runtime" />
<dependency org="org.springframework.webflow" name="org.springframework.binding" rev="latest.integration" conf="compile->runtime"/>
<dependency org="org.springframework.webflow" name="org.springframework.js" rev="latest.integration" conf="compile->runtime"/>

2
spring-webflow/pom.xml
View File

@@ -116,7 +116,7 @@
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>2.0.4</version>
<version>3.0.2.RELEASE</version>
<optional>true</optional>
</dependency>
<dependency>

26
spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java
View File

@@ -16,18 +16,18 @@
package org.springframework.webflow.security;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Iterator;
import java.util.List;
import org.springframework.security.AccessDecisionManager;
import org.springframework.security.Authentication;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.SecurityConfig;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.vote.AbstractAccessDecisionManager;
import org.springframework.security.vote.AffirmativeBased;
import org.springframework.security.vote.RoleVoter;
import org.springframework.security.vote.UnanimousBased;
import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.access.vote.AbstractAccessDecisionManager;
import org.springframework.security.access.vote.AffirmativeBased;
import org.springframework.security.access.vote.RoleVoter;
import org.springframework.security.access.vote.UnanimousBased;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.webflow.definition.FlowDefinition;
import org.springframework.webflow.definition.StateDefinition;
import org.springframework.webflow.definition.TransitionDefinition;
@@ -90,9 +90,9 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
*/
protected void decide(SecurityRule rule, Object object) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
ConfigAttributeDefinition config = new ConfigAttributeDefinition(getConfigAttributes(rule));
Collection configAttributes = getConfigAttributes(rule);
if (accessDecisionManager != null) {
accessDecisionManager.decide(authentication, object, config);
accessDecisionManager.decide(authentication, object, configAttributes);
} else {
AbstractAccessDecisionManager abstractAccessDecisionManager;
List voters = new ArrayList();
@@ -105,7 +105,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
throw new IllegalStateException("Unknown SecurityRule match type: " + rule.getComparisonType());
}
abstractAccessDecisionManager.setDecisionVoters(voters);
abstractAccessDecisionManager.decide(authentication, object, config);
abstractAccessDecisionManager.decide(authentication, object, configAttributes);
}
}
@@ -114,7 +114,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
* @param rule the rule to convert
* @return list of ConfigAttributes for Spring Security
*/
protected List getConfigAttributes(SecurityRule rule) {
protected Collection getConfigAttributes(SecurityRule rule) {
List configAttributes = new ArrayList();
Iterator attributeIt = rule.getAttributes().iterator();
while (attributeIt.hasNext()) {

16
spring-webflow/src/test/java/org/springframework/webflow/security/SecurityFlowExecutionListenerTests.java
View File

@@ -5,14 +5,14 @@ import java.util.HashSet;
import junit.framework.TestCase;
import org.springframework.security.AccessDeniedException;
import org.springframework.security.Authentication;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.context.SecurityContextImpl;
import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.context.SecurityContextImpl;
import org.springframework.webflow.core.collection.LocalAttributeMap;
import org.springframework.webflow.definition.FlowDefinition;
import org.springframework.webflow.engine.Flow;

2
spring-webflow/template.mf
View File

@@ -9,7 +9,7 @@ Import-Template:
org.springframework.orm.*;version="[3.0.2.RELEASE, 3.1.0)";resolution:=optional,
org.springframework.transaction.*;version="[3.0.2.RELEASE, 3.1.0)";resolution:=optional,
org.springframework.web.portlet.*;version="[3.0.2.RELEASE, 3.1.0)";resolution:=optional,
org.springframework.security.*;version="[2.0.0, 3.0.0)";resolution:=optional,
org.springframework.security.*;version="[3.0.0, 4.0.0)";resolution:=optional,
org.apache.commons.logging;version="[1.1.1, 2.0.0)",
javax.servlet;version="[2.4.0, 3.0.0)",
javax.servlet.http;version="[2.4.0, 3.0.0)",