Spring/spring-webflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

changed name of secured authorities to attributes

Browse Source
This commit is contained in:
Scott Andrews
2008-03-07 17:08:01 +00:00
parent 63e7ea2197
commit b6fba51f02
12 changed files with 105 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/flows/booking/booking.xml
View File

@@ -3,7 +3,7 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
<secured authorities="ROLE_USER" />
<secured attributes="ROLE_USER" />
<persistence-context/>

2
spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/flows/booking/booking.xml
View File

@@ -4,7 +4,7 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow
http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
<secured authorities="ROLE_USER" />
<secured attributes="ROLE_USER" />
<persistence-context/>

8
spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilder.java
View File

@@ -914,11 +914,11 @@ public class XmlFlowBuilder extends AbstractFlowBuilder implements ResourceHolde
}
private void parseAndSetSecuredAttribute(Element element, MutableAttributeMap attributes) {
Element secured = DomUtils.getChildElementByTagName(element, SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
Element secured = DomUtils.getChildElementByTagName(element, "secured");
if (secured != null) {
SecurityRule rule = new SecurityRule();
rule.setRequiredAuthorities(SecurityRule.convertAuthoritiesFromCommaSeparatedString(secured
.getAttribute("authorities")));
rule.setAttributes(SecurityRule.convertAttributesFromCommaSeparatedString(secured
.getAttribute("attributes")));
String comparisonType = secured.getAttribute("match");
if ("any".equals(comparisonType)) {
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
@@ -928,7 +928,7 @@ public class XmlFlowBuilder extends AbstractFlowBuilder implements ResourceHolde
// default to any
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
}
attributes.put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
attributes.put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
}
}

25
spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/spring-webflow-2.0.xsd
View File

@@ -1322,16 +1322,29 @@ For example:
<xsd:documentation>
<![CDATA[
Secures this flow definition element.
The user invoking this element must meet the required authorities otherwise access to the element will be denied.
The user invoking this element must meet the required attributes otherwise access to the element will be denied.
<br>
WARNING: This element will only configure a security attribute in the definition. The flow execution must also be secured with a SecurityFlowExecutionListener.
<br>
For example:
<pre>
&lt;web:flow-executor id="flowExecutor" flow-registry="flowRegistry"&gt;
&lt;web:flow-execution-listeners&gt;
&lt;web:listener ref="securityFlowExecutionListener" /&gt;
&lt;/web:flow-execution-listeners&gt;
&lt;/web:flow-executor&gt;
&lt;bean id="securityFlowExecutionListener" class="org.springframework.webflow.security.SecurityFlowExecutionListener" /&gt;
</pre>
]]>
</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:attribute name="authorities" type="xsd:string" use="required">
<xsd:attribute name="attributes" type="xsd:string" use="required">
<xsd:annotation>
<xsd:documentation>
<![CDATA[
The comma separated list of security authorities.
The comma separated list of security attributes.
]]>
</xsd:documentation>
</xsd:annotation>
@@ -1340,7 +1353,7 @@ The comma separated list of security authorities.
<xsd:annotation>
<xsd:documentation>
<![CDATA[
The method for matching the authorities. Accepted values are 'any' and 'all'. Default is 'any'.
The method for matching the attributes. Accepted values are 'any' and 'all'. Default is 'any'.
]]>
</xsd:documentation>
</xsd:annotation>
@@ -1350,7 +1363,7 @@ The method for matching the authorities. Accepted values are 'any' and 'all'.
<xsd:annotation>
<xsd:documentation>
<![CDATA[
Matching any of the authorities grants access.
Matching any of the attributes grants access.
]]>
</xsd:documentation>
</xsd:annotation>
@@ -1359,7 +1372,7 @@ Matching any of the authorities grants access.
<xsd:annotation>
<xsd:documentation>
<![CDATA[
Matching all of the authorities grants access.
Matching all of the attributes grants access.
]]>
</xsd:documentation>
</xsd:annotation>

14
spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java
View File

@@ -33,8 +33,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
* Check security authorization when flow session starts
*/
public void sessionCreating(RequestContext context, FlowDefinition definition) {
SecurityRule rule = (SecurityRule) definition.getAttributes().get(
SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
SecurityRule rule = (SecurityRule) definition.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
if (rule != null) {
decide(rule, definition);
}
@@ -44,7 +43,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
* Check security authorization when entering state
*/
public void stateEntering(RequestContext context, StateDefinition state) throws EnterStateVetoException {
SecurityRule rule = (SecurityRule) state.getAttributes().get(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
SecurityRule rule = (SecurityRule) state.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
if (rule != null) {
decide(rule, state);
}
@@ -54,8 +53,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
* Check security authorization on transition
*/
public void transitionExecuting(RequestContext context, TransitionDefinition transition) {
SecurityRule rule = (SecurityRule) transition.getAttributes().get(
SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
SecurityRule rule = (SecurityRule) transition.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
if (rule != null) {
decide(rule, transition);
}
@@ -95,9 +93,9 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
*/
protected List getConfigAttributes(SecurityRule rule) {
List configAttributes = new ArrayList();
Iterator requiredAuthorityIt = rule.getRequiredAuthorities().iterator();
while (requiredAuthorityIt.hasNext()) {
configAttributes.add(new SecurityConfig((String) requiredAuthorityIt.next()));
Iterator attributeIt = rule.getAttributes().iterator();
while (attributeIt.hasNext()) {
configAttributes.add(new SecurityConfig((String) attributeIt.next()));
}
return configAttributes;
}

66
spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
View File

@@ -6,7 +6,7 @@ import java.util.HashSet;
import java.util.Iterator;
/**
* Encapsulates the rules for comparing security authorities
* Encapsulates the rules for comparing security attributes
*
* @author Scott Andrews
*/
@@ -15,69 +15,69 @@ public class SecurityRule {
/**
* Attribute name for the location of the security rule
*/
public static final String SECURITY_AUTHORITY_ATTRIBUTE_NAME = "secured";
public static final String SECURITY_ATTRIBUTE_NAME = "secured";
/**
* Compare method where any of the required authorities can match the principal's authorities
* Compare method where any attribute authorization allows access
*/
public static final short COMPARISON_ANY = 1;
/**
* Compare method where all of the required authorities must match the principal's authorities
* Compare method where all attribute authorization allows access
*/
public static final short COMPARISON_ALL = 2;
private Collection requiredAuthorities;
private Collection attributes;
private short comparisonType = COMPARISON_ANY;
/**
* Convert authorities to comma separated String
* @param authorities the authorities to convert
* Convert attributes to comma separated String
* @param attributes the attributes to convert
* @return comma separated String
*/
public static String convertAuthoritiesToCommaSeparatedString(Collection authorities) {
StringBuffer str = new StringBuffer();
Iterator authorityIt = authorities.iterator();
while (authorityIt.hasNext()) {
if (str.length() != 0) {
str.append(", ");
public static String convertAttributesToCommaSeparatedString(Collection attributes) {
StringBuffer attrs = new StringBuffer();
Iterator attributeIt = attributes.iterator();
while (attributeIt.hasNext()) {
if (attrs.length() != 0) {
attrs.append(", ");
}
str.append(authorityIt.next());
attrs.append(attributeIt.next());
}
return str.toString();
return attrs.toString();
}
/**
* Convert authorities from comma separated String to Collection
* @param authorities the authorities to convert
* Convert attributes from comma separated String to Collection
* @param attributes the attributes to convert
* @return comma parsed Collection
*/
public static Collection convertAuthoritiesFromCommaSeparatedString(String authorities) {
Collection auths = new HashSet();
Iterator authorityIt = Arrays.asList(authorities.split(",")).iterator();
while (authorityIt.hasNext()) {
String authority = ((String) authorityIt.next()).trim();
if (!"".equals(authority)) {
auths.add(authority);
public static Collection convertAttributesFromCommaSeparatedString(String attributes) {
Collection attrs = new HashSet();
Iterator attributeIt = Arrays.asList(attributes.split(",")).iterator();
while (attributeIt.hasNext()) {
String attribute = ((String) attributeIt.next()).trim();
if (!"".equals(attribute)) {
attrs.add(attribute);
}
}
return auths;
return attrs;
}
/**
* Gets required authorities
* @return required authorities
* Gets security attributes
* @return security attributes
*/
public Collection getRequiredAuthorities() {
return requiredAuthorities;
public Collection getAttributes() {
return attributes;
}
/**
* Sets required authorities
* @param requiredAuthorities required authorities
* Sets security attributes
* @param attributes security attributes
*/
public void setRequiredAuthorities(Collection requiredAuthorities) {
this.requiredAuthorities = requiredAuthorities;
public void setAttributes(Collection attributes) {
this.attributes = attributes;
}
/**

18
spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilderTests.java
View File

@@ -150,11 +150,11 @@ public class XmlFlowBuilderTests extends TestCase {
builder = new XmlFlowBuilder(resource);
FlowAssembler assembler = new FlowAssembler(builder, new MockFlowBuilderContext("flow"));
Flow flow = assembler.assembleFlow();
SecurityRule rule = (SecurityRule) flow.getAttributes().get(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
SecurityRule rule = (SecurityRule) flow.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
assertNotNull(rule);
assertEquals(SecurityRule.COMPARISON_ANY, rule.getComparisonType());
assertEquals(1, rule.getRequiredAuthorities().size());
assertTrue(rule.getRequiredAuthorities().contains("ROLE_USER"));
assertEquals(1, rule.getAttributes().size());
assertTrue(rule.getAttributes().contains("ROLE_USER"));
}
public void testFlowSecuredState() {
@@ -163,11 +163,11 @@ public class XmlFlowBuilderTests extends TestCase {
FlowAssembler assembler = new FlowAssembler(builder, new MockFlowBuilderContext("flow"));
Flow flow = assembler.assembleFlow();
SecurityRule rule = (SecurityRule) flow.getState("end").getAttributes().get(
SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
SecurityRule.SECURITY_ATTRIBUTE_NAME);
assertNotNull(rule);
assertEquals(SecurityRule.COMPARISON_ANY, rule.getComparisonType());
assertEquals(1, rule.getRequiredAuthorities().size());
assertTrue(rule.getRequiredAuthorities().contains("ROLE_USER"));
assertEquals(1, rule.getAttributes().size());
assertTrue(rule.getAttributes().contains("ROLE_USER"));
}
public void testFlowSecuredTransition() {
@@ -176,11 +176,11 @@ public class XmlFlowBuilderTests extends TestCase {
FlowAssembler assembler = new FlowAssembler(builder, new MockFlowBuilderContext("flow"));
Flow flow = assembler.assembleFlow();
SecurityRule rule = (SecurityRule) flow.getGlobalTransitionSet().toArray()[0].getAttributes().get(
SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
SecurityRule.SECURITY_ATTRIBUTE_NAME);
assertNotNull(rule);
assertEquals(SecurityRule.COMPARISON_ANY, rule.getComparisonType());
assertEquals(1, rule.getRequiredAuthorities().size());
assertTrue(rule.getRequiredAuthorities().contains("ROLE_USER"));
assertEquals(1, rule.getAttributes().size());
assertTrue(rule.getAttributes().contains("ROLE_USER"));
}
public void testFlowVariable() {

2
spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-state.xml
View File

@@ -3,7 +3,7 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
<end-state id="end">
<secured authorities="ROLE_USER"/>
<secured attributes="ROLE_USER"/>
</end-state>
</flow>

2
spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-transition.xml
View File

@@ -6,7 +6,7 @@
<global-transitions>
<transition to="end">
<secured authorities="ROLE_USER"/>
<secured attributes="ROLE_USER"/>
</transition>
</global-transitions>

2
spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured.xml
View File

@@ -2,7 +2,7 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
<secured authorities="ROLE_USER"/>
<secured attributes="ROLE_USER"/>
<end-state id="end"/>

38
spring-webflow/src/test/java/org/springframework/webflow/security/SecurityFlowExecutionListenerTests.java
View File

@@ -37,7 +37,7 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
RequestContext context = new MockRequestContext();
Flow flow = new Flow("flow");
SecurityRule rule = getSecurityRuleAnyAuthorized();
((LocalAttributeMap) flow.getAttributes()).put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
((LocalAttributeMap) flow.getAttributes()).put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
configureSecurityContext();
listener.sessionCreating(context, flow);
}
@@ -56,7 +56,7 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
Flow flow = new Flow("flow");
ViewState state = new ViewState(flow, "view", new StubViewFactory());
SecurityRule rule = getSecurityRuleAllAuthorized();
((LocalAttributeMap) state.getAttributes()).put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
((LocalAttributeMap) state.getAttributes()).put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
configureSecurityContext();
listener.stateEntering(context, state);
}
@@ -73,7 +73,7 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
RequestContext context = new MockRequestContext();
Transition transition = new Transition(new DefaultTargetStateResolver("target"));
SecurityRule rule = getSecurityRuleAnyAuthorized();
((LocalAttributeMap) transition.getAttributes()).put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
((LocalAttributeMap) transition.getAttributes()).put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
configureSecurityContext();
listener.transitionExecuting(context, transition);
}
@@ -117,40 +117,40 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
private SecurityRule getSecurityRuleAnyAuthorized() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
Collection authorities = new HashSet();
authorities.add("ROLE_1");
authorities.add("ROLE_A");
rule.setRequiredAuthorities(authorities);
Collection attributes = new HashSet();
attributes.add("ROLE_1");
attributes.add("ROLE_A");
rule.setAttributes(attributes);
return rule;
}
private SecurityRule getSecurityRuleAnyDenied() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
Collection authorities = new HashSet();
authorities.add("ROLE_A");
authorities.add("ROLE_B");
rule.setRequiredAuthorities(authorities);
Collection attributes = new HashSet();
attributes.add("ROLE_A");
attributes.add("ROLE_B");
rule.setAttributes(attributes);
return rule;
}
private SecurityRule getSecurityRuleAllAuthorized() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ALL);
Collection authorities = new HashSet();
authorities.add("ROLE_1");
authorities.add("ROLE_3");
rule.setRequiredAuthorities(authorities);
Collection attributes = new HashSet();
attributes.add("ROLE_1");
attributes.add("ROLE_3");
rule.setAttributes(attributes);
return rule;
}
private SecurityRule getSecurityRuleAllDenied() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ALL);
Collection authorities = new HashSet();
authorities.add("ROLE_1");
authorities.add("ROLE_A");
rule.setRequiredAuthorities(authorities);
Collection attributes = new HashSet();
attributes.add("ROLE_1");
attributes.add("ROLE_A");
rule.setAttributes(attributes);
return rule;
}

22
spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
View File

@@ -8,20 +8,18 @@ import junit.framework.TestCase;
public class SecurityRuleTests extends TestCase {
public void testConvertAuthoritiesToCommaSeparatedString() {
Collection authorities = new ArrayList();
authorities.add("ROLE_USER");
authorities.add("ROLE_ANONYMOUS");
Assert.assertEquals("ROLE_USER, ROLE_ANONYMOUS", SecurityRule
.convertAuthoritiesToCommaSeparatedString(authorities));
public void testConvertAttributesToCommaSeparatedString() {
Collection attributes = new ArrayList();
attributes.add("ROLE_1");
attributes.add("ROLE_2");
Assert.assertEquals("ROLE_1, ROLE_2", SecurityRule.convertAttributesToCommaSeparatedString(attributes));
}
public void testConvertAuthoritiesFromCommaSeparatedString() {
Collection authorities = SecurityRule
.convertAuthoritiesFromCommaSeparatedString(" ,,ROLE_USER, ROLE_ANONYMOUS");
Assert.assertEquals(2, authorities.size());
Assert.assertTrue(authorities.contains("ROLE_USER"));
Assert.assertTrue(authorities.contains("ROLE_ANONYMOUS"));
public void testConvertAttributesFromCommaSeparatedString() {
Collection attributes = SecurityRule.convertAttributesFromCommaSeparatedString(" ,,ROLE_1, ROLE_2");
Assert.assertEquals(2, attributes.size());
Assert.assertTrue(attributes.contains("ROLE_1"));
Assert.assertTrue(attributes.contains("ROLE_2"));
}
public void testDefaultComparisonType() {