diff --git a/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/flows/booking/booking.xml b/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/flows/booking/booking.xml
index c9f1866d..5c3e776b 100755
--- a/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/flows/booking/booking.xml
+++ b/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/flows/booking/booking.xml
@@ -3,7 +3,7 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
-
+
diff --git a/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/flows/booking/booking.xml b/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/flows/booking/booking.xml
index f6827809..c86703de 100755
--- a/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/flows/booking/booking.xml
+++ b/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/flows/booking/booking.xml
@@ -4,7 +4,7 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow
http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
-
+
diff --git a/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilder.java b/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilder.java
index e957a3d1..dfd78391 100644
--- a/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilder.java
+++ b/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilder.java
@@ -914,11 +914,11 @@ public class XmlFlowBuilder extends AbstractFlowBuilder implements ResourceHolde
}
private void parseAndSetSecuredAttribute(Element element, MutableAttributeMap attributes) {
- Element secured = DomUtils.getChildElementByTagName(element, SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
+ Element secured = DomUtils.getChildElementByTagName(element, "secured");
if (secured != null) {
SecurityRule rule = new SecurityRule();
- rule.setRequiredAuthorities(SecurityRule.convertAuthoritiesFromCommaSeparatedString(secured
- .getAttribute("authorities")));
+ rule.setAttributes(SecurityRule.convertAttributesFromCommaSeparatedString(secured
+ .getAttribute("attributes")));
String comparisonType = secured.getAttribute("match");
if ("any".equals(comparisonType)) {
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
@@ -928,7 +928,7 @@ public class XmlFlowBuilder extends AbstractFlowBuilder implements ResourceHolde
// default to any
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
}
- attributes.put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
+ attributes.put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
}
}
diff --git a/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/spring-webflow-2.0.xsd b/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/spring-webflow-2.0.xsd
index 13c8bc07..feac50ec 100644
--- a/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/spring-webflow-2.0.xsd
+++ b/spring-webflow/src/main/java/org/springframework/webflow/engine/builder/xml/spring-webflow-2.0.xsd
@@ -1322,16 +1322,29 @@ For example:
+WARNING: This element will only configure a security attribute in the definition. The flow execution must also be secured with a SecurityFlowExecutionListener.
+
+For example:
+
+ <web:flow-executor id="flowExecutor" flow-registry="flowRegistry">
+ <web:flow-execution-listeners>
+ <web:listener ref="securityFlowExecutionListener" />
+ </web:flow-execution-listeners>
+ </web:flow-executor>
+
+ <bean id="securityFlowExecutionListener" class="org.springframework.webflow.security.SecurityFlowExecutionListener" />
+
]]>
-
+
@@ -1340,7 +1353,7 @@ The comma separated list of security authorities.
@@ -1350,7 +1363,7 @@ The method for matching the authorities. Accepted values are 'any' and 'all'.
@@ -1359,7 +1372,7 @@ Matching any of the authorities grants access.
diff --git a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java
index 3f6c3608..699a914c 100644
--- a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java
+++ b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java
@@ -33,8 +33,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
* Check security authorization when flow session starts
*/
public void sessionCreating(RequestContext context, FlowDefinition definition) {
- SecurityRule rule = (SecurityRule) definition.getAttributes().get(
- SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
+ SecurityRule rule = (SecurityRule) definition.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
if (rule != null) {
decide(rule, definition);
}
@@ -44,7 +43,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
* Check security authorization when entering state
*/
public void stateEntering(RequestContext context, StateDefinition state) throws EnterStateVetoException {
- SecurityRule rule = (SecurityRule) state.getAttributes().get(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
+ SecurityRule rule = (SecurityRule) state.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
if (rule != null) {
decide(rule, state);
}
@@ -54,8 +53,7 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
* Check security authorization on transition
*/
public void transitionExecuting(RequestContext context, TransitionDefinition transition) {
- SecurityRule rule = (SecurityRule) transition.getAttributes().get(
- SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
+ SecurityRule rule = (SecurityRule) transition.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
if (rule != null) {
decide(rule, transition);
}
@@ -95,9 +93,9 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter
*/
protected List getConfigAttributes(SecurityRule rule) {
List configAttributes = new ArrayList();
- Iterator requiredAuthorityIt = rule.getRequiredAuthorities().iterator();
- while (requiredAuthorityIt.hasNext()) {
- configAttributes.add(new SecurityConfig((String) requiredAuthorityIt.next()));
+ Iterator attributeIt = rule.getAttributes().iterator();
+ while (attributeIt.hasNext()) {
+ configAttributes.add(new SecurityConfig((String) attributeIt.next()));
}
return configAttributes;
}
diff --git a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
index 9ba3e528..37cff195 100644
--- a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
+++ b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
@@ -6,7 +6,7 @@ import java.util.HashSet;
import java.util.Iterator;
/**
- * Encapsulates the rules for comparing security authorities
+ * Encapsulates the rules for comparing security attributes
*
* @author Scott Andrews
*/
@@ -15,69 +15,69 @@ public class SecurityRule {
/**
* Attribute name for the location of the security rule
*/
- public static final String SECURITY_AUTHORITY_ATTRIBUTE_NAME = "secured";
+ public static final String SECURITY_ATTRIBUTE_NAME = "secured";
/**
- * Compare method where any of the required authorities can match the principal's authorities
+ * Compare method where any attribute authorization allows access
*/
public static final short COMPARISON_ANY = 1;
/**
- * Compare method where all of the required authorities must match the principal's authorities
+ * Compare method where all attribute authorization allows access
*/
public static final short COMPARISON_ALL = 2;
- private Collection requiredAuthorities;
+ private Collection attributes;
private short comparisonType = COMPARISON_ANY;
/**
- * Convert authorities to comma separated String
- * @param authorities the authorities to convert
+ * Convert attributes to comma separated String
+ * @param attributes the attributes to convert
* @return comma separated String
*/
- public static String convertAuthoritiesToCommaSeparatedString(Collection authorities) {
- StringBuffer str = new StringBuffer();
- Iterator authorityIt = authorities.iterator();
- while (authorityIt.hasNext()) {
- if (str.length() != 0) {
- str.append(", ");
+ public static String convertAttributesToCommaSeparatedString(Collection attributes) {
+ StringBuffer attrs = new StringBuffer();
+ Iterator attributeIt = attributes.iterator();
+ while (attributeIt.hasNext()) {
+ if (attrs.length() != 0) {
+ attrs.append(", ");
}
- str.append(authorityIt.next());
+ attrs.append(attributeIt.next());
}
- return str.toString();
+ return attrs.toString();
}
/**
- * Convert authorities from comma separated String to Collection
- * @param authorities the authorities to convert
+ * Convert attributes from comma separated String to Collection
+ * @param attributes the attributes to convert
* @return comma parsed Collection
*/
- public static Collection convertAuthoritiesFromCommaSeparatedString(String authorities) {
- Collection auths = new HashSet();
- Iterator authorityIt = Arrays.asList(authorities.split(",")).iterator();
- while (authorityIt.hasNext()) {
- String authority = ((String) authorityIt.next()).trim();
- if (!"".equals(authority)) {
- auths.add(authority);
+ public static Collection convertAttributesFromCommaSeparatedString(String attributes) {
+ Collection attrs = new HashSet();
+ Iterator attributeIt = Arrays.asList(attributes.split(",")).iterator();
+ while (attributeIt.hasNext()) {
+ String attribute = ((String) attributeIt.next()).trim();
+ if (!"".equals(attribute)) {
+ attrs.add(attribute);
}
}
- return auths;
+ return attrs;
}
/**
- * Gets required authorities
- * @return required authorities
+ * Gets security attributes
+ * @return security attributes
*/
- public Collection getRequiredAuthorities() {
- return requiredAuthorities;
+ public Collection getAttributes() {
+ return attributes;
}
/**
- * Sets required authorities
- * @param requiredAuthorities required authorities
+ * Sets security attributes
+ * @param attributes security attributes
*/
- public void setRequiredAuthorities(Collection requiredAuthorities) {
- this.requiredAuthorities = requiredAuthorities;
+ public void setAttributes(Collection attributes) {
+ this.attributes = attributes;
}
/**
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilderTests.java b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilderTests.java
index 84497653..711e6f59 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilderTests.java
+++ b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/XmlFlowBuilderTests.java
@@ -150,11 +150,11 @@ public class XmlFlowBuilderTests extends TestCase {
builder = new XmlFlowBuilder(resource);
FlowAssembler assembler = new FlowAssembler(builder, new MockFlowBuilderContext("flow"));
Flow flow = assembler.assembleFlow();
- SecurityRule rule = (SecurityRule) flow.getAttributes().get(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
+ SecurityRule rule = (SecurityRule) flow.getAttributes().get(SecurityRule.SECURITY_ATTRIBUTE_NAME);
assertNotNull(rule);
assertEquals(SecurityRule.COMPARISON_ANY, rule.getComparisonType());
- assertEquals(1, rule.getRequiredAuthorities().size());
- assertTrue(rule.getRequiredAuthorities().contains("ROLE_USER"));
+ assertEquals(1, rule.getAttributes().size());
+ assertTrue(rule.getAttributes().contains("ROLE_USER"));
}
public void testFlowSecuredState() {
@@ -163,11 +163,11 @@ public class XmlFlowBuilderTests extends TestCase {
FlowAssembler assembler = new FlowAssembler(builder, new MockFlowBuilderContext("flow"));
Flow flow = assembler.assembleFlow();
SecurityRule rule = (SecurityRule) flow.getState("end").getAttributes().get(
- SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
+ SecurityRule.SECURITY_ATTRIBUTE_NAME);
assertNotNull(rule);
assertEquals(SecurityRule.COMPARISON_ANY, rule.getComparisonType());
- assertEquals(1, rule.getRequiredAuthorities().size());
- assertTrue(rule.getRequiredAuthorities().contains("ROLE_USER"));
+ assertEquals(1, rule.getAttributes().size());
+ assertTrue(rule.getAttributes().contains("ROLE_USER"));
}
public void testFlowSecuredTransition() {
@@ -176,11 +176,11 @@ public class XmlFlowBuilderTests extends TestCase {
FlowAssembler assembler = new FlowAssembler(builder, new MockFlowBuilderContext("flow"));
Flow flow = assembler.assembleFlow();
SecurityRule rule = (SecurityRule) flow.getGlobalTransitionSet().toArray()[0].getAttributes().get(
- SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME);
+ SecurityRule.SECURITY_ATTRIBUTE_NAME);
assertNotNull(rule);
assertEquals(SecurityRule.COMPARISON_ANY, rule.getComparisonType());
- assertEquals(1, rule.getRequiredAuthorities().size());
- assertTrue(rule.getRequiredAuthorities().contains("ROLE_USER"));
+ assertEquals(1, rule.getAttributes().size());
+ assertTrue(rule.getAttributes().contains("ROLE_USER"));
}
public void testFlowVariable() {
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-state.xml b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-state.xml
index 1eba2dc6..e056e496 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-state.xml
+++ b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-state.xml
@@ -3,7 +3,7 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
-
+
\ No newline at end of file
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-transition.xml b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-transition.xml
index 4e56d89a..d006bd3c 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-transition.xml
+++ b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured-transition.xml
@@ -6,7 +6,7 @@
-
+
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured.xml b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured.xml
index cbcdc276..fdb2b369 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured.xml
+++ b/spring-webflow/src/test/java/org/springframework/webflow/engine/builder/xml/flow-secured.xml
@@ -2,7 +2,7 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
-
+
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityFlowExecutionListenerTests.java b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityFlowExecutionListenerTests.java
index daedb38b..517cb1c1 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityFlowExecutionListenerTests.java
+++ b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityFlowExecutionListenerTests.java
@@ -37,7 +37,7 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
RequestContext context = new MockRequestContext();
Flow flow = new Flow("flow");
SecurityRule rule = getSecurityRuleAnyAuthorized();
- ((LocalAttributeMap) flow.getAttributes()).put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
+ ((LocalAttributeMap) flow.getAttributes()).put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
configureSecurityContext();
listener.sessionCreating(context, flow);
}
@@ -56,7 +56,7 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
Flow flow = new Flow("flow");
ViewState state = new ViewState(flow, "view", new StubViewFactory());
SecurityRule rule = getSecurityRuleAllAuthorized();
- ((LocalAttributeMap) state.getAttributes()).put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
+ ((LocalAttributeMap) state.getAttributes()).put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
configureSecurityContext();
listener.stateEntering(context, state);
}
@@ -73,7 +73,7 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
RequestContext context = new MockRequestContext();
Transition transition = new Transition(new DefaultTargetStateResolver("target"));
SecurityRule rule = getSecurityRuleAnyAuthorized();
- ((LocalAttributeMap) transition.getAttributes()).put(SecurityRule.SECURITY_AUTHORITY_ATTRIBUTE_NAME, rule);
+ ((LocalAttributeMap) transition.getAttributes()).put(SecurityRule.SECURITY_ATTRIBUTE_NAME, rule);
configureSecurityContext();
listener.transitionExecuting(context, transition);
}
@@ -117,40 +117,40 @@ public class SecurityFlowExecutionListenerTests extends TestCase {
private SecurityRule getSecurityRuleAnyAuthorized() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
- Collection authorities = new HashSet();
- authorities.add("ROLE_1");
- authorities.add("ROLE_A");
- rule.setRequiredAuthorities(authorities);
+ Collection attributes = new HashSet();
+ attributes.add("ROLE_1");
+ attributes.add("ROLE_A");
+ rule.setAttributes(attributes);
return rule;
}
private SecurityRule getSecurityRuleAnyDenied() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ANY);
- Collection authorities = new HashSet();
- authorities.add("ROLE_A");
- authorities.add("ROLE_B");
- rule.setRequiredAuthorities(authorities);
+ Collection attributes = new HashSet();
+ attributes.add("ROLE_A");
+ attributes.add("ROLE_B");
+ rule.setAttributes(attributes);
return rule;
}
private SecurityRule getSecurityRuleAllAuthorized() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ALL);
- Collection authorities = new HashSet();
- authorities.add("ROLE_1");
- authorities.add("ROLE_3");
- rule.setRequiredAuthorities(authorities);
+ Collection attributes = new HashSet();
+ attributes.add("ROLE_1");
+ attributes.add("ROLE_3");
+ rule.setAttributes(attributes);
return rule;
}
private SecurityRule getSecurityRuleAllDenied() {
SecurityRule rule = new SecurityRule();
rule.setComparisonType(SecurityRule.COMPARISON_ALL);
- Collection authorities = new HashSet();
- authorities.add("ROLE_1");
- authorities.add("ROLE_A");
- rule.setRequiredAuthorities(authorities);
+ Collection attributes = new HashSet();
+ attributes.add("ROLE_1");
+ attributes.add("ROLE_A");
+ rule.setAttributes(attributes);
return rule;
}
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
index 90c58da9..743e6e5f 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
+++ b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
@@ -8,20 +8,18 @@ import junit.framework.TestCase;
public class SecurityRuleTests extends TestCase {
- public void testConvertAuthoritiesToCommaSeparatedString() {
- Collection authorities = new ArrayList();
- authorities.add("ROLE_USER");
- authorities.add("ROLE_ANONYMOUS");
- Assert.assertEquals("ROLE_USER, ROLE_ANONYMOUS", SecurityRule
- .convertAuthoritiesToCommaSeparatedString(authorities));
+ public void testConvertAttributesToCommaSeparatedString() {
+ Collection attributes = new ArrayList();
+ attributes.add("ROLE_1");
+ attributes.add("ROLE_2");
+ Assert.assertEquals("ROLE_1, ROLE_2", SecurityRule.convertAttributesToCommaSeparatedString(attributes));
}
- public void testConvertAuthoritiesFromCommaSeparatedString() {
- Collection authorities = SecurityRule
- .convertAuthoritiesFromCommaSeparatedString(" ,,ROLE_USER, ROLE_ANONYMOUS");
- Assert.assertEquals(2, authorities.size());
- Assert.assertTrue(authorities.contains("ROLE_USER"));
- Assert.assertTrue(authorities.contains("ROLE_ANONYMOUS"));
+ public void testConvertAttributesFromCommaSeparatedString() {
+ Collection attributes = SecurityRule.convertAttributesFromCommaSeparatedString(" ,,ROLE_1, ROLE_2");
+ Assert.assertEquals(2, attributes.size());
+ Assert.assertTrue(attributes.contains("ROLE_1"));
+ Assert.assertTrue(attributes.contains("ROLE_2"));
}
public void testDefaultComparisonType() {