Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SWS-708 - PayloadValidatingInterceptor errors not clearing SecurityContextHolder

Browse Source
This commit is contained in:
Arjen Poutsma
2011-05-18 14:23:02 +00:00
parent da9e377e3c
commit 95ac6687b6
16 changed files with 460 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2002-2009 the original author or authors.
* Copyright 2005-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -20,9 +20,6 @@ import java.util.Iterator;
import java.util.Locale;
import javax.xml.namespace.QName;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.util.Assert;
import org.springframework.ws.client.WebServiceClientException;
import org.springframework.ws.client.support.interceptor.ClientInterceptor;
@@ -36,6 +33,9 @@ import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.server.SoapEndpointInterceptor;
import org.springframework.ws.soap.soap11.Soap11Body;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Interceptor base class for interceptors that handle WS-Security. Can be used on the server side, registered in a
* {@link org.springframework.ws.server.endpoint.mapping.AbstractEndpointMapping#setInterceptors(org.springframework.ws.server.EndpointInterceptor[])
@@ -166,17 +166,19 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
if (!result) {
messageContext.clearResponse();
}
cleanUp();
}
return result;
}
/** Returns <code>true</code>, i.e. fault responses are not secured. */
public boolean handleFault(MessageContext messageContext, Object endpoint) throws Exception {
cleanUp();
return true;
}
public void afterCompletion(MessageContext messageContext, Object endpoint, Exception ex) {
cleanUp();
}
public boolean understands(SoapHeaderElement headerElement) {
return WS_SECURITY_NAME.equals(headerElement.getName());
}

12
security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2010 the original author or authors.
* Copyright 2005-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -18,12 +18,12 @@ package org.springframework.ws.soap.security.wss4j;
import java.util.Properties;
import org.springframework.security.core.Authentication;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.memory.InMemoryDaoImpl;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
@@ -69,6 +69,7 @@ public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCa
// test clean up
messageContext.getResponse();
interceptor.handleResponse(messageContext, null);
interceptor.afterCompletion(messageContext, null, null);
assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
}
@@ -83,6 +84,7 @@ public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCa
// test clean up
messageContext.getResponse();
interceptor.handleResponse(messageContext, null);
interceptor.afterCompletion(messageContext, null, null);
assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
}

64
security/src/test/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptorTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2010 the original author or authors.
* Copyright 2005-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -26,10 +26,11 @@ import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import static org.junit.Assert.*;
public class XwsSecurityInterceptorTest {
private MessageFactory messageFactory;
@@ -48,14 +49,14 @@ public class XwsSecurityInterceptorTest {
@Override
protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
throws XwsSecuritySecurementException {
Assert.fail("secure not expected");
fail("secure not expected");
}
@Override
protected void validateMessage(SoapMessage message, MessageContext messageContext)
throws WsSecurityValidationException {
SaajSoapMessage saajSoapMessage = (SaajSoapMessage) message;
Assert.assertEquals("Invalid message", request, saajSoapMessage.getSaajMessage());
assertEquals("Invalid message", request, saajSoapMessage.getSaajMessage());
saajSoapMessage.setSaajMessage(validatedRequest);
}
@@ -63,13 +64,14 @@ public class XwsSecurityInterceptorTest {
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
interceptor.handleRequest(context, null);
Assert.assertEquals("Invalid request", validatedRequest,
((SaajSoapMessage) context.getRequest()).getSaajMessage());
assertEquals("Invalid request", validatedRequest, ((SaajSoapMessage) context.getRequest()).getSaajMessage());
}
@Test
public void testHandleServerResponse() throws Exception {
final SOAPMessage securedResponse = messageFactory.createMessage();
final boolean[] cleanupCalled = new boolean[1];
cleanupCalled[0] = false;
XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
@Override
@@ -82,21 +84,49 @@ public class XwsSecurityInterceptorTest {
@Override
protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
throws WsSecurityValidationException {
Assert.fail("validate not expected");
fail("validate not expected");
}
@Override
protected void cleanUp() {
cleanupCalled[0] = true;
}
};
SOAPMessage request = messageFactory.createMessage();
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
context.getResponse();
interceptor.handleResponse(context, null);
Assert.assertEquals("Invalid response", securedResponse,
((SaajSoapMessage) context.getResponse()).getSaajMessage());
interceptor.afterCompletion(context, null, null);
assertEquals("Invalid response", securedResponse, ((SaajSoapMessage) context.getResponse()).getSaajMessage());
assertTrue("Cleanup not called", cleanupCalled[0]);
}
@Test
public void testhandleClientRequest() throws Exception {
public void testHandleServerFault() throws Exception {
final boolean[] cleanupCalled = new boolean[1];
cleanupCalled[0] = false;
XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
@Override
protected void cleanUp() {
cleanupCalled[0] = true;
}
};
SOAPMessage request = messageFactory.createMessage();
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
context.getResponse();
interceptor.handleFault(context, null);
interceptor.afterCompletion(context, null, null);
assertTrue("Cleanup not called", cleanupCalled[0]);
}
@Test
public void testHandleClientRequest() throws Exception {
final SOAPMessage request = messageFactory.createMessage();
final SOAPMessage securedRequest = messageFactory.createMessage();
XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
@@ -105,22 +135,21 @@ public class XwsSecurityInterceptorTest {
protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
throws XwsSecuritySecurementException {
SaajSoapMessage saajSoapMessage = (SaajSoapMessage) soapMessage;
Assert.assertEquals("Invalid message", request, saajSoapMessage.getSaajMessage());
assertEquals("Invalid message", request, saajSoapMessage.getSaajMessage());
saajSoapMessage.setSaajMessage(securedRequest);
}
@Override
protected void validateMessage(SoapMessage message, MessageContext messageContext)
throws WsSecurityValidationException {
Assert.fail("validate not expected");
fail("validate not expected");
}
};
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
interceptor.handleRequest(context);
Assert.assertEquals("Invalid request", securedRequest,
((SaajSoapMessage) context.getRequest()).getSaajMessage());
assertEquals("Invalid request", securedRequest, ((SaajSoapMessage) context.getRequest()).getSaajMessage());
}
@Test
@@ -131,7 +160,7 @@ public class XwsSecurityInterceptorTest {
@Override
protected void secureMessage(SoapMessage message, MessageContext messageContext)
throws XwsSecuritySecurementException {
Assert.fail("secure not expected");
fail("secure not expected");
}
@Override
@@ -147,8 +176,7 @@ public class XwsSecurityInterceptorTest {
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
context.getResponse();
interceptor.handleResponse(context);
Assert.assertEquals("Invalid response", validatedResponse,
((SaajSoapMessage) context.getResponse()).getSaajMessage());
assertEquals("Invalid response", validatedResponse, ((SaajSoapMessage) context.getResponse()).getSaajMessage());
}
}

8
security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SpringDigestPasswordValidationCallbackHandlerTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2010 the original author or authors.
* Copyright 2005-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -17,9 +17,9 @@
package org.springframework.ws.soap.security.xwss.callback;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
@@ -110,7 +110,7 @@ public class SpringDigestPasswordValidationCallbackHandlerTest {
}
@Test
public void testAuthenticateUserDigestDisbaled() throws Exception {
public void testAuthenticateUserDigestDisabled() throws Exception {
User user = new User(username, "Ernie", false, true, true, true, new GrantedAuthority[0]);
expect(userDetailsService.loadUserByUsername(username)).andReturn(user);