SpringCloud/spring-cloud-sleuth
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Spring Security

Browse Source
This commit is contained in:
Marcin Grzejszczak
2021-06-01 16:21:06 +02:00
parent 6a094db84e
commit 082ccbd2f2
23 changed files with 831 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/SleuthWebSpan.java
View File

@@ -33,7 +33,7 @@ enum SleuthWebSpan implements DocumentedSpan {
@Override
public TagKey[] getTagKeys() {
return Tags.values();
return TagKey.merge(Tags.values(), SecurityTags.values());
}
};
@@ -78,4 +78,74 @@ enum SleuthWebSpan implements DocumentedSpan {
}
/**
* Tags related to security.
*
* @author Marcin Grzejszczak
* @since 3.1.0
*/
enum SecurityTags implements TagKey {
/**
* Authorities assigned to the user.
*/
AUTHORITIES {
@Override
public String getKey() {
return "security.authentication.authorities";
}
},
/**
* Whether user is authenticated.
*/
AUTHENTICATED {
@Override
public String getKey() {
return "security.authentication.authenticated";
}
},
/**
* Whether principal is enabled.
*/
PRINCIPAL_ENABLED {
@Override
public String getKey() {
return "security.principal.enabled";
}
},
/**
* Principal's authorities.
*/
PRINCIPAL_AUTHORITIES {
@Override
public String getKey() {
return "security.principal.authorities";
}
},
/**
* Whether principal's account is non expired.
*/
PRINCIPAL_ACCOUNT_NON_EXPIRED {
@Override
public String getKey() {
return "security.principal.account-non-expired";
}
},
/**
* Whether principal's credentials are non expired.
*/
PRINCIPAL_CREDENTIALS_NON_EXPIRED {
@Override
public String getKey() {
return "security.principal.credentials-non-expired";
}
}
}
}

91
spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityServletFilter.java Normal file
View File

@@ -0,0 +1,91 @@
/*
* Copyright 2013-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.cloud.sleuth.instrument.web;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.cloud.sleuth.Span;
import org.springframework.cloud.sleuth.Tracer;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.GenericFilterBean;
/**
* A filter that adds security related tags.
*
* @author Marcin Grzejszczak
* @since 3.1.0
*/
public class TracingSecurityServletFilter extends GenericFilterBean {
private final Tracer tracer;
public TracingSecurityServletFilter(Tracer tracer) {
this.tracer = tracer;
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
throws ServletException, IOException {
SecurityContext securityContext = getContext();
if (securityContext != null) {
Span span = this.tracer.currentSpan();
if (span != null) {
TracingSecurityTagSetter.setSecurityTags(span, securityContext.getAuthentication());
}
}
filterChain.doFilter(servletRequest, servletResponse);
}
SecurityContext getContext() {
return SecurityContextHolder.getContext();
}
/**
* Lazy version of the {@link TracingSecurityServletFilter}.
* @param beanFactory bean factory
* @return lazy version of the filter
*/
public static Filter lazy(BeanFactory beanFactory) {
return new Filter() {
private TracingSecurityServletFilter tracingSecurityServletFilter;
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
FilterChain filterChain) throws IOException, ServletException {
tracingSecurityFilter().doFilter(servletRequest, servletResponse, filterChain);
}
private TracingSecurityServletFilter tracingSecurityFilter() {
if (this.tracingSecurityServletFilter == null) {
this.tracingSecurityServletFilter = new TracingSecurityServletFilter(
beanFactory.getBean(Tracer.class));
}
return this.tracingSecurityServletFilter;
}
};
}
}

57
spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityTagSetter.java Normal file
View File

@@ -0,0 +1,57 @@
/*
* Copyright 2013-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.cloud.sleuth.instrument.web;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.cloud.sleuth.Span;
import org.springframework.cloud.sleuth.docs.AssertingSpan;
import org.springframework.cloud.sleuth.instrument.web.SleuthWebSpan.SecurityTags;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.User;
import org.springframework.util.StringUtils;
final class TracingSecurityTagSetter {
private static final Log log = LogFactory.getLog(TracingSecurityTagSetter.class);
private TracingSecurityTagSetter() {
throw new IllegalStateException("Can't instantiate a utility class");
}
static void setSecurityTags(Span span, Authentication authentication) {
if (log.isDebugEnabled()) {
log.debug("Will set security tags on span [" + span + "]");
}
AssertingSpan assertingSpan = AssertingSpan.of(SleuthWebSpan.WEB_FILTER_SPAN, span);
assertingSpan.tag(SecurityTags.AUTHORITIES,
StringUtils.collectionToCommaDelimitedString(authentication.getAuthorities()));
assertingSpan.tag(SecurityTags.AUTHENTICATED, String.valueOf(authentication.isAuthenticated()));
Object principal = authentication.getPrincipal();
if (principal instanceof User) {
User user = (User) principal;
assertingSpan.tag(SecurityTags.PRINCIPAL_ENABLED, String.valueOf(user.isEnabled()));
assertingSpan.tag(SecurityTags.PRINCIPAL_AUTHORITIES,
StringUtils.collectionToCommaDelimitedString(user.getAuthorities()));
assertingSpan.tag(SecurityTags.PRINCIPAL_ACCOUNT_NON_EXPIRED, String.valueOf(user.isAccountNonExpired()));
assertingSpan.tag(SecurityTags.PRINCIPAL_CREDENTIALS_NON_EXPIRED,
String.valueOf(user.isCredentialsNonExpired()));
}
}
}

56
spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityWebFilter.java Normal file
View File

@@ -0,0 +1,56 @@
/*
* Copyright 2013-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.cloud.sleuth.instrument.web;
import reactor.core.publisher.Mono;
import org.springframework.cloud.sleuth.Span;
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebFilter;
import org.springframework.web.server.WebFilterChain;
/**
* A filter that adds security related tags.
*
* @author Marcin Grzejszczak
* @since 3.1.0
*/
public class TracingSecurityWebFilter implements WebFilter {
@Override
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
// @formatter:off
return getContext()
.filter((c) -> c.getAuthentication() != null)
.map(SecurityContext::getAuthentication)
.doOnNext(authentication -> {
Object attribute = exchange.getAttribute(TraceWebFilter.TRACE_REQUEST_ATTR);
if (attribute instanceof Span) {
TracingSecurityTagSetter.setSecurityTags((Span) attribute, authentication);
}
})
.then(chain.filter(exchange));
// @formatter:on
}
Mono<SecurityContext> getContext() {
return ReactiveSecurityContextHolder.getContext();
}
}

73
spring-cloud-sleuth-instrumentation/src/test/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityServletFilterTests.java Normal file
View File

@@ -0,0 +1,73 @@
/*
* Copyright 2013-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.cloud.sleuth.instrument.web;
import java.io.IOException;
import java.util.Collections;
import javax.servlet.ServletException;
import org.junit.jupiter.api.Test;
import org.springframework.cloud.sleuth.tracer.SimpleSpan;
import org.springframework.cloud.sleuth.tracer.SimpleTracer;
import org.springframework.mock.web.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextImpl;
import org.springframework.security.core.userdetails.User;
import static org.assertj.core.api.BDDAssertions.then;
class TracingSecurityServletFilterTests {
SimpleTracer tracer = new SimpleTracer();
TracingSecurityServletFilter filter = new TracingSecurityServletFilter(this.tracer) {
@Override
SecurityContext getContext() {
return new SecurityContextImpl(new TestingAuthenticationToken(
new User("foo", "bar", Collections.singletonList(new SimpleGrantedAuthority("my-role"))), null,
"my-authority"));
}
};
@Test
void should_tag_current_span_with_security_info() throws ServletException, IOException {
SimpleSpan simpleSpan = this.tracer.nextSpan().start();
this.filter.doFilter(new MockHttpServletRequest(), new MockHttpServletResponse(), new MockFilterChain());
then(simpleSpan.tags).containsEntry("security.authentication.authorities", "my-authority")
.containsEntry("security.authentication.authenticated", "true")
.containsEntry("security.principal.enabled", "true")
.containsEntry("security.principal.authorities", "my-role")
.containsEntry("security.principal.account-non-expired", "true")
.containsEntry("security.principal.credentials-non-expired", "true");
}
@Test
void should_do_nothing_when_there_is_no_current_span() throws ServletException, IOException {
this.filter.doFilter(new MockHttpServletRequest(), new MockHttpServletResponse(), new MockFilterChain());
then(this.tracer.spans).isEmpty();
}
}

77
spring-cloud-sleuth-instrumentation/src/test/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityWebFluxFilterTests.java Normal file
View File

@@ -0,0 +1,77 @@
/*
* Copyright 2013-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.cloud.sleuth.instrument.web;
import java.time.Duration;
import java.util.Collections;
import org.junit.jupiter.api.Test;
import reactor.core.publisher.Mono;
import org.springframework.cloud.sleuth.tracer.SimpleSpan;
import org.springframework.cloud.sleuth.tracer.SimpleTracer;
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
import org.springframework.mock.web.server.MockServerWebExchange;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextImpl;
import org.springframework.security.core.userdetails.User;
import static org.assertj.core.api.BDDAssertions.then;
class TracingSecurityWebFluxFilterTests {
SimpleTracer tracer = new SimpleTracer();
TracingSecurityWebFilter filter = new TracingSecurityWebFilter() {
@Override
Mono<SecurityContext> getContext() {
return Mono.just(new SecurityContextImpl(new TestingAuthenticationToken(
new User("foo", "bar", Collections.singletonList(new SimpleGrantedAuthority("my-role"))), null,
"my-authority")));
}
};
@Test
void should_tag_current_span_with_security_info() {
MockServerHttpRequest request = MockServerHttpRequest.post("foo/bar").build();
MockServerWebExchange exchange = MockServerWebExchange.builder(request).build();
SimpleSpan simpleSpan = this.tracer.nextSpan().start();
exchange.getAttributes().put(TraceWebFilter.TRACE_REQUEST_ATTR, simpleSpan);
this.filter.filter(exchange, exchange1 -> Mono.empty()).block(Duration.ofMillis(10));
then(simpleSpan.tags).containsEntry("security.authentication.authorities", "my-authority")
.containsEntry("security.authentication.authenticated", "true")
.containsEntry("security.principal.enabled", "true")
.containsEntry("security.principal.authorities", "my-role")
.containsEntry("security.principal.account-non-expired", "true")
.containsEntry("security.principal.credentials-non-expired", "true");
}
@Test
void should_do_nothing_when_there_is_no_current_span() {
MockServerHttpRequest request = MockServerHttpRequest.post("foo/bar").build();
MockServerWebExchange exchange = MockServerWebExchange.builder(request).build();
this.filter.filter(exchange, exchange1 -> Mono.empty()).block(Duration.ofMillis(10));
then(this.tracer.spans).isEmpty();
}
}