SpringCloud/spring-cloud-sleuth
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

WIP

Browse Source
This commit is contained in:
Marcin Grzejszczak
2021-06-08 10:30:53 +02:00
parent 082ccbd2f2
commit 471ea737bd
4 changed files with 123 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-cloud-sleuth-autoconfigure/src/main/java/org/springframework/cloud/sleuth/autoconfig/instrument/web/TraceServletSecurityBeanPostProcessor.java
View File

@@ -35,6 +35,8 @@ class TraceServletSecurityBeanPostProcessor implements BeanPostProcessor {
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
if (bean instanceof HttpSecurity) {
HttpSecurity httpSecurity = (HttpSecurity) bean;
// httpSecurity.addFilterAfter(TracingSecurityServletFilter.lazy(this.beanFactory),
// SecurityContextHolderAwareRequestFilter.class);
httpSecurity.addFilterAfter(TracingSecurityServletFilter.lazy(this.beanFactory), SwitchUserFilter.class);
}
return bean;

10
spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/SleuthWebSpan.java
View File

@@ -116,16 +116,6 @@ enum SleuthWebSpan implements DocumentedSpan {
}
},
/**
* Principal's authorities.
*/
PRINCIPAL_AUTHORITIES {
@Override
public String getKey() {
return "security.principal.authorities";
}
},
/**
* Whether principal's account is non expired.
*/

195
spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityServletFilter.java
View File

@@ -1,91 +1,104 @@
/*
* Copyright 2013-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.cloud.sleuth.instrument.web;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.cloud.sleuth.Span;
import org.springframework.cloud.sleuth.Tracer;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.GenericFilterBean;
/**
* A filter that adds security related tags.
*
* @author Marcin Grzejszczak
* @since 3.1.0
*/
public class TracingSecurityServletFilter extends GenericFilterBean {
private final Tracer tracer;
public TracingSecurityServletFilter(Tracer tracer) {
this.tracer = tracer;
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
throws ServletException, IOException {
SecurityContext securityContext = getContext();
if (securityContext != null) {
Span span = this.tracer.currentSpan();
if (span != null) {
TracingSecurityTagSetter.setSecurityTags(span, securityContext.getAuthentication());
}
}
filterChain.doFilter(servletRequest, servletResponse);
}
SecurityContext getContext() {
return SecurityContextHolder.getContext();
}
/**
* Lazy version of the {@link TracingSecurityServletFilter}.
* @param beanFactory bean factory
* @return lazy version of the filter
*/
public static Filter lazy(BeanFactory beanFactory) {
return new Filter() {
private TracingSecurityServletFilter tracingSecurityServletFilter;
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
FilterChain filterChain) throws IOException, ServletException {
tracingSecurityFilter().doFilter(servletRequest, servletResponse, filterChain);
}
private TracingSecurityServletFilter tracingSecurityFilter() {
if (this.tracingSecurityServletFilter == null) {
this.tracingSecurityServletFilter = new TracingSecurityServletFilter(
beanFactory.getBean(Tracer.class));
}
return this.tracingSecurityServletFilter;
}
};
}
}
/*
* Copyright 2013-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.cloud.sleuth.instrument.web;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.cloud.sleuth.Span;
import org.springframework.cloud.sleuth.Tracer;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.GenericFilterBean;
/**
* A filter that adds security related tags.
*
* @author Marcin Grzejszczak
* @since 3.1.0
*/
// TODO: Check the DelegatingFilterProxy
public class TracingSecurityServletFilter extends GenericFilterBean {
private final Tracer tracer;
public TracingSecurityServletFilter(Tracer tracer) {
this.tracer = tracer;
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
throws ServletException, IOException {
// SecurityContextHolder.setContext();
// Object contextCleared;
// tracer.currentSpan().event("contexSet");
// actual clearing happens
SecurityContext securityContext = getContext();
if (securityContext != null) {
Span span = this.tracer.currentSpan();
if (span != null) {
Span nextSpan = this.tracer.nextSpan().start();
TracingSecurityTagSetter.setSecurityTags(nextSpan, securityContext.getAuthentication());
nextSpan.end();
}
}
filterChain.doFilter(servletRequest, servletResponse);
}
SecurityContext getContext() {
return SecurityContextHolder.getContext();
}
/**
* Lazy version of the {@link TracingSecurityServletFilter}.
* @param beanFactory bean factory
* @return lazy version of the filter
*/
public static Filter lazy(BeanFactory beanFactory) {
return new Filter() {
private TracingSecurityServletFilter tracingSecurityServletFilter;
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
FilterChain filterChain) throws IOException, ServletException {
tracingSecurityFilter().doFilter(servletRequest, servletResponse, filterChain);
}
private TracingSecurityServletFilter tracingSecurityFilter() {
if (this.tracingSecurityServletFilter == null) {
this.tracingSecurityServletFilter = new TracingSecurityServletFilter(
beanFactory.getBean(Tracer.class));
}
return this.tracingSecurityServletFilter;
}
};
}
}

19
spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityTagSetter.java
View File

@@ -39,19 +39,34 @@ final class TracingSecurityTagSetter {
log.debug("Will set security tags on span [" + span + "]");
}
AssertingSpan assertingSpan = AssertingSpan.of(SleuthWebSpan.WEB_FILTER_SPAN, span);
assertingSpan.tag(SecurityTags.AUTHORITIES,
StringUtils.collectionToCommaDelimitedString(authentication.getAuthorities()));
// we might have true even though it's an annonymous user - check
// AuthenticationTrustResolver
// instead of authenticated - is annonymous
// add also remember-me from AuthenticationTrustResolver
assertingSpan.tag(SecurityTags.AUTHENTICATED, String.valueOf(authentication.isAuthenticated()));
Object principal = authentication.getPrincipal();
if (principal instanceof User) {
User user = (User) principal;
assertingSpan.tag(SecurityTags.PRINCIPAL_ENABLED, String.valueOf(user.isEnabled()));
assertingSpan.tag(SecurityTags.PRINCIPAL_AUTHORITIES,
StringUtils.collectionToCommaDelimitedString(user.getAuthorities()));
assertingSpan.tag(SecurityTags.PRINCIPAL_ACCOUNT_NON_EXPIRED, String.valueOf(user.isAccountNonExpired()));
assertingSpan.tag(SecurityTags.PRINCIPAL_CREDENTIALS_NON_EXPIRED,
String.valueOf(user.isCredentialsNonExpired()));
}
/*
*
* Add the customizer interface UserSpanCustomizer {
*
* void customize(Span currentSpan, SecurityContextHolder contextHolder) {
*
* } }
*
*/
}
}