diff --git a/spring-cloud-sleuth-autoconfigure/src/main/java/org/springframework/cloud/sleuth/autoconfig/instrument/web/TraceServletSecurityBeanPostProcessor.java b/spring-cloud-sleuth-autoconfigure/src/main/java/org/springframework/cloud/sleuth/autoconfig/instrument/web/TraceServletSecurityBeanPostProcessor.java index 746006713..24b19c8dc 100644 --- a/spring-cloud-sleuth-autoconfigure/src/main/java/org/springframework/cloud/sleuth/autoconfig/instrument/web/TraceServletSecurityBeanPostProcessor.java +++ b/spring-cloud-sleuth-autoconfigure/src/main/java/org/springframework/cloud/sleuth/autoconfig/instrument/web/TraceServletSecurityBeanPostProcessor.java @@ -35,6 +35,8 @@ class TraceServletSecurityBeanPostProcessor implements BeanPostProcessor { public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException { if (bean instanceof HttpSecurity) { HttpSecurity httpSecurity = (HttpSecurity) bean; + // httpSecurity.addFilterAfter(TracingSecurityServletFilter.lazy(this.beanFactory), + // SecurityContextHolderAwareRequestFilter.class); httpSecurity.addFilterAfter(TracingSecurityServletFilter.lazy(this.beanFactory), SwitchUserFilter.class); } return bean; diff --git a/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/SleuthWebSpan.java b/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/SleuthWebSpan.java index 29d04a15b..26a5d2c68 100644 --- a/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/SleuthWebSpan.java +++ b/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/SleuthWebSpan.java @@ -116,16 +116,6 @@ enum SleuthWebSpan implements DocumentedSpan { } }, - /** - * Principal's authorities. - */ - PRINCIPAL_AUTHORITIES { - @Override - public String getKey() { - return "security.principal.authorities"; - } - }, - /** * Whether principal's account is non expired. */ diff --git a/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityServletFilter.java b/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityServletFilter.java index 0fb14768d..b11bad71f 100644 --- a/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityServletFilter.java +++ b/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityServletFilter.java @@ -1,91 +1,104 @@ -/* - * Copyright 2013-2021 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.cloud.sleuth.instrument.web; - -import java.io.IOException; - -import javax.servlet.Filter; -import javax.servlet.FilterChain; -import javax.servlet.ServletException; -import javax.servlet.ServletRequest; -import javax.servlet.ServletResponse; - -import org.springframework.beans.factory.BeanFactory; -import org.springframework.cloud.sleuth.Span; -import org.springframework.cloud.sleuth.Tracer; -import org.springframework.security.core.context.SecurityContext; -import org.springframework.security.core.context.SecurityContextHolder; -import org.springframework.web.filter.GenericFilterBean; - -/** - * A filter that adds security related tags. - * - * @author Marcin Grzejszczak - * @since 3.1.0 - */ -public class TracingSecurityServletFilter extends GenericFilterBean { - - private final Tracer tracer; - - public TracingSecurityServletFilter(Tracer tracer) { - this.tracer = tracer; - } - - @Override - public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) - throws ServletException, IOException { - SecurityContext securityContext = getContext(); - if (securityContext != null) { - Span span = this.tracer.currentSpan(); - if (span != null) { - TracingSecurityTagSetter.setSecurityTags(span, securityContext.getAuthentication()); - } - } - filterChain.doFilter(servletRequest, servletResponse); - } - - SecurityContext getContext() { - return SecurityContextHolder.getContext(); - } - - /** - * Lazy version of the {@link TracingSecurityServletFilter}. - * @param beanFactory bean factory - * @return lazy version of the filter - */ - public static Filter lazy(BeanFactory beanFactory) { - return new Filter() { - - private TracingSecurityServletFilter tracingSecurityServletFilter; - - @Override - public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, - FilterChain filterChain) throws IOException, ServletException { - tracingSecurityFilter().doFilter(servletRequest, servletResponse, filterChain); - } - - private TracingSecurityServletFilter tracingSecurityFilter() { - if (this.tracingSecurityServletFilter == null) { - this.tracingSecurityServletFilter = new TracingSecurityServletFilter( - beanFactory.getBean(Tracer.class)); - } - return this.tracingSecurityServletFilter; - } - }; - } - -} +/* + * Copyright 2013-2021 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.sleuth.instrument.web; + +import java.io.IOException; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; + +import org.springframework.beans.factory.BeanFactory; +import org.springframework.cloud.sleuth.Span; +import org.springframework.cloud.sleuth.Tracer; +import org.springframework.security.core.context.SecurityContext; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.web.filter.GenericFilterBean; + +/** + * A filter that adds security related tags. + * + * @author Marcin Grzejszczak + * @since 3.1.0 + */ +// TODO: Check the DelegatingFilterProxy +public class TracingSecurityServletFilter extends GenericFilterBean { + + private final Tracer tracer; + + public TracingSecurityServletFilter(Tracer tracer) { + this.tracer = tracer; + } + + @Override + public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) + throws ServletException, IOException { + + // SecurityContextHolder.setContext(); + + // Object contextCleared; + // tracer.currentSpan().event("contexSet"); + + // actual clearing happens + + SecurityContext securityContext = getContext(); + if (securityContext != null) { + Span span = this.tracer.currentSpan(); + if (span != null) { + Span nextSpan = this.tracer.nextSpan().start(); + TracingSecurityTagSetter.setSecurityTags(nextSpan, securityContext.getAuthentication()); + nextSpan.end(); + + + } + } + filterChain.doFilter(servletRequest, servletResponse); + } + + SecurityContext getContext() { + return SecurityContextHolder.getContext(); + } + + /** + * Lazy version of the {@link TracingSecurityServletFilter}. + * @param beanFactory bean factory + * @return lazy version of the filter + */ + public static Filter lazy(BeanFactory beanFactory) { + return new Filter() { + + private TracingSecurityServletFilter tracingSecurityServletFilter; + + @Override + public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, + FilterChain filterChain) throws IOException, ServletException { + tracingSecurityFilter().doFilter(servletRequest, servletResponse, filterChain); + } + + private TracingSecurityServletFilter tracingSecurityFilter() { + if (this.tracingSecurityServletFilter == null) { + this.tracingSecurityServletFilter = new TracingSecurityServletFilter( + beanFactory.getBean(Tracer.class)); + } + return this.tracingSecurityServletFilter; + } + }; + } + +} diff --git a/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityTagSetter.java b/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityTagSetter.java index 39793a6f6..5959e33cb 100644 --- a/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityTagSetter.java +++ b/spring-cloud-sleuth-instrumentation/src/main/java/org/springframework/cloud/sleuth/instrument/web/TracingSecurityTagSetter.java @@ -39,19 +39,34 @@ final class TracingSecurityTagSetter { log.debug("Will set security tags on span [" + span + "]"); } AssertingSpan assertingSpan = AssertingSpan.of(SleuthWebSpan.WEB_FILTER_SPAN, span); + assertingSpan.tag(SecurityTags.AUTHORITIES, StringUtils.collectionToCommaDelimitedString(authentication.getAuthorities())); + + // we might have true even though it's an annonymous user - check + // AuthenticationTrustResolver + // instead of authenticated - is annonymous + // add also remember-me from AuthenticationTrustResolver assertingSpan.tag(SecurityTags.AUTHENTICATED, String.valueOf(authentication.isAuthenticated())); Object principal = authentication.getPrincipal(); if (principal instanceof User) { User user = (User) principal; assertingSpan.tag(SecurityTags.PRINCIPAL_ENABLED, String.valueOf(user.isEnabled())); - assertingSpan.tag(SecurityTags.PRINCIPAL_AUTHORITIES, - StringUtils.collectionToCommaDelimitedString(user.getAuthorities())); assertingSpan.tag(SecurityTags.PRINCIPAL_ACCOUNT_NON_EXPIRED, String.valueOf(user.isAccountNonExpired())); assertingSpan.tag(SecurityTags.PRINCIPAL_CREDENTIALS_NON_EXPIRED, String.valueOf(user.isCredentialsNonExpired())); } + + /* + * + * Add the customizer interface UserSpanCustomizer { + * + * void customize(Span currentSpan, SecurityContextHolder contextHolder) { + * + * } } + * + */ + } }