Add support for One-Time Token Login
Closes gh-15114
This commit is contained in:
Marcus Hert Da Coregio
+1
@@ -157,6 +157,7 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>>
|
||||
* <li>{@link DigestAuthenticationFilter}</li>
|
||||
* <li>{@link BearerTokenAuthenticationFilter}</li>
|
||||
* <li>{@link BasicAuthenticationFilter}</li>
|
||||
* <li>{@link org.springframework.security.web.authentication.AuthenticationFilter}</li>
|
||||
* <li>{@link RequestCacheAwareFilter}</li>
|
||||
* <li>{@link SecurityContextHolderAwareRequestFilter}</li>
|
||||
* <li>{@link JaasApiIntegrationFilter}</li>
|
||||
|
||||
+6
@@ -27,14 +27,17 @@ import org.springframework.security.web.access.channel.ChannelProcessingFilter;
|
||||
import org.springframework.security.web.access.intercept.AuthorizationFilter;
|
||||
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
|
||||
import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.AuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.logout.LogoutFilter;
|
||||
import org.springframework.security.web.authentication.ott.GenerateOneTimeTokenFilter;
|
||||
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
|
||||
import org.springframework.security.web.authentication.preauth.x509.X509AuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.switchuser.SwitchUserFilter;
|
||||
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
|
||||
import org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter;
|
||||
import org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter;
|
||||
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.www.DigestAuthenticationFilter;
|
||||
import org.springframework.security.web.context.SecurityContextHolderFilter;
|
||||
@@ -87,6 +90,7 @@ final class FilterOrderRegistration {
|
||||
this.filterToOrder.put(
|
||||
"org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter",
|
||||
order.next());
|
||||
put(GenerateOneTimeTokenFilter.class, order.next());
|
||||
put(X509AuthenticationFilter.class, order.next());
|
||||
put(AbstractPreAuthenticatedProcessingFilter.class, order.next());
|
||||
this.filterToOrder.put("org.springframework.security.cas.web.CasAuthenticationFilter", order.next());
|
||||
@@ -99,12 +103,14 @@ final class FilterOrderRegistration {
|
||||
order.next(); // gh-8105
|
||||
put(DefaultLoginPageGeneratingFilter.class, order.next());
|
||||
put(DefaultLogoutPageGeneratingFilter.class, order.next());
|
||||
put(DefaultOneTimeTokenSubmitPageGeneratingFilter.class, order.next());
|
||||
put(ConcurrentSessionFilter.class, order.next());
|
||||
put(DigestAuthenticationFilter.class, order.next());
|
||||
this.filterToOrder.put(
|
||||
"org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter",
|
||||
order.next());
|
||||
put(BasicAuthenticationFilter.class, order.next());
|
||||
put(AuthenticationFilter.class, order.next());
|
||||
put(RequestCacheAwareFilter.class, order.next());
|
||||
put(SecurityContextHolderAwareRequestFilter.class, order.next());
|
||||
put(JaasApiIntegrationFilter.class, order.next());
|
||||
|
||||
+41
-1
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2002-2023 the original author or authors.
|
||||
* Copyright 2002-2024 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -72,6 +72,7 @@ import org.springframework.security.config.annotation.web.configurers.oauth2.cli
|
||||
import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer;
|
||||
import org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer;
|
||||
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer;
|
||||
import org.springframework.security.config.annotation.web.configurers.ott.OneTimeTokenLoginConfigurer;
|
||||
import org.springframework.security.config.annotation.web.configurers.saml2.Saml2LoginConfigurer;
|
||||
import org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer;
|
||||
import org.springframework.security.config.annotation.web.configurers.saml2.Saml2MetadataConfigurer;
|
||||
@@ -2978,6 +2979,45 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
|
||||
return HttpSecurity.this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Configures One-Time Token Login Support.
|
||||
*
|
||||
* <h2>Example Configuration</h2>
|
||||
*
|
||||
* <pre>
|
||||
* @Configuration
|
||||
* @EnableWebSecurity
|
||||
* public class SecurityConfig {
|
||||
*
|
||||
* @Bean
|
||||
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
||||
* http
|
||||
* .authorizeHttpRequests((authorize) -> authorize
|
||||
* .anyRequest().authenticated()
|
||||
* )
|
||||
* .oneTimeTokenLogin(Customizer.withDefaults());
|
||||
* return http.build();
|
||||
* }
|
||||
*
|
||||
* @Bean
|
||||
* public GeneratedOneTimeTokenHandler generatedOneTimeTokenHandler() {
|
||||
* return new MyMagicLinkGeneratedOneTimeTokenHandler();
|
||||
* }
|
||||
*
|
||||
* }
|
||||
* </pre>
|
||||
* @param oneTimeTokenLoginConfigurerCustomizer the {@link Customizer} to provide more
|
||||
* options for the {@link OneTimeTokenLoginConfigurer}
|
||||
* @return the {@link HttpSecurity} for further customizations
|
||||
* @throws Exception
|
||||
*/
|
||||
public HttpSecurity oneTimeTokenLogin(
|
||||
Customizer<OneTimeTokenLoginConfigurer<HttpSecurity>> oneTimeTokenLoginConfigurerCustomizer)
|
||||
throws Exception {
|
||||
oneTimeTokenLoginConfigurerCustomizer.customize(getOrApply(new OneTimeTokenLoginConfigurer<>(getContext())));
|
||||
return HttpSecurity.this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Configures channel security. In order for this configuration to be useful at least
|
||||
* one mapping to a required channel must be provided.
|
||||
|
||||
+345
@@ -0,0 +1,345 @@
|
||||
/*
|
||||
* Copyright 2002-2024 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.config.annotation.web.configurers.ott;
|
||||
|
||||
import java.util.Collections;
|
||||
import java.util.Map;
|
||||
|
||||
import jakarta.servlet.http.HttpServletRequest;
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
|
||||
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
|
||||
import org.springframework.context.ApplicationContext;
|
||||
import org.springframework.http.HttpMethod;
|
||||
import org.springframework.security.authentication.AuthenticationManager;
|
||||
import org.springframework.security.authentication.AuthenticationProvider;
|
||||
import org.springframework.security.authentication.ott.InMemoryOneTimeTokenService;
|
||||
import org.springframework.security.authentication.ott.OneTimeToken;
|
||||
import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationProvider;
|
||||
import org.springframework.security.authentication.ott.OneTimeTokenService;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
|
||||
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.core.userdetails.UserDetailsService;
|
||||
import org.springframework.security.web.authentication.AuthenticationConverter;
|
||||
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
|
||||
import org.springframework.security.web.authentication.AuthenticationFilter;
|
||||
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
|
||||
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
|
||||
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
|
||||
import org.springframework.security.web.authentication.ott.GenerateOneTimeTokenFilter;
|
||||
import org.springframework.security.web.authentication.ott.GeneratedOneTimeTokenHandler;
|
||||
import org.springframework.security.web.authentication.ott.OneTimeTokenAuthenticationConverter;
|
||||
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
|
||||
import org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter;
|
||||
import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
|
||||
import org.springframework.security.web.context.SecurityContextRepository;
|
||||
import org.springframework.security.web.csrf.CsrfToken;
|
||||
import org.springframework.util.Assert;
|
||||
import org.springframework.util.StringUtils;
|
||||
|
||||
import static org.springframework.security.web.util.matcher.AntPathRequestMatcher.antMatcher;
|
||||
|
||||
public final class OneTimeTokenLoginConfigurer<H extends HttpSecurityBuilder<H>>
|
||||
extends AbstractHttpConfigurer<OneTimeTokenLoginConfigurer<H>, H> {
|
||||
|
||||
private final Log logger = LogFactory.getLog(getClass());
|
||||
|
||||
private final ApplicationContext context;
|
||||
|
||||
private OneTimeTokenService oneTimeTokenService;
|
||||
|
||||
private AuthenticationConverter authenticationConverter = new OneTimeTokenAuthenticationConverter();
|
||||
|
||||
private AuthenticationFailureHandler authenticationFailureHandler;
|
||||
|
||||
private AuthenticationSuccessHandler authenticationSuccessHandler = new SavedRequestAwareAuthenticationSuccessHandler();
|
||||
|
||||
private String defaultSubmitPageUrl = "/login/ott";
|
||||
|
||||
private boolean submitPageEnabled = true;
|
||||
|
||||
private String loginProcessingUrl = "/login/ott";
|
||||
|
||||
private String generateTokenUrl = "/ott/generate";
|
||||
|
||||
private GeneratedOneTimeTokenHandler generatedOneTimeTokenHandler;
|
||||
|
||||
private AuthenticationProvider authenticationProvider;
|
||||
|
||||
public OneTimeTokenLoginConfigurer(ApplicationContext context) {
|
||||
this.context = context;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(H http) {
|
||||
AuthenticationProvider authenticationProvider = getAuthenticationProvider(http);
|
||||
http.authenticationProvider(postProcess(authenticationProvider));
|
||||
configureDefaultLoginPage(http);
|
||||
}
|
||||
|
||||
private void configureDefaultLoginPage(H http) {
|
||||
DefaultLoginPageGeneratingFilter loginPageGeneratingFilter = http
|
||||
.getSharedObject(DefaultLoginPageGeneratingFilter.class);
|
||||
if (loginPageGeneratingFilter == null) {
|
||||
return;
|
||||
}
|
||||
loginPageGeneratingFilter.setOneTimeTokenEnabled(true);
|
||||
loginPageGeneratingFilter.setGenerateOneTimeTokenUrl(this.generateTokenUrl);
|
||||
if (this.authenticationFailureHandler == null
|
||||
&& StringUtils.hasText(loginPageGeneratingFilter.getLoginPageUrl())) {
|
||||
this.authenticationFailureHandler = new SimpleUrlAuthenticationFailureHandler(
|
||||
loginPageGeneratingFilter.getLoginPageUrl() + "?error");
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void configure(H http) {
|
||||
configureSubmitPage(http);
|
||||
configureOttGenerateFilter(http);
|
||||
configureOttAuthenticationFilter(http);
|
||||
}
|
||||
|
||||
private void configureOttAuthenticationFilter(H http) {
|
||||
AuthenticationManager authenticationManager = http.getSharedObject(AuthenticationManager.class);
|
||||
AuthenticationFilter oneTimeTokenAuthenticationFilter = new AuthenticationFilter(authenticationManager,
|
||||
this.authenticationConverter);
|
||||
oneTimeTokenAuthenticationFilter.setSecurityContextRepository(getSecurityContextRepository(http));
|
||||
oneTimeTokenAuthenticationFilter.setRequestMatcher(antMatcher(HttpMethod.POST, this.loginProcessingUrl));
|
||||
oneTimeTokenAuthenticationFilter.setFailureHandler(getAuthenticationFailureHandler());
|
||||
oneTimeTokenAuthenticationFilter.setSuccessHandler(this.authenticationSuccessHandler);
|
||||
http.addFilter(postProcess(oneTimeTokenAuthenticationFilter));
|
||||
}
|
||||
|
||||
private SecurityContextRepository getSecurityContextRepository(H http) {
|
||||
SecurityContextRepository securityContextRepository = http.getSharedObject(SecurityContextRepository.class);
|
||||
if (securityContextRepository != null) {
|
||||
return securityContextRepository;
|
||||
}
|
||||
return new HttpSessionSecurityContextRepository();
|
||||
}
|
||||
|
||||
private void configureOttGenerateFilter(H http) {
|
||||
GenerateOneTimeTokenFilter generateFilter = new GenerateOneTimeTokenFilter(getOneTimeTokenService(http));
|
||||
generateFilter.setGeneratedOneTimeTokenHandler(getGeneratedOneTimeTokenHandler(http));
|
||||
generateFilter.setRequestMatcher(antMatcher(HttpMethod.POST, this.generateTokenUrl));
|
||||
http.addFilter(postProcess(generateFilter));
|
||||
}
|
||||
|
||||
private GeneratedOneTimeTokenHandler getGeneratedOneTimeTokenHandler(H http) {
|
||||
if (this.generatedOneTimeTokenHandler == null) {
|
||||
this.generatedOneTimeTokenHandler = getBeanOrNull(http, GeneratedOneTimeTokenHandler.class);
|
||||
}
|
||||
if (this.generatedOneTimeTokenHandler == null) {
|
||||
throw new IllegalStateException("""
|
||||
A GeneratedOneTimeTokenHandler is required to enable oneTimeTokenLogin().
|
||||
Please provide it as a bean or pass it to the oneTimeTokenLogin() DSL.
|
||||
""");
|
||||
}
|
||||
return this.generatedOneTimeTokenHandler;
|
||||
}
|
||||
|
||||
private void configureSubmitPage(H http) {
|
||||
if (!this.submitPageEnabled) {
|
||||
return;
|
||||
}
|
||||
DefaultOneTimeTokenSubmitPageGeneratingFilter submitPage = new DefaultOneTimeTokenSubmitPageGeneratingFilter();
|
||||
submitPage.setResolveHiddenInputs(this::hiddenInputs);
|
||||
submitPage.setRequestMatcher(antMatcher(HttpMethod.GET, this.defaultSubmitPageUrl));
|
||||
submitPage.setLoginProcessingUrl(this.loginProcessingUrl);
|
||||
http.addFilter(postProcess(submitPage));
|
||||
}
|
||||
|
||||
private AuthenticationProvider getAuthenticationProvider(H http) {
|
||||
if (this.authenticationProvider != null) {
|
||||
return this.authenticationProvider;
|
||||
}
|
||||
UserDetailsService userDetailsService = getContext().getBean(UserDetailsService.class);
|
||||
this.authenticationProvider = new OneTimeTokenAuthenticationProvider(getOneTimeTokenService(http),
|
||||
userDetailsService);
|
||||
return this.authenticationProvider;
|
||||
}
|
||||
|
||||
/**
|
||||
* Specifies the {@link AuthenticationProvider} to use when authenticating the user.
|
||||
* @param authenticationProvider
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> authenticationProvider(AuthenticationProvider authenticationProvider) {
|
||||
Assert.notNull(authenticationProvider, "authenticationProvider cannot be null");
|
||||
this.authenticationProvider = authenticationProvider;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Specifies the URL that a One-Time Token generate request will be processed.
|
||||
* Defaults to {@code /ott/generate}.
|
||||
* @param generateTokenUrl
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> generateTokenUrl(String generateTokenUrl) {
|
||||
Assert.hasText(generateTokenUrl, "generateTokenUrl cannot be null or empty");
|
||||
this.generateTokenUrl = generateTokenUrl;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Specifies strategy to be used to handle generated one-time tokens.
|
||||
* @param generatedOneTimeTokenHandler
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> generatedOneTimeTokenHandler(
|
||||
GeneratedOneTimeTokenHandler generatedOneTimeTokenHandler) {
|
||||
Assert.notNull(generatedOneTimeTokenHandler, "generatedOneTimeTokenHandler cannot be null");
|
||||
this.generatedOneTimeTokenHandler = generatedOneTimeTokenHandler;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Specifies the URL to process the login request, defaults to {@code /login/ott}.
|
||||
* Only POST requests are processed, for that reason make sure that you pass a valid
|
||||
* CSRF token if CSRF protection is enabled.
|
||||
* @param loginProcessingUrl
|
||||
* @see org.springframework.security.config.annotation.web.builders.HttpSecurity#csrf(Customizer)
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> loginProcessingUrl(String loginProcessingUrl) {
|
||||
Assert.hasText(loginProcessingUrl, "loginProcessingUrl cannot be null or empty");
|
||||
this.loginProcessingUrl = loginProcessingUrl;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Configures whether the default one-time token submit page should be shown. This
|
||||
* will prevent the {@link DefaultOneTimeTokenSubmitPageGeneratingFilter} to be
|
||||
* configured.
|
||||
* @param show
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> showDefaultSubmitPage(boolean show) {
|
||||
this.submitPageEnabled = show;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the URL that the default submit page will be generated. Defaults to
|
||||
* {@code /login/ott}. If you don't want to generate the default submit page you
|
||||
* should use {@link #showDefaultSubmitPage(boolean)}. Note that this method always
|
||||
* invoke {@link #showDefaultSubmitPage(boolean)} passing {@code true}.
|
||||
* @param submitPageUrl
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> defaultSubmitPageUrl(String submitPageUrl) {
|
||||
Assert.hasText(submitPageUrl, "submitPageUrl cannot be null or empty");
|
||||
this.defaultSubmitPageUrl = submitPageUrl;
|
||||
showDefaultSubmitPage(true);
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Configures the {@link OneTimeTokenService} used to generate and consume
|
||||
* {@link OneTimeToken}
|
||||
* @param oneTimeTokenService
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> oneTimeTokenService(OneTimeTokenService oneTimeTokenService) {
|
||||
Assert.notNull(oneTimeTokenService, "oneTimeTokenService cannot be null");
|
||||
this.oneTimeTokenService = oneTimeTokenService;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Use this {@link AuthenticationConverter} when converting incoming requests to an
|
||||
* {@link Authentication}. By default, the {@link OneTimeTokenAuthenticationConverter}
|
||||
* is used.
|
||||
* @param authenticationConverter the {@link AuthenticationConverter} to use
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> authenticationConverter(AuthenticationConverter authenticationConverter) {
|
||||
Assert.notNull(authenticationConverter, "authenticationConverter cannot be null");
|
||||
this.authenticationConverter = authenticationConverter;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Specifies the {@link AuthenticationFailureHandler} to use when authentication
|
||||
* fails. The default is redirecting to "/login?error" using
|
||||
* {@link SimpleUrlAuthenticationFailureHandler}
|
||||
* @param authenticationFailureHandler the {@link AuthenticationFailureHandler} to use
|
||||
* when authentication fails.
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> authenticationFailureHandler(
|
||||
AuthenticationFailureHandler authenticationFailureHandler) {
|
||||
Assert.notNull(authenticationFailureHandler, "authenticationFailureHandler cannot be null");
|
||||
this.authenticationFailureHandler = authenticationFailureHandler;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Specifies the {@link AuthenticationSuccessHandler} to be used. The default is
|
||||
* {@link SavedRequestAwareAuthenticationSuccessHandler} with no additional properties
|
||||
* set.
|
||||
* @param authenticationSuccessHandler the {@link AuthenticationSuccessHandler}.
|
||||
*/
|
||||
public OneTimeTokenLoginConfigurer<H> authenticationSuccessHandler(
|
||||
AuthenticationSuccessHandler authenticationSuccessHandler) {
|
||||
Assert.notNull(authenticationSuccessHandler, "authenticationSuccessHandler cannot be null");
|
||||
this.authenticationSuccessHandler = authenticationSuccessHandler;
|
||||
return this;
|
||||
}
|
||||
|
||||
private AuthenticationFailureHandler getAuthenticationFailureHandler() {
|
||||
if (this.authenticationFailureHandler != null) {
|
||||
return this.authenticationFailureHandler;
|
||||
}
|
||||
this.authenticationFailureHandler = new SimpleUrlAuthenticationFailureHandler("/login?error");
|
||||
return this.authenticationFailureHandler;
|
||||
}
|
||||
|
||||
private OneTimeTokenService getOneTimeTokenService(H http) {
|
||||
if (this.oneTimeTokenService != null) {
|
||||
return this.oneTimeTokenService;
|
||||
}
|
||||
OneTimeTokenService bean = getBeanOrNull(http, OneTimeTokenService.class);
|
||||
if (bean != null) {
|
||||
this.oneTimeTokenService = bean;
|
||||
}
|
||||
else {
|
||||
this.logger.debug("Configuring InMemoryOneTimeTokenService for oneTimeTokenLogin()");
|
||||
this.oneTimeTokenService = new InMemoryOneTimeTokenService();
|
||||
}
|
||||
return this.oneTimeTokenService;
|
||||
}
|
||||
|
||||
private <C> C getBeanOrNull(H http, Class<C> clazz) {
|
||||
ApplicationContext context = http.getSharedObject(ApplicationContext.class);
|
||||
if (context == null) {
|
||||
return null;
|
||||
}
|
||||
try {
|
||||
return context.getBean(clazz);
|
||||
}
|
||||
catch (NoSuchBeanDefinitionException ex) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
private Map<String, String> hiddenInputs(HttpServletRequest request) {
|
||||
CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
|
||||
return (token != null) ? Collections.singletonMap(token.getParameterName(), token.getToken())
|
||||
: Collections.emptyMap();
|
||||
}
|
||||
|
||||
public ApplicationContext getContext() {
|
||||
return this.context;
|
||||
}
|
||||
|
||||
}
|
||||
+222
@@ -0,0 +1,222 @@
|
||||
/*
|
||||
* Copyright 2002-2024 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.config.annotation.web.configurers.ott;
|
||||
|
||||
import java.io.IOException;
|
||||
|
||||
import jakarta.servlet.ServletException;
|
||||
import jakarta.servlet.http.HttpServletRequest;
|
||||
import jakarta.servlet.http.HttpServletResponse;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.security.authentication.ott.OneTimeToken;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.security.core.userdetails.PasswordEncodedUser;
|
||||
import org.springframework.security.core.userdetails.UserDetailsService;
|
||||
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
|
||||
import org.springframework.security.web.authentication.ott.GeneratedOneTimeTokenHandler;
|
||||
import org.springframework.security.web.authentication.ott.RedirectGeneratedOneTimeTokenHandler;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThatException;
|
||||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
|
||||
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
|
||||
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
@ExtendWith(SpringTestContextExtension.class)
|
||||
public class OneTimeTokenLoginConfigurerTests {
|
||||
|
||||
public SpringTestContext spring = new SpringTestContext(this);
|
||||
|
||||
@Autowired(required = false)
|
||||
MockMvc mvc;
|
||||
|
||||
@Test
|
||||
void oneTimeTokenWhenCorrectTokenThenCanAuthenticate() throws Exception {
|
||||
this.spring.register(OneTimeTokenDefaultConfig.class).autowire();
|
||||
this.mvc.perform(post("/ott/generate").param("username", "user").with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/login/ott"));
|
||||
|
||||
String token = TestGeneratedOneTimeTokenHandler.lastToken.getTokenValue();
|
||||
|
||||
this.mvc.perform(post("/login/ott").param("token", token).with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/"), authenticated());
|
||||
}
|
||||
|
||||
@Test
|
||||
void oneTimeTokenWhenDifferentAuthenticationUrlsThenCanAuthenticate() throws Exception {
|
||||
this.spring.register(OneTimeTokenDifferentUrlsConfig.class).autowire();
|
||||
this.mvc.perform(post("/generateurl").param("username", "user").with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/redirected"));
|
||||
|
||||
String token = TestGeneratedOneTimeTokenHandler.lastToken.getTokenValue();
|
||||
|
||||
this.mvc.perform(post("/loginprocessingurl").param("token", token).with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/authenticated"), authenticated());
|
||||
}
|
||||
|
||||
@Test
|
||||
void oneTimeTokenWhenCorrectTokenUsedTwiceThenSecondTimeFails() throws Exception {
|
||||
this.spring.register(OneTimeTokenDefaultConfig.class).autowire();
|
||||
this.mvc.perform(post("/ott/generate").param("username", "user").with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/login/ott"));
|
||||
|
||||
String token = TestGeneratedOneTimeTokenHandler.lastToken.getTokenValue();
|
||||
|
||||
this.mvc.perform(post("/login/ott").param("token", token).with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/"), authenticated());
|
||||
|
||||
this.mvc.perform(post("/login/ott").param("token", token).with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/login?error"), unauthenticated());
|
||||
}
|
||||
|
||||
@Test
|
||||
void oneTimeTokenWhenWrongTokenThenAuthenticationFail() throws Exception {
|
||||
this.spring.register(OneTimeTokenDefaultConfig.class).autowire();
|
||||
this.mvc.perform(post("/ott/generate").param("username", "user").with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/login/ott"));
|
||||
|
||||
String token = "wrong";
|
||||
|
||||
this.mvc.perform(post("/login/ott").param("token", token).with(csrf()))
|
||||
.andExpectAll(status().isFound(), redirectedUrl("/login?error"), unauthenticated());
|
||||
}
|
||||
|
||||
@Test
|
||||
void oneTimeTokenWhenNoGeneratedOneTimeTokenHandlerThenException() {
|
||||
assertThatException()
|
||||
.isThrownBy(() -> this.spring.register(OneTimeTokenNoGeneratedOttHandlerConfig.class).autowire())
|
||||
.havingRootCause()
|
||||
.isInstanceOf(IllegalStateException.class)
|
||||
.withMessage("""
|
||||
A GeneratedOneTimeTokenHandler is required to enable oneTimeTokenLogin().
|
||||
Please provide it as a bean or pass it to the oneTimeTokenLogin() DSL.
|
||||
""");
|
||||
}
|
||||
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
@EnableWebSecurity
|
||||
@Import(UserDetailsServiceConfig.class)
|
||||
static class OneTimeTokenDefaultConfig {
|
||||
|
||||
@Bean
|
||||
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeHttpRequests((authz) -> authz
|
||||
.anyRequest().authenticated()
|
||||
)
|
||||
.oneTimeTokenLogin((ott) -> ott
|
||||
.generatedOneTimeTokenHandler(new TestGeneratedOneTimeTokenHandler())
|
||||
);
|
||||
// @formatter:on
|
||||
return http.build();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
@EnableWebSecurity
|
||||
@Import(UserDetailsServiceConfig.class)
|
||||
static class OneTimeTokenDifferentUrlsConfig {
|
||||
|
||||
@Bean
|
||||
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeHttpRequests((authz) -> authz
|
||||
.anyRequest().authenticated()
|
||||
)
|
||||
.oneTimeTokenLogin((ott) -> ott
|
||||
.generateTokenUrl("/generateurl")
|
||||
.generatedOneTimeTokenHandler(new TestGeneratedOneTimeTokenHandler("/redirected"))
|
||||
.loginProcessingUrl("/loginprocessingurl")
|
||||
.authenticationSuccessHandler(new SimpleUrlAuthenticationSuccessHandler("/authenticated"))
|
||||
);
|
||||
// @formatter:on
|
||||
return http.build();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
@EnableWebSecurity
|
||||
@Import(UserDetailsServiceConfig.class)
|
||||
static class OneTimeTokenNoGeneratedOttHandlerConfig {
|
||||
|
||||
@Bean
|
||||
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeHttpRequests((authz) -> authz
|
||||
.anyRequest().authenticated()
|
||||
)
|
||||
.oneTimeTokenLogin(Customizer.withDefaults());
|
||||
// @formatter:on
|
||||
return http.build();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static class TestGeneratedOneTimeTokenHandler implements GeneratedOneTimeTokenHandler {
|
||||
|
||||
private static OneTimeToken lastToken;
|
||||
|
||||
private final GeneratedOneTimeTokenHandler delegate;
|
||||
|
||||
TestGeneratedOneTimeTokenHandler() {
|
||||
this.delegate = new RedirectGeneratedOneTimeTokenHandler("/login/ott");
|
||||
}
|
||||
|
||||
TestGeneratedOneTimeTokenHandler(String redirectUrl) {
|
||||
this.delegate = new RedirectGeneratedOneTimeTokenHandler(redirectUrl);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken)
|
||||
throws IOException, ServletException {
|
||||
lastToken = oneTimeToken;
|
||||
this.delegate.handle(request, response, oneTimeToken);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
static class UserDetailsServiceConfig {
|
||||
|
||||
@Bean
|
||||
UserDetailsService userDetailsService() {
|
||||
return new InMemoryUserDetailsManager(PasswordEncodedUser.user(), PasswordEncodedUser.admin());
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user