SEC-2137: Allow disabling session fixation and enable concurrency control
This commit is contained in:
Rob Winch
+91
@@ -0,0 +1,91 @@
|
||||
/*
|
||||
R * Copyright 2002-2013 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.web.authentication.session;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
/**
|
||||
* A {@link SessionAuthenticationStrategy} that accepts multiple
|
||||
* {@link SessionAuthenticationStrategy} implementations to delegate to. Each
|
||||
* {@link SessionAuthenticationStrategy} is invoked in turn. The invocations are
|
||||
* short circuited if any exception, (i.e. SessionAuthenticationException) is
|
||||
* thrown.
|
||||
*
|
||||
* <p>
|
||||
* Typical usage would include having the following delegates (in this order)
|
||||
* </p>
|
||||
*
|
||||
* <ul>
|
||||
* <li> {@link ConcurrentSessionControlAuthenticationStrategy} - verifies that a
|
||||
* user is allowed to authenticate (i.e. they have not already logged into the
|
||||
* application.</li>
|
||||
* <li> {@link SessionFixationProtectionStrategy} - If session fixation is
|
||||
* desired, {@link SessionFixationProtectionStrategy} should be after
|
||||
* {@link ConcurrentSessionControlAuthenticationStrategy} to prevent unnecessary
|
||||
* {@link HttpSession} creation if the
|
||||
* {@link ConcurrentSessionControlAuthenticationStrategy} rejects
|
||||
* authentication.</li>
|
||||
* <li> {@link RegisterSessionAuthenticationStrategy} - It is important this is
|
||||
* after {@link SessionFixationProtectionStrategy} so that the correct session
|
||||
* is registered.</li>
|
||||
* </ul>
|
||||
*
|
||||
* @author Rob Winch
|
||||
* @since 3.2
|
||||
*/
|
||||
public class CompositeSessionAuthenticationStrategy implements SessionAuthenticationStrategy {
|
||||
private final Log logger = LogFactory.getLog(getClass());
|
||||
private final List<SessionAuthenticationStrategy> delegateStrategies;
|
||||
|
||||
public CompositeSessionAuthenticationStrategy(List<SessionAuthenticationStrategy> delegateStrategies) {
|
||||
Assert.notEmpty(delegateStrategies, "delegateStrategies cannot be null or empty");
|
||||
for(SessionAuthenticationStrategy strategy : delegateStrategies) {
|
||||
if(strategy == null) {
|
||||
throw new IllegalArgumentException("delegateStrategies cannot contain null entires. Got " + delegateStrategies);
|
||||
}
|
||||
}
|
||||
this.delegateStrategies = new ArrayList<SessionAuthenticationStrategy>(delegateStrategies);
|
||||
}
|
||||
|
||||
/* (non-Javadoc)
|
||||
* @see org.springframework.security.web.authentication.session.SessionAuthenticationStrategy#onAuthentication(org.springframework.security.core.Authentication, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
|
||||
*/
|
||||
public void onAuthentication(Authentication authentication,
|
||||
HttpServletRequest request, HttpServletResponse response)
|
||||
throws SessionAuthenticationException {
|
||||
for(SessionAuthenticationStrategy delegate : delegateStrategies) {
|
||||
if(logger.isDebugEnabled()) {
|
||||
logger.debug("Delegating to " + delegate);
|
||||
}
|
||||
delegate.onAuthentication(authentication, request, response);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public String toString() {
|
||||
return getClass().getName() + " [delegateStrategies = " + delegateStrategies + "]";
|
||||
}
|
||||
}
|
||||
+183
@@ -0,0 +1,183 @@
|
||||
package org.springframework.security.web.authentication.session;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
|
||||
import org.springframework.context.MessageSource;
|
||||
import org.springframework.context.MessageSourceAware;
|
||||
import org.springframework.context.support.MessageSourceAccessor;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.core.SpringSecurityMessageSource;
|
||||
import org.springframework.security.core.session.SessionInformation;
|
||||
import org.springframework.security.core.session.SessionRegistry;
|
||||
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
|
||||
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
||||
import org.springframework.security.web.session.ConcurrentSessionFilter;
|
||||
import org.springframework.security.web.session.SessionManagementFilter;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
/**
|
||||
* Strategy which handles concurrent session-control.
|
||||
*
|
||||
* <p>
|
||||
* When invoked following an authentication, it will check whether the user in
|
||||
* question should be allowed to proceed, by comparing the number of sessions
|
||||
* they already have active with the configured <tt>maximumSessions</tt> value.
|
||||
* The {@link SessionRegistry} is used as the source of data on authenticated
|
||||
* users and session data.
|
||||
* </p>
|
||||
* <p>
|
||||
* If a user has reached the maximum number of permitted sessions, the behaviour
|
||||
* depends on the <tt>exceptionIfMaxExceeded</tt> property. The default
|
||||
* behaviour is to expired the least recently used session, which will be
|
||||
* invalidated by the {@link ConcurrentSessionFilter} if accessed again. If
|
||||
* <tt>exceptionIfMaxExceeded</tt> is set to <tt>true</tt>, however, the user
|
||||
* will be prevented from starting a new authenticated session.
|
||||
* </p>
|
||||
* <p>
|
||||
* This strategy can be injected into both the {@link SessionManagementFilter}
|
||||
* and instances of {@link AbstractAuthenticationProcessingFilter} (typically
|
||||
* {@link UsernamePasswordAuthenticationFilter}), but is typically combined with
|
||||
* {@link RegisterSessionAuthenticationStrategy} using
|
||||
* {@link CompositeSessionAuthenticationStrategy}.
|
||||
* </p>
|
||||
*
|
||||
* @see CompositeSessionAuthenticationStrategy
|
||||
*
|
||||
* @author Luke Taylor
|
||||
* @author Rob Winch
|
||||
* @since 3.2
|
||||
*/
|
||||
public class ConcurrentSessionControlAuthenticationStrategy implements MessageSourceAware, SessionAuthenticationStrategy {
|
||||
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
|
||||
private final SessionRegistry sessionRegistry;
|
||||
private boolean exceptionIfMaximumExceeded = false;
|
||||
private int maximumSessions = 1;
|
||||
|
||||
/**
|
||||
* @param sessionRegistry the session registry which should be updated when the authenticated session is changed.
|
||||
*/
|
||||
public ConcurrentSessionControlAuthenticationStrategy(SessionRegistry sessionRegistry) {
|
||||
Assert.notNull(sessionRegistry, "The sessionRegistry cannot be null");
|
||||
this.sessionRegistry = sessionRegistry;
|
||||
}
|
||||
|
||||
/**
|
||||
* In addition to the steps from the superclass, the sessionRegistry will be updated with the new session information.
|
||||
*/
|
||||
public void onAuthentication(Authentication authentication, HttpServletRequest request,
|
||||
HttpServletResponse response) {
|
||||
|
||||
final List<SessionInformation> sessions = sessionRegistry.getAllSessions(authentication.getPrincipal(), false);
|
||||
|
||||
int sessionCount = sessions.size();
|
||||
int allowedSessions = getMaximumSessionsForThisUser(authentication);
|
||||
|
||||
if (sessionCount < allowedSessions) {
|
||||
// They haven't got too many login sessions running at present
|
||||
return;
|
||||
}
|
||||
|
||||
if (allowedSessions == -1) {
|
||||
// We permit unlimited logins
|
||||
return;
|
||||
}
|
||||
|
||||
if (sessionCount == allowedSessions) {
|
||||
HttpSession session = request.getSession(false);
|
||||
|
||||
if (session != null) {
|
||||
// Only permit it though if this request is associated with one of the already registered sessions
|
||||
for (SessionInformation si : sessions) {
|
||||
if (si.getSessionId().equals(session.getId())) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
// If the session is null, a new one will be created by the parent class, exceeding the allowed number
|
||||
}
|
||||
|
||||
allowableSessionsExceeded(sessions, allowedSessions, sessionRegistry);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method intended for use by subclasses to override the maximum number of sessions that are permitted for
|
||||
* a particular authentication. The default implementation simply returns the <code>maximumSessions</code> value
|
||||
* for the bean.
|
||||
*
|
||||
* @param authentication to determine the maximum sessions for
|
||||
*
|
||||
* @return either -1 meaning unlimited, or a positive integer to limit (never zero)
|
||||
*/
|
||||
protected int getMaximumSessionsForThisUser(Authentication authentication) {
|
||||
return maximumSessions;
|
||||
}
|
||||
|
||||
/**
|
||||
* Allows subclasses to customise behaviour when too many sessions are detected.
|
||||
*
|
||||
* @param sessions either <code>null</code> or all unexpired sessions associated with the principal
|
||||
* @param allowableSessions the number of concurrent sessions the user is allowed to have
|
||||
* @param registry an instance of the <code>SessionRegistry</code> for subclass use
|
||||
*
|
||||
*/
|
||||
protected void allowableSessionsExceeded(List<SessionInformation> sessions, int allowableSessions,
|
||||
SessionRegistry registry) throws SessionAuthenticationException {
|
||||
if (exceptionIfMaximumExceeded || (sessions == null)) {
|
||||
throw new SessionAuthenticationException(messages.getMessage("ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
|
||||
new Object[] {Integer.valueOf(allowableSessions)},
|
||||
"Maximum sessions of {0} for this principal exceeded"));
|
||||
}
|
||||
|
||||
// Determine least recently used session, and mark it for invalidation
|
||||
SessionInformation leastRecentlyUsed = null;
|
||||
|
||||
for (SessionInformation session : sessions) {
|
||||
if ((leastRecentlyUsed == null)
|
||||
|| session.getLastRequest().before(leastRecentlyUsed.getLastRequest())) {
|
||||
leastRecentlyUsed = session;
|
||||
}
|
||||
}
|
||||
|
||||
leastRecentlyUsed.expireNow();
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the <tt>exceptionIfMaximumExceeded</tt> property, which determines
|
||||
* whether the user should be prevented from opening more sessions than
|
||||
* allowed. If set to <tt>true</tt>, a
|
||||
* <tt>SessionAuthenticationException</tt> will be raised which means the
|
||||
* user authenticating will be prevented from authenticating. if set to
|
||||
* <tt>false</tt>, the user that has already authenticated will be forcibly
|
||||
* logged out.
|
||||
*
|
||||
* @param exceptionIfMaximumExceeded
|
||||
* defaults to <tt>false</tt>.
|
||||
*/
|
||||
public void setExceptionIfMaximumExceeded(boolean exceptionIfMaximumExceeded) {
|
||||
this.exceptionIfMaximumExceeded = exceptionIfMaximumExceeded;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the <tt>maxSessions</tt> property. The default value is 1. Use -1 for unlimited sessions.
|
||||
*
|
||||
* @param maximumSessions the maximimum number of permitted sessions a user can have open simultaneously.
|
||||
*/
|
||||
public void setMaximumSessions(int maximumSessions) {
|
||||
Assert.isTrue(maximumSessions != 0,
|
||||
"MaximumLogins must be either -1 to allow unlimited logins, or a positive integer to specify a maximum");
|
||||
this.maximumSessions = maximumSessions;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the {@link MessageSource} used for reporting errors back to the user
|
||||
* when the user has exceeded the maximum number of authentications.
|
||||
*/
|
||||
public void setMessageSource(MessageSource messageSource) {
|
||||
Assert.notNull(messageSource, "messageSource cannot be null");
|
||||
this.messages = new MessageSourceAccessor(messageSource);
|
||||
}
|
||||
}
|
||||
+2
@@ -37,7 +37,9 @@ import org.springframework.util.Assert;
|
||||
*
|
||||
* @author Luke Taylor
|
||||
* @since 3.0
|
||||
* @deprecated Use {@link ConcurrentSessionControlAuthenticationStrategy} instead
|
||||
*/
|
||||
@Deprecated
|
||||
public class ConcurrentSessionControlStrategy extends SessionFixationProtectionStrategy
|
||||
implements MessageSourceAware {
|
||||
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
|
||||
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
package org.springframework.security.web.authentication.session;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.core.session.SessionRegistry;
|
||||
import org.springframework.security.web.session.HttpSessionEventPublisher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
/**
|
||||
* Strategy used to register a user with the {@link SessionRegistry} after
|
||||
* successful {@link Authentication}.
|
||||
*
|
||||
* <p>
|
||||
* {@link RegisterSessionAuthenticationStrategy} is typically used in
|
||||
* combination with {@link CompositeSessionAuthenticationStrategy} and
|
||||
* {@link ConcurrentSessionControlAuthenticationStrategy}, but can be used on
|
||||
* its own if tracking of sessions is desired but no need to control
|
||||
* concurrency.</P
|
||||
*
|
||||
* <p>
|
||||
* NOTE: When using a {@link SessionRegistry} it is important that all sessions
|
||||
* (including timed out sessions) are removed. This is typically done by adding
|
||||
* {@link HttpSessionEventPublisher}.</p>
|
||||
*
|
||||
* @see CompositeSessionAuthenticationStrategy
|
||||
*
|
||||
* @author Luke Taylor
|
||||
* @author Rob Winch
|
||||
* @since 3.2
|
||||
*/
|
||||
public class RegisterSessionAuthenticationStrategy implements SessionAuthenticationStrategy {
|
||||
private final SessionRegistry sessionRegistry;
|
||||
|
||||
/**
|
||||
* @param sessionRegistry the session registry which should be updated when the authenticated session is changed.
|
||||
*/
|
||||
public RegisterSessionAuthenticationStrategy(SessionRegistry sessionRegistry) {
|
||||
Assert.notNull(sessionRegistry, "The sessionRegistry cannot be null");
|
||||
this.sessionRegistry = sessionRegistry;
|
||||
}
|
||||
|
||||
/**
|
||||
* In addition to the steps from the superclass, the sessionRegistry will be updated with the new session information.
|
||||
*/
|
||||
public void onAuthentication(Authentication authentication, HttpServletRequest request,
|
||||
HttpServletResponse response) {
|
||||
sessionRegistry.registerNewSession(request.getSession().getId(), authentication.getPrincipal());
|
||||
}
|
||||
}
|
||||
+92
@@ -0,0 +1,92 @@
|
||||
/*
|
||||
* Copyright 2002-2013 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.web.authentication.session;
|
||||
|
||||
import static junit.framework.Assert.fail;
|
||||
import static org.mockito.Mockito.doThrow;
|
||||
import static org.mockito.Mockito.times;
|
||||
import static org.mockito.Mockito.verify;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.mockito.Mock;
|
||||
import org.mockito.runners.MockitoJUnitRunner;
|
||||
import org.springframework.security.core.Authentication;
|
||||
|
||||
/**
|
||||
* @author Rob Winch
|
||||
*
|
||||
*/
|
||||
@RunWith(MockitoJUnitRunner.class)
|
||||
public class CompositeSessionAuthenticationStrategyTests {
|
||||
@Mock
|
||||
private SessionAuthenticationStrategy strategy1;
|
||||
@Mock
|
||||
private SessionAuthenticationStrategy strategy2;
|
||||
@Mock
|
||||
private Authentication authentication;
|
||||
@Mock
|
||||
private HttpServletRequest request;
|
||||
@Mock
|
||||
private HttpServletResponse response;
|
||||
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void constructorNullDelegates() {
|
||||
new CompositeSessionAuthenticationStrategy(null);
|
||||
}
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void constructorEmptyDelegates() {
|
||||
new CompositeSessionAuthenticationStrategy(Collections.<SessionAuthenticationStrategy>emptyList());
|
||||
}
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void constructorDelegatesContainNull() {
|
||||
new CompositeSessionAuthenticationStrategy(Collections.<SessionAuthenticationStrategy>singletonList(null));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void delegatesToAll() {
|
||||
CompositeSessionAuthenticationStrategy strategy = new CompositeSessionAuthenticationStrategy(Arrays.asList(strategy1,strategy2));
|
||||
strategy.onAuthentication(authentication, request, response);
|
||||
|
||||
verify(strategy1).onAuthentication(authentication, request, response);
|
||||
verify(strategy2).onAuthentication(authentication, request, response);
|
||||
}
|
||||
|
||||
|
||||
@Test
|
||||
public void delegateShortCircuits() {
|
||||
doThrow(new SessionAuthenticationException("oops")).when(strategy1).onAuthentication(authentication, request, response);
|
||||
|
||||
CompositeSessionAuthenticationStrategy strategy = new CompositeSessionAuthenticationStrategy(Arrays.asList(strategy1,strategy2));
|
||||
|
||||
try {
|
||||
strategy.onAuthentication(authentication, request, response);
|
||||
fail("Expected Exception");
|
||||
} catch (SessionAuthenticationException success) {}
|
||||
|
||||
verify(strategy1).onAuthentication(authentication, request, response);
|
||||
verify(strategy2,times(0)).onAuthentication(authentication, request, response);
|
||||
}
|
||||
}
|
||||
+132
@@ -0,0 +1,132 @@
|
||||
/*
|
||||
* Copyright 2002-2013 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.web.authentication.session;
|
||||
|
||||
import static org.fest.assertions.Assertions.assertThat;
|
||||
import static org.mockito.Matchers.any;
|
||||
import static org.mockito.Matchers.anyBoolean;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.Date;
|
||||
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.mockito.Mock;
|
||||
import org.mockito.runners.MockitoJUnitRunner;
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
import org.springframework.mock.web.MockHttpSession;
|
||||
import org.springframework.mock.web.MockServletContext;
|
||||
import org.springframework.security.authentication.TestingAuthenticationToken;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.core.session.SessionInformation;
|
||||
import org.springframework.security.core.session.SessionRegistry;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Rob Winch
|
||||
*
|
||||
*/
|
||||
@RunWith(MockitoJUnitRunner.class)
|
||||
public class ConcurrentSessionControlAuthenticationStrategyTests {
|
||||
@Mock
|
||||
private SessionRegistry sessionRegistry;
|
||||
|
||||
private Authentication authentication;
|
||||
private MockHttpServletRequest request;
|
||||
private MockHttpServletResponse response;
|
||||
private SessionInformation sessionInformation;
|
||||
|
||||
private ConcurrentSessionControlAuthenticationStrategy strategy;
|
||||
|
||||
@Before
|
||||
public void setup() throws Exception {
|
||||
authentication = new TestingAuthenticationToken("user", "password", "ROLE_USER");
|
||||
request = new MockHttpServletRequest();
|
||||
response = new MockHttpServletResponse();
|
||||
sessionInformation = new SessionInformation(authentication.getPrincipal(), "unique", new Date(1374766134216L));
|
||||
|
||||
strategy = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry);
|
||||
}
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void constructorNullRegistry() {
|
||||
new ConcurrentSessionControlAuthenticationStrategy(null);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void noRegisteredSession() {
|
||||
when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>emptyList());
|
||||
strategy.setMaximumSessions(1);
|
||||
strategy.setExceptionIfMaximumExceeded(true);
|
||||
|
||||
strategy.onAuthentication(authentication, request, response);
|
||||
|
||||
// no exception
|
||||
}
|
||||
|
||||
@Test
|
||||
public void maxSessionsSameSessionId() {
|
||||
MockHttpSession session = new MockHttpSession(new MockServletContext(), sessionInformation.getSessionId());
|
||||
request.setSession(session);
|
||||
when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>singletonList(sessionInformation));
|
||||
strategy.setMaximumSessions(1);
|
||||
strategy.setExceptionIfMaximumExceeded(true);
|
||||
|
||||
strategy.onAuthentication(authentication, request, response);
|
||||
|
||||
// no exception
|
||||
}
|
||||
|
||||
@Test(expected = SessionAuthenticationException.class)
|
||||
public void maxSessionsWithException() {
|
||||
when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>singletonList(sessionInformation));
|
||||
strategy.setMaximumSessions(1);
|
||||
strategy.setExceptionIfMaximumExceeded(true);
|
||||
|
||||
strategy.onAuthentication(authentication, request, response);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void maxSessionsExpireExistingUser() {
|
||||
when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>singletonList(sessionInformation));
|
||||
strategy.setMaximumSessions(1);
|
||||
|
||||
strategy.onAuthentication(authentication, request, response);
|
||||
|
||||
assertThat(sessionInformation.isExpired()).isTrue();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void maxSessionsExpireLeastRecentExistingUser() {
|
||||
SessionInformation moreRecentSessionInfo = new SessionInformation(authentication.getPrincipal(), "unique", new Date(1374766999999L));
|
||||
when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Arrays.<SessionInformation>asList(moreRecentSessionInfo,sessionInformation));
|
||||
strategy.setMaximumSessions(2);
|
||||
|
||||
strategy.onAuthentication(authentication, request, response);
|
||||
|
||||
assertThat(sessionInformation.isExpired()).isTrue();
|
||||
}
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void setMessageSourceNull() {
|
||||
strategy.setMessageSource(null);
|
||||
}
|
||||
}
|
||||
+67
@@ -0,0 +1,67 @@
|
||||
/*
|
||||
* Copyright 2002-2013 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.web.authentication.session;
|
||||
|
||||
import static org.mockito.Mockito.verify;
|
||||
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.mockito.Mock;
|
||||
import org.mockito.runners.MockitoJUnitRunner;
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
import org.springframework.security.authentication.TestingAuthenticationToken;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.core.session.SessionRegistry;
|
||||
|
||||
/**
|
||||
* @author Rob Winch
|
||||
*
|
||||
*/
|
||||
@RunWith(MockitoJUnitRunner.class)
|
||||
public class RegisterSessionAuthenticationStrategyTests {
|
||||
|
||||
@Mock
|
||||
private SessionRegistry registry;
|
||||
|
||||
private RegisterSessionAuthenticationStrategy authenticationStrategy;
|
||||
|
||||
private Authentication authentication;
|
||||
private MockHttpServletRequest request;
|
||||
private MockHttpServletResponse response;
|
||||
|
||||
@Before
|
||||
public void setup() {
|
||||
authenticationStrategy = new RegisterSessionAuthenticationStrategy(registry);
|
||||
authentication = new TestingAuthenticationToken("user", "password","ROLE_USER");
|
||||
request = new MockHttpServletRequest();
|
||||
response = new MockHttpServletResponse();
|
||||
}
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void constructorNullRegistry() {
|
||||
new RegisterSessionAuthenticationStrategy(null);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void onAuthenticationRegistersSession() {
|
||||
authenticationStrategy.onAuthentication(authentication, request, response);
|
||||
|
||||
verify(registry).registerNewSession(request.getSession().getId(), authentication.getPrincipal());
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user