Use PathPatternRequestMatcher in saml2
Issue gh-16887
This commit is contained in:
Josh Cummings
+4
-4
@@ -30,11 +30,12 @@ import org.springframework.security.saml2.provider.service.registration.RelyingP
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
|
||||
import org.springframework.security.web.authentication.AuthenticationConverter;
|
||||
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
final class BaseOpenSamlAuthenticationTokenConverter implements AuthenticationConverter {
|
||||
|
||||
static {
|
||||
@@ -45,9 +46,8 @@ final class BaseOpenSamlAuthenticationTokenConverter implements AuthenticationCo
|
||||
|
||||
private final RelyingPartyRegistrationRepository registrations;
|
||||
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso/{registrationId}"),
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso"));
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(pathPattern("/login/saml2/sso/{registrationId}"),
|
||||
pathPattern("/login/saml2/sso"));
|
||||
|
||||
private Saml2AuthenticationRequestRepository<?> authenticationRequests = new HttpSessionSaml2AuthenticationRequestRepository();
|
||||
|
||||
|
||||
+3
-1
@@ -57,6 +57,8 @@ import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatchers;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* For internal use only. Intended for consolidating common behavior related to minting a
|
||||
* SAML 2.0 Authn Request.
|
||||
@@ -222,7 +224,7 @@ class BaseOpenSamlAuthenticationRequestResolver implements Saml2AuthenticationRe
|
||||
|
||||
PathPatternQueryRequestMatcher(String path, String... params) {
|
||||
List<RequestMatcher> matchers = new ArrayList<>();
|
||||
matchers.add(PathPatternRequestMatcher.withDefaults().matcher(path));
|
||||
matchers.add(pathPattern(path));
|
||||
for (String param : params) {
|
||||
String[] parts = param.split("=");
|
||||
if (parts.length == 1) {
|
||||
|
||||
+4
-4
@@ -34,11 +34,12 @@ import org.springframework.security.saml2.provider.service.web.Saml2Authenticati
|
||||
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
|
||||
import org.springframework.security.web.authentication.AuthenticationConverter;
|
||||
import org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy;
|
||||
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* @since 5.2
|
||||
*/
|
||||
@@ -47,8 +48,7 @@ public class Saml2WebSsoAuthenticationFilter extends AbstractAuthenticationProce
|
||||
public static final String DEFAULT_FILTER_PROCESSES_URI = "/login/saml2/sso/{registrationId}";
|
||||
|
||||
private static final RequestMatcher DEFAULT_REQUEST_MATCHER = new OrRequestMatcher(
|
||||
PathPatternRequestMatcher.withDefaults().matcher(DEFAULT_FILTER_PROCESSES_URI),
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso"));
|
||||
pathPattern(DEFAULT_FILTER_PROCESSES_URI), pathPattern("/login/saml2/sso"));
|
||||
|
||||
private final AuthenticationConverter authenticationConverter;
|
||||
|
||||
@@ -64,7 +64,7 @@ public class Saml2WebSsoAuthenticationFilter extends AbstractAuthenticationProce
|
||||
*/
|
||||
public Saml2WebSsoAuthenticationFilter(RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) {
|
||||
this(relyingPartyRegistrationRepository, DEFAULT_FILTER_PROCESSES_URI);
|
||||
RequestMatcher processUri = PathPatternRequestMatcher.withDefaults().matcher(DEFAULT_FILTER_PROCESSES_URI);
|
||||
RequestMatcher processUri = pathPattern(DEFAULT_FILTER_PROCESSES_URI);
|
||||
setRequiresAuthenticationRequestMatcher(processUri);
|
||||
}
|
||||
|
||||
|
||||
+4
-4
@@ -33,11 +33,12 @@ import org.springframework.security.saml2.provider.service.registration.RelyingP
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
|
||||
import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers;
|
||||
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* An OpenSAML-based implementation of
|
||||
* {@link Saml2LogoutRequestValidatorParametersResolver}
|
||||
@@ -53,9 +54,8 @@ final class BaseOpenSamlLogoutRequestValidatorParametersResolver
|
||||
|
||||
private final RelyingPartyRegistrationRepository registrations;
|
||||
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo/{registrationId}"),
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo"));
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(pathPattern("/logout/saml2/slo/{registrationId}"),
|
||||
pathPattern("/logout/saml2/slo"));
|
||||
|
||||
/**
|
||||
* Constructs a {@link BaseOpenSamlLogoutRequestValidatorParametersResolver}
|
||||
|
||||
+3
-2
@@ -41,11 +41,12 @@ import org.springframework.security.saml2.provider.service.web.RelyingPartyRegis
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
|
||||
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
|
||||
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
import org.springframework.web.filter.OncePerRequestFilter;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* A filter for handling a <saml2:LogoutResponse> sent from the asserting party. A
|
||||
* <saml2:LogoutResponse> is sent in response to a <saml2:LogoutRequest>
|
||||
@@ -72,7 +73,7 @@ public final class Saml2LogoutResponseFilter extends OncePerRequestFilter {
|
||||
|
||||
private Saml2LogoutRequestRepository logoutRequestRepository = new HttpSessionLogoutRequestRepository();
|
||||
|
||||
private RequestMatcher logoutRequestMatcher = PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo");
|
||||
private RequestMatcher logoutRequestMatcher = pathPattern("/logout/saml2/slo");
|
||||
|
||||
public Saml2LogoutResponseFilter(RelyingPartyRegistrationRepository registrations,
|
||||
Saml2LogoutResponseValidator logoutResponseValidator, LogoutSuccessHandler logoutSuccessHandler) {
|
||||
|
||||
+4
-4
@@ -34,11 +34,12 @@ import org.springframework.security.saml2.provider.service.registration.Iterable
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers;
|
||||
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* An implementation of {@link Saml2MetadataResponseResolver} that identifies which
|
||||
* {@link RelyingPartyRegistration}s to use with a {@link RequestMatcher}
|
||||
@@ -51,9 +52,8 @@ public class RequestMatcherMetadataResponseResolver implements Saml2MetadataResp
|
||||
private static final String DEFAULT_METADATA_FILENAME = "saml-{registrationId}-metadata.xml";
|
||||
|
||||
private RequestMatcher matcher = new OrRequestMatcher(
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/saml2/service-provider-metadata/{registrationId}"),
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/saml2/metadata/{registrationId}"),
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/saml2/metadata"));
|
||||
pathPattern("/saml2/service-provider-metadata/{registrationId}"),
|
||||
pathPattern("/saml2/metadata/{registrationId}"), pathPattern("/saml2/metadata"));
|
||||
|
||||
private String filename = DEFAULT_METADATA_FILENAME;
|
||||
|
||||
|
||||
+4
-4
@@ -32,11 +32,12 @@ import org.springframework.security.saml2.provider.service.registration.RelyingP
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
|
||||
import org.springframework.security.web.authentication.AuthenticationConverter;
|
||||
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* An {@link AuthenticationConverter} that generates a {@link Saml2AuthenticationToken}
|
||||
* appropriate for authenticated a SAML 2.0 Assertion against an
|
||||
@@ -58,9 +59,8 @@ public final class OpenSamlAuthenticationTokenConverter implements Authenticatio
|
||||
|
||||
private final RelyingPartyRegistrationRepository registrations;
|
||||
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso/{registrationId}"),
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso"));
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(pathPattern("/login/saml2/sso/{registrationId}"),
|
||||
pathPattern("/login/saml2/sso"));
|
||||
|
||||
private Function<HttpServletRequest, AbstractSaml2AuthenticationRequest> loader;
|
||||
|
||||
|
||||
+4
-4
@@ -36,11 +36,12 @@ import org.springframework.security.saml2.provider.service.registration.RelyingP
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
|
||||
import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers;
|
||||
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* An OpenSAML-based implementation of
|
||||
* {@link Saml2LogoutRequestValidatorParametersResolver}
|
||||
@@ -57,9 +58,8 @@ public final class OpenSamlLogoutRequestValidatorParametersResolver
|
||||
OpenSamlInitializationService.initialize();
|
||||
}
|
||||
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo/{registrationId}"),
|
||||
PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo"));
|
||||
private RequestMatcher requestMatcher = new OrRequestMatcher(pathPattern("/logout/saml2/slo/{registrationId}"),
|
||||
pathPattern("/logout/saml2/slo"));
|
||||
|
||||
private final OpenSamlOperations saml = new OpenSaml4Template();
|
||||
|
||||
|
||||
+2
-2
@@ -29,13 +29,13 @@ import org.springframework.security.saml2.provider.service.registration.Saml2Mes
|
||||
import org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
|
||||
import org.springframework.security.web.servlet.TestMockHttpServletRequests;
|
||||
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.mockito.ArgumentMatchers.any;
|
||||
import static org.mockito.BDDMockito.given;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.verify;
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
public class OpenSaml4AuthenticationRequestResolverTests {
|
||||
|
||||
@@ -92,7 +92,7 @@ public class OpenSaml4AuthenticationRequestResolverTests {
|
||||
RelyingPartyRegistrationResolver relyingParties = mock(RelyingPartyRegistrationResolver.class);
|
||||
given(relyingParties.resolve(any(), any())).willReturn(this.registration);
|
||||
OpenSaml4AuthenticationRequestResolver resolver = new OpenSaml4AuthenticationRequestResolver(relyingParties);
|
||||
resolver.setRequestMatcher(new AntPathRequestMatcher("/custom/authentication/{registrationId}"));
|
||||
resolver.setRequestMatcher(pathPattern("/custom/authentication/{registrationId}"));
|
||||
Saml2RedirectAuthenticationRequest authnRequest = resolver
|
||||
.resolve(givenRequest("/custom/authentication/registration-id"));
|
||||
|
||||
|
||||
+2
-2
@@ -29,13 +29,13 @@ import org.springframework.security.saml2.provider.service.registration.Saml2Mes
|
||||
import org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations;
|
||||
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
|
||||
import org.springframework.security.web.servlet.TestMockHttpServletRequests;
|
||||
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.mockito.ArgumentMatchers.any;
|
||||
import static org.mockito.BDDMockito.given;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.verify;
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
public class OpenSaml5AuthenticationRequestResolverTests {
|
||||
|
||||
@@ -92,7 +92,7 @@ public class OpenSaml5AuthenticationRequestResolverTests {
|
||||
RelyingPartyRegistrationResolver relyingParties = mock(RelyingPartyRegistrationResolver.class);
|
||||
given(relyingParties.resolve(any(), any())).willReturn(this.registration);
|
||||
OpenSaml5AuthenticationRequestResolver resolver = new OpenSaml5AuthenticationRequestResolver(relyingParties);
|
||||
resolver.setRequestMatcher(new AntPathRequestMatcher("/custom/authentication/{registrationId}"));
|
||||
resolver.setRequestMatcher(pathPattern("/custom/authentication/{registrationId}"));
|
||||
Saml2RedirectAuthenticationRequest authnRequest = resolver
|
||||
.resolve(givenRequest("/custom/authentication/registration-id"));
|
||||
|
||||
|
||||
+4
-4
@@ -34,7 +34,6 @@ import org.springframework.security.saml2.provider.service.metadata.Saml2Metadat
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
|
||||
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
|
||||
import org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations;
|
||||
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
|
||||
@@ -44,6 +43,7 @@ import static org.mockito.BDDMockito.given;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.verify;
|
||||
import static org.mockito.Mockito.verifyNoInteractions;
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
/**
|
||||
* Tests for {@link Saml2MetadataFilter}
|
||||
@@ -129,7 +129,7 @@ public class Saml2MetadataFilterTests {
|
||||
@Test
|
||||
public void doFilterWhenCustomRequestMatcherThenUses() throws Exception {
|
||||
MockHttpServletRequest request = uri("/path");
|
||||
this.filter.setRequestMatcher(new AntPathRequestMatcher("/path"));
|
||||
this.filter.setRequestMatcher(pathPattern("/path"));
|
||||
this.filter.doFilter(request, this.response, this.chain);
|
||||
verifyNoInteractions(this.chain);
|
||||
verify(this.repository).findByRegistrationId("path");
|
||||
@@ -159,7 +159,7 @@ public class Saml2MetadataFilterTests {
|
||||
RelyingPartyRegistrationResolver resolver = new DefaultRelyingPartyRegistrationResolver(
|
||||
(id) -> this.repository.findByRegistrationId("registration-id"));
|
||||
this.filter = new Saml2MetadataFilter(resolver, this.resolver);
|
||||
this.filter.setRequestMatcher(new AntPathRequestMatcher("/metadata"));
|
||||
this.filter.setRequestMatcher(pathPattern("/metadata"));
|
||||
MockHttpServletRequest request = uri("/metadata");
|
||||
this.filter.doFilter(request, this.response, new MockFilterChain());
|
||||
verify(this.repository).findByRegistrationId("registration-id");
|
||||
@@ -173,7 +173,7 @@ public class Saml2MetadataFilterTests {
|
||||
given(this.resolver.resolve(any(RelyingPartyRegistration.class))).willReturn("metadata");
|
||||
this.filter = new Saml2MetadataFilter((id) -> this.repository.findByRegistrationId("registration-id"),
|
||||
this.resolver);
|
||||
this.filter.setRequestMatcher(new AntPathRequestMatcher("/metadata"));
|
||||
this.filter.setRequestMatcher(pathPattern("/metadata"));
|
||||
MockHttpServletRequest request = uri("/metadata");
|
||||
this.filter.doFilter(request, this.response, new MockFilterChain());
|
||||
verify(this.repository).findByRegistrationId("registration-id");
|
||||
|
||||
+2
-2
@@ -43,7 +43,6 @@ import org.springframework.security.saml2.provider.service.web.Saml2Authenticati
|
||||
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter;
|
||||
import org.springframework.security.web.authentication.AuthenticationConverter;
|
||||
import org.springframework.security.web.authentication.WebAuthenticationDetails;
|
||||
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
@@ -54,6 +53,7 @@ import static org.mockito.BDDMockito.given;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.verify;
|
||||
import static org.mockito.Mockito.verifyNoInteractions;
|
||||
import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern;
|
||||
|
||||
public class Saml2WebSsoAuthenticationFilterTests {
|
||||
|
||||
@@ -225,7 +225,7 @@ public class Saml2WebSsoAuthenticationFilterTests {
|
||||
given(this.repository.findByRegistrationId("registration-id")).willReturn(registration);
|
||||
given(this.authenticationManager.authenticate(authentication)).willReturn(authentication);
|
||||
String loginProcessingUrl = "/{registrationId}/login/saml2/sso";
|
||||
RequestMatcher matcher = new AntPathRequestMatcher(loginProcessingUrl);
|
||||
RequestMatcher matcher = pathPattern(loginProcessingUrl);
|
||||
DefaultRelyingPartyRegistrationResolver delegate = new DefaultRelyingPartyRegistrationResolver(this.repository);
|
||||
RelyingPartyRegistrationResolver resolver = (request, id) -> {
|
||||
String registrationId = matcher.matcher(request).getVariables().get("registrationId");
|
||||
|
||||
Reference in New Issue
Block a user