Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-04 17:27:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent authentication when user is inactive for reactive apps

Browse Source 
Currently, reactive applications doesn't perform validation when user
is locked, disabled or expired. This commit introduces these validations.

Fixes gh-7113
This commit is contained in:
Eddú Meléndez Gonzales
2019-07-29 10:03:05 -05:00
committed by Eleftheria Stein-Kousathana
parent 4ca9e15595
commit 8e6e975e86
3 changed files with 235 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/test/java/org/springframework/security/authentication/UserDetailsRepositoryReactiveAuthenticationManagerTests.java
+54 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@ import org.springframework.security.crypto.password.PasswordEncoder;
/**
* @author Rob Winch
* @author Eddú Meléndez
* @since 5.1
*/
@RunWith(MockitoJUnitRunner.class)
@@ -171,4 +172,56 @@ public class UserDetailsRepositoryReactiveAuthenticationManagerTests {
verifyZeroInteractions(this.postAuthenticationChecks);
}
@Test(expected = AccountExpiredException.class)
public void authenticateWhenAccountExpiredThenException() {
this.manager.setPasswordEncoder(this.encoder);
UserDetails expiredUser = User.withUsername("user")
.password("password")
.roles("USER")
.accountExpired(true)
.build();
when(this.userDetailsService.findByUsername(any())).thenReturn(Mono.just(expiredUser));
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
expiredUser, expiredUser.getPassword());
this.manager.authenticate(token).block();
}
@Test(expected = LockedException.class)
public void authenticateWhenAccountLockedThenException() {
this.manager.setPasswordEncoder(this.encoder);
UserDetails lockedUser = User.withUsername("user")
.password("password")
.roles("USER")
.accountLocked(true)
.build();
when(this.userDetailsService.findByUsername(any())).thenReturn(Mono.just(lockedUser));
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
lockedUser, lockedUser.getPassword());
this.manager.authenticate(token).block();
}
@Test(expected = DisabledException.class)
public void authenticateWhenAccountDisabledThenException() {
this.manager.setPasswordEncoder(this.encoder);
UserDetails disabledUser = User.withUsername("user")
.password("password")
.roles("USER")
.disabled(true)
.build();
when(this.userDetailsService.findByUsername(any())).thenReturn(Mono.just(disabledUser));
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
disabledUser, disabledUser.getPassword());
this.manager.authenticate(token).block();
}
}