Added building of filter chain in post-processing, support for basic authentication and automatic generation of login page, if no loginUrl supplied.

core/src/test/java/org/springframework/security/config/HttpSecurityBeanDefinitionParserTests.java

@@ -1,8 +1,21 @@
 package org.springframework.security.config;
 
-import org.springframework.context.support.ClassPathXmlApplicationContext;
+import org.junit.AfterClass;
+import static org.junit.Assert.assertTrue;
 import org.junit.BeforeClass;
 import org.junit.Test;
+import org.springframework.context.support.ClassPathXmlApplicationContext;
+import org.springframework.security.context.HttpSessionContextIntegrationFilter;
+import org.springframework.security.intercept.web.FilterChainMap;
+import org.springframework.security.intercept.web.FilterSecurityInterceptor;
+import org.springframework.security.ui.ExceptionTranslationFilter;
+import org.springframework.security.ui.basicauth.BasicProcessingFilter;
+import org.springframework.security.ui.logout.LogoutFilter;
+import org.springframework.security.ui.webapp.AuthenticationProcessingFilter;
+import org.springframework.security.ui.webapp.DefaultLoginPageGeneratingFilter;
+import org.springframework.security.util.FilterChainProxy;
+
+import javax.servlet.Filter;
 
 /**
  * @author Luke Taylor
@@ -16,8 +29,44 @@ public class HttpSecurityBeanDefinitionParserTests {
         appContext = new ClassPathXmlApplicationContext("org/springframework/security/config/http-security.xml");
     }
 
-    @Test
-    public void testContextContainsExpectedBeansAndData() {
+    @AfterClass
+    public static void closeAppContext() {
+        if (appContext != null) {
+            appContext.close();
+        }
     }
 
+    @Test
+    public void filterChainProxyShouldReturnEmptyFilterListForUnprotectedUrl() {
+        FilterChainProxy filterChainProxy =
+                (FilterChainProxy) appContext.getBean(HttpSecurityBeanDefinitionParser.DEFAULT_FILTER_CHAIN_PROXY_ID);
+
+        FilterChainMap filterChainMap = filterChainProxy.getFilterChainMap();
+
+        Filter[] filters = filterChainMap.getFilters("/unprotected");
+
+        assertTrue(filters.length == 0);
+    }
+
+    @Test
+    public void filterChainProxyShouldReturnCorrectFilterListForProtectedUrl() {
+        FilterChainProxy filterChainProxy =
+                (FilterChainProxy) appContext.getBean(HttpSecurityBeanDefinitionParser.DEFAULT_FILTER_CHAIN_PROXY_ID);
+
+        FilterChainMap filterChainMap = filterChainProxy.getFilterChainMap();
+
+        Filter[] filters = filterChainMap.getFilters("/someurl");
+
+
+        
+        assertTrue("Expected 7 filters in chain", filters.length == 7);
+
+        assertTrue(filters[0] instanceof HttpSessionContextIntegrationFilter);
+        assertTrue(filters[1] instanceof LogoutFilter);
+        assertTrue(filters[2] instanceof AuthenticationProcessingFilter);
+        assertTrue(filters[3] instanceof DefaultLoginPageGeneratingFilter);
+        assertTrue(filters[4] instanceof BasicProcessingFilter);
+        assertTrue(filters[5] instanceof ExceptionTranslationFilter);
+        assertTrue(filters[6] instanceof FilterSecurityInterceptor);
+    }
 }

core/src/test/resources/org/springframework/security/config/http-security.xml

@@ -6,20 +6,22 @@
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
 
-    <security:autoconfig />    
+    <security:autoconfig />
 
     <security:http createSession="ifRequired" pathType="ant" lowerCaseComparisons="true">
-        <security:intercept-url path="/unprotected" filters="none"/>
-        <security:intercept-url path="/somepath" filters="filter1,filter2,filter3" access="ROLE_SPECIAL,ROLE_USER" />
-        <security:intercept-url path="/**" access="ROLE_USER" />
+        <security:intercept-url pattern="/unprotected" filters="none"/>
+        <security:intercept-url pattern="/somepath" access="ROLE_SPECIAL,ROLE_USER" />
+        <security:intercept-url pattern="/**" access="ROLE_USER" />
+
+        <!-- Default logout configuration -->
+        <security:logout logoutUrl="/j_spring_security_logout" logoutSuccessUrl="/" invalidateSession="true" />        
 
         <!-- Default form login configuration. Will create filter and entry point -->
         <security:form-login loginUrl="/j_spring_security_check"  />
 
-        <!-- Default logout configuration -->
-        <security:logout logoutUrl="/j_spring_security_logout" logoutSuccessUrl="/" invalidateSession="true" />
-
-    </security:http>    
+        <!-- Default basic auth configuration. Will create filter and entry point -->
+        <security:http-basic realm="NamespaceTestRealm"  />
+    </security:http>
 
 
     <security:authentication-provider>
@@ -27,6 +29,6 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc
             <security:user name="bob" password="bobspassword" authorities="ROLE_A,ROLE_B" />
             <security:user name="bill" password="billspassword" authorities="ROLE_A,ROLE_B,AUTH_OTHER" />
         </security:user-service>
-    </security:authentication-provider>    
+    </security:authentication-provider>
 
 </beans>