Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-04 01:07:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1012: Refactoring of use of GrantedAuthority[] to generified collections

Browse Source
This commit is contained in:
Luke Taylor
2008-10-31 03:53:00 +00:00
parent e891b334e6
commit ec44f2bdfe
137 changed files with 2250 additions and 4219 deletions
Download Patch File Download Diff File Expand all files Collapse all files
taglibs/src/main/java/org/springframework/security/taglibs/authz/AclTag.java
+9 -6
View File
@@ -46,16 +46,19 @@ import javax.servlet.jsp.tagext.TagSupport;
/**
* An implementation of {@link javax.servlet.jsp.tagext.Tag} that allows its body through if some authorizations
* are granted to the request's principal.<P>Only works with permissions that are subclasses of {@link
* org.springframework.security.acl.basic.BasicAclEntry}.</p>
* <p>One or more comma separate integer permissions are specified via the <code>hasPermission</code> attribute.
* are granted to the request's principal.
* <p>
* Only works with permissions that are subclasses of {@link org.springframework.security.acl.basic.BasicAclEntry}.
* <p>
* One or more comma separate integer permissions are specified via the <code>hasPermission</code> attribute.
* The tag will include its body if <b>any</b> of the integer permissions have been granted to the current
* <code>Authentication</code> (obtained from the <code>SecurityContextHolder</code>).</p>
* <p>For this class to operate it must be able to access the application context via the
* <code>Authentication</code> (obtained from the <code>SecurityContextHolder</code>).
* <p>
* For this class to operate it must be able to access the application context via the
* <code>WebApplicationContextUtils</code> and locate an {@link AclManager}. Application contexts have no need to have
* more than one <code>AclManager</code> (as a provider-based implementation can be used so that it locates a provider
* that is authoritative for the given domain object instance), so the first <code>AclManager</code> located will be
* used.</p>
* used.
*
* @author Ben Alex
* @version $Id$
taglibs/src/main/java/org/springframework/security/taglibs/authz/AuthorizeTag.java
+12 -18
View File
@@ -15,17 +15,6 @@
package org.springframework.security.taglibs.authz;
import org.springframework.security.Authentication;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.util.StringUtils;
import org.springframework.web.util.ExpressionEvaluationUtils;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
@@ -36,6 +25,13 @@ import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.Tag;
import javax.servlet.jsp.tagext.TagSupport;
import org.springframework.security.Authentication;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.util.StringUtils;
import org.springframework.web.util.ExpressionEvaluationUtils;
/**
* An implementation of {@link javax.servlet.jsp.tagext.Tag} that allows it's body through if some authorizations
@@ -125,20 +121,18 @@ public class AuthorizeTag extends TagSupport {
return ifNotGranted;
}
private Collection getPrincipalAuthorities() {
private Collection<GrantedAuthority> getPrincipalAuthorities() {
Authentication currentUser = SecurityContextHolder.getContext().getAuthentication();
if (null == currentUser) {
return Collections.EMPTY_LIST;
return Collections.emptyList();
}
if ((null == currentUser.getAuthorities()) || (currentUser.getAuthorities().length < 1)) {
return Collections.EMPTY_LIST;
if ((null == currentUser.getAuthorities())) {
return Collections.emptyList();
}
Collection granted = Arrays.asList(currentUser.getAuthorities());
return granted;
return currentUser.getAuthorities();
}
private Set parseAuthoritiesString(String authorizationsString) {
taglibs/src/main/java/org/springframework/security/taglibs/velocity/Authz.java
+5 -22
View File
@@ -17,8 +17,6 @@ package org.springframework.security.taglibs.velocity;
import org.springframework.security.Authentication;
import org.springframework.security.acl.AclManager;
import org.springframework.security.taglibs.authz.AclTag;
import org.springframework.security.taglibs.authz.AuthenticationTag;
import org.springframework.security.taglibs.authz.AuthorizeTag;
@@ -39,7 +37,7 @@ public interface Authz {
//~ Methods ========================================================================================================
/**
* all the listed roles must be granted to return true, otherwise fasle;
* all the listed roles must be granted to return true, otherwise false;
*
* @param roles - comma separate GrantedAuthoritys
*
@@ -48,7 +46,7 @@ public interface Authz {
boolean allGranted(String roles);
/**
* any the listed roles must be granted to return true, otherwise fasle;
* any the listed roles must be granted to return true, otherwise false;
*
* @param roles - comma separate GrantedAuthoritys
*
@@ -57,9 +55,8 @@ public interface Authz {
boolean anyGranted(String roles);
/**
* set Spring application context which contains acegi related bean
* get Spring application context which contains
*
* @return DOCUMENT ME!
*/
ApplicationContext getAppCtx();
@@ -72,20 +69,7 @@ public interface Authz {
String getPrincipal();
/**
* return true if the principal holds either permission specified for the provided domain object<P>Only
* works with permissions that are subclasses of {@link org.springframework.security.acl.basic.AbstractBasicAclEntry}.</p>
* <p>For this class to operate it must be able to access the application context via the
* <code>WebApplicationContextUtils</code> and locate an {@link AclManager}.</p>
*
* @param domainObject - domain object need acl control
* @param permissions - comma separate integer permissions
*
* @return got acl permission (true|false)
*/
boolean hasPermission(Object domainObject, String permissions);
/**
* none the listed roles must be granted to return true, otherwise fasle;
* none the listed roles must be granted to return true, otherwise false;
*
* @param roles - comma separate GrantedAuthoritys
*
@@ -94,9 +78,8 @@ public interface Authz {
boolean noneGranted(String roles);
/**
* get Spring application context which contains acegi related bean
* set Spring application context which contains Acegi related bean
*
* @param appCtx DOCUMENT ME!
*/
void setAppCtx(ApplicationContext appCtx);
}
taglibs/src/main/java/org/springframework/security/taglibs/velocity/AuthzImpl.java
+6 -67
View File
@@ -15,17 +15,12 @@
package org.springframework.security.taglibs.velocity;
import org.springframework.security.acl.AclManager;
import org.springframework.security.taglibs.authz.AclTag;
import org.springframework.security.taglibs.authz.AuthenticationTag;
import org.springframework.security.taglibs.authz.AuthorizeTag;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.Tag;
import org.springframework.context.ApplicationContext;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.PageContext;
import javax.servlet.jsp.tagext.Tag;
import org.springframework.security.taglibs.authz.AuthenticationTag;
import org.springframework.security.taglibs.authz.AuthorizeTag;
/**
@@ -60,18 +55,14 @@ public class AuthzImpl implements Authz {
/**
* implementation of AuthenticationTag
*
* @return DOCUMENT ME!
*
* @throws IllegalArgumentException DOCUMENT ME!
*/
public String getPrincipal() {
MyAuthenticationTag authenticationTag = new MyAuthenticationTag();
authenticationTag.setProperty("username");
authenticationTag.setProperty("name");
try {
authenticationTag.doStartTag();
authenticationTag.doEndTag();
} catch (JspException je) {
je.printStackTrace();
throw new IllegalArgumentException(je.getMessage());
@@ -80,38 +71,6 @@ public class AuthzImpl implements Authz {
return authenticationTag.getLastMessage();
}
/**
* implementation of AclTag
*
* @param domainObject DOCUMENT ME!
* @param permissions DOCUMENT ME!
*
* @return DOCUMENT ME!
*
* @throws IllegalArgumentException DOCUMENT ME!
*/
public boolean hasPermission(Object domainObject, String permissions) {
MyAclTag aclTag = new MyAclTag();
aclTag.setPageContext(null);
aclTag.setContext(getAppCtx());
aclTag.setDomainObject(domainObject);
aclTag.setHasPermission(permissions);
int result = -1;
try {
result = aclTag.doStartTag();
} catch (JspException je) {
throw new IllegalArgumentException(je.getMessage());
}
if (Tag.EVAL_BODY_INCLUDE == result) {
return true;
} else {
return false;
}
}
/**
* implementation of AuthorizeTag
*
@@ -166,8 +125,6 @@ public class AuthzImpl implements Authz {
/**
* test case can use this class to mock application context with aclManager bean in it.
*
* @param appCtx DOCUMENT ME!
*/
public void setAppCtx(ApplicationContext appCtx) {
this.appCtx = appCtx;
@@ -175,24 +132,6 @@ public class AuthzImpl implements Authz {
//~ Inner Classes ==================================================================================================
/**
* AclTag need to access the application context via the <code> WebApplicationContextUtils</code> and
* locate an {@link AclManager}. WebApplicationContextUtils get application context via ServletContext. I decided
* to let the Authz provide the Spring application context.
*/
private class MyAclTag extends AclTag {
private static final long serialVersionUID = 6752340622125924108L;
ApplicationContext context;
protected ApplicationContext getContext(PageContext pageContext) {
return context;
}
protected void setContext(ApplicationContext context) {
this.context = context;
}
}
/**
* it must output somthing to JSP page, so have to override the writeMessage method to avoid JSP related
* operation. Get Idea from Acegi Test class.
taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthenticationTagTests.java
+2 -1
View File
@@ -22,6 +22,7 @@ import org.springframework.security.GrantedAuthority;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.providers.TestingAuthenticationToken;
import org.springframework.security.userdetails.User;
import org.springframework.security.util.AuthorityUtils;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.Tag;
@@ -38,7 +39,7 @@ public class AuthenticationTagTests extends TestCase {
private final MyAuthenticationTag authenticationTag = new MyAuthenticationTag();
private final Authentication auth = new TestingAuthenticationToken(new User("rodUserDetails", "koala", true, true, true,
true, new GrantedAuthority[] {}), "koala", new GrantedAuthority[] {});
true, AuthorityUtils.NO_AUTHORITIES), "koala", AuthorityUtils.NO_AUTHORITIES);
//~ Methods ========================================================================================================
taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagExpressionLanguageTests.java
-2
View File
@@ -43,8 +43,6 @@ public class AuthorizeTagExpressionLanguageTests extends TestCase {
//~ Methods ========================================================================================================
protected void setUp() throws Exception {
super.setUp();
pageContext = new MockPageContext();
authorizeTag.setPageContext(pageContext);
taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplTest.java
-246
View File
@@ -1,246 +0,0 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.velocity;
import junit.framework.TestCase;
import org.springframework.security.Authentication;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.acl.AclEntry;
import org.springframework.security.acl.AclManager;
import org.springframework.security.acl.basic.SimpleAclEntry;
import org.springframework.security.acl.basic.AclObjectIdentity;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.providers.TestingAuthenticationToken;
import org.springframework.security.userdetails.User;
import org.springframework.context.ConfigurableApplicationContext;
import org.springframework.context.support.StaticApplicationContext;
public class AuthzImplTest extends TestCase {
//~ Instance fields ================================================================================================
private Authz authz = new AuthzImpl();
private ConfigurableApplicationContext ctx;
//~ Methods ========================================================================================================
protected void setUp() throws Exception {
super.setUp();
ctx = new StaticApplicationContext();
final AclEntry[] acls = new AclEntry[] {new MockAclEntry(),
new SimpleAclEntry("rod", new MockAclObjectIdentity(), null, SimpleAclEntry.ADMINISTRATION),
new SimpleAclEntry("rod", new MockAclObjectIdentity(), null, SimpleAclEntry.READ)
};
// Create an AclManager
AclManager aclManager = new AclManager() {
String object = "object1";
String principal = "rod";
public AclEntry[] getAcls(Object domainInstance) {
return domainInstance.equals(object) ? acls : null;
}
public AclEntry[] getAcls(Object domainInstance, Authentication authentication) {
return domainInstance.equals(object) && authentication.getPrincipal().equals(principal) ? acls : null;
}
};
// Register the AclManager into our ApplicationContext
ctx.getBeanFactory().registerSingleton("aclManager", aclManager);
}
protected void tearDown() throws Exception {
ctx.close();
}
public void testIllegalArgumentExceptionThrownIfHasPermissionNotValidFormat() {
Authentication auth = new TestingAuthenticationToken("john", "crow", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
authz.setAppCtx(ctx);
String permissions = "0,5, 6"; // shouldn't be any space
try {
authz.hasPermission(null, permissions);
} catch (IllegalArgumentException iae) {
assertTrue(true);
}
SecurityContextHolder.getContext().setAuthentication(null);
}
public void testInclusionDeniedWhenAclManagerUnawareOfObject() {
Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
authz.setAppCtx(ctx);
boolean result = authz.hasPermission(new Integer(54), new Long(SimpleAclEntry.ADMINISTRATION).toString());
assertFalse(result);
SecurityContextHolder.getContext().setAuthentication(null);
}
public void testInclusionDeniedWhenNoListOfPermissionsGiven() {
Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
authz.setAppCtx(ctx);
boolean result = authz.hasPermission("object1", null);
assertFalse(result);
SecurityContextHolder.getContext().setAuthentication(null);
}
public void testInclusionDeniedWhenPrincipalDoesNotHoldAnyPermissions() {
Authentication auth = new TestingAuthenticationToken("john", "crow", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
authz.setAppCtx(ctx);
String permissions = new Integer(SimpleAclEntry.ADMINISTRATION) + "," + new Integer(SimpleAclEntry.READ);
boolean result = authz.hasPermission("object1", permissions);
assertFalse(result);
SecurityContextHolder.getContext().setAuthentication(null);
}
public void testInclusionDeniedWhenPrincipalDoesNotHoldRequiredPermissions() {
Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
authz.setAppCtx(ctx);
String permissions = new Integer(SimpleAclEntry.DELETE).toString();
boolean result = authz.hasPermission("object1", permissions);
assertFalse(result);
SecurityContextHolder.getContext().setAuthentication(null);
}
public void testInclusionDeniedWhenSecurityContextEmpty() {
SecurityContextHolder.getContext().setAuthentication(null);
authz.setAppCtx(ctx);
String permissions = new Long(SimpleAclEntry.ADMINISTRATION).toString();
boolean result = authz.hasPermission("object1", permissions);
assertFalse(result);
SecurityContextHolder.getContext().setAuthentication(null);
}
public void testInclusionPermittedWhenDomainObjectIsNull() {
authz.setAppCtx(ctx);
String permissions = new Integer(SimpleAclEntry.READ).toString();
boolean result = authz.hasPermission(null, permissions);
assertTrue(result);
}
public void testOperationWhenPrincipalHoldsPermissionOfMultipleList() {
Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
authz.setAppCtx(ctx);
String permissions = new Integer(SimpleAclEntry.ADMINISTRATION) + "," + new Integer(SimpleAclEntry.READ);
boolean result = authz.hasPermission("object1", permissions);
assertTrue(result);
SecurityContextHolder.getContext().setAuthentication(null);
}
public void testOperationWhenPrincipalHoldsPermissionOfSingleList() {
Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
authz.setAppCtx(ctx);
String permissions = new Integer(SimpleAclEntry.READ).toString();
boolean result = authz.hasPermission("object1", permissions);
assertTrue(result);
SecurityContextHolder.getContext().setAuthentication(null);
}
/*
* Test method for 'com.alibaba.exodus2.web.common.security.pulltool.AuthzImpl.getPrincipal()'
*/
public void testOperationWhenPrincipalIsAString() {
Authentication auth = new TestingAuthenticationToken("rodAsString", "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
assertEquals("rodAsString", authz.getPrincipal());
}
public void testOperationWhenPrincipalIsAUserDetailsInstance() {
Authentication auth = new TestingAuthenticationToken(new User("rodUserDetails", "koala", true, true, true,
true, new GrantedAuthority[] {}), "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
assertEquals("rodUserDetails", authz.getPrincipal());
}
public void testOperationWhenPrincipalIsNull() {
Authentication auth = new TestingAuthenticationToken(null, "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
assertNull(authz.getPrincipal());
}
public void testOperationWhenSecurityContextIsNull() {
SecurityContextHolder.getContext().setAuthentication(null);
assertEquals(null, authz.getPrincipal());
SecurityContextHolder.getContext().setAuthentication(null);
}
//~ Inner Classes ==================================================================================================
private class MockAclEntry implements AclEntry {
private static final long serialVersionUID = 1L;
// just so AclTag iterates some different types of AclEntrys
}
private static class MockAclObjectIdentity implements AclObjectIdentity {
}
}
taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplTests.java
+64
View File
@@ -0,0 +1,64 @@
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.taglibs.velocity;
import junit.framework.TestCase;
import org.springframework.security.Authentication;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.providers.TestingAuthenticationToken;
import org.springframework.security.userdetails.User;
import org.springframework.security.util.AuthorityUtils;
public class AuthzImplTests extends TestCase {
//~ Instance fields ================================================================================================
private Authz authz = new AuthzImpl();
//~ Methods ========================================================================================================
public void testOperationWhenPrincipalIsAString() {
Authentication auth = new TestingAuthenticationToken("rodAsString", "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
assertEquals("rodAsString", authz.getPrincipal());
}
public void testOperationWhenPrincipalIsAUserDetailsInstance() {
Authentication auth = new TestingAuthenticationToken(new User("rodUserDetails", "koala", true, true, true,
true, AuthorityUtils.NO_AUTHORITIES), "koala", AuthorityUtils.NO_AUTHORITIES);
SecurityContextHolder.getContext().setAuthentication(auth);
assertEquals("rodUserDetails", authz.getPrincipal());
}
public void testOperationWhenPrincipalIsNull() {
Authentication auth = new TestingAuthenticationToken(null, "koala", new GrantedAuthority[] {});
SecurityContextHolder.getContext().setAuthentication(auth);
assertNull(authz.getPrincipal());
}
public void testOperationWhenSecurityContextIsNull() {
SecurityContextHolder.getContext().setAuthentication(null);
assertEquals(null, authz.getPrincipal());
SecurityContextHolder.getContext().setAuthentication(null);
}
}