Introduced ReactiveAuthenticationManagerResolver

Suitable for multi-tenant reactive applications needing to branch
authentication strategies based on request details.

web/src/main/java/org/springframework/security/web/server/authentication/AuthenticationWebFilter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,9 @@ package org.springframework.security.web.server.authentication;
 
 import java.util.function.Function;
 
+import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.authentication.ReactiveAuthenticationManagerResolver;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.context.ReactiveSecurityContextHolder;
@@ -51,6 +53,11 @@ import reactor.core.publisher.Mono;
  *     The {@link ReactiveAuthenticationManager} specified in
  *     {@link #AuthenticationWebFilter(ReactiveAuthenticationManager)} is used to perform authentication.
  * </li>
+ *<li>
+ *     The {@link ReactiveAuthenticationManagerResolver} specified in
+ *     {@link #AuthenticationWebFilter(ReactiveAuthenticationManagerResolver)} is used to resolve the appropriate
+ *     authentication manager from context to perform authentication.
+ * </li>
  * <li>
  *     If authentication is successful, {@link ServerAuthenticationSuccessHandler} is invoked and the authentication
  *     is set on {@link ReactiveSecurityContextHolder}, else {@link ServerAuthenticationFailureHandler} is invoked
@@ -58,11 +65,11 @@ import reactor.core.publisher.Mono;
  * </ul>
  *
  * @author Rob Winch
+ * @author Rafiullah Hamedy
  * @since 5.0
  */
 public class AuthenticationWebFilter implements WebFilter {
-
-	private final ReactiveAuthenticationManager authenticationManager;
+	private final ReactiveAuthenticationManagerResolver<ServerHttpRequest> authenticationManagerResolver;
 
 	private ServerAuthenticationSuccessHandler authenticationSuccessHandler = new WebFilterChainServerAuthenticationSuccessHandler();
 
@@ -80,7 +87,17 @@ public class AuthenticationWebFilter implements WebFilter {
 	 */
 	public AuthenticationWebFilter(ReactiveAuthenticationManager authenticationManager) {
 		Assert.notNull(authenticationManager, "authenticationManager cannot be null");
-		this.authenticationManager = authenticationManager;
+		this.authenticationManagerResolver = request -> Mono.just(authenticationManager);
+	}
+
+	/**
+	 * Creates an instance
+	 * @param authenticationManagerResolver the authentication manager resolver to use
+	 * @since 5.2
+	 */
+	public AuthenticationWebFilter(ReactiveAuthenticationManagerResolver<ServerHttpRequest> authenticationManagerResolver) {
+		Assert.notNull(authenticationManagerResolver, "authenticationResolverManager cannot be null");
+		this.authenticationManagerResolver = authenticationManagerResolver;
 	}
 
 	@Override
@@ -95,7 +112,9 @@ public class AuthenticationWebFilter implements WebFilter {
 	private Mono<Void> authenticate(ServerWebExchange exchange,
 		WebFilterChain chain, Authentication token) {
 		WebFilterExchange webFilterExchange = new WebFilterExchange(exchange, chain);
-		return this.authenticationManager.authenticate(token)
+
+		return this.authenticationManagerResolver.resolve(exchange.getRequest())
+			.flatMap(authenticationManager -> authenticationManager.authenticate(token))
 			.switchIfEmpty(Mono.defer(() -> Mono.error(new IllegalStateException("No provider found for " + token.getClass()))))
 			.flatMap(authentication -> onAuthenticationSuccess(authentication, webFilterExchange))
 			.onErrorResume(AuthenticationException.class, e -> this.authenticationFailureHandler

web/src/test/java/org/springframework/security/web/server/authentication/AuthenticationWebFilterTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,8 +23,10 @@ import org.mockito.Mock;
 import org.mockito.junit.MockitoJUnitRunner;
 import reactor.core.publisher.Mono;
 
+import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.authentication.ReactiveAuthenticationManagerResolver;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.test.web.reactive.server.WebTestClientBuilder;
@@ -40,6 +42,7 @@ import static org.mockito.Mockito.*;
 
 /**
  * @author Rob Winch
+ * @author Rafiullah Hamedy
  * @since 5.0
  */
 @RunWith(MockitoJUnitRunner.class)
@@ -54,6 +57,8 @@ public class AuthenticationWebFilterTests {
 	private ServerAuthenticationFailureHandler failureHandler;
 	@Mock
 	private ServerSecurityContextRepository securityContextRepository;
+	@Mock
+	private ReactiveAuthenticationManagerResolver<ServerHttpRequest> authenticationManagerResolver;
 
 	private AuthenticationWebFilter filter;
 
@@ -85,6 +90,25 @@ public class AuthenticationWebFilterTests {
 		assertThat(result.getResponseCookies()).isEmpty();
 	}
 
+	@Test
+	public void filterWhenAuthenticationManagerResolverDefaultsAndNoAuthenticationThenContinues() {
+		this.filter = new AuthenticationWebFilter(this.authenticationManagerResolver);
+
+		WebTestClient client = WebTestClientBuilder
+			.bindToWebFilters(this.filter)
+			.build();
+
+		EntityExchangeResult<String> result = client.get()
+			.uri("/")
+			.exchange()
+			.expectStatus().isOk()
+			.expectBody(String.class).consumeWith(b -> assertThat(b.getResponseBody()).isEqualTo("ok"))
+			.returnResult();
+
+		verifyZeroInteractions(this.authenticationManagerResolver);
+		assertThat(result.getResponseCookies()).isEmpty();
+	}
+
 	@Test
 	public void filterWhenDefaultsAndAuthenticationSuccessThenContinues() {
 		when(this.authenticationManager.authenticate(any())).thenReturn(Mono.just(new TestingAuthenticationToken("test", "this", "ROLE")));
@@ -106,6 +130,29 @@ public class AuthenticationWebFilterTests {
 		assertThat(result.getResponseCookies()).isEmpty();
 	}
 
+	@Test
+	public void filterWhenAuthenticationManagerResolverDefaultsAndAuthenticationSuccessThenContinues() {
+		when(this.authenticationManager.authenticate(any())).thenReturn(Mono.just(new TestingAuthenticationToken("test", "this", "ROLE")));
+		when(this.authenticationManagerResolver.resolve(any())).thenReturn(Mono.just(this.authenticationManager));
+
+		this.filter = new AuthenticationWebFilter(this.authenticationManagerResolver);
+
+		WebTestClient client = WebTestClientBuilder
+			.bindToWebFilters(this.filter)
+			.build();
+
+		EntityExchangeResult<String> result = client
+			.get()
+			.uri("/")
+			.headers(headers -> headers.setBasicAuth("test", "this"))
+			.exchange()
+			.expectStatus().isOk()
+			.expectBody(String.class).consumeWith(b -> assertThat(b.getResponseBody()).isEqualTo("ok"))
+			.returnResult();
+
+		assertThat(result.getResponseCookies()).isEmpty();
+	}
+
 	@Test
 	public void filterWhenDefaultsAndAuthenticationFailThenUnauthorized() {
 		when(this.authenticationManager.authenticate(any())).thenReturn(Mono.error(new BadCredentialsException("failed")));
@@ -127,6 +174,29 @@ public class AuthenticationWebFilterTests {
 		assertThat(result.getResponseCookies()).isEmpty();
 	}
 
+	@Test
+	public void filterWhenAuthenticationManagerResolverDefaultsAndAuthenticationFailThenUnauthorized() {
+		when(this.authenticationManager.authenticate(any())).thenReturn(Mono.error(new BadCredentialsException("failed")));
+		when(this.authenticationManagerResolver.resolve(any())).thenReturn(Mono.just(this.authenticationManager));
+
+		this.filter = new AuthenticationWebFilter(this.authenticationManagerResolver);
+
+		WebTestClient client = WebTestClientBuilder
+			.bindToWebFilters(this.filter)
+			.build();
+
+		EntityExchangeResult<Void> result = client
+			.get()
+			.uri("/")
+			.headers(headers -> headers.setBasicAuth("test", "this"))
+			.exchange()
+			.expectStatus().isUnauthorized()
+			.expectHeader().valueMatches("WWW-Authenticate", "Basic realm=\"Realm\"")
+			.expectBody().isEmpty();
+
+		assertThat(result.getResponseCookies()).isEmpty();
+	}
+
 	@Test
 	public void filterWhenConvertEmptyThenOk() {
 		when(this.authenticationConverter.convert(any())).thenReturn(Mono.empty());