Examples with FilterChain jakarta.servlet.FilterChain used on opensource projects

Example 71 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class OAuth2LoginAuthenticationFilterTests method doFilterWhenAuthorizationResponseAuthorizationRequestNotFoundThenAuthorizationRequestNotFoundError.

@Test
public void doFilterWhenAuthorizationResponseAuthorizationRequestNotFoundThenAuthorizationRequestNotFoundError() throws Exception {
    String requestUri = "/login/oauth2/code/" + this.registration2.getRegistrationId();
    MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
    request.setServletPath(requestUri);
    request.addParameter(OAuth2ParameterNames.CODE, "code");
    request.addParameter(OAuth2ParameterNames.STATE, "state");
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain filterChain = mock(FilterChain.class);
    this.filter.doFilter(request, response, filterChain);
    ArgumentCaptor<AuthenticationException> authenticationExceptionArgCaptor = ArgumentCaptor.forClass(AuthenticationException.class);
    verify(this.failureHandler).onAuthenticationFailure(any(HttpServletRequest.class), any(HttpServletResponse.class), authenticationExceptionArgCaptor.capture());
    assertThat(authenticationExceptionArgCaptor.getValue()).isInstanceOf(OAuth2AuthenticationException.class);
    OAuth2AuthenticationException authenticationException = (OAuth2AuthenticationException) authenticationExceptionArgCaptor.getValue();
    assertThat(authenticationException.getError().getErrorCode()).isEqualTo("authorization_request_not_found");
}

Example 72 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class SwitchUserFilterTests method switchToLockedAccountCausesRedirectToSwitchFailureUrl.

@Test
public void switchToLockedAccountCausesRedirectToSwitchFailureUrl() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setRequestURI("/login/impersonate");
    request.addParameter(SwitchUserFilter.SPRING_SECURITY_SWITCH_USERNAME_KEY, "mcgarrett");
    MockHttpServletResponse response = new MockHttpServletResponse();
    SwitchUserFilter filter = new SwitchUserFilter();
    filter.setTargetUrl("/target");
    filter.setUserDetailsService(new MockUserDetailsService());
    filter.afterPropertiesSet();
    // Check it with no url set (should get a text response)
    FilterChain chain = mock(FilterChain.class);
    filter.doFilter(request, response, chain);
    verify(chain, never()).doFilter(request, response);
    assertThat(response.getErrorMessage()).isNotNull();
    // Now check for the redirect
    request.setContextPath("/mywebapp");
    request.setRequestURI("/mywebapp/login/impersonate");
    filter = new SwitchUserFilter();
    filter.setTargetUrl("/target");
    filter.setUserDetailsService(new MockUserDetailsService());
    filter.setSwitchFailureUrl("/switchfailed");
    filter.afterPropertiesSet();
    response = new MockHttpServletResponse();
    chain = mock(FilterChain.class);
    filter.doFilter(request, response, chain);
    verify(chain, never()).doFilter(request, response);
    assertThat(response.getRedirectedUrl()).isEqualTo("/mywebapp/switchfailed");
    assertThat(FieldUtils.getFieldValue(filter, "switchFailureUrl")).isEqualTo("/switchfailed");
}

Example 73 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class SwitchUserFilterTests method exitUserJackLordToDanoSucceeds.

@Test
public void exitUserJackLordToDanoSucceeds() throws Exception {
    // original user
    UsernamePasswordAuthenticationToken source = new UsernamePasswordAuthenticationToken("dano", "hawaii50", ROLES_12);
    // set current user (Admin)
    List<GrantedAuthority> adminAuths = new ArrayList<>();
    adminAuths.addAll(ROLES_12);
    adminAuths.add(new SwitchUserGrantedAuthority("PREVIOUS_ADMINISTRATOR", source));
    UsernamePasswordAuthenticationToken admin = new UsernamePasswordAuthenticationToken("jacklord", "hawaii50", adminAuths);
    SecurityContextHolder.getContext().setAuthentication(admin);
    MockHttpServletRequest request = createMockSwitchRequest();
    request.setRequestURI("/logout/impersonate");
    // setup filter
    SwitchUserFilter filter = new SwitchUserFilter();
    filter.setUserDetailsService(new MockUserDetailsService());
    filter.setExitUserUrl("/logout/impersonate");
    filter.setSuccessHandler(new SimpleUrlAuthenticationSuccessHandler("/webapp/someOtherUrl"));
    // run 'exit'
    FilterChain chain = mock(FilterChain.class);
    MockHttpServletResponse response = new MockHttpServletResponse();
    filter.doFilter(request, response, chain);
    verify(chain, never()).doFilter(request, response);
    // check current user, should be back to original user (dano)
    Authentication targetAuth = SecurityContextHolder.getContext().getAuthentication();
    assertThat(targetAuth).isNotNull();
    assertThat(targetAuth.getPrincipal()).isEqualTo("dano");
}

Example 74 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class SwitchUserFilterTests method testSwitchRequestFromDanoToJackLord.

@Test
public void testSwitchRequestFromDanoToJackLord() throws Exception {
    // set current user
    UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken("dano", "hawaii50");
    SecurityContextHolder.getContext().setAuthentication(auth);
    // http request
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setRequestURI("/webapp/login/impersonate");
    request.setContextPath("/webapp");
    request.addParameter(SwitchUserFilter.SPRING_SECURITY_SWITCH_USERNAME_KEY, "jacklord");
    // http response
    MockHttpServletResponse response = new MockHttpServletResponse();
    // setup filter
    SwitchUserFilter filter = new SwitchUserFilter();
    filter.setUserDetailsService(new MockUserDetailsService());
    filter.setSwitchUserUrl("/login/impersonate");
    filter.setSuccessHandler(new SimpleUrlAuthenticationSuccessHandler("/webapp/someOtherUrl"));
    FilterChain chain = mock(FilterChain.class);
    // test updates user token and context
    filter.doFilter(request, response, chain);
    verify(chain, never()).doFilter(request, response);
    // check current user
    Authentication targetAuth = SecurityContextHolder.getContext().getAuthentication();
    assertThat(targetAuth).isNotNull();
    assertThat(targetAuth.getPrincipal() instanceof UserDetails).isTrue();
    assertThat(((User) targetAuth.getPrincipal()).getUsername()).isEqualTo("jacklord");
}

Example 75 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class SwitchUserFilterTests method redirectOmitsContextPathIfUseRelativeContextSet.

@Test
public void redirectOmitsContextPathIfUseRelativeContextSet() throws Exception {
    // set current user
    UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken("dano", "hawaii50");
    SecurityContextHolder.getContext().setAuthentication(auth);
    MockHttpServletRequest request = createMockSwitchRequest();
    request.setContextPath("/webapp");
    request.addParameter(SwitchUserFilter.SPRING_SECURITY_SWITCH_USERNAME_KEY, "jacklord");
    request.setRequestURI("/webapp/login/impersonate");
    SwitchUserFilter filter = new SwitchUserFilter();
    filter.setSwitchUserUrl("/login/impersonate");
    SimpleUrlAuthenticationSuccessHandler switchSuccessHandler = new SimpleUrlAuthenticationSuccessHandler("/someOtherUrl");
    DefaultRedirectStrategy contextRelativeRedirector = new DefaultRedirectStrategy();
    contextRelativeRedirector.setContextRelative(true);
    switchSuccessHandler.setRedirectStrategy(contextRelativeRedirector);
    filter.setSuccessHandler(switchSuccessHandler);
    filter.setUserDetailsService(new MockUserDetailsService());
    FilterChain chain = mock(FilterChain.class);
    MockHttpServletResponse response = new MockHttpServletResponse();
    filter.doFilter(request, response, chain);
    verify(chain, never()).doFilter(request, response);
    assertThat(response.getRedirectedUrl()).isEqualTo("/someOtherUrl");
}