Search in sources :

Example 46 with AnnotationConfigServletWebServerApplicationContext

use of org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext in project spring-boot by spring-projects.

the class OAuth2AutoConfigurationTests method testAuthorizationServerOverride.

@Test
public void testAuthorizationServerOverride() {
    this.context = new AnnotationConfigServletWebServerApplicationContext();
    EnvironmentTestUtils.addEnvironment(this.context, "security.oauth2.resourceId:resource-id");
    this.context.register(AuthorizationAndResourceServerConfiguration.class, CustomAuthorizationServer.class, MinimalSecureWebApplication.class);
    this.context.refresh();
    BaseClientDetails config = new BaseClientDetails();
    config.setClientId("client");
    config.setClientSecret("secret");
    config.setResourceIds(Arrays.asList("resource-id"));
    config.setAuthorizedGrantTypes(Arrays.asList("password"));
    config.setAuthorities(AuthorityUtils.commaSeparatedStringToAuthorityList("USER"));
    config.setScope(Arrays.asList("read"));
    assertThat(countBeans(AUTHORIZATION_SERVER_CONFIG)).isEqualTo(0);
    assertThat(countBeans(RESOURCE_SERVER_CONFIG)).isEqualTo(1);
    verifyAuthentication(config);
}
Also used : BaseClientDetails(org.springframework.security.oauth2.provider.client.BaseClientDetails) AnnotationConfigServletWebServerApplicationContext(org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext) Test(org.junit.Test)

Example 47 with AnnotationConfigServletWebServerApplicationContext

use of org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext in project spring-boot by spring-projects.

the class OAuth2AutoConfigurationTests method methodSecurityExpressionHandlerIsConfiguredWithPermissionEvaluatorFromTheContext.

@Test
public void methodSecurityExpressionHandlerIsConfiguredWithPermissionEvaluatorFromTheContext() {
    this.context = new AnnotationConfigServletWebServerApplicationContext();
    this.context.register(PermissionEvaluatorConfiguration.class, AuthorizationAndResourceServerConfiguration.class, MinimalSecureWebApplication.class);
    this.context.refresh();
    PreInvocationAuthorizationAdvice advice = this.context.getBean(PreInvocationAuthorizationAdvice.class);
    MethodSecurityExpressionHandler expressionHandler = (MethodSecurityExpressionHandler) ReflectionTestUtils.getField(advice, "expressionHandler");
    PermissionEvaluator permissionEvaluator = (PermissionEvaluator) ReflectionTestUtils.getField(expressionHandler, "permissionEvaluator");
    assertThat(permissionEvaluator).isSameAs(this.context.getBean(PermissionEvaluator.class));
}
Also used : PreInvocationAuthorizationAdvice(org.springframework.security.access.prepost.PreInvocationAuthorizationAdvice) PermissionEvaluator(org.springframework.security.access.PermissionEvaluator) AnnotationConfigServletWebServerApplicationContext(org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext) OAuth2MethodSecurityExpressionHandler(org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler) MethodSecurityExpressionHandler(org.springframework.security.access.expression.method.MethodSecurityExpressionHandler) Test(org.junit.Test)

Example 48 with AnnotationConfigServletWebServerApplicationContext

use of org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext in project spring-boot by spring-projects.

the class OAuth2AutoConfigurationTests method methodSecurityExpressionHandlerIsConfiguredWithRoleHierarchyFromTheContext.

@Test
public void methodSecurityExpressionHandlerIsConfiguredWithRoleHierarchyFromTheContext() {
    this.context = new AnnotationConfigServletWebServerApplicationContext();
    this.context.register(RoleHierarchyConfiguration.class, AuthorizationAndResourceServerConfiguration.class, MinimalSecureWebApplication.class);
    this.context.refresh();
    PreInvocationAuthorizationAdvice advice = this.context.getBean(PreInvocationAuthorizationAdvice.class);
    MethodSecurityExpressionHandler expressionHandler = (MethodSecurityExpressionHandler) ReflectionTestUtils.getField(advice, "expressionHandler");
    RoleHierarchy roleHierarchy = (RoleHierarchy) ReflectionTestUtils.getField(expressionHandler, "roleHierarchy");
    assertThat(roleHierarchy).isSameAs(this.context.getBean(RoleHierarchy.class));
}
Also used : PreInvocationAuthorizationAdvice(org.springframework.security.access.prepost.PreInvocationAuthorizationAdvice) AnnotationConfigServletWebServerApplicationContext(org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext) RoleHierarchy(org.springframework.security.access.hierarchicalroles.RoleHierarchy) OAuth2MethodSecurityExpressionHandler(org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler) MethodSecurityExpressionHandler(org.springframework.security.access.expression.method.MethodSecurityExpressionHandler) Test(org.junit.Test)

Example 49 with AnnotationConfigServletWebServerApplicationContext

use of org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext in project spring-boot by spring-projects.

the class OAuth2AutoConfigurationTests method testDefaultConfiguration.

@Test
public void testDefaultConfiguration() {
    this.context = new AnnotationConfigServletWebServerApplicationContext();
    this.context.register(AuthorizationAndResourceServerConfiguration.class, MinimalSecureWebApplication.class);
    this.context.refresh();
    this.context.getBean(AUTHORIZATION_SERVER_CONFIG);
    this.context.getBean(RESOURCE_SERVER_CONFIG);
    this.context.getBean(OAuth2MethodSecurityConfiguration.class);
    ClientDetails config = this.context.getBean(BaseClientDetails.class);
    AuthorizationEndpoint endpoint = this.context.getBean(AuthorizationEndpoint.class);
    UserApprovalHandler handler = (UserApprovalHandler) ReflectionTestUtils.getField(endpoint, "userApprovalHandler");
    ClientDetailsService clientDetailsService = this.context.getBean(ClientDetailsService.class);
    ClientDetails clientDetails = clientDetailsService.loadClientByClientId(config.getClientId());
    assertThat(AopUtils.isJdkDynamicProxy(clientDetailsService)).isTrue();
    assertThat(AopUtils.getTargetClass(clientDetailsService).getName()).isEqualTo(InMemoryClientDetailsService.class.getName());
    assertThat(handler).isInstanceOf(ApprovalStoreUserApprovalHandler.class);
    assertThat(clientDetails).isEqualTo(config);
    verifyAuthentication(config);
    assertThat(this.context.getBeanNamesForType(OAuth2RestOperations.class)).isEmpty();
}
Also used : InMemoryClientDetailsService(org.springframework.security.oauth2.provider.client.InMemoryClientDetailsService) BaseClientDetails(org.springframework.security.oauth2.provider.client.BaseClientDetails) ClientDetails(org.springframework.security.oauth2.provider.ClientDetails) AnnotationConfigServletWebServerApplicationContext(org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext) ApprovalStoreUserApprovalHandler(org.springframework.security.oauth2.provider.approval.ApprovalStoreUserApprovalHandler) UserApprovalHandler(org.springframework.security.oauth2.provider.approval.UserApprovalHandler) AuthorizationEndpoint(org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint) ClientDetailsService(org.springframework.security.oauth2.provider.ClientDetailsService) InMemoryClientDetailsService(org.springframework.security.oauth2.provider.client.InMemoryClientDetailsService) Test(org.junit.Test)

Example 50 with AnnotationConfigServletWebServerApplicationContext

use of org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext in project spring-boot by spring-projects.

the class OAuth2AutoConfigurationTests method testDisablingAuthorizationServer.

@Test
public void testDisablingAuthorizationServer() {
    this.context = new AnnotationConfigServletWebServerApplicationContext();
    this.context.register(ResourceServerConfiguration.class, MinimalSecureWebApplication.class);
    EnvironmentTestUtils.addEnvironment(this.context, "security.oauth2.resource.jwt.keyValue:DEADBEEF");
    this.context.refresh();
    assertThat(countBeans(RESOURCE_SERVER_CONFIG)).isEqualTo(1);
    assertThat(countBeans(AUTHORIZATION_SERVER_CONFIG)).isEqualTo(0);
    assertThat(countBeans(UserApprovalHandler.class)).isEqualTo(0);
    assertThat(countBeans(DefaultTokenServices.class)).isEqualTo(1);
}
Also used : AnnotationConfigServletWebServerApplicationContext(org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext) Test(org.junit.Test)

Aggregations

AnnotationConfigServletWebServerApplicationContext (org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext)52 Test (org.junit.Test)41 DispatcherServlet (org.springframework.web.servlet.DispatcherServlet)8 BaseClientDetails (org.springframework.security.oauth2.provider.client.BaseClientDetails)7 ClientDetails (org.springframework.security.oauth2.provider.ClientDetails)6 Jsr250MethodSecurityMetadataSource (org.springframework.security.access.annotation.Jsr250MethodSecurityMetadataSource)4 DelegatingMethodSecurityMetadataSource (org.springframework.security.access.method.DelegatingMethodSecurityMetadataSource)4 MethodSecurityMetadataSource (org.springframework.security.access.method.MethodSecurityMetadataSource)4 ServerPortInfoApplicationContextInitializer (org.springframework.boot.web.context.ServerPortInfoApplicationContextInitializer)3 ServletContextEvent (javax.servlet.ServletContextEvent)2 ServletContextListener (javax.servlet.ServletContextListener)2 MethodSecurityExpressionHandler (org.springframework.security.access.expression.method.MethodSecurityExpressionHandler)2 PreInvocationAuthorizationAdvice (org.springframework.security.access.prepost.PreInvocationAuthorizationAdvice)2 PrePostAnnotationSecurityMetadataSource (org.springframework.security.access.prepost.PrePostAnnotationSecurityMetadataSource)2 OAuth2ClientContext (org.springframework.security.oauth2.client.OAuth2ClientContext)2 OAuth2MethodSecurityExpressionHandler (org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler)2 RestTemplate (org.springframework.web.client.RestTemplate)2 StandardServletMultipartResolver (org.springframework.web.multipart.support.StandardServletMultipartResolver)2 URL (java.net.URL)1 ArrayList (java.util.ArrayList)1