Examples with ConfigAttribute org.springframework.security.access.ConfigAttribute used on opensource projects

Example 36 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-security-oauth by spring-projects.

the class ScopeVoterTests method testAccessDeniedIfWrongScopesPresent.

@Test
public void testAccessDeniedIfWrongScopesPresent() throws Exception {
    OAuth2Request clientAuthentication = RequestTokenFactory.createOAuth2Request("foo", false, Collections.singleton("read"));
    Authentication userAuthentication = null;
    OAuth2Authentication oAuth2Authentication = new OAuth2Authentication(clientAuthentication, userAuthentication);
    voter.setThrowException(false);
    assertEquals(AccessDecisionVoter.ACCESS_DENIED, voter.vote(oAuth2Authentication, null, Collections.<ConfigAttribute>singleton(new SecurityConfig("SCOPE_WRITE"))));
}

Example 37 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-security-oauth by spring-projects.

the class ClientScopeVoter method vote.

public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    int result = ACCESS_ABSTAIN;
    if (!(authentication instanceof OAuth2Authentication)) {
        return result;
    }
    OAuth2Authentication oauth2Authentication = (OAuth2Authentication) authentication;
    OAuth2Request clientAuthentication = oauth2Authentication.getOAuth2Request();
    ClientDetails client = clientDetailsService.loadClientByClientId(clientAuthentication.getClientId());
    Set<String> scopes = clientAuthentication.getScope();
    if (oauth2Authentication.isClientOnly() && clientAuthoritiesAreScopes) {
        scopes = AuthorityUtils.authorityListToSet(clientAuthentication.getAuthorities());
    }
    for (ConfigAttribute attribute : attributes) {
        if (this.supports(attribute)) {
            result = ACCESS_GRANTED;
            for (String scope : scopes) {
                if (!client.getScope().contains(scope)) {
                    result = ACCESS_DENIED;
                    break;
                }
            }
            if (result == ACCESS_DENIED && throwException) {
                InsufficientScopeException failure = new InsufficientScopeException("Insufficient scope for this resource", client.getScope());
                throw new AccessDeniedException(failure.getMessage(), failure);
            }
            return result;
        }
    }
    return result;
}

Example 38 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project midpoint by Evolveum.

the class AbstractModelIntegrationTest method createConfigAttributes.

protected Collection<ConfigAttribute> createConfigAttributes(String action) {
    Collection<ConfigAttribute> attrs = new ArrayList<ConfigAttribute>();
    attrs.add(new SecurityConfig(action));
    return attrs;
}

Example 39 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-boot by spring-projects.

the class AuthorizationAuditListenerTests method testAuthenticationCredentialsNotFound.

@Test
public void testAuthenticationCredentialsNotFound() {
    AuditApplicationEvent event = handleAuthorizationEvent(new AuthenticationCredentialsNotFoundEvent(this, Collections.<ConfigAttribute>singletonList(new SecurityConfig("USER")), new AuthenticationCredentialsNotFoundException("Bad user")));
    assertThat(event.getAuditEvent().getType()).isEqualTo(AuthenticationAuditListener.AUTHENTICATION_FAILURE);
}

Example 40 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-boot by spring-projects.

the class AuthorizationAuditListenerTests method testAuthorizationFailure.

@Test
public void testAuthorizationFailure() {
    AuditApplicationEvent event = handleAuthorizationEvent(new AuthorizationFailureEvent(this, Collections.<ConfigAttribute>singletonList(new SecurityConfig("USER")), new UsernamePasswordAuthenticationToken("user", "password"), new AccessDeniedException("Bad user")));
    assertThat(event.getAuditEvent().getType()).isEqualTo(AuthorizationAuditListener.AUTHORIZATION_FAILURE);
}