Examples with SecurityConfig org.springframework.security.access.SecurityConfig used on opensource projects

Example 36 with SecurityConfig

use of org.springframework.security.access.SecurityConfig in project spring-security-oauth by spring-projects.

the class ScopeVoterTests method testAbstainIfNotOAuth2.

@Test
public void testAbstainIfNotOAuth2() throws Exception {
    Authentication clientAuthentication = new UsernamePasswordAuthenticationToken("foo", "bar");
    assertEquals(AccessDecisionVoter.ACCESS_ABSTAIN, voter.vote(clientAuthentication, null, Collections.<ConfigAttribute>singleton(new SecurityConfig("SCOPE_READ"))));
}

Example 37 with SecurityConfig

use of org.springframework.security.access.SecurityConfig in project spring-security-oauth by spring-projects.

the class ScopeVoterTests method testDenyIfOAuth2AndExplictlyDenied.

@Test
public void testDenyIfOAuth2AndExplictlyDenied() throws Exception {
    OAuth2Request clientAuthentication = RequestTokenFactory.createOAuth2Request("foo", false, Collections.singleton("read"));
    Authentication userAuthentication = null;
    OAuth2Authentication oAuth2Authentication = new OAuth2Authentication(clientAuthentication, userAuthentication);
    assertEquals(AccessDecisionVoter.ACCESS_DENIED, voter.vote(oAuth2Authentication, null, Collections.<ConfigAttribute>singleton(new SecurityConfig("DENY_OAUTH"))));
}

Example 38 with SecurityConfig

use of org.springframework.security.access.SecurityConfig in project spring-boot by spring-projects.

the class AuthorizationAuditListenerTests method testDetailsAreIncludedInAuditEvent.

@Test
public void testDetailsAreIncludedInAuditEvent() throws Exception {
    Object details = new Object();
    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken("user", "password");
    authentication.setDetails(details);
    AuditApplicationEvent event = handleAuthorizationEvent(new AuthorizationFailureEvent(this, Collections.<ConfigAttribute>singletonList(new SecurityConfig("USER")), authentication, new AccessDeniedException("Bad user")));
    assertThat(event.getAuditEvent().getType()).isEqualTo(AuthorizationAuditListener.AUTHORIZATION_FAILURE);
    assertThat(event.getAuditEvent().getData()).containsEntry("details", details);
}

Example 39 with SecurityConfig

use of org.springframework.security.access.SecurityConfig in project midpoint by Evolveum.

the class MidPointGuiAuthorizationEvaluator method addSecurityConfig.

private void addSecurityConfig(FilterInvocation filterInvocation, Collection<ConfigAttribute> guiConfigAttr, String url, DisplayableValue<String>[] actions) {
    AntPathRequestMatcher matcher = new AntPathRequestMatcher(url);
    if (!matcher.matches(filterInvocation.getRequest()) || actions == null) {
        return;
    }
    for (DisplayableValue<String> action : actions) {
        String actionUri = action.getValue();
        if (StringUtils.isBlank(actionUri)) {
            continue;
        }
        //all users has permission to access these resources
        if (action.equals(AuthorizationConstants.AUTZ_UI_PERMIT_ALL_URL)) {
            return;
        }
        SecurityConfig config = new SecurityConfig(actionUri);
        if (!guiConfigAttr.contains(config)) {
            guiConfigAttr.add(config);
        }
    }
}