Examples with RunAsManager org.springframework.security.access.intercept.RunAsManager used on opensource projects

Example 1 with RunAsManager

use of org.springframework.security.access.intercept.RunAsManager in project spring-security by spring-projects.

the class AspectJMethodSecurityInterceptorTests method invokeWithAspectJCallbackRunAsReplacementCleansAfterException.

// SEC-1967
@Test
@SuppressWarnings("unchecked")
public void invokeWithAspectJCallbackRunAsReplacementCleansAfterException() {
    SecurityContext ctx = SecurityContextHolder.getContext();
    ctx.setAuthentication(this.token);
    this.token.setAuthenticated(true);
    final RunAsManager runAs = mock(RunAsManager.class);
    final RunAsUserToken runAsToken = new RunAsUserToken("key", "someone", "creds", this.token.getAuthorities(), TestingAuthenticationToken.class);
    this.interceptor.setRunAsManager(runAs);
    given(runAs.buildRunAs(eq(this.token), any(MethodInvocation.class), any(List.class))).willReturn(runAsToken);
    given(this.aspectJCallback.proceedWithObject()).willThrow(new RuntimeException());
    assertThatExceptionOfType(RuntimeException.class).isThrownBy(() -> this.interceptor.invoke(this.joinPoint, this.aspectJCallback));
    // Check we've changed back
    assertThat(SecurityContextHolder.getContext()).isSameAs(ctx);
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isSameAs(this.token);
}

Example 2 with RunAsManager

use of org.springframework.security.access.intercept.RunAsManager in project spring-security by spring-projects.

the class AspectJMethodSecurityInterceptorTests method invokeRunAsReplacementCleansAfterException.

// SEC-1967
@Test
@SuppressWarnings("unchecked")
public void invokeRunAsReplacementCleansAfterException() throws Throwable {
    SecurityContext ctx = SecurityContextHolder.getContext();
    ctx.setAuthentication(this.token);
    this.token.setAuthenticated(true);
    final RunAsManager runAs = mock(RunAsManager.class);
    final RunAsUserToken runAsToken = new RunAsUserToken("key", "someone", "creds", this.token.getAuthorities(), TestingAuthenticationToken.class);
    this.interceptor.setRunAsManager(runAs);
    given(runAs.buildRunAs(eq(this.token), any(MethodInvocation.class), any(List.class))).willReturn(runAsToken);
    given(this.joinPoint.proceed()).willThrow(new RuntimeException());
    assertThatExceptionOfType(RuntimeException.class).isThrownBy(() -> this.interceptor.invoke(this.joinPoint));
    // Check we've changed back
    assertThat(SecurityContextHolder.getContext()).isSameAs(ctx);
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isSameAs(this.token);
}

Example 3 with RunAsManager

use of org.springframework.security.access.intercept.RunAsManager in project spring-security by spring-projects.

the class MethodSecurityInterceptorTests method intitalizationRejectsRunAsManagerThatDoesNotSupportMethodInvocation.

@Test
public void intitalizationRejectsRunAsManagerThatDoesNotSupportMethodInvocation() throws Exception {
    final RunAsManager ram = mock(RunAsManager.class);
    given(ram.supports(MethodInvocation.class)).willReturn(false);
    this.interceptor.setRunAsManager(ram);
    assertThatIllegalArgumentException().isThrownBy(() -> this.interceptor.afterPropertiesSet());
}

Example 4 with RunAsManager

use of org.springframework.security.access.intercept.RunAsManager in project spring-security by spring-projects.

the class MethodSecurityInterceptorTests method runAsReplacementCleansAfterException.

// SEC-1967
@Test
public void runAsReplacementCleansAfterException() {
    createTarget(true);
    given(this.realTarget.makeUpperCase(anyString())).willThrow(new RuntimeException());
    SecurityContext ctx = SecurityContextHolder.getContext();
    ctx.setAuthentication(this.token);
    this.token.setAuthenticated(true);
    final RunAsManager runAs = mock(RunAsManager.class);
    final RunAsUserToken runAsToken = new RunAsUserToken("key", "someone", "creds", this.token.getAuthorities(), TestingAuthenticationToken.class);
    this.interceptor.setRunAsManager(runAs);
    mdsReturnsUserRole();
    given(runAs.buildRunAs(eq(this.token), any(MethodInvocation.class), any(List.class))).willReturn(runAsToken);
    assertThatExceptionOfType(RuntimeException.class).isThrownBy(() -> this.advisedTarget.makeUpperCase("hello"));
    // Check we've changed back
    assertThat(SecurityContextHolder.getContext()).isSameAs(ctx);
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isSameAs(this.token);
}

Example 5 with RunAsManager

use of org.springframework.security.access.intercept.RunAsManager in project spring-security by spring-projects.

the class GlobalMethodSecurityConfiguration method methodSecurityInterceptor.

/**
	 * Creates the default MethodInterceptor which is a MethodSecurityInterceptor using
	 * the following methods to construct it.
	 * <ul>
	 * <li>{@link #accessDecisionManager()}</li>
	 * <li>{@link #afterInvocationManager()}</li>
	 * <li>{@link #authenticationManager()}</li>
	 * <li>{@link #methodSecurityMetadataSource()}</li>
	 * <li>{@link #runAsManager()}</li>
	 *
	 * </ul>
	 *
	 * <p>
	 * Subclasses can override this method to provide a different
	 * {@link MethodInterceptor}.
	 * </p>
	 *
	 * @return
	 * @throws Exception
	 */
@Bean
public MethodInterceptor methodSecurityInterceptor() throws Exception {
    this.methodSecurityInterceptor = isAspectJ() ? new AspectJMethodSecurityInterceptor() : new MethodSecurityInterceptor();
    methodSecurityInterceptor.setAccessDecisionManager(accessDecisionManager());
    methodSecurityInterceptor.setAfterInvocationManager(afterInvocationManager());
    methodSecurityInterceptor.setSecurityMetadataSource(methodSecurityMetadataSource());
    RunAsManager runAsManager = runAsManager();
    if (runAsManager != null) {
        methodSecurityInterceptor.setRunAsManager(runAsManager);
    }
    return this.methodSecurityInterceptor;
}