Search in sources :

Example 16 with AnonymousAuthenticationToken

use of org.springframework.security.authentication.AnonymousAuthenticationToken in project midpoint by Evolveum.

the class AbstractModelIntegrationTest method loginAnonymous.

protected void loginAnonymous() {
    Authentication authentication = new AnonymousAuthenticationToken("foo", "anonymousUser", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS"));
    SecurityContextHolder.getContext().setAuthentication(authentication);
}
Also used : Authentication(org.springframework.security.core.Authentication) AnonymousAuthenticationToken(org.springframework.security.authentication.AnonymousAuthenticationToken)

Example 17 with AnonymousAuthenticationToken

use of org.springframework.security.authentication.AnonymousAuthenticationToken in project spring-security by spring-projects.

the class CasAuthenticationFilterTests method testRequiresAuthenticationAuthAll.

@Test
public void testRequiresAuthenticationAuthAll() {
    ServiceProperties properties = new ServiceProperties();
    properties.setAuthenticateAllArtifacts(true);
    String url = "/login/cas";
    CasAuthenticationFilter filter = new CasAuthenticationFilter();
    filter.setFilterProcessesUrl(url);
    filter.setServiceProperties(properties);
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpServletResponse response = new MockHttpServletResponse();
    request.setServletPath(url);
    assertThat(filter.requiresAuthentication(request, response)).isTrue();
    request.setServletPath("/other");
    assertThat(filter.requiresAuthentication(request, response)).isFalse();
    request.setParameter(properties.getArtifactParameter(), "value");
    assertThat(filter.requiresAuthentication(request, response)).isTrue();
    SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("key", "principal", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
    assertThat(filter.requiresAuthentication(request, response)).isTrue();
    SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("un", "principal", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
    assertThat(filter.requiresAuthentication(request, response)).isTrue();
    SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("un", "principal", "ROLE_ANONYMOUS"));
    assertThat(filter.requiresAuthentication(request, response)).isFalse();
}
Also used : ServiceProperties(org.springframework.security.cas.ServiceProperties) MockHttpServletRequest(org.springframework.mock.web.MockHttpServletRequest) AnonymousAuthenticationToken(org.springframework.security.authentication.AnonymousAuthenticationToken) TestingAuthenticationToken(org.springframework.security.authentication.TestingAuthenticationToken) MockHttpServletResponse(org.springframework.mock.web.MockHttpServletResponse) Test(org.junit.Test)

Example 18 with AnonymousAuthenticationToken

use of org.springframework.security.authentication.AnonymousAuthenticationToken in project spring-security by spring-projects.

the class DefaultFilterChainValidator method checkLoginPageIsntProtected.

/*
	 * Checks for the common error of having a login page URL protected by the security
	 * interceptor
	 */
private void checkLoginPageIsntProtected(FilterChainProxy fcp, List<Filter> filterStack) {
    ExceptionTranslationFilter etf = getFilter(ExceptionTranslationFilter.class, filterStack);
    if (etf == null || !(etf.getAuthenticationEntryPoint() instanceof LoginUrlAuthenticationEntryPoint)) {
        return;
    }
    String loginPage = ((LoginUrlAuthenticationEntryPoint) etf.getAuthenticationEntryPoint()).getLoginFormUrl();
    logger.info("Checking whether login URL '" + loginPage + "' is accessible with your configuration");
    FilterInvocation loginRequest = new FilterInvocation(loginPage, "POST");
    List<Filter> filters = null;
    try {
        filters = fcp.getFilters(loginPage);
    } catch (Exception e) {
        // May happen legitimately if a filter-chain request matcher requires more
        // request data than that provided
        // by the dummy request used when creating the filter invocation.
        logger.info("Failed to obtain filter chain information for the login page. Unable to complete check.");
    }
    if (filters == null || filters.isEmpty()) {
        logger.debug("Filter chain is empty for the login page");
        return;
    }
    if (getFilter(DefaultLoginPageGeneratingFilter.class, filters) != null) {
        logger.debug("Default generated login page is in use");
        return;
    }
    FilterSecurityInterceptor fsi = getFilter(FilterSecurityInterceptor.class, filters);
    FilterInvocationSecurityMetadataSource fids = fsi.getSecurityMetadataSource();
    Collection<ConfigAttribute> attributes = fids.getAttributes(loginRequest);
    if (attributes == null) {
        logger.debug("No access attributes defined for login page URL");
        if (fsi.isRejectPublicInvocations()) {
            logger.warn("FilterSecurityInterceptor is configured to reject public invocations." + " Your login page may not be accessible.");
        }
        return;
    }
    AnonymousAuthenticationFilter anonPF = getFilter(AnonymousAuthenticationFilter.class, filters);
    if (anonPF == null) {
        logger.warn("The login page is being protected by the filter chain, but you don't appear to have" + " anonymous authentication enabled. This is almost certainly an error.");
        return;
    }
    // Simulate an anonymous access with the supplied attributes.
    AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("key", anonPF.getPrincipal(), anonPF.getAuthorities());
    try {
        fsi.getAccessDecisionManager().decide(token, loginRequest, attributes);
    } catch (AccessDeniedException e) {
        logger.warn("Anonymous access to the login page doesn't appear to be enabled. This is almost certainly " + "an error. Please check your configuration allows unauthenticated access to the configured " + "login page. (Simulated access was rejected: " + e + ")");
    } catch (Exception e) {
        // May happen legitimately if a filter-chain request matcher requires more
        // request data than that provided
        // by the dummy request used when creating the filter invocation. See SEC-1878
        logger.info("Unable to check access to the login page to determine if anonymous access is allowed. This might be an error, but can happen under normal circumstances.", e);
    }
}
Also used : DefaultLoginPageGeneratingFilter(org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter) AccessDeniedException(org.springframework.security.access.AccessDeniedException) ConfigAttribute(org.springframework.security.access.ConfigAttribute) FilterSecurityInterceptor(org.springframework.security.web.access.intercept.FilterSecurityInterceptor) ExceptionTranslationFilter(org.springframework.security.web.access.ExceptionTranslationFilter) AnonymousAuthenticationToken(org.springframework.security.authentication.AnonymousAuthenticationToken) LoginUrlAuthenticationEntryPoint(org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint) FilterInvocationSecurityMetadataSource(org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource) AccessDeniedException(org.springframework.security.access.AccessDeniedException) SecurityContextPersistenceFilter(org.springframework.security.web.context.SecurityContextPersistenceFilter) DefaultLoginPageGeneratingFilter(org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter) SessionManagementFilter(org.springframework.security.web.session.SessionManagementFilter) Filter(javax.servlet.Filter) JaasApiIntegrationFilter(org.springframework.security.web.jaasapi.JaasApiIntegrationFilter) AnonymousAuthenticationFilter(org.springframework.security.web.authentication.AnonymousAuthenticationFilter) BasicAuthenticationFilter(org.springframework.security.web.authentication.www.BasicAuthenticationFilter) SecurityContextHolderAwareRequestFilter(org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter) ExceptionTranslationFilter(org.springframework.security.web.access.ExceptionTranslationFilter) UsernamePasswordAuthenticationFilter(org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter) AnonymousAuthenticationFilter(org.springframework.security.web.authentication.AnonymousAuthenticationFilter) FilterInvocation(org.springframework.security.web.FilterInvocation)

Example 19 with AnonymousAuthenticationToken

use of org.springframework.security.authentication.AnonymousAuthenticationToken in project spring-security by spring-projects.

the class AnonymousAuthenticationProviderTests method testDetectsAnInvalidKey.

// ~ Methods
// ========================================================================================================
@Test
public void testDetectsAnInvalidKey() throws Exception {
    AnonymousAuthenticationProvider aap = new AnonymousAuthenticationProvider("qwerty");
    AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("WRONG_KEY", "Test", AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO"));
    try {
        aap.authenticate(token);
        fail("Should have thrown BadCredentialsException");
    } catch (BadCredentialsException expected) {
    }
}
Also used : AnonymousAuthenticationToken(org.springframework.security.authentication.AnonymousAuthenticationToken) BadCredentialsException(org.springframework.security.authentication.BadCredentialsException) AnonymousAuthenticationProvider(org.springframework.security.authentication.AnonymousAuthenticationProvider)

Example 20 with AnonymousAuthenticationToken

use of org.springframework.security.authentication.AnonymousAuthenticationToken in project spring-security by spring-projects.

the class AnonymousAuthenticationTokenTests method testEqualsWhenEqual.

@Test
public void testEqualsWhenEqual() {
    AnonymousAuthenticationToken token1 = new AnonymousAuthenticationToken("key", "Test", ROLES_12);
    AnonymousAuthenticationToken token2 = new AnonymousAuthenticationToken("key", "Test", ROLES_12);
    assertThat(token2).isEqualTo(token1);
}
Also used : AnonymousAuthenticationToken(org.springframework.security.authentication.AnonymousAuthenticationToken) Test(org.junit.Test)

Aggregations

AnonymousAuthenticationToken (org.springframework.security.authentication.AnonymousAuthenticationToken)40 Test (org.junit.Test)20 Authentication (org.springframework.security.core.Authentication)13 GrantedAuthority (org.springframework.security.core.GrantedAuthority)7 ArrayList (java.util.ArrayList)6 Before (org.junit.Before)6 SimpleGrantedAuthority (org.springframework.security.core.authority.SimpleGrantedAuthority)6 MockHttpServletRequest (org.springframework.mock.web.MockHttpServletRequest)5 MockHttpServletResponse (org.springframework.mock.web.MockHttpServletResponse)5 PrepareForTest (org.powermock.core.classloader.annotations.PrepareForTest)3 TestingAuthenticationToken (org.springframework.security.authentication.TestingAuthenticationToken)3 SecurityContext (org.springframework.security.core.context.SecurityContext)3 AccessDeniedException (org.springframework.security.access.AccessDeniedException)2 AnonymousAuthenticationProvider (org.springframework.security.authentication.AnonymousAuthenticationProvider)2 User (org.springframework.security.core.userdetails.User)2 UserDetails (org.springframework.security.core.userdetails.UserDetails)2 DefaultOAuth2AccessToken (org.springframework.security.oauth2.common.DefaultOAuth2AccessToken)2 OAuth2AccessToken (org.springframework.security.oauth2.common.OAuth2AccessToken)2 SecurityQuestionsAuthenticationContext (com.evolveum.midpoint.model.api.context.SecurityQuestionsAuthenticationContext)1 PrismObject (com.evolveum.midpoint.prism.PrismObject)1