Examples with AuthorizationDecision org.springframework.security.authorization.AuthorizationDecision used on opensource projects

Example 36 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class SecuredAuthorizationManagerTests method checkSecuredUserOrAdminWhenRoleAnonymousThenDeniedDecision.

@Test
public void checkSecuredUserOrAdminWhenRoleAnonymousThenDeniedDecision() throws Exception {
    Supplier<Authentication> authentication = () -> new TestingAuthenticationToken("user", "password", "ROLE_ANONYMOUS");
    MockMethodInvocation methodInvocation = new MockMethodInvocation(new TestClass(), TestClass.class, "securedUserOrAdmin");
    SecuredAuthorizationManager manager = new SecuredAuthorizationManager();
    AuthorizationDecision decision = manager.check(authentication, methodInvocation);
    assertThat(decision).isNotNull();
    assertThat(decision.isGranted()).isFalse();
}

Example 37 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class AuthorizationWebFilterTests method filterWhenGrantedAndDoeAccessAuthenticationThenChainSubscribedAndSecurityContextSubscribed.

@Test
public void filterWhenGrantedAndDoeAccessAuthenticationThenChainSubscribedAndSecurityContextSubscribed() {
    PublisherProbe<SecurityContext> context = PublisherProbe.empty();
    given(this.chain.filter(this.exchange)).willReturn(this.chainResult.mono());
    AuthorizationWebFilter filter = new AuthorizationWebFilter((a, e) -> a.map((auth) -> new AuthorizationDecision(true)).defaultIfEmpty(new AuthorizationDecision(true)));
    Mono<Void> result = filter.filter(this.exchange, this.chain).subscriberContext(ReactiveSecurityContextHolder.withSecurityContext(context.mono()));
    StepVerifier.create(result).verifyComplete();
    this.chainResult.assertWasSubscribed();
    context.assertWasSubscribed();
}

Example 38 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class RequestMatcherDelegatingAuthorizationManagerTests method checkWhenMultipleMappingsConfiguredThenDelegatesMatchingManager.

@Test
public void checkWhenMultipleMappingsConfiguredThenDelegatesMatchingManager() {
    RequestMatcherDelegatingAuthorizationManager manager = RequestMatcherDelegatingAuthorizationManager.builder().add(new MvcRequestMatcher(null, "/grant"), (a, o) -> new AuthorizationDecision(true)).add(new MvcRequestMatcher(null, "/deny"), (a, o) -> new AuthorizationDecision(false)).add(new MvcRequestMatcher(null, "/neutral"), (a, o) -> null).build();
    Supplier<Authentication> authentication = () -> new TestingAuthenticationToken("user", "password", "ROLE_USER");
    AuthorizationDecision grant = manager.check(authentication, new MockHttpServletRequest(null, "/grant"));
    assertThat(grant).isNotNull();
    assertThat(grant.isGranted()).isTrue();
    AuthorizationDecision deny = manager.check(authentication, new MockHttpServletRequest(null, "/deny"));
    assertThat(deny).isNotNull();
    assertThat(deny.isGranted()).isFalse();
    AuthorizationDecision neutral = manager.check(authentication, new MockHttpServletRequest(null, "/neutral"));
    assertThat(neutral).isNull();
    AuthorizationDecision abstain = manager.check(authentication, new MockHttpServletRequest(null, "/abstain"));
    assertThat(abstain).isNull();
}

Example 39 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class AuthorizationManagerWebInvocationPrivilegeEvaluatorTests method isAllowedWhenAuthorizationManagerDeniesAllowedFalse.

@Test
void isAllowedWhenAuthorizationManagerDeniesAllowedFalse() {
    given(this.authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(false));
    boolean allowed = this.privilegeEvaluator.isAllowed("/test", TestAuthentication.authenticatedUser());
    assertThat(allowed).isFalse();
}