Examples with SecurityFilterChain org.springframework.security.web.SecurityFilterChain used on opensource projects

Example 31 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project spring-security by spring-projects.

the class WebSecurityConfigurationTests method loadConfigWhenWebSecurityCustomizerAndWebSecurityConfigurerAdapterThenFilterChainsOrdered.

@Test
public void loadConfigWhenWebSecurityCustomizerAndWebSecurityConfigurerAdapterThenFilterChainsOrdered() {
    this.spring.register(CustomizerAndAdapterConfig.class).autowire();
    FilterChainProxy filterChainProxy = this.spring.getContext().getBean(FilterChainProxy.class);
    List<SecurityFilterChain> filterChains = filterChainProxy.getFilterChains();
    assertThat(filterChains).hasSize(3);
    MockHttpServletRequest request = new MockHttpServletRequest("GET", "");
    request.setServletPath("/ignore1");
    assertThat(filterChains.get(0).matches(request)).isTrue();
    assertThat(filterChains.get(0).getFilters()).isEmpty();
    request.setServletPath("/ignore2");
    assertThat(filterChains.get(1).matches(request)).isTrue();
    assertThat(filterChains.get(1).getFilters()).isEmpty();
    request.setServletPath("/role1/**");
    assertThat(filterChains.get(2).matches(request)).isTrue();
    request.setServletPath("/test/**");
    assertThat(filterChains.get(2).matches(request)).isFalse();
}

Example 32 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project spring-security by spring-projects.

the class WebSecurityConfigurationTests method loadConfigWhenOnlyWebSecurityCustomizerThenDefaultFilterChainCreated.

@Test
public void loadConfigWhenOnlyWebSecurityCustomizerThenDefaultFilterChainCreated() {
    this.spring.register(WebSecurityCustomizerConfig.class).autowire();
    FilterChainProxy filterChainProxy = this.spring.getContext().getBean(FilterChainProxy.class);
    List<SecurityFilterChain> filterChains = filterChainProxy.getFilterChains();
    assertThat(filterChains).hasSize(3);
    MockHttpServletRequest request = new MockHttpServletRequest("GET", "");
    request.setServletPath("/ignore1");
    assertThat(filterChains.get(0).matches(request)).isTrue();
    assertThat(filterChains.get(0).getFilters()).isEmpty();
    request.setServletPath("/ignore2");
    assertThat(filterChains.get(1).matches(request)).isTrue();
    assertThat(filterChains.get(1).getFilters()).isEmpty();
    request.setServletPath("/test/**");
    assertThat(filterChains.get(2).matches(request)).isTrue();
}

Example 33 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project spring-security by spring-projects.

the class WebSecurityConfigurationTests method loadConfigWhenSecurityFilterChainsHaveOrderThenFilterChainsOrdered.

@Test
public void loadConfigWhenSecurityFilterChainsHaveOrderThenFilterChainsOrdered() {
    this.spring.register(SortedSecurityFilterChainConfig.class).autowire();
    FilterChainProxy filterChainProxy = this.spring.getContext().getBean(FilterChainProxy.class);
    List<SecurityFilterChain> filterChains = filterChainProxy.getFilterChains();
    assertThat(filterChains).hasSize(4);
    MockHttpServletRequest request = new MockHttpServletRequest("GET", "");
    request.setServletPath("/role1/**");
    assertThat(filterChains.get(0).matches(request)).isTrue();
    request.setServletPath("/role2/**");
    assertThat(filterChains.get(1).matches(request)).isTrue();
    request.setServletPath("/role3/**");
    assertThat(filterChains.get(2).matches(request)).isTrue();
    request.setServletPath("/**");
    assertThat(filterChains.get(3).matches(request)).isTrue();
}

Example 34 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project midpoint by Evolveum.

the class MidpointWebSecurityConfiguration method springSecurityFilterChain.

@Override
public Filter springSecurityFilterChain() throws Exception {
    Filter filter = super.springSecurityFilterChain();
    if (filter instanceof FilterChainProxy) {
        List<SecurityFilterChain> filters;
        if (!((FilterChainProxy) filter).getFilterChains().isEmpty()) {
            filters = new ArrayList<SecurityFilterChain>();
            filters.addAll(((FilterChainProxy) filter).getFilterChains());
        // filters.remove(filters.size() - 1);
        } else {
            filters = ((FilterChainProxy) filter).getFilterChains();
        }
        MidpointFilterChainProxy mpFilter = objectObjectPostProcessor.postProcess(new MidpointFilterChainProxy(filters));
        if (firewall != null) {
            mpFilter.setFirewall(firewall);
        }
        mpFilter.afterPropertiesSet();
        return mpFilter;
    }
    return filter;
}

Example 35 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project midpoint by Evolveum.

the class OidcResourceServerModuleFactory method createModuleFilter.

@Override
public AuthModule createModuleFilter(AbstractAuthenticationModuleType moduleType, String sequenceSuffix, ServletRequest request, Map<Class<?>, Object> sharedObjects, AuthenticationModulesType authenticationsPolicy, CredentialsPolicyType credentialPolicy, AuthenticationChannel authenticationChannel) throws Exception {
    if (!(moduleType instanceof OidcAuthenticationModuleType)) {
        LOGGER.error("This factory support only OidcAuthenticationModuleType, but modelType is " + moduleType);
        return null;
    }
    if (((OidcAuthenticationModuleType) moduleType).getResourceServer() == null) {
        LOGGER.error("Resource configuration of OidcAuthenticationModuleType is null");
        return null;
    }
    isSupportedChannel(authenticationChannel);
    OidcResourceServerModuleWebSecurityConfiguration.setProtector(getProtector());
    OidcResourceServerModuleWebSecurityConfiguration configuration = OidcResourceServerModuleWebSecurityConfiguration.build((OidcAuthenticationModuleType) moduleType, sequenceSuffix);
    configuration.setSequenceSuffix(sequenceSuffix);
    OidcResourceServerAuthenticationModuleType resourceServer = ((OidcAuthenticationModuleType) moduleType).getResourceServer();
    JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
    if (resourceServer.getNameOfUsernameClaim() != null) {
        jwtAuthenticationConverter.setPrincipalClaimName(resourceServer.getNameOfUsernameClaim());
    }
    configuration.addAuthenticationProvider(getObjectObjectPostProcessor().postProcess(new OidcResourceServerProvider(configuration.getDecoder(), jwtAuthenticationConverter)));
    OidcResourceServerModuleWebSecurityConfigurer<OidcResourceServerModuleWebSecurityConfiguration> module = getObjectObjectPostProcessor().postProcess(new OidcResourceServerModuleWebSecurityConfigurer<>(configuration));
    module.setObjectPostProcessor(getObjectObjectPostProcessor());
    HttpSecurity http = module.getNewHttpSecurity();
    setSharedObjects(http, sharedObjects);
    ModuleAuthenticationImpl moduleAuthentication = createEmptyModuleAuthentication(configuration, resourceServer);
    moduleAuthentication.setFocusType(moduleType.getFocusType());
    SecurityFilterChain filter = http.build();
    return AuthModuleImpl.build(filter, configuration, moduleAuthentication);
}