Examples with FilterSecurityInterceptor org.springframework.security.web.access.intercept.FilterSecurityInterceptor used on opensource projects

Example 6 with FilterSecurityInterceptor

use of org.springframework.security.web.access.intercept.FilterSecurityInterceptor in project spring-security by spring-projects.

the class DefaultWebInvocationPrivilegeEvaluatorTests method setUp.

@BeforeEach
public final void setUp() {
    this.interceptor = new FilterSecurityInterceptor();
    this.ods = mock(FilterInvocationSecurityMetadataSource.class);
    this.adm = mock(AccessDecisionManager.class);
    this.ram = mock(RunAsManager.class);
    this.interceptor.setAuthenticationManager(mock(AuthenticationManager.class));
    this.interceptor.setSecurityMetadataSource(this.ods);
    this.interceptor.setAccessDecisionManager(this.adm);
    this.interceptor.setRunAsManager(this.ram);
    this.interceptor.setApplicationEventPublisher(mock(ApplicationEventPublisher.class));
    SecurityContextHolder.clearContext();
}

Example 7 with FilterSecurityInterceptor

use of org.springframework.security.web.access.intercept.FilterSecurityInterceptor in project spring-security by spring-projects.

the class UrlAuthorizationsTests method configureWhenNoAccessDecisionManagerThenDefaultsToAffirmativeBased.

@Test
public void configureWhenNoAccessDecisionManagerThenDefaultsToAffirmativeBased() {
    this.spring.register(NoSpecificAccessDecisionManagerConfig.class).autowire();
    FilterSecurityInterceptor interceptor = getFilter(FilterSecurityInterceptor.class);
    assertThat(interceptor).isNotNull();
    assertThat(interceptor).extracting("accessDecisionManager").isInstanceOf(AffirmativeBased.class);
}

Example 8 with FilterSecurityInterceptor

use of org.springframework.security.web.access.intercept.FilterSecurityInterceptor in project spring-security by spring-projects.

the class DefaultFilterChainValidator method checkLoginPageIsntProtected.

/*
	 * Checks for the common error of having a login page URL protected by the security
	 * interceptor
	 */
private void checkLoginPageIsntProtected(FilterChainProxy fcp, List<Filter> filterStack) {
    ExceptionTranslationFilter etf = getFilter(ExceptionTranslationFilter.class, filterStack);
    if (etf == null || !(etf.getAuthenticationEntryPoint() instanceof LoginUrlAuthenticationEntryPoint)) {
        return;
    }
    String loginPage = ((LoginUrlAuthenticationEntryPoint) etf.getAuthenticationEntryPoint()).getLoginFormUrl();
    this.logger.info("Checking whether login URL '" + loginPage + "' is accessible with your configuration");
    FilterInvocation loginRequest = new FilterInvocation(loginPage, "POST");
    List<Filter> filters = null;
    try {
        filters = fcp.getFilters(loginPage);
    } catch (Exception ex) {
        // May happen legitimately if a filter-chain request matcher requires more
        // request data than that provided
        // by the dummy request used when creating the filter invocation.
        this.logger.info("Failed to obtain filter chain information for the login page. Unable to complete check.");
    }
    if (filters == null || filters.isEmpty()) {
        this.logger.debug("Filter chain is empty for the login page");
        return;
    }
    if (getFilter(DefaultLoginPageGeneratingFilter.class, filters) != null) {
        this.logger.debug("Default generated login page is in use");
        return;
    }
    FilterSecurityInterceptor fsi = getFilter(FilterSecurityInterceptor.class, filters);
    FilterInvocationSecurityMetadataSource fids = fsi.getSecurityMetadataSource();
    Collection<ConfigAttribute> attributes = fids.getAttributes(loginRequest);
    if (attributes == null) {
        this.logger.debug("No access attributes defined for login page URL");
        if (fsi.isRejectPublicInvocations()) {
            this.logger.warn("FilterSecurityInterceptor is configured to reject public invocations." + " Your login page may not be accessible.");
        }
        return;
    }
    AnonymousAuthenticationFilter anonPF = getFilter(AnonymousAuthenticationFilter.class, filters);
    if (anonPF == null) {
        this.logger.warn("The login page is being protected by the filter chain, but you don't appear to have" + " anonymous authentication enabled. This is almost certainly an error.");
        return;
    }
    // Simulate an anonymous access with the supplied attributes.
    AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("key", anonPF.getPrincipal(), anonPF.getAuthorities());
    try {
        fsi.getAccessDecisionManager().decide(token, loginRequest, attributes);
    } catch (AccessDeniedException ex) {
        this.logger.warn("Anonymous access to the login page doesn't appear to be enabled. " + "This is almost certainly an error. Please check your configuration allows unauthenticated " + "access to the configured login page. (Simulated access was rejected: " + ex + ")");
    } catch (Exception ex) {
        // May happen legitimately if a filter-chain request matcher requires more
        // request data than that provided
        // by the dummy request used when creating the filter invocation. See SEC-1878
        this.logger.info("Unable to check access to the login page to determine if anonymous access is allowed. " + "This might be an error, but can happen under normal circumstances.", ex);
    }
}

Example 9 with FilterSecurityInterceptor

use of org.springframework.security.web.access.intercept.FilterSecurityInterceptor in project spring-security by spring-projects.

the class WebSecurityConfiguration method springSecurityFilterChain.

/**
 * Creates the Spring Security Filter Chain
 * @return the {@link Filter} that represents the security filter chain
 * @throws Exception
 */
@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
public Filter springSecurityFilterChain() throws Exception {
    boolean hasConfigurers = this.webSecurityConfigurers != null && !this.webSecurityConfigurers.isEmpty();
    boolean hasFilterChain = !this.securityFilterChains.isEmpty();
    Assert.state(!(hasConfigurers && hasFilterChain), "Found WebSecurityConfigurerAdapter as well as SecurityFilterChain. Please select just one.");
    if (!hasConfigurers && !hasFilterChain) {
        WebSecurityConfigurerAdapter adapter = this.objectObjectPostProcessor.postProcess(new WebSecurityConfigurerAdapter() {
        });
        this.webSecurity.apply(adapter);
    }
    for (SecurityFilterChain securityFilterChain : this.securityFilterChains) {
        this.webSecurity.addSecurityFilterChainBuilder(() -> securityFilterChain);
        for (Filter filter : securityFilterChain.getFilters()) {
            if (filter instanceof FilterSecurityInterceptor) {
                this.webSecurity.securityInterceptor((FilterSecurityInterceptor) filter);
                break;
            }
        }
    }
    for (WebSecurityCustomizer customizer : this.webSecurityCustomizers) {
        customizer.customize(this.webSecurity);
    }
    return this.webSecurity.build();
}

Example 10 with FilterSecurityInterceptor

use of org.springframework.security.web.access.intercept.FilterSecurityInterceptor in project spring-security by spring-projects.

the class AbstractInterceptUrlConfigurer method configure.

@Override
public void configure(H http) throws Exception {
    FilterInvocationSecurityMetadataSource metadataSource = createMetadataSource(http);
    if (metadataSource == null) {
        return;
    }
    FilterSecurityInterceptor securityInterceptor = createFilterSecurityInterceptor(http, metadataSource, http.getSharedObject(AuthenticationManager.class));
    if (this.filterSecurityInterceptorOncePerRequest != null) {
        securityInterceptor.setObserveOncePerRequest(this.filterSecurityInterceptorOncePerRequest);
    }
    securityInterceptor = postProcess(securityInterceptor);
    http.addFilter(securityInterceptor);
    http.setSharedObject(FilterSecurityInterceptor.class, securityInterceptor);
}