Examples with HttpSessionSecurityContextRepository org.springframework.security.web.context.HttpSessionSecurityContextRepository used on opensource projects

Example 6 with HttpSessionSecurityContextRepository

use of org.springframework.security.web.context.HttpSessionSecurityContextRepository in project motech by motech.

the class SecurityRuleBuilder method addFilters.

private List<Filter> addFilters(MotechURLSecurityRule securityRule) throws ServletException {
    List<Filter> filters = new ArrayList<>();
    SecurityContextRepository contextRepository = new HttpSessionSecurityContextRepository();
    RequestCache requestCache = new HttpSessionRequestCache();
    addSecureChannel(filters, securityRule.getProtocol());
    addSecurityContextPersistenceFilter(filters, contextRepository);
    addLogoutFilter(filters, securityRule);
    addAuthenticationFilters(filters, securityRule);
    addRequestCacheFilter(filters, requestCache);
    addSecurityContextHolderAwareRequestFilter(filters);
    addAnonymousAuthenticationFilter(filters);
    addSessionManagementFilter(filters, contextRepository);
    addExceptionTranslationFilter(filters, requestCache, securityRule.isRest());
    addFilterSecurityInterceptor(filters, securityRule);
    return filters;
}

Example 7 with HttpSessionSecurityContextRepository

use of org.springframework.security.web.context.HttpSessionSecurityContextRepository in project jenkins by jenkinsci.

the class SecurityRealm method createFilter.

/**
 * Creates {@link Filter} that all the incoming HTTP requests will go through
 * for authentication.
 *
 * <p>
 * The default implementation uses {@link #getSecurityComponents()} and builds
 * a standard filter chain.
 * But subclasses can override this to completely change the filter sequence.
 *
 * <p>
 * For other plugins that want to contribute {@link Filter}, see
 * {@link PluginServletFilter}.
 *
 * @since 1.271
 */
public Filter createFilter(FilterConfig filterConfig) {
    LOGGER.entering(SecurityRealm.class.getName(), "createFilter");
    SecurityComponents sc = getSecurityComponents();
    List<Filter> filters = new ArrayList<>();
    {
        HttpSessionSecurityContextRepository httpSessionSecurityContextRepository = new HttpSessionSecurityContextRepository();
        httpSessionSecurityContextRepository.setAllowSessionCreation(false);
        filters.add(new HttpSessionContextIntegrationFilter2(httpSessionSecurityContextRepository));
    }
    {
        // if any "Authorization: Basic xxx:yyy" is sent this is the filter that processes it
        BasicHeaderProcessor bhp = new BasicHeaderProcessor();
        // if basic authentication fails (which only happens incorrect basic auth credential is sent),
        // respond with 401 with basic auth request, instead of redirecting the user to the login page,
        // since users of basic auth tends to be a program and won't see the redirection to the form
        // page as a failure
        BasicAuthenticationEntryPoint basicAuthenticationEntryPoint = new BasicAuthenticationEntryPoint();
        basicAuthenticationEntryPoint.setRealmName("Jenkins");
        bhp.setAuthenticationEntryPoint(basicAuthenticationEntryPoint);
        bhp.setRememberMeServices(sc.rememberMe2);
        filters.add(bhp);
    }
    {
        AuthenticationProcessingFilter2 apf = new AuthenticationProcessingFilter2(getAuthenticationGatewayUrl());
        apf.setAuthenticationManager(sc.manager2);
        if (SystemProperties.getInteger(SecurityRealm.class.getName() + ".sessionFixationProtectionMode", 1) == 1) {
            // By default, use the 'canonical' protection from Spring Security; see AuthenticationProcessingFilter2#successfulAuthentication for alternative
            apf.setSessionAuthenticationStrategy(new SessionFixationProtectionStrategy());
        }
        apf.setRememberMeServices(sc.rememberMe2);
        final AuthenticationSuccessHandler successHandler = new AuthenticationSuccessHandler();
        successHandler.setTargetUrlParameter("from");
        apf.setAuthenticationSuccessHandler(successHandler);
        apf.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler("/loginError"));
        filters.add(apf);
    }
    filters.add(new RememberMeAuthenticationFilter(sc.manager2, sc.rememberMe2));
    filters.addAll(commonFilters());
    return new ChainedServletFilter(filters);
}

Example 8 with HttpSessionSecurityContextRepository

use of org.springframework.security.web.context.HttpSessionSecurityContextRepository in project midpoint by Evolveum.

the class MidpointWebSecurityConfigurerAdapter method createSessionContextRepository.

private void createSessionContextRepository(HttpSecurity http) {
    HttpSessionSecurityContextRepository httpSecurityRepository = new HttpSessionSecurityContextRepository() {

        @Override
        public void saveContext(SecurityContext context, HttpServletRequest request, HttpServletResponse response) {
            if (!AuthSequenceUtil.isRecordSessionLessAccessChannel(request)) {
                super.saveContext(context, request, response);
            }
        }

        @Override
        protected SecurityContext generateNewContext() {
            return new MidpointSecurityContext(super.generateNewContext());
        }
    };
    httpSecurityRepository.setDisableUrlRewriting(true);
    AuthenticationTrustResolver trustResolver = http.getSharedObject(AuthenticationTrustResolver.class);
    if (trustResolver != null) {
        httpSecurityRepository.setTrustResolver(trustResolver);
    }
    http.setSharedObject(SecurityContextRepository.class, httpSecurityRepository);
}

Example 9 with HttpSessionSecurityContextRepository

use of org.springframework.security.web.context.HttpSessionSecurityContextRepository in project spring-authorization-server by spring-projects.

the class OAuth2AuthorizationCodeGrantTests method init.

@BeforeClass
public static void init() {
    JWKSet jwkSet = new JWKSet(TestJwks.DEFAULT_RSA_JWK);
    jwkSource = (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
    jwtEncoder = new NimbusJwsEncoder(jwkSource);
    providerSettings = ProviderSettings.builder().authorizationEndpoint("/test/authorize").tokenEndpoint("/test/token").build();
    authorizationRequestConverter = mock(AuthenticationConverter.class);
    authorizationRequestAuthenticationProvider = mock(AuthenticationProvider.class);
    authorizationResponseHandler = mock(AuthenticationSuccessHandler.class);
    authorizationErrorResponseHandler = mock(AuthenticationFailureHandler.class);
    securityContextRepository = spy(new HttpSessionSecurityContextRepository());
    db = new EmbeddedDatabaseBuilder().generateUniqueName(true).setType(EmbeddedDatabaseType.HSQL).setScriptEncoding("UTF-8").addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql").addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql").addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql").build();
}

Example 10 with HttpSessionSecurityContextRepository

use of org.springframework.security.web.context.HttpSessionSecurityContextRepository in project spring-security by spring-projects.

the class WebTestUtils method getSecurityContextRepository.

/**
 * Gets the {@link SecurityContextRepository} for the specified
 * {@link HttpServletRequest}. If one is not found, a default
 * {@link HttpSessionSecurityContextRepository} is used.
 * @param request the {@link HttpServletRequest} to obtain the
 * {@link SecurityContextRepository}
 * @return the {@link SecurityContextRepository} for the specified
 * {@link HttpServletRequest}
 */
public static SecurityContextRepository getSecurityContextRepository(HttpServletRequest request) {
    SecurityContextPersistenceFilter filter = findFilter(request, SecurityContextPersistenceFilter.class);
    if (filter != null) {
        return (SecurityContextRepository) ReflectionTestUtils.getField(filter, "repo");
    }
    SecurityContextHolderFilter holderFilter = findFilter(request, SecurityContextHolderFilter.class);
    if (holderFilter != null) {
        return (SecurityContextRepository) ReflectionTestUtils.getField(holderFilter, "securityContextRepository");
    }
    return DEFAULT_CONTEXT_REPO;
}