Examples with ServerSecurityContextRepository org.springframework.security.web.server.context.ServerSecurityContextRepository used on opensource projects

Example 1 with ServerSecurityContextRepository

use of org.springframework.security.web.server.context.ServerSecurityContextRepository in project spring-security by spring-projects.

the class ServerHttpSecurity method securityContextRepositoryWebFilter.

private WebFilter securityContextRepositoryWebFilter() {
    ServerSecurityContextRepository repository = (this.securityContextRepository != null) ? this.securityContextRepository : new WebSessionServerSecurityContextRepository();
    WebFilter result = new ReactorContextWebFilter(repository);
    return new OrderedWebFilter(result, SecurityWebFiltersOrder.REACTOR_CONTEXT.getOrder());
}

Example 2 with ServerSecurityContextRepository

use of org.springframework.security.web.server.context.ServerSecurityContextRepository in project spring-security by spring-projects.

the class OAuth2LoginTests method logoutWhenUsingOidcLogoutHandlerThenRedirects.

@Test
public void logoutWhenUsingOidcLogoutHandlerThenRedirects() {
    this.spring.register(OAuth2LoginConfigWithOidcLogoutSuccessHandler.class).autowire();
    OAuth2AuthenticationToken token = new OAuth2AuthenticationToken(TestOidcUsers.create(), AuthorityUtils.NO_AUTHORITIES, getBean(ClientRegistration.class).getRegistrationId());
    ServerSecurityContextRepository repository = getBean(ServerSecurityContextRepository.class);
    given(repository.load(any())).willReturn(authentication(token));
    // @formatter:off
    this.client.post().uri("/logout").exchange().expectHeader().valueEquals("Location", "https://logout?id_token_hint=id-token");
// @formatter:on
}

Example 3 with ServerSecurityContextRepository

use of org.springframework.security.web.server.context.ServerSecurityContextRepository in project spring-security by spring-projects.

the class OAuth2LoginTests method oauth2LoginWhenCustomBeansThenUsed.

@Test
public void oauth2LoginWhenCustomBeansThenUsed() {
    this.spring.register(OAuth2LoginWithMultipleClientRegistrations.class, OAuth2LoginWithCustomBeansConfig.class).autowire();
    // @formatter:off
    WebTestClient webTestClient = WebTestClientBuilder.bindToWebFilters(this.springSecurity).build();
    // @formatter:on
    OAuth2LoginWithCustomBeansConfig config = this.spring.getContext().getBean(OAuth2LoginWithCustomBeansConfig.class);
    OAuth2AuthorizationRequest request = TestOAuth2AuthorizationRequests.request().scope("openid").build();
    OAuth2AuthorizationResponse response = TestOAuth2AuthorizationResponses.success().build();
    OAuth2AuthorizationExchange exchange = new OAuth2AuthorizationExchange(request, response);
    OAuth2AccessToken accessToken = TestOAuth2AccessTokens.scopes("openid");
    OAuth2AuthorizationCodeAuthenticationToken token = new OAuth2AuthorizationCodeAuthenticationToken(google, exchange, accessToken);
    ServerAuthenticationConverter converter = config.authenticationConverter;
    given(converter.convert(any())).willReturn(Mono.just(token));
    ServerSecurityContextRepository securityContextRepository = config.securityContextRepository;
    given(securityContextRepository.save(any(), any())).willReturn(Mono.empty());
    given(securityContextRepository.load(any())).willReturn(authentication(token));
    Map<String, Object> additionalParameters = new HashMap<>();
    additionalParameters.put(OidcParameterNames.ID_TOKEN, "id-token");
    // @formatter:off
    OAuth2AccessTokenResponse accessTokenResponse = OAuth2AccessTokenResponse.withToken(accessToken.getTokenValue()).tokenType(accessToken.getTokenType()).scopes(accessToken.getScopes()).additionalParameters(additionalParameters).build();
    // @formatter:on
    ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> tokenResponseClient = config.tokenResponseClient;
    given(tokenResponseClient.getTokenResponse(any())).willReturn(Mono.just(accessTokenResponse));
    OidcUser user = TestOidcUsers.create();
    ReactiveOAuth2UserService<OidcUserRequest, OidcUser> userService = config.userService;
    given(userService.loadUser(any())).willReturn(Mono.just(user));
    // @formatter:off
    webTestClient.get().uri("/login/oauth2/code/google").exchange().expectStatus().is3xxRedirection();
    // @formatter:on
    verify(config.jwtDecoderFactory).createDecoder(any());
    verify(tokenResponseClient).getTokenResponse(any());
    verify(securityContextRepository).save(any(), any());
}

Example 4 with ServerSecurityContextRepository

use of org.springframework.security.web.server.context.ServerSecurityContextRepository in project spring-security by spring-projects.

the class FormLoginTests method formLoginSecurityContextRepository.

@Test
public void formLoginSecurityContextRepository() {
    ServerSecurityContextRepository defaultSecContextRepository = mock(ServerSecurityContextRepository.class);
    ServerSecurityContextRepository formLoginSecContextRepository = mock(ServerSecurityContextRepository.class);
    TestingAuthenticationToken token = new TestingAuthenticationToken("rob", "rob", "ROLE_USER");
    given(defaultSecContextRepository.save(any(), any())).willReturn(Mono.empty());
    given(defaultSecContextRepository.load(any())).willReturn(authentication(token));
    given(formLoginSecContextRepository.save(any(), any())).willReturn(Mono.empty());
    given(formLoginSecContextRepository.load(any())).willReturn(authentication(token));
    // @formatter:off
    SecurityWebFilterChain securityWebFilter = this.http.authorizeExchange().anyExchange().authenticated().and().securityContextRepository(defaultSecContextRepository).formLogin().securityContextRepository(formLoginSecContextRepository).and().build();
    WebTestClient webTestClient = WebTestClientBuilder.bindToWebFilters(securityWebFilter).build();
    WebDriver driver = WebTestClientHtmlUnitDriverBuilder.webTestClientSetup(webTestClient).build();
    // @formatter:on
    DefaultLoginPage loginPage = DefaultLoginPage.to(driver).assertAt();
    // @formatter:off
    HomePage homePage = loginPage.loginForm().username("user").password("password").submit(HomePage.class);
    // @formatter:on
    homePage.assertAt();
    verify(defaultSecContextRepository, atLeastOnce()).load(any());
    verify(formLoginSecContextRepository).save(any(), any());
}

Example 5 with ServerSecurityContextRepository

use of org.springframework.security.web.server.context.ServerSecurityContextRepository in project spring-security by spring-projects.

the class SwitchUserWebFilterTests method setSecurityContextRepositoryWhenDefinedThenChangeDefaultValue.

@Test
public void setSecurityContextRepositoryWhenDefinedThenChangeDefaultValue() {
    final Object oldSecurityContextRepository = ReflectionTestUtils.getField(this.switchUserWebFilter, "securityContextRepository");
    assertThat(oldSecurityContextRepository).isSameAs(this.serverSecurityContextRepository);
    final ServerSecurityContextRepository newSecurityContextRepository = mock(ServerSecurityContextRepository.class);
    this.switchUserWebFilter.setSecurityContextRepository(newSecurityContextRepository);
    final Object currentSecurityContextRepository = ReflectionTestUtils.getField(this.switchUserWebFilter, "securityContextRepository");
    assertThat(currentSecurityContextRepository).isSameAs(newSecurityContextRepository);
}