Examples with RequestMatcher org.springframework.security.web.util.matcher.RequestMatcher used on opensource projects

Example 76 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class Saml2WebSsoAuthenticationFilterTests method doFilterWhenPathStartsWithRegistrationIdThenAuthenticates.

@Test
public void doFilterWhenPathStartsWithRegistrationIdThenAuthenticates() throws Exception {
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.full().build();
    Authentication authentication = new TestingAuthenticationToken("user", "password");
    given(this.repository.findByRegistrationId("registration-id")).willReturn(registration);
    given(this.authenticationManager.authenticate(authentication)).willReturn(authentication);
    String loginProcessingUrl = "/{registrationId}/login/saml2/sso";
    RequestMatcher matcher = new AntPathRequestMatcher(loginProcessingUrl);
    DefaultRelyingPartyRegistrationResolver delegate = new DefaultRelyingPartyRegistrationResolver(this.repository);
    RelyingPartyRegistrationResolver resolver = (request, id) -> {
        String registrationId = matcher.matcher(request).getVariables().get("registrationId");
        return delegate.resolve(request, registrationId);
    };
    Saml2AuthenticationTokenConverter authenticationConverter = new Saml2AuthenticationTokenConverter(resolver);
    this.filter = new Saml2WebSsoAuthenticationFilter(authenticationConverter, loginProcessingUrl);
    this.filter.setAuthenticationManager(this.authenticationManager);
    this.request.setPathInfo("/registration-id/login/saml2/sso");
    this.request.setParameter(Saml2ParameterNames.SAML_RESPONSE, "response");
    this.filter.doFilter(this.request, this.response, new MockFilterChain());
    verify(this.repository).findByRegistrationId("registration-id");
}

Example 77 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class RequestMatcherDelegatingAuthorizationManager method check.

/**
 * Delegates to a specific {@link AuthorizationManager} based on a
 * {@link RequestMatcher} evaluation.
 * @param authentication the {@link Supplier} of the {@link Authentication} to check
 * @param request the {@link HttpServletRequest} to check
 * @return an {@link AuthorizationDecision}. If there is no {@link RequestMatcher}
 * matching the request, or the {@link AuthorizationManager} could not decide, then
 * null is returned
 */
@Override
public AuthorizationDecision check(Supplier<Authentication> authentication, HttpServletRequest request) {
    if (this.logger.isTraceEnabled()) {
        this.logger.trace(LogMessage.format("Authorizing %s", request));
    }
    for (Map.Entry<RequestMatcher, AuthorizationManager<RequestAuthorizationContext>> mapping : this.mappings.entrySet()) {
        RequestMatcher matcher = mapping.getKey();
        MatchResult matchResult = matcher.matcher(request);
        if (matchResult.isMatch()) {
            AuthorizationManager<RequestAuthorizationContext> manager = mapping.getValue();
            if (this.logger.isTraceEnabled()) {
                this.logger.trace(LogMessage.format("Checking authorization on %s using %s", request, manager));
            }
            return manager.check(authentication, new RequestAuthorizationContext(request, matchResult.getVariables()));
        }
    }
    this.logger.trace("Abstaining since did not find matching RequestMatcher");
    return null;
}

Example 78 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class DefaultFilterInvocationSecurityMetadataSource method getAttributes.

@Override
public Collection<ConfigAttribute> getAttributes(Object object) {
    final HttpServletRequest request = ((FilterInvocation) object).getRequest();
    int count = 0;
    for (Map.Entry<RequestMatcher, Collection<ConfigAttribute>> entry : this.requestMap.entrySet()) {
        if (entry.getKey().matches(request)) {
            return entry.getValue();
        } else {
            if (this.logger.isTraceEnabled()) {
                this.logger.trace(LogMessage.format("Did not match request to %s - %s (%d/%d)", entry.getKey(), entry.getValue(), ++count, this.requestMap.size()));
            }
        }
    }
    return null;
}

Example 79 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class ExpressionBasedFilterInvocationSecurityMetadataSourceTests method expectedAttributeIsReturned.

@Test
public void expectedAttributeIsReturned() {
    final String expression = "hasRole('X')";
    LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<>();
    requestMap.put(AnyRequestMatcher.INSTANCE, SecurityConfig.createList(expression));
    ExpressionBasedFilterInvocationSecurityMetadataSource mds = new ExpressionBasedFilterInvocationSecurityMetadataSource(requestMap, new DefaultWebSecurityExpressionHandler());
    assertThat(mds.getAllConfigAttributes()).hasSize(1);
    Collection<ConfigAttribute> attrs = mds.getAttributes(new FilterInvocation("/path", "GET"));
    assertThat(attrs).hasSize(1);
    WebExpressionConfigAttribute attribute = (WebExpressionConfigAttribute) attrs.toArray()[0];
    assertThat(attribute.getAttribute()).isNull();
    assertThat(attribute.getAuthorizeExpression().getExpressionString()).isEqualTo(expression);
    assertThat(attribute.toString()).isEqualTo(expression);
}

Example 80 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class DefaultFilterInvocationSecurityMetadataSourceTests method mixingPatternsWithAndWithoutHttpMethodsIsSupported.

// SEC-1236
@Test
public void mixingPatternsWithAndWithoutHttpMethodsIsSupported() {
    LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<>();
    Collection<ConfigAttribute> userAttrs = SecurityConfig.createList("A");
    requestMap.put(new AntPathRequestMatcher("/user/**", null), userAttrs);
    requestMap.put(new AntPathRequestMatcher("/teller/**", "GET"), SecurityConfig.createList("B"));
    this.fids = new DefaultFilterInvocationSecurityMetadataSource(requestMap);
    FilterInvocation fi = createFilterInvocation("/user", null, null, "GET");
    Collection<ConfigAttribute> attrs = this.fids.getAttributes(fi);
    assertThat(attrs).isEqualTo(userAttrs);
}