Example usage for org.springframework.security.web FilterInvocation FilterInvocation

Introduction

In this page you can find the example usage for org.springframework.security.web FilterInvocation FilterInvocation.

Prototype

public FilterInvocation(String servletPath, String method) 

Source Link

Usage

From source file:de.iew.framework.security.access.WebResourceAccessEvaluatorTest.java

@Test
public void testEvaluateFlagConfigAttributeIsAuthenticatedDeniedAsAnonymous() throws Exception {
    // Testfix erstellen
    Authentication authenticationToken = newAnonymousAuthenticationToken();

    FilterInvocation filterInvocation = new FilterInvocation("/junit", "GET");

    WebResourceAccessRule rule = new WebResourceAccessRule();
    rule.setAuthenticated(true);//from  w  w  w. ja  v  a 2 s . com

    FlagConfigAttribute configAttribute = new FlagConfigAttribute(rule);

    // Das Testobjekt erstellen
    WebResourceAccessEvaluator webResourceAccessEvaluator = new WebResourceAccessEvaluator();

    // Test und Auswertung
    assertFalse(webResourceAccessEvaluator.evaluate(authenticationToken, filterInvocation, configAttribute));
}

---

From source file:de.iew.framework.security.access.WebResourceAccessEvaluatorTest.java

@Test
public void testEvaluateFlagConfigAttributeIsAuthenticatedGrantedAsUser() throws Exception {
    // Testfix erstellen
    Authentication authenticationToken = newUserAuthenticationToken();

    FilterInvocation filterInvocation = new FilterInvocation("/junit", "GET");

    WebResourceAccessRule rule = new WebResourceAccessRule();
    rule.setAuthenticated(true);//from www.  ja  va  2 s.  c  o  m

    FlagConfigAttribute configAttribute = new FlagConfigAttribute(rule);

    // Das Testobjekt erstellen
    WebResourceAccessEvaluator webResourceAccessEvaluator = new WebResourceAccessEvaluator();

    // Test und Auswertung
    assertTrue(webResourceAccessEvaluator.evaluate(authenticationToken, filterInvocation, configAttribute));
}

---

From source file:de.iew.framework.security.access.WebResourceAccessEvaluatorTest.java

/**
 * Is Authenticated lsst den Nutzer auch durch, wenn er als Remember-Me
 * authentifieziert wurde. Im Gegensatz dazu wrde der Zugriff bei
 * Is Fully Authenticated verweigert./*w  w  w  .  j  a  va2  s .c  o m*/
 *
 * @throws Exception
 */
@Test
public void testEvaluateFlagConfigAttributeIsAuthenticatedGrantedAsRememberMe() throws Exception {
    // Testfix erstellen
    Authentication authenticationToken = newRememberMeAuthenticationToken();

    FilterInvocation filterInvocation = new FilterInvocation("/junit", "GET");

    WebResourceAccessRule rule = new WebResourceAccessRule();
    rule.setAuthenticated(true);

    FlagConfigAttribute configAttribute = new FlagConfigAttribute(rule);

    // Das Testobjekt erstellen
    WebResourceAccessEvaluator webResourceAccessEvaluator = new WebResourceAccessEvaluator();

    // Test und Auswertung
    assertTrue(webResourceAccessEvaluator.evaluate(authenticationToken, filterInvocation, configAttribute));
}

---

From source file:de.iew.framework.security.access.WebResourceAccessEvaluatorTest.java

@Test
public void testEvaluateFlagConfigAttributeIsFullyAuthenticatedGrantedAsUser() throws Exception {
    // Testfix erstellen
    Authentication authenticationToken = newUserAuthenticationToken();

    FilterInvocation filterInvocation = new FilterInvocation("/junit", "GET");

    WebResourceAccessRule rule = new WebResourceAccessRule();
    rule.setFullyAuthenticated(true);//  www .  j  a va 2s .c om

    FlagConfigAttribute configAttribute = new FlagConfigAttribute(rule);

    // Das Testobjekt erstellen
    WebResourceAccessEvaluator webResourceAccessEvaluator = new WebResourceAccessEvaluator();

    // Test und Auswertung
    assertTrue(webResourceAccessEvaluator.evaluate(authenticationToken, filterInvocation, configAttribute));
}

---

From source file:de.iew.framework.security.access.WebResourceAccessEvaluatorTest.java

@Test
public void testEvaluateFlagConfigAttributeIsFullyAuthenticatedDeniedAsAnonymous() throws Exception {
    // Testfix erstellen
    Authentication authenticationToken = newAnonymousAuthenticationToken();

    FilterInvocation filterInvocation = new FilterInvocation("/junit", "GET");

    WebResourceAccessRule rule = new WebResourceAccessRule();
    rule.setFullyAuthenticated(true);/*w  w  w. j  a v  a  2 s  . c  o m*/

    FlagConfigAttribute configAttribute = new FlagConfigAttribute(rule);

    // Das Testobjekt erstellen
    WebResourceAccessEvaluator webResourceAccessEvaluator = new WebResourceAccessEvaluator();

    // Test und Auswertung
    assertFalse(webResourceAccessEvaluator.evaluate(authenticationToken, filterInvocation, configAttribute));
}

---

From source file:de.iew.framework.security.access.WebResourceAccessEvaluatorTest.java

@Test
public void testEvaluateFlagConfigAttributeIsFullyAuthenticatedDeniedAsRememberMe() throws Exception {
    // Testfix erstellen
    Authentication authenticationToken = newRememberMeAuthenticationToken();

    FilterInvocation filterInvocation = new FilterInvocation("/junit", "GET");

    WebResourceAccessRule rule = new WebResourceAccessRule();
    rule.setFullyAuthenticated(true);/*from ww w . ja  v a2  s  . com*/

    FlagConfigAttribute configAttribute = new FlagConfigAttribute(rule);

    // Das Testobjekt erstellen
    WebResourceAccessEvaluator webResourceAccessEvaluator = new WebResourceAccessEvaluator();

    // Test und Auswertung
    assertFalse(webResourceAccessEvaluator.evaluate(authenticationToken, filterInvocation, configAttribute));
}

---

From source file:org.springframework.security.config.http.DefaultFilterChainValidator.java

private void checkLoginPageIsntProtected(FilterChainProxy fcp, List<Filter> filterStack) {
    ExceptionTranslationFilter etf = getFilter(ExceptionTranslationFilter.class, filterStack);

    if (etf == null || !(etf.getAuthenticationEntryPoint() instanceof LoginUrlAuthenticationEntryPoint)) {
        return;// w w w . j  a  v a2s .c  o  m
    }

    String loginPage = ((LoginUrlAuthenticationEntryPoint) etf.getAuthenticationEntryPoint()).getLoginFormUrl();
    logger.info("Checking whether login URL '" + loginPage + "' is accessible with your configuration");
    FilterInvocation loginRequest = new FilterInvocation(loginPage, "POST");
    List<Filter> filters = null;

    try {
        filters = fcp.getFilters(loginPage);
    } catch (Exception e) {
        // May happen legitimately if a filter-chain request matcher requires more
        // request data than that provided
        // by the dummy request used when creating the filter invocation.
        logger.info("Failed to obtain filter chain information for the login page. Unable to complete check.");
    }

    if (filters == null || filters.isEmpty()) {
        logger.debug("Filter chain is empty for the login page");
        return;
    }

    if (getFilter(DefaultLoginPageGeneratingFilter.class, filters) != null) {
        logger.debug("Default generated login page is in use");
        return;
    }

    FilterSecurityInterceptor fsi = getFilter(FilterSecurityInterceptor.class, filters);
    FilterInvocationSecurityMetadataSource fids = fsi.getSecurityMetadataSource();

    Collection<ConfigAttribute> attributes = fids.getAttributes(loginRequest);

    if (attributes == null) {
        logger.debug("No access attributes defined for login page URL");
        if (fsi.isRejectPublicInvocations()) {
            logger.warn("FilterSecurityInterceptor is configured to reject public invocations."
                    + " Your login page may not be accessible.");
        }
        return;
    }

    AnonymousAuthenticationFilter anonPF = getFilter(AnonymousAuthenticationFilter.class, filters);
    if (anonPF == null) {
        logger.warn("The login page is being protected by the filter chain, but you don't appear to have"
                + " anonymous authentication enabled. This is almost certainly an error.");
        return;
    }

    // Simulate an anonymous access with the supplied attributes.
    AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("key", anonPF.getPrincipal(),
            anonPF.getAuthorities());
    try {
        fsi.getAccessDecisionManager().decide(token, loginRequest, attributes);
    } catch (AccessDeniedException e) {
        logger.warn("Anonymous access to the login page doesn't appear to be enabled. This is almost certainly "
                + "an error. Please check your configuration allows unauthenticated access to the configured "
                + "login page. (Simulated access was rejected: " + e + ")");
    } catch (Exception e) {
        // May happen legitimately if a filter-chain request matcher requires more
        // request data than that provided
        // by the dummy request used when creating the filter invocation. See SEC-1878
        logger.info(
                "Unable to check access to the login page to determine if anonymous access is allowed. This might be an error, but can happen under normal circumstances.",
                e);
    }
}

---

From source file:org.springframework.security.web.FilterChainProxy.java

/**
 * Convenience method, mainly for testing.
 *
 * @param url the URL//from  w w w  .  j  a v  a  2 s  . c om
 * @return matching filter list
 */
public List<Filter> getFilters(String url) {
    return getFilters(firewall.getFirewalledRequest((new FilterInvocation(url, "GET").getRequest())));
}

---

• «
• 1
• 2
• »