Skip to content

Commit 8291f20

Browse files
rwinchrwinch
committed
DaoAuthenticationProvider uses DelegatingPasswordEncoder
This means that passwords will be encoded with BCrypt by default Fixes: gh-2775
1 parent d19b222 commit 8291f20

File tree

40 files changed

+197
-150
lines changed

40 files changed

+197
-150
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/userdetails/AbstractDaoAuthenticationConfigurer.java

-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
1919
import org.springframework.security.config.annotation.ObjectPostProcessor;
2020
import org.springframework.security.config.annotation.SecurityBuilder;
21-
import org.springframework.security.config.annotation.SecurityConfigurer;
2221
import org.springframework.security.config.annotation.authentication.ProviderManagerBuilder;
2322
import org.springframework.security.core.userdetails.UserDetailsService;
2423
import org.springframework.security.crypto.password.PasswordEncoder;

‎config/src/test/groovy/org/springframework/security/config/annotation/authentication/AuthenticationManagerBuilderTests.groovy

+3-2
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import org.springframework.security.config.annotation.configuration.ObjectPostPr
3535
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
3636
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
3737
import org.springframework.security.core.Authentication
38+
import org.springframework.security.core.userdetails.PasswordEncodedUser
3839
import org.springframework.security.core.userdetails.UserDetailsService
3940
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
4041

@@ -90,10 +91,10 @@ class AuthenticationManagerBuilderTests extends BaseSpringSpec {
9091
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
9192
auth
9293
.inMemoryAuthentication()
93-
.withUser("user").password("password").roles("USER").and()
94+
.withUser(PasswordEncodedUser.user())
9495
.and()
9596
.inMemoryAuthentication()
96-
.withUser("admin").password("password").roles("USER","ADMIN")
97+
.withUser(PasswordEncodedUser.admin())
9798
}
9899
}
99100

‎config/src/test/groovy/org/springframework/security/config/annotation/authentication/NamespaceAuthenticationManagerTests.groovy

+6-5
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import org.springframework.security.config.annotation.authentication.builders.Au
2525
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
2626
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
2727
import org.springframework.security.core.Authentication
28+
import org.springframework.security.core.userdetails.PasswordEncodedUser
2829

2930
/**
3031
*
@@ -50,7 +51,7 @@ class NamespaceAuthenticationManagerTests extends BaseSpringSpec {
5051
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
5152
auth
5253
.inMemoryAuthentication()
53-
.withUser("user").password("password").roles("USER")
54+
.withUser(PasswordEncodedUser.user())
5455
}
5556

5657
// Only necessary to have access to verify the AuthenticationManager
@@ -68,7 +69,7 @@ class NamespaceAuthenticationManagerTests extends BaseSpringSpec {
6869
Authentication auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password"))
6970
then:
7071
auth.credentials == "password"
71-
auth.principal.password == "password"
72+
auth.principal.password
7273
}
7374

7475
@EnableWebSecurity
@@ -77,7 +78,7 @@ class NamespaceAuthenticationManagerTests extends BaseSpringSpec {
7778
auth
7879
.eraseCredentials(false)
7980
.inMemoryAuthentication()
80-
.withUser("user").password("password").roles("USER")
81+
.withUser(PasswordEncodedUser.user())
8182
}
8283

8384
// Only necessary to have access to verify the AuthenticationManager
@@ -95,7 +96,7 @@ class NamespaceAuthenticationManagerTests extends BaseSpringSpec {
9596
Authentication auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password"))
9697
then:
9798
auth.credentials == "password"
98-
auth.principal.password == "password"
99+
auth.principal.password
99100
}
100101

101102
@EnableWebSecurity
@@ -105,7 +106,7 @@ class NamespaceAuthenticationManagerTests extends BaseSpringSpec {
105106
auth
106107
.eraseCredentials(false)
107108
.inMemoryAuthentication()
108-
.withUser("user").password("password").roles("USER")
109+
.withUser(PasswordEncodedUser.user())
109110
}
110111
}
111112
}

‎config/src/test/groovy/org/springframework/security/config/annotation/authentication/NamespaceJdbcUserServiceTests.groovy

+3-3
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
*/
1616
package org.springframework.security.config.annotation.authentication
1717

18+
import org.springframework.security.core.userdetails.PasswordEncodedUser
19+
1820
import javax.sql.DataSource
1921

2022
import org.springframework.beans.factory.annotation.Autowired
@@ -89,9 +91,7 @@ class NamespaceJdbcUserServiceTests extends BaseSpringSpec {
8991
// imports the default schema (will fail if already exists)
9092
.withDefaultSchema()
9193
// adds this user automatically (will fail if already exists)
92-
.withUser("user")
93-
.password("password")
94-
.roles("USER")
94+
.withUser(PasswordEncodedUser.user())
9595
}
9696

9797
// Only necessary to have access to verify the AuthenticationManager

‎config/src/test/groovy/org/springframework/security/config/annotation/authentication/configuration/AuthenticationConfigurationTests.groovy

+10-9
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
3939
import org.springframework.security.core.AuthenticationException
4040
import org.springframework.security.core.authority.AuthorityUtils
4141
import org.springframework.security.core.context.SecurityContextHolder
42+
import org.springframework.security.core.userdetails.PasswordEncodedUser
4243
import org.springframework.security.core.userdetails.User
4344
import org.springframework.security.core.userdetails.UserDetailsService
4445
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
@@ -64,7 +65,7 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
6465
static class GlobalMethodSecurityAutowiredConfig {
6566
@Autowired
6667
public void configureGlobal(AuthenticationManagerBuilder auth) {
67-
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
68+
auth.inMemoryAuthentication().withUser(PasswordEncodedUser.user())
6869
}
6970
}
7071

@@ -88,7 +89,7 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
8889
static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
8990
@Autowired
9091
public void configureGlobal(AuthenticationManagerBuilder auth) {
91-
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
92+
auth.inMemoryAuthentication().withUser(PasswordEncodedUser.user())
9293
}
9394
}
9495

@@ -111,7 +112,7 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
111112
static class WebMvcSecurityConfig extends WebSecurityConfigurerAdapter {
112113
@Autowired
113114
public void configureGlobal(AuthenticationManagerBuilder auth) {
114-
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
115+
auth.inMemoryAuthentication().withUser(PasswordEncodedUser.user())
115116
}
116117
}
117118

@@ -148,7 +149,7 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
148149
@Configuration
149150
static class GlobalAuthenticationConfiguererAdapterImpl extends GlobalAuthenticationConfigurerAdapter {
150151
public void init(AuthenticationManagerBuilder auth) throws Exception {
151-
auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
152+
auth.inMemoryAuthentication().withUser(PasswordEncodedUser.user())
152153
}
153154
}
154155

@@ -264,7 +265,7 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
264265
public void init(AuthenticationManagerBuilder auth) throws Exception {
265266
auth
266267
.inMemoryAuthentication()
267-
.withUser("user").password("password").roles("USER")
268+
.withUser(PasswordEncodedUser.user())
268269
}
269270
}
270271

@@ -282,7 +283,7 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
282283
return;
283284
}
284285

285-
User user = new User("boot","password", AuthorityUtils.createAuthorityList("ROLE_USER"))
286+
User user = User.withUserDetails(PasswordEncodedUser.user()).username("boot").build()
286287

287288
List<User> users = Arrays.asList(user);
288289
InMemoryUserDetailsManager inMemory = new InMemoryUserDetailsManager(users);
@@ -373,11 +374,11 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
373374
when:
374375
am.authenticate(new UsernamePasswordAuthenticationToken("user", "password"))
375376
then:
376-
1 * uds.loadUserByUsername("user") >> new User("user","password",AuthorityUtils.createAuthorityList("ROLE_USER"))
377+
1 * uds.loadUserByUsername("user") >> PasswordEncodedUser.user()
377378
when:
378379
am.authenticate(new UsernamePasswordAuthenticationToken("user", "invalid"))
379380
then:
380-
1 * uds.loadUserByUsername("user") >> new User("user","password",AuthorityUtils.createAuthorityList("ROLE_USER"))
381+
1 * uds.loadUserByUsername("user") >> PasswordEncodedUser.user()
381382
thrown(AuthenticationException.class)
382383
}
383384

@@ -514,4 +515,4 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
514515
@Autowired
515516
Service service
516517
}
517-
}
518+
}

‎config/src/test/groovy/org/springframework/security/config/annotation/web/SampleWebSecurityConfigurerAdapterTests.groovy

+7-5
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
*/
1616
package org.springframework.security.config.annotation.web
1717

18+
import org.springframework.security.core.userdetails.PasswordEncodedUser
19+
1820
import javax.servlet.http.HttpServletResponse
1921

2022
import org.springframework.beans.factory.annotation.Autowired
@@ -93,7 +95,7 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
9395
protected void configure(AuthenticationManagerBuilder auth) {
9496
auth
9597
.inMemoryAuthentication()
96-
.withUser("user").password("password").roles("USER");
98+
.withUser(PasswordEncodedUser.user());
9799
}
98100
}
99101

@@ -180,8 +182,8 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
180182
protected void configure(AuthenticationManagerBuilder auth) {
181183
auth
182184
.inMemoryAuthentication()
183-
.withUser("user").password("password").roles("USER").and()
184-
.withUser("admin").password("password").roles("USER", "ADMIN");
185+
.withUser(PasswordEncodedUser.user())
186+
.withUser(PasswordEncodedUser.admin());
185187
}
186188
}
187189

@@ -276,8 +278,8 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
276278
protected void configure(AuthenticationManagerBuilder auth) {
277279
auth
278280
.inMemoryAuthentication()
279-
.withUser("user").password("password").roles("USER").and()
280-
.withUser("admin").password("password").roles("USER", "ADMIN");
281+
.withUser(PasswordEncodedUser.user())
282+
.withUser(PasswordEncodedUser.admin());
281283
}
282284

283285
@Configuration

‎config/src/test/groovy/org/springframework/security/config/annotation/web/WebSecurityConfigurerAdapterTests.groovy

+7-5
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,9 @@
1313
* See the License for the specific language governing permissions and
1414
* limitations under the License.
1515
*/
16-
package org.springframework.security.config.annotation.web;
16+
package org.springframework.security.config.annotation.web
17+
18+
import org.springframework.security.core.userdetails.PasswordEncodedUser;
1719

1820
import static org.junit.Assert.*
1921
import static org.springframework.security.config.annotation.web.WebSecurityConfigurerAdapterTestsConfigs.*
@@ -94,7 +96,7 @@ class WebSecurityConfigurerAdapterTests extends BaseSpringSpec {
9496
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
9597
auth
9698
.inMemoryAuthentication()
97-
.withUser("user").password("password").roles("USER")
99+
.withUser(PasswordEncodedUser.user())
98100
}
99101

100102
@Override
@@ -117,7 +119,7 @@ class WebSecurityConfigurerAdapterTests extends BaseSpringSpec {
117119
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
118120
auth
119121
.inMemoryAuthentication()
120-
.withUser("user").password("password").roles("USER")
122+
.withUser(PasswordEncodedUser.user())
121123
}
122124

123125
@Override
@@ -153,7 +155,7 @@ class WebSecurityConfigurerAdapterTests extends BaseSpringSpec {
153155
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
154156
auth
155157
.inMemoryAuthentication()
156-
.withUser("user").password("password").roles("USER")
158+
.withUser("user").password("{noop}password").roles("USER")
157159
}
158160
159161
@Override
@@ -234,7 +236,7 @@ class WebSecurityConfigurerAdapterTests extends BaseSpringSpec {
234236
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
235237
auth
236238
.inMemoryAuthentication()
237-
.withUser("user").password("password").roles("USER")
239+
.withUser(PasswordEncodedUser.user())
238240
}
239241
}
240242

‎config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/BaseWebConfig.groovy

+4-3
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ package org.springframework.security.config.annotation.web.configuration;
1717

1818
import org.springframework.context.annotation.Configuration
1919
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
20+
import org.springframework.security.core.userdetails.PasswordEncodedUser
2021

2122
/**
2223
*
@@ -34,7 +35,7 @@ public abstract class BaseWebConfig extends WebSecurityConfigurerAdapter {
3435
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
3536
auth
3637
.inMemoryAuthentication()
37-
.withUser("user").password("password").roles("USER").and()
38-
.withUser("admin").password("password").roles("USER", "ADMIN");
38+
.withUser(PasswordEncodedUser.user())
39+
.withUser(PasswordEncodedUser.admin());
3940
}
40-
}
41+
}

‎config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/EnableWebSecurityTests.groovy

+2-1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import org.springframework.security.authentication.TestingAuthenticationToken
2020
import org.springframework.security.core.annotation.AuthenticationPrincipal
2121
import org.springframework.security.core.context.SecurityContext
2222
import org.springframework.security.core.context.SecurityContextImpl
23+
import org.springframework.security.core.userdetails.PasswordEncodedUser
2324
import org.springframework.security.core.userdetails.User
2425
import org.springframework.security.web.context.HttpSessionSecurityContextRepository
2526
import org.springframework.test.context.web.WebAppConfiguration
@@ -65,7 +66,7 @@ class EnableWebSecurityTests extends BaseSpringSpec {
6566
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
6667
auth
6768
.inMemoryAuthentication()
68-
.withUser("user").password("password").roles("USER");
69+
.withUser(PasswordEncodedUser.user());
6970
}
7071

7172
@Bean

‎config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/CsrfConfigurerTests.groovy

+10-8
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
*/
1616
package org.springframework.security.config.annotation.web.configurers
1717

18+
import org.springframework.security.core.userdetails.PasswordEncodedUser
19+
1820
import javax.servlet.http.HttpServletResponse
1921

2022
import spock.lang.Unroll
@@ -135,8 +137,8 @@ class CsrfConfigurerTests extends BaseSpringSpec {
135137
@Override
136138
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
137139
auth
138-
.inMemoryAuthentication()
139-
.withUser("user").password("password").roles("USER")
140+
.inMemoryAuthentication()
141+
.withUser(PasswordEncodedUser.user());
140142
}
141143
}
142144

@@ -257,8 +259,8 @@ class CsrfConfigurerTests extends BaseSpringSpec {
257259
@Override
258260
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
259261
auth
260-
.inMemoryAuthentication()
261-
.withUser("user").password("password").roles("USER")
262+
.inMemoryAuthentication()
263+
.withUser(PasswordEncodedUser.user());
262264
}
263265
}
264266

@@ -447,8 +449,8 @@ class CsrfConfigurerTests extends BaseSpringSpec {
447449
@Override
448450
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
449451
auth
450-
.inMemoryAuthentication()
451-
.withUser("user").password("password").roles("USER")
452+
.inMemoryAuthentication()
453+
.withUser(PasswordEncodedUser.user());
452454
}
453455
}
454456

@@ -487,8 +489,8 @@ class CsrfConfigurerTests extends BaseSpringSpec {
487489
@Override
488490
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
489491
auth
490-
.inMemoryAuthentication()
491-
.withUser("user").password("password").roles("USER")
492+
.inMemoryAuthentication()
493+
.withUser(PasswordEncodedUser.user());
492494
}
493495
}
494496

0 commit comments

Comments
 (0)