Skip to content

Commit b88977c

Browse files
franticticktickfranticticktick
committed
Add AuthorizationResult support for AuthorizationManager
Closes gh-14843
1 parent 567933d commit b88977c

File tree

28 files changed

+234
-53
lines changed

28 files changed

+234
-53
lines changed

‎config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -32,8 +32,8 @@
3232
import org.springframework.security.access.ConfigAttribute;
3333
import org.springframework.security.authentication.AnonymousAuthenticationToken;
3434
import org.springframework.security.authentication.TestingAuthenticationToken;
35-
import org.springframework.security.authorization.AuthorizationDecision;
3635
import org.springframework.security.authorization.AuthorizationManager;
36+
import org.springframework.security.authorization.AuthorizationResult;
3737
import org.springframework.security.core.Authentication;
3838
import org.springframework.security.web.DefaultSecurityFilterChain;
3939
import org.springframework.security.web.FilterChainProxy;
@@ -221,7 +221,8 @@ private boolean checkLoginPageIsPublic(List<Filter> filters, FilterInvocation lo
221221
AuthorizationManager<HttpServletRequest> authorizationManager = authorizationFilter
222222
.getAuthorizationManager();
223223
try {
224-
AuthorizationDecision decision = authorizationManager.check(() -> TEST, loginRequest.getHttpRequest());
224+
AuthorizationResult decision = authorizationManager.authorize(() -> TEST,
225+
loginRequest.getHttpRequest());
225226
return decision != null && decision.isGranted();
226227
}
227228
catch (Exception ex) {
@@ -252,7 +253,8 @@ private Supplier<Boolean> deriveAnonymousCheck(List<Filter> filters, FilterInvoc
252253
return () -> {
253254
AuthorizationManager<HttpServletRequest> authorizationManager = authorizationFilter
254255
.getAuthorizationManager();
255-
AuthorizationDecision decision = authorizationManager.check(() -> token, loginRequest.getHttpRequest());
256+
AuthorizationResult decision = authorizationManager.authorize(() -> token,
257+
loginRequest.getHttpRequest());
256258
return decision != null && decision.isGranted();
257259
};
258260
}

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java

+4
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@
7575
import org.springframework.security.authorization.AuthorizationDecision;
7676
import org.springframework.security.authorization.AuthorizationEventPublisher;
7777
import org.springframework.security.authorization.AuthorizationManager;
78+
import org.springframework.security.authorization.AuthorizationResult;
7879
import org.springframework.security.authorization.method.AuthorizationAdvisor;
7980
import org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory;
8081
import org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory.TargetVisitor;
@@ -110,6 +111,7 @@
110111
import static org.mockito.ArgumentMatchers.any;
111112
import static org.mockito.Mockito.atLeastOnce;
112113
import static org.mockito.Mockito.clearInvocations;
114+
import static org.mockito.Mockito.doCallRealMethod;
113115
import static org.mockito.Mockito.mock;
114116
import static org.mockito.Mockito.never;
115117
import static org.mockito.Mockito.spy;
@@ -1293,6 +1295,8 @@ static class AuthorizationEventPublisherConfig {
12931295

12941296
@Bean
12951297
AuthorizationEventPublisher authorizationEventPublisher() {
1298+
doCallRealMethod().when(this.publisher)
1299+
.publishAuthorizationEvent(any(), any(), any(AuthorizationResult.class));
12961300
return this.publisher;
12971301
}
12981302

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurerTests.java

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -42,6 +42,7 @@
4242
import org.springframework.security.authorization.AuthorizationEventPublisher;
4343
import org.springframework.security.authorization.AuthorizationManager;
4444
import org.springframework.security.authorization.AuthorizationObservationContext;
45+
import org.springframework.security.authorization.AuthorizationResult;
4546
import org.springframework.security.config.ObjectPostProcessor;
4647
import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry;
4748
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -78,6 +79,7 @@
7879
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
7980
import static org.mockito.Mockito.any;
8081
import static org.mockito.Mockito.atLeastOnce;
82+
import static org.mockito.Mockito.doCallRealMethod;
8183
import static org.mockito.Mockito.mock;
8284
import static org.mockito.Mockito.spy;
8385
import static org.mockito.Mockito.verify;
@@ -1241,6 +1243,8 @@ static class AuthorizationEventPublisherConfig {
12411243

12421244
@Bean
12431245
AuthorizationEventPublisher authorizationEventPublisher() {
1246+
doCallRealMethod().when(this.publisher)
1247+
.publishAuthorizationEvent(any(), any(), any(AuthorizationResult.class));
12441248
return this.publisher;
12451249
}
12461250

‎config/src/test/java/org/springframework/security/config/http/DefaultFilterChainValidatorTests.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -113,6 +113,7 @@ public void validateCheckLoginPageIsntProtectedThrowsIllegalArgumentException()
113113
@Test
114114
public void validateCheckLoginPageAllowsAnonymous() {
115115
given(this.authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(false));
116+
given(this.authorizationManager.authorize(any(), any())).willCallRealMethod();
116117
this.validator.validate(this.chainAuthorizationFilter);
117118
verify(this.logger).warn("Anonymous access to the login page doesn't appear to be enabled. "
118119
+ "This is almost certainly an error. Please check your configuration allows unauthenticated "

‎config/src/test/java/org/springframework/security/config/http/HttpConfigTests.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -91,6 +91,7 @@ public void getWhenUsingAuthorizationManagerThenRedirectsToLogin() throws Except
9191
AuthorizationManager<HttpServletRequest> authorizationManager = this.spring.getContext()
9292
.getBean(AuthorizationManager.class);
9393
given(authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(false));
94+
given(authorizationManager.authorize(any(), any())).willCallRealMethod();
9495
// @formatter:off
9596
this.mvc.perform(get("/"))
9697
.andExpect(status().isFound())

‎config/src/test/java/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests.java

+1
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,7 @@ public void sendWhenCustomAuthorizationManagerThenAuthorizesAccordingly() {
514514
AuthorizationManager<Message<?>> authorizationManager = this.spring.getContext()
515515
.getBean(AuthorizationManager.class);
516516
given(authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(false));
517+
given(authorizationManager.authorize(any(), any())).willCallRealMethod();
517518
Message<?> message = message("/any");
518519
assertThatExceptionOfType(Exception.class).isThrownBy(send(message))
519520
.withCauseInstanceOf(AccessDeniedException.class);

‎core/src/main/java/org/springframework/security/authorization/AuthorizationEventPublisher.java

+25-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -42,8 +42,32 @@ public interface AuthorizationEventPublisher {
4242
* @param object the secured object
4343
* @param decision the decision about whether the user may access the secured object
4444
* @param <T> the secured object's type
45+
* @deprecated use
46+
* {@link #publishAuthorizationEvent(Supplier, Object, AuthorizationResult)} instead
4547
*/
48+
@Deprecated
4649
<T> void publishAuthorizationEvent(Supplier<Authentication> authentication, T object,
4750
AuthorizationDecision decision);
4851

52+
/**
53+
* Publish the given details in the form of an event, typically
54+
* {@link AuthorizationGrantedEvent} or {@link AuthorizationDeniedEvent}.
55+
*
56+
* Note that success events can be very noisy if enabled by default. Because of this
57+
* implementations may choose to drop success events by default.
58+
* @param authentication a {@link Supplier} for the current user
59+
* @param object the secured object
60+
* @param decision {@link AuthorizationResult} the decision about whether the user may
61+
* access the secured object
62+
* @param <T> the secured object's type
63+
* @since 6.4
64+
*/
65+
default <T> void publishAuthorizationEvent(Supplier<Authentication> authentication, T object,
66+
AuthorizationResult decision) {
67+
if (decision != null && !(decision instanceof AuthorizationDecision)) {
68+
throw new UnsupportedOperationException("Decision must be of type AuthorizationDecision");
69+
}
70+
publishAuthorizationEvent(authentication, object, (AuthorizationDecision) decision);
71+
}
72+
4973
}

‎core/src/main/java/org/springframework/security/authorization/AuthorizationManager.java

+16-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -50,8 +50,23 @@ default void verify(Supplier<Authentication> authentication, T object) {
5050
* @param authentication the {@link Supplier} of the {@link Authentication} to check
5151
* @param object the {@link T} object to check
5252
* @return an {@link AuthorizationDecision} or null if no decision could be made
53+
* @deprecated please use {@link #authorize(Supplier, Object)} instead
5354
*/
5455
@Nullable
56+
@Deprecated
5557
AuthorizationDecision check(Supplier<Authentication> authentication, T object);
5658

59+
/**
60+
* Determines if access is granted for a specific authentication and object.
61+
* @param authentication the {@link Supplier} of the {@link Authentication} to
62+
* authorize
63+
* @param object the {@link T} object to authorize
64+
* @return an {@link AuthorizationResult}
65+
* @since 6.4
66+
*/
67+
@Nullable
68+
default AuthorizationResult authorize(Supplier<Authentication> authentication, T object) {
69+
return check(authentication, object);
70+
}
71+
5772
}

‎core/src/main/java/org/springframework/security/authorization/AuthorizationObservationContext.java

+30-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -35,6 +35,8 @@ public class AuthorizationObservationContext<T> extends Observation.Context {
3535

3636
private AuthorizationDecision decision;
3737

38+
private AuthorizationResult authorizationResult;
39+
3840
public AuthorizationObservationContext(T object) {
3941
Assert.notNull(object, "object cannot be null");
4042
this.object = object;
@@ -71,17 +73,43 @@ public T getObject() {
7173
/**
7274
* Get the observed {@link AuthorizationDecision}
7375
* @return the observed {@link AuthorizationDecision}
76+
* @deprecated please use {@link #getAuthorizationResult()} instead
7477
*/
78+
@Deprecated
7579
public AuthorizationDecision getDecision() {
76-
return this.decision;
80+
Assert.isInstanceOf(AuthorizationDecision.class, this.authorizationResult,
81+
"Please call getAuthorizationResult instead. If you must call getDecision, please ensure that the result you provide is of type AuthorizationDecision");
82+
return (AuthorizationDecision) this.authorizationResult;
7783
}
7884

7985
/**
8086
* Set the observed {@link AuthorizationDecision}
8187
* @param decision the observed {@link AuthorizationDecision}
88+
* @deprecated please use {@link #setAuthorizationResult(AuthorizationResult)} instead
8289
*/
90+
@Deprecated
8391
public void setDecision(AuthorizationDecision decision) {
92+
Assert.isInstanceOf(AuthorizationDecision.class, decision,
93+
"Please call setAuthorizationResult instead. If you must call getDecision, please ensure that the result you provide is of type AuthorizationDecision");
8494
this.decision = decision;
8595
}
8696

97+
/**
98+
* Get the observed {@link AuthorizationResult}
99+
* @return the observed {@link AuthorizationResult}
100+
* @since 6.4
101+
*/
102+
public AuthorizationResult getAuthorizationResult() {
103+
return this.authorizationResult;
104+
}
105+
106+
/**
107+
* Set the observed {@link AuthorizationResult}
108+
* @param authorizationResult the observed {@link AuthorizationResult}
109+
* @since 6.4
110+
*/
111+
public void setAuthorizationResult(AuthorizationResult authorizationResult) {
112+
this.authorizationResult = authorizationResult;
113+
}
114+
87115
}

‎core/src/main/java/org/springframework/security/authorization/AuthorizationObservationConvention.java

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -100,10 +100,10 @@ private String getObjectType(AuthorizationObservationContext<?> context) {
100100
}
101101

102102
private String getAuthorizationDecision(AuthorizationObservationContext<?> context) {
103-
if (context.getDecision() == null) {
103+
if (context.getAuthorizationResult() == null) {
104104
return "unknown";
105105
}
106-
return String.valueOf(context.getDecision().isGranted());
106+
return String.valueOf(context.getAuthorizationResult().isGranted());
107107
}
108108

109109
private String getAuthorities(AuthorizationObservationContext<?> context) {
@@ -114,10 +114,10 @@ private String getAuthorities(AuthorizationObservationContext<?> context) {
114114
}
115115

116116
private String getDecisionDetails(AuthorizationObservationContext<?> context) {
117-
if (context.getDecision() == null) {
117+
if (context.getAuthorizationResult() == null) {
118118
return "unknown";
119119
}
120-
AuthorizationDecision decision = context.getDecision();
120+
AuthorizationResult decision = context.getAuthorizationResult();
121121
return String.valueOf(decision);
122122
}
123123

‎core/src/main/java/org/springframework/security/authorization/ObservationAuthorizationManager.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -71,7 +71,7 @@ public AuthorizationDecision check(Supplier<Authentication> authentication, T ob
7171
Observation observation = Observation.createNotStarted(this.convention, () -> context, this.registry).start();
7272
try (Observation.Scope scope = observation.openScope()) {
7373
AuthorizationDecision decision = this.delegate.check(wrapped, object);
74-
context.setDecision(decision);
74+
context.setAuthorizationResult(decision);
7575
if (decision != null && !decision.isGranted()) {
7676
observation.error(new AccessDeniedException(
7777
this.messages.getMessage("AbstractAccessDecisionManager.accessDenied", "Access Denied")));

‎core/src/main/java/org/springframework/security/authorization/ObservationReactiveAuthorizationManager.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -68,7 +68,7 @@ public Mono<AuthorizationDecision> check(Mono<Authentication> authentication, T
6868
.parentObservation(contextView.getOrDefault(ObservationThreadLocalAccessor.KEY, null))
6969
.start();
7070
return this.delegate.check(wrapped, object).doOnSuccess((decision) -> {
71-
context.setDecision(decision);
71+
context.setAuthorizationResult(decision);
7272
if (decision == null || !decision.isGranted()) {
7373
observation.error(new AccessDeniedException("Access Denied"));
7474
}

‎core/src/main/java/org/springframework/security/authorization/ReactiveAuthorizationManager.java

+14-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2017 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -36,7 +36,9 @@ public interface ReactiveAuthorizationManager<T> {
3636
* @param authentication the Authentication to check
3737
* @param object the object to check
3838
* @return an decision or empty Mono if no decision could be made.
39+
* @deprecated please use {@link #authorize(Mono, Object)} instead
3940
*/
41+
@Deprecated
4042
Mono<AuthorizationDecision> check(Mono<Authentication> authentication, T object);
4143

4244
/**
@@ -55,4 +57,15 @@ default Mono<Void> verify(Mono<Authentication> authentication, T object) {
5557
// @formatter:on
5658
}
5759

60+
/**
61+
* Determines if access is granted for a specific authentication and object.
62+
* @param authentication the Authentication to authorize
63+
* @param object the object to check
64+
* @return an decision or empty Mono if no decision could be made.
65+
* @since 6.4
66+
*/
67+
default Mono<AuthorizationResult> authorize(Mono<Authentication> authentication, T object) {
68+
return check(authentication, object).cast(AuthorizationResult.class);
69+
}
70+
5871
}

0 commit comments

Comments
 (0)