Skip to content

Merge pull request #6901 from eleftherias/gh-6885-http-basic-dsl #6901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 20, 2019

Conversation

eleftherias
Copy link
Contributor

Issue: gh-5557
Fixes: gh-6885

* @param <C> the configurer type
*/
@FunctionalInterface
public interface HttpConfigurerConsumer<C extends AbstractHttpConfigurer> {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason to use this vs using java.util.function.Consumer?

NOTE: Much of the java configuration was written when we supported JDK 1.5+. Now that we require at least JDK 8 I think Consumer makes sense. Perhaps you were following the patterns that existed in the older code is why you created this interface?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The java.util.function.Consumer does't allow exceptions to be thrown from the accept method.
In our case the realmName method on HttpBasicConfigurer throws an exception, so you would not be able to use that method in a lambda with the Java Consumer.
I have seen a custom consumer in Spring Boot and I assume it is for the same reason.
https://github.com/spring-projects/spring-boot/blob/36c1c051b8106371d37f8a747cea0e369a8e5c84/spring-boot-project/spring-boot-test/src/main/java/org/springframework/boot/test/context/runner/ContextConsumer.java

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the pointer. That makes sense. A few thoughts:

  • I think we should change the signature to allow throwing Throwable rather than Exception
  • I'm thinking we may want to make this more central (i.e. within core) since it is likely we will need to use this in other places.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rwinch I moved the consumer to the core module and renamed it. I also made the Throwable a type argument so that it doesn't need to bubble up as a Throwable in the calling methods.

* @return {@link HttpBasicConfigurer} for additional customization
* @throws Exception
*/
public HttpBasicConfigurer<B> withDefaults() throws Exception {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I'd prefer to revert and potentially use a generic noop Consumer. The reason is that withDefaults is exposed for those not using lambda's and becomes confusing since the defaults are already applied by default. Another reason is that way we don't need a withDefaults for every configurer that we have.

I know we already talked about creating a method reference for users, but in hindsight I'd suggest we just require users to create an empty lambda. The JDK doesn't even provide one. We can always introduce a generic no op consumer later on.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree.
I believe users could still do the following to keep the defaults.

http
    .httpBasic(httpBasicConfigurer -> {});

@eleftherias eleftherias force-pushed the gh-6885-http-basic-dsl branch from 4aeaff7 to 5f3cc01 Compare June 4, 2019 19:27
@eleftherias eleftherias added the in: config An issue in spring-security-config label Jun 5, 2019
@eleftherias eleftherias force-pushed the gh-6885-http-basic-dsl branch 2 times, most recently from 491a6e2 to 986a4ca Compare June 18, 2019 16:01
*
* &#064;Override
* protected void configure(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().httpBasic(httpBasicConfig -> {});
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd fix this formatting to have newlines in it. I know there are other places we are missing newlines, but that occurred by mistake.

* }
*
* &#064;Override
* protected void configure(AuthenticationManagerBuilder auth) throws Exception {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd just omit this from the configuration as we now recommend exposing a UserDetailsService via a Bean. This also allows the user to focus on this specific configuration

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated the Javadoc with both suggestions.

@eleftherias eleftherias force-pushed the gh-6885-http-basic-dsl branch 2 times, most recently from be1f362 to 0e25aef Compare June 18, 2019 21:44
*/
@FunctionalInterface
public interface Customizer<T> {

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry this went in a full circle. However, now that we have a custom interface again, perhaps we can reintroduce something like

<T> Customizer<T> withDefaults() {
    return t -> {};
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would need to be static -- right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rwinch I added withDefaults to the Customizer.
@sbrannen Yes, the method is static.

@eleftherias eleftherias force-pushed the gh-6885-http-basic-dsl branch from 0e25aef to b32f7c1 Compare June 20, 2019 13:18
@eleftherias eleftherias force-pushed the gh-6885-http-basic-dsl branch from b32f7c1 to e1eaaa9 Compare June 20, 2019 15:12
@rwinch rwinch self-assigned this Jun 20, 2019
@rwinch rwinch added this to the 5.2.0.RC1 milestone Jun 20, 2019
@rwinch rwinch changed the title Allow configuration of HTTP basic through nested builder Merge pull request #6901 from eleftherias/gh-6885-http-basic-dsl Jun 20, 2019
@rwinch rwinch merged commit 12da990 into spring-projects:master Jun 20, 2019
@rwinch
Copy link
Member

rwinch commented Jun 20, 2019

Thanks @eleftherias! This is now merged into master

@eleftherias eleftherias deleted the gh-6885-http-basic-dsl branch August 26, 2019 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: config An issue in spring-security-config
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Allow http basic auth to be configured using nested builder
3 participants