Skip to content

Skip actuator security autoconfig if resource server autoconfig is active #15472

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Skip actuator security autoconfig if resource server autoconfig is active #15472

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8441f48
Skip actuator security configuration if oauth2 resource server securi…
sdoxsee Dec 14, 2018
41ecea0
GH-15472: Add tests to verify actuator endpoints with OAuth2ResourceS…
sdoxsee Dec 22, 2018
f0628bf
GH-15472: Simplify tests to only verify the absense of ReactiveManage…
sdoxsee Jan 1, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions spring-boot-project/spring-boot-actuator-autoconfigure/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -556,6 +556,16 @@
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-resource-server</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-jose</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
Expand Down
17 changes: 17 additions & 0 deletions .../autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
import org.springframework.boot.actuate.autoconfigure.health.HealthIndicatorAutoConfiguration;
import org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration;
import org.springframework.boot.autoconfigure.security.reactive.ReactiveUserDetailsServiceAutoConfiguration;
import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
Expand Down Expand Up @@ -117,6 +118,22 @@ public void backsOffIfCustomSecurityIsAdded() {
});
}

@Test
public void backsOffIfReactiveOAuth2ResourceServerAutoConfigurationSecurityIsAdded() {
this.contextRunner
.withConfiguration(AutoConfigurations
.of(ReactiveOAuth2ResourceServerAutoConfiguration.class))
.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://authserver")
.run((context) -> {
assertThat(
getAuthenticateHeader(context, "/actuator/health").toString())
.contains("Bearer");
assertThat(getAuthenticateHeader(context, "/anything").toString())
.contains("Bearer");
});
}

@Test
public void backsOffWhenWebFilterChainProxyBeanPresent() {
this.contextRunner.withUserConfiguration(WebFilterChainProxyConfiguration.class)
Expand Down
33 changes: 32 additions & 1 deletion ...t/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
package org.springframework.boot.actuate.autoconfigure.security.servlet;

import java.io.IOException;
import java.util.List;

import org.junit.Test;

Expand All @@ -27,10 +28,12 @@
import org.springframework.boot.actuate.autoconfigure.health.HealthIndicatorAutoConfiguration;
import org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.mock.web.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
Expand Down Expand Up @@ -106,8 +109,36 @@ public void backOffIfCustomSecurityIsAdded() {
});
}

@Test
public void backOffIfOAuth2ResourceServerAutoConfigurationSecurityIsAdded() {
this.contextRunner
.withConfiguration(AutoConfigurations
.of(OAuth2ResourceServerAutoConfiguration.class))
.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://authserver")
.run((context) -> {
assertThat(
getAuthenticateHeader(context, "/actuator/info").toString())
.contains("Bearer");
assertThat(getAuthenticateHeader(context, "/anything").toString())
.contains("Bearer");
});
}

private List<String> getAuthenticateHeader(AssertableWebApplicationContext context,
String path) throws IOException, javax.servlet.ServletException {
MockHttpServletResponse response = getResponse(context, path);
return response.getHeaders(HttpHeaders.WWW_AUTHENTICATE);
}

private HttpStatus getResponseStatus(AssertableWebApplicationContext context,
String path) throws IOException, javax.servlet.ServletException {
MockHttpServletResponse response = getResponse(context, path);
return HttpStatus.valueOf(response.getStatus());
}

private MockHttpServletResponse getResponse(AssertableWebApplicationContext context,
String path) throws IOException, javax.servlet.ServletException {
FilterChainProxy filterChainProxy = context.getBean(FilterChainProxy.class);
MockServletContext servletContext = new MockServletContext();
MockHttpServletResponse response = new MockHttpServletResponse();
Expand All @@ -117,7 +148,7 @@ private HttpStatus getResponseStatus(AssertableWebApplicationContext context,
request.setServletPath(path);
request.setMethod("GET");
filterChainProxy.doFilter(request, response, new MockFilterChain());
return HttpStatus.valueOf(response.getStatus());
return response;
}

@Configuration
Expand Down