spring-projectsGH-3897: Deprecate ChannelSecurityInterceptor

Fixes spring-projects#3897

Spring Security has deprecated `AccessDecisionManager` and all its infrastructure
in favor of `AuthorizationManager`

* Deprecate and AOP `ChannelSecurityInterceptor` and all its infrastructure,
including `@SecuredChannel` and respective XML configuration.
The `AuthorizationChannelInterceptor` added to respective channels for security
or configured as a global channel interceptor fully covers the previous AOP configuration
* Fix deprecation warnings in other tests with security

Author: artembilan

build.gradle

@@ -167,6 +167,7 @@ allprojects {
             mavenBom "io.micrometer:micrometer-tracing-bom:$micrometerTracingVersion"
             mavenBom "org.apache.camel:camel-bom:$camelVersion"
             mavenBom "org.testcontainers:testcontainers-bom:$testcontainersVersion"
+            mavenBom "org.springframework.security:spring-security-bom:$springSecurityVersion"
         }
 
     }
@@ -659,10 +660,10 @@ project('spring-integration-http') {
 
         testImplementation project(':spring-integration-security')
         testImplementation "org.hamcrest:hamcrest-core:$hamcrestVersion"
-        testImplementation("org.springframework.security:spring-security-config:$springSecurityVersion") {
+        testImplementation('org.springframework.security:spring-security-config') {
             exclude group: 'org.springframework'
         }
-        testImplementation("org.springframework.security:spring-security-test:$springSecurityVersion") {
+        testImplementation('org.springframework.security:spring-security-test') {
             exclude group: 'org.springframework'
         }
         testImplementation 'com.fasterxml.jackson.core:jackson-databind'
@@ -863,11 +864,11 @@ project('spring-integration-security') {
     description = 'Spring Integration Security Support'
     dependencies {
         api project(':spring-integration-core')
-        api("org.springframework.security:spring-security-core:$springSecurityVersion") {
+        api('org.springframework.security:spring-security-messaging') {
             exclude group: 'org.springframework'
         }
 
-        testImplementation("org.springframework.security:spring-security-config:$springSecurityVersion") {
+        testImplementation('org.springframework.security:spring-security-config') {
             exclude group: 'org.springframework'
         }
     }
@@ -955,10 +956,10 @@ project('spring-integration-webflux') {
         testImplementation "jakarta.servlet:jakarta.servlet-api:$servletApiVersion"
         testImplementation "org.hamcrest:hamcrest-core:$hamcrestVersion"
         testImplementation 'org.springframework:spring-webmvc'
-        testImplementation("org.springframework.security:spring-security-config:$springSecurityVersion") {
+        testImplementation('org.springframework.security:spring-security-config') {
             exclude group: 'org.springframework'
         }
-        testImplementation("org.springframework.security:spring-security-test:$springSecurityVersion") {
+        testImplementation('org.springframework.security:spring-security-test') {
             exclude group: 'org.springframework'
         }
         testImplementation 'com.fasterxml.jackson.core:jackson-databind'

spring-integration-http/src/test/java/org/springframework/integration/http/dsl/HttpDslTests.java

@@ -27,7 +27,6 @@
 
 import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 
@@ -52,22 +51,18 @@
 import org.springframework.integration.handler.AbstractReplyProducingMessageHandler;
 import org.springframework.integration.http.multipart.UploadedMultipartFile;
 import org.springframework.integration.http.outbound.HttpRequestExecutingMessageHandler;
-import org.springframework.integration.security.channel.ChannelSecurityInterceptor;
-import org.springframework.integration.security.channel.SecuredChannel;
 import org.springframework.messaging.Message;
 import org.springframework.messaging.MessageChannel;
 import org.springframework.messaging.PollableChannel;
 import org.springframework.messaging.support.ErrorMessage;
 import org.springframework.mock.web.MockPart;
-import org.springframework.security.access.AccessDecisionManager;
-import org.springframework.security.access.vote.AffirmativeBased;
-import org.springframework.security.access.vote.RoleVoter;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.authorization.AuthorityAuthorizationManager;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.factory.PasswordEncoderFactories;
+import org.springframework.security.messaging.access.intercept.AuthorizationChannelInterceptor;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@@ -335,9 +330,11 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
 		}
 
 		@Bean
-		@SecuredChannel(interceptor = "channelSecurityInterceptor", sendAccess = "ROLE_ADMIN")
 		public MessageChannel transformSecuredChannel() {
-			return new DirectChannel();
+			DirectChannel directChannel = new DirectChannel();
+			directChannel.addInterceptor(
+					new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasRole("ADMIN")));
+			return directChannel;
 		}
 
 		@Bean
@@ -393,21 +390,6 @@ public MultipartResolver multipartResolver() {
 			return new StandardServletMultipartResolver();
 		}
 
-		@Bean
-		public AccessDecisionManager accessDecisionManager() {
-			return new AffirmativeBased(Collections.singletonList(new RoleVoter()));
-		}
-
-		@Bean
-		public ChannelSecurityInterceptor channelSecurityInterceptor(AccessDecisionManager accessDecisionManager,
-				AuthenticationManagerBuilder authenticationManagerBuilder) {
-
-			ChannelSecurityInterceptor channelSecurityInterceptor = new ChannelSecurityInterceptor();
-			channelSecurityInterceptor.setAuthenticationManager(authenticationManagerBuilder.getOrBuild());
-			channelSecurityInterceptor.setAccessDecisionManager(accessDecisionManager);
-			return channelSecurityInterceptor;
-		}
-
 		@Bean
 		public Validator customValidator() {
 			return new TestModelValidator();

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelAccessPolicy.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,7 +26,11 @@
  *
  * @author Oleg Zhurakousky
  * @since 2.0
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public interface ChannelAccessPolicy {
 
 	Collection<ConfigAttribute> getConfigAttributesForSend();

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelInvocation.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,7 +29,11 @@
  * is a <em>send</em> operation, the {@link Message} is also available.
  *
  * @author Mark Fisher
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public class ChannelInvocation {
 
 	private final MessageChannel channel;

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelSecurityInterceptor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,15 @@
  *
  * @author Mark Fisher
  * @author Oleg Zhurakousky
+ *
  * @see SecuredChannel
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}.
+ * However, the {@link org.springframework.security.messaging.access.intercept.AuthorizationChannelInterceptor}
+ * can be configured with any {@link org.springframework.security.authorization.AuthorizationManager} implementation.
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public final class ChannelSecurityInterceptor extends AbstractSecurityInterceptor implements MethodInterceptor {
 
 	private final ChannelSecurityMetadataSource securityMetadataSource;

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelSecurityMetadataSource.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -36,7 +36,11 @@
  *
  * @author Mark Fisher
  * @author Oleg Zhurakousky
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public class ChannelSecurityMetadataSource implements SecurityMetadataSource {
 
 	private final Map<Pattern, ChannelAccessPolicy> patternMappings;

spring-integration-security/src/main/java/org/springframework/integration/security/channel/DefaultChannelAccessPolicy.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,7 +33,11 @@
  * @author Mark Fisher
  * @author Oleg Zhurakousky
  * @author Artem Bilan
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public class DefaultChannelAccessPolicy implements ChannelAccessPolicy {
 
 	private final Collection<ConfigAttribute> configAttributeDefinitionForSend;

spring-integration-security/src/main/java/org/springframework/integration/security/channel/SecuredChannel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2019 the original author or authors.
+ * Copyright 2015-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,7 +33,11 @@
  *
  * @author Artem Bilan
  * @since 4.2
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 @Target(ElementType.METHOD)
 @Retention(RetentionPolicy.RUNTIME)
 @Documented

spring-integration-security/src/main/java/org/springframework/integration/security/config/ChannelSecurityInterceptorBeanPostProcessor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,7 +42,11 @@
  * @author Oleg Zhurakousky
  * @author Artem Bilan
  * @author Gary Russell
+
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 @SuppressWarnings("serial")
 public class ChannelSecurityInterceptorBeanPostProcessor extends AbstractAutoProxyCreator {
 

spring-integration-security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,11 @@
  * Namespace handler for the security namespace.
  *
  * @author Jonas Partner
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public class IntegrationSecurityNamespaceHandler extends AbstractIntegrationNamespaceHandler {
 
 	public void init() {

spring-integration-security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -41,7 +41,11 @@
  * @author Jonas Partner
  * @author Mark Fisher
  * @author Artem Bilan
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public class SecuredChannelsParser extends AbstractSingleBeanDefinitionParser {
 
 	@Override

spring-integration-security/src/main/java/org/springframework/integration/security/config/SecurityIntegrationConfigurationInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2014-2019 the original author or authors.
+ * Copyright 2014-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,7 +43,11 @@
  * @author Artem Bilan
  *
  * @since 4.0
+ *
+ * @deprecated since 6.0 in favor of literally
+ * {@code new AuthorizationChannelInterceptor(AuthorityAuthorizationManager.hasAnyRole())}
  */
+@Deprecated(since = "6.0", forRemoval = true)
 public class SecurityIntegrationConfigurationInitializer implements IntegrationConfigurationInitializer {
 
 	private static final String CHANNEL_SECURITY_INTERCEPTOR_BPP_BEAN_NAME =

spring-integration-security/src/test/java/org/springframework/integration/security/MockAuthenticationManager.java

@@ -1,22 +1,37 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans:beans xmlns="http://www.springframework.org/schema/integration"
-			 xmlns:si-security="http://www.springframework.org/schema/integration/security"
 			 xmlns:beans="http://www.springframework.org/schema/beans"
 			 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 			 xmlns:task="http://www.springframework.org/schema/task"
+			 xmlns:security="http://www.springframework.org/schema/security"
 			 xsi:schemaLocation="http://www.springframework.org/schema/beans
 			https://www.springframework.org/schema/beans/spring-beans.xsd
 			http://www.springframework.org/schema/integration
 			https://www.springframework.org/schema/integration/spring-integration.xsd
-			http://www.springframework.org/schema/integration/security
-			https://www.springframework.org/schema/integration/security/spring-integration-security.xsd
+			http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
 			http://www.springframework.org/schema/task https://www.springframework.org/schema/task/spring-task.xsd">
 
-	<beans:import resource="classpath:org/springframework/integration/security/config/commonSecurityConfiguration.xml"/>
+	<security:user-service id="userDetailsService">
+		<security:user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN"/>
+		<security:user name="bob" password="bobspassword" authorities="ROLE_USER"/>
+	</security:user-service>
 
-	<si-security:secured-channels>
-		<si-security:access-policy pattern="securedChannel.*" send-access="ROLE_ADMIN, ROLE_PRESIDENT"/>
-	</si-security:secured-channels>
+	<channel-interceptor pattern="securedChannel*">
+		<beans:bean
+				class="org.springframework.security.messaging.access.intercept.AuthorizationChannelInterceptor">
+			<beans:constructor-arg>
+				<beans:bean class="org.springframework.security.authorization.AuthorityAuthorizationManager"
+							factory-method="hasAnyRole">
+					<beans:constructor-arg>
+						<beans:array>
+							<beans:value>ADMIN</beans:value>
+							<beans:value>PRESIDENT</beans:value>
+						</beans:array>
+					</beans:constructor-arg>
+				</beans:bean>
+			</beans:constructor-arg>
+		</beans:bean>
+	</channel-interceptor>
 
 	<beans:bean id="testHandler" class="org.springframework.integration.security.TestHandler"/>