Skip to content

Commit ec09b62

Browse files
eleftheriaskostya05983
eleftherias
authored and
kostya05983
committed
Allow configuration of anonymous through nested builder
Issue: spring-projectsgh-5557
1 parent 11d7bb1 commit ec09b62

File tree

2 files changed

+168
-8
lines changed

2 files changed

+168
-8
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1531,6 +1531,76 @@ public AnonymousConfigurer<HttpSecurity> anonymous() throws Exception {
15311531
return getOrApply(new AnonymousConfigurer<>());
15321532
}
15331533

1534+
/**
1535+
* Allows configuring how an anonymous user is represented. This is automatically
1536+
* applied when used in conjunction with {@link WebSecurityConfigurerAdapter}. By
1537+
* default anonymous users will be represented with an
1538+
* {@link org.springframework.security.authentication.AnonymousAuthenticationToken}
1539+
* and contain the role "ROLE_ANONYMOUS".
1540+
*
1541+
* <h2>Example Configuration</h2>
1542+
*
1543+
* The following configuration demonstrates how to specify that anonymous users should
1544+
* contain the role "ROLE_ANON" instead.
1545+
*
1546+
* <pre>
1547+
* &#064;Configuration
1548+
* &#064;EnableWebSecurity
1549+
* public class AnononymousSecurityConfig extends WebSecurityConfigurerAdapter {
1550+
*
1551+
* &#064;Override
1552+
* protected void configure(HttpSecurity http) throws Exception {
1553+
* http
1554+
* .authorizeRequests(authorizeRequests ->
1555+
* authorizeRequests
1556+
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
1557+
* )
1558+
* .formLogin(withDefaults())
1559+
* // sample anonymous customization
1560+
* .anonymous(anonymous ->
1561+
* anonymous
1562+
* .authorities(&quot;ROLE_ANON&quot;)
1563+
* )
1564+
* }
1565+
* }
1566+
* </pre>
1567+
*
1568+
* The following demonstrates how to represent anonymous users as null. Note that this
1569+
* can cause {@link NullPointerException} in code that assumes anonymous
1570+
* authentication is enabled.
1571+
*
1572+
* <pre>
1573+
* &#064;Configuration
1574+
* &#064;EnableWebSecurity
1575+
* public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {
1576+
*
1577+
* &#064;Override
1578+
* protected void configure(HttpSecurity http) throws Exception {
1579+
* http
1580+
* .authorizeRequests(authorizeRequests ->
1581+
* authorizeRequests
1582+
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
1583+
* )
1584+
* .formLogin(withDefaults())
1585+
* // sample anonymous customization
1586+
* .anonymous(anonymous ->
1587+
* anonymous.disabled()
1588+
* );
1589+
* }
1590+
* }
1591+
* </pre>
1592+
*
1593+
* @param anonymousCustomizer the {@link Customizer} to provide more options for
1594+
* the {@link AnonymousConfigurer}
1595+
* @return the {@link HttpSecurity} for further customizations
1596+
* @throws Exception
1597+
*/
1598+
public HttpSecurity anonymous(Customizer<AnonymousConfigurer<HttpSecurity>> anonymousCustomizer) throws Exception {
1599+
anonymousCustomizer.customize(getOrApply(new AnonymousConfigurer<>()));
1600+
return HttpSecurity.this;
1601+
}
1602+
1603+
15341604
/**
15351605
* Specifies to support form based authentication. If
15361606
* {@link FormLoginConfigurer#loginPage(String)} is not specified a default login page

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/AnonymousConfigurerTests.java

Lines changed: 98 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -18,18 +18,22 @@
1818
import org.junit.Rule;
1919
import org.junit.Test;
2020
import org.springframework.beans.factory.annotation.Autowired;
21+
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
2122
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2223
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
2324
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
2425
import org.springframework.security.config.test.SpringTestRule;
2526
import org.springframework.security.core.annotation.AuthenticationPrincipal;
27+
import org.springframework.security.core.userdetails.PasswordEncodedUser;
2628
import org.springframework.test.web.servlet.MockMvc;
2729
import org.springframework.web.bind.annotation.GetMapping;
2830
import org.springframework.web.bind.annotation.RestController;
2931
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
3032

33+
import static org.springframework.security.config.Customizer.withDefaults;
3134
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
3235
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
36+
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
3337

3438
/**
3539
* @author Rob Winch
@@ -44,7 +48,7 @@ public class AnonymousConfigurerTests {
4448

4549
@Test
4650
public void requestWhenAnonymousTwiceInvokedThenDoesNotOverride() throws Exception {
47-
this.spring.register(InvokeTwiceDoesNotOverride.class).autowire();
51+
this.spring.register(InvokeTwiceDoesNotOverride.class, PrincipalController.class).autowire();
4852

4953
this.mockMvc.perform(get("/"))
5054
.andExpect(content().string("principal"));
@@ -63,13 +67,99 @@ protected void configure(HttpSecurity http) throws Exception {
6367
.and()
6468
.anonymous();
6569
}
70+
}
71+
72+
@Test
73+
public void requestWhenAnonymousPrincipalInLambdaThenPrincipalUsed() throws Exception {
74+
this.spring.register(AnonymousPrincipalInLambdaConfig.class, PrincipalController.class).autowire();
75+
76+
this.mockMvc.perform(get("/"))
77+
.andExpect(content().string("principal"));
78+
}
79+
80+
@EnableWebSecurity
81+
@EnableWebMvc
82+
static class AnonymousPrincipalInLambdaConfig extends WebSecurityConfigurerAdapter {
83+
84+
@Override
85+
protected void configure(HttpSecurity http) throws Exception {
86+
// @formatter:off
87+
http
88+
.anonymous(anonymous ->
89+
anonymous
90+
.principal("principal")
91+
);
92+
// @formatter:on
93+
}
94+
}
95+
96+
@Test
97+
public void requestWhenAnonymousDisabledInLambdaThenRespondsWithForbidden() throws Exception {
98+
this.spring.register(AnonymousDisabledInLambdaConfig.class, PrincipalController.class).autowire();
99+
100+
this.mockMvc.perform(get("/"))
101+
.andExpect(status().isForbidden());
102+
}
103+
104+
@EnableWebSecurity
105+
static class AnonymousDisabledInLambdaConfig extends WebSecurityConfigurerAdapter {
106+
@Override
107+
protected void configure(HttpSecurity http) throws Exception {
108+
// @formatter:off
109+
http
110+
.authorizeRequests(authorizeRequests ->
111+
authorizeRequests
112+
.anyRequest().permitAll()
113+
)
114+
.anonymous(AbstractHttpConfigurer::disable);
115+
// @formatter:on
116+
}
117+
118+
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
119+
// @formatter:off
120+
auth
121+
.inMemoryAuthentication()
122+
.withUser(PasswordEncodedUser.user());
123+
// @formatter:on
124+
}
125+
}
126+
127+
@Test
128+
public void requestWhenAnonymousWithDefaultsInLambdaThenRespondsWithOk() throws Exception {
129+
this.spring.register(AnonymousWithDefaultsInLambdaConfig.class, PrincipalController.class).autowire();
130+
131+
this.mockMvc.perform(get("/"))
132+
.andExpect(status().isOk());
133+
}
134+
135+
@EnableWebSecurity
136+
static class AnonymousWithDefaultsInLambdaConfig extends WebSecurityConfigurerAdapter {
137+
@Override
138+
protected void configure(HttpSecurity http) throws Exception {
139+
// @formatter:off
140+
http
141+
.authorizeRequests(authorizeRequests ->
142+
authorizeRequests
143+
.anyRequest().permitAll()
144+
)
145+
.anonymous(withDefaults());
146+
// @formatter:on
147+
}
148+
149+
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
150+
// @formatter:off
151+
auth
152+
.inMemoryAuthentication()
153+
.withUser(PasswordEncodedUser.user());
154+
// @formatter:on
155+
}
156+
}
66157

67-
@RestController
68-
static class PrincipalController {
69-
@GetMapping("/")
70-
String principal(@AuthenticationPrincipal String principal) {
71-
return principal;
72-
}
158+
@RestController
159+
static class PrincipalController {
160+
@GetMapping("/")
161+
String principal(@AuthenticationPrincipal String principal) {
162+
return principal;
73163
}
74164
}
75165
}

0 commit comments

Comments
 (0)