Skip to content

Commit b7d3acc

Browse files
HomoEfficiorwinch
HomoEfficio
authored and
rwinch
committed
Add constructors to AbstractAuthenticationProcessingFilter
Closes gh-8309
1 parent 419d726 commit b7d3acc

File tree

4 files changed

+150
-5
lines changed

4 files changed

+150
-5
lines changed

‎web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,33 @@ protected AbstractAuthenticationProcessingFilter(
156156
this.requiresAuthenticationRequestMatcher = requiresAuthenticationRequestMatcher;
157157
}
158158

159+
/**
160+
* Creates a new instance with a default filterProcessesUrl and an {@link AuthenticationManager}
161+
*
162+
* @param defaultFilterProcessesUrl the default value for <tt>filterProcessesUrl</tt>.
163+
* @param authenticationManager the {@link AuthenticationManager} used to authenticate an {@link Authentication} object.
164+
* Cannot be null.
165+
*/
166+
protected AbstractAuthenticationProcessingFilter(String defaultFilterProcessesUrl,
167+
AuthenticationManager authenticationManager) {
168+
setFilterProcessesUrl(defaultFilterProcessesUrl);
169+
setAuthenticationManager(authenticationManager);
170+
}
171+
172+
/**
173+
* Creates a new instance with a {@link RequestMatcher} and an {@link AuthenticationManager}
174+
*
175+
* @param requiresAuthenticationRequestMatcher the {@link RequestMatcher} used to determine
176+
* if authentication is required. Cannot be null.
177+
* @param authenticationManager the {@link AuthenticationManager} used to authenticate an {@link Authentication} object.
178+
* Cannot be null.
179+
*/
180+
protected AbstractAuthenticationProcessingFilter(RequestMatcher requiresAuthenticationRequestMatcher,
181+
AuthenticationManager authenticationManager) {
182+
setRequiresAuthenticationRequestMatcher(requiresAuthenticationRequestMatcher);
183+
setAuthenticationManager(authenticationManager);
184+
}
185+
159186
// ~ Methods
160187
// ========================================================================================================
161188

‎web/src/main/java/org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilter.java

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
package org.springframework.security.web.authentication;
1818

1919
import org.springframework.lang.Nullable;
20+
import org.springframework.security.authentication.AuthenticationManager;
2021
import org.springframework.security.authentication.AuthenticationServiceException;
2122
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
2223
import org.springframework.security.core.Authentication;
@@ -51,6 +52,8 @@ public class UsernamePasswordAuthenticationFilter extends
5152

5253
public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
5354
public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
55+
private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
56+
new AntPathRequestMatcher("/login", "POST");
5457

5558
private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
5659
private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
@@ -60,7 +63,11 @@ public class UsernamePasswordAuthenticationFilter extends
6063
// ===================================================================================================
6164

6265
public UsernamePasswordAuthenticationFilter() {
63-
super(new AntPathRequestMatcher("/login", "POST"));
66+
super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
67+
}
68+
69+
public UsernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager) {
70+
super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
6471
}
6572

6673
// ~ Methods

‎web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilterTests.java

Lines changed: 98 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@
5050
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices;
5151
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
5252
import org.springframework.security.web.firewall.DefaultHttpFirewall;
53+
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
54+
import org.springframework.security.web.util.matcher.RequestMatcher;
5355
import org.springframework.test.util.ReflectionTestUtils;
5456

5557
/**
@@ -212,6 +214,78 @@ public void testNormalOperationWithDefaultFilterProcessesUrl() throws Exception
212214
assertThat(request.getSession()).isEqualTo(sessionPreAuth);
213215
}
214216

217+
@Test
218+
public void testNormalOperationWithDefaultFilterProcessesUrlAndAuthenticationManager() throws Exception {
219+
// Setup our HTTP request
220+
MockHttpServletRequest request = createMockAuthenticationRequest();
221+
HttpSession sessionPreAuth = request.getSession();
222+
223+
// Setup our filter configuration
224+
MockFilterConfig config = new MockFilterConfig(null, null);
225+
226+
// Setup our expectation that the filter chain will not be invoked, as we redirect
227+
// to defaultTargetUrl
228+
MockFilterChain chain = new MockFilterChain(false);
229+
MockHttpServletResponse response = new MockHttpServletResponse();
230+
231+
// Setup our test object, to grant access
232+
MockAuthenticationFilter filter = new MockAuthenticationFilter(
233+
"/j_mock_post", mock(AuthenticationManager.class));
234+
235+
filter.setSessionAuthenticationStrategy(
236+
mock(SessionAuthenticationStrategy.class));
237+
filter.setAuthenticationSuccessHandler(successHandler);
238+
filter.setAuthenticationFailureHandler(failureHandler);
239+
filter.afterPropertiesSet();
240+
241+
// Test
242+
filter.doFilter(request, response, chain);
243+
assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/logged_in.jsp");
244+
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull();
245+
assertThat(
246+
SecurityContextHolder.getContext().getAuthentication().getPrincipal().toString()).isEqualTo(
247+
"test");
248+
// Should still have the same session
249+
assertThat(request.getSession()).isEqualTo(sessionPreAuth);
250+
}
251+
252+
@Test
253+
public void testNormalOperationWithRequestMatcherAndAuthenticationManager() throws Exception {
254+
// Setup our HTTP request
255+
MockHttpServletRequest request = createMockAuthenticationRequest();
256+
request.setServletPath("/j_eradicate_corona_virus");
257+
request.setRequestURI("/mycontext/j_eradicate_corona_virus");
258+
HttpSession sessionPreAuth = request.getSession();
259+
260+
// Setup our filter configuration
261+
MockFilterConfig config = new MockFilterConfig(null, null);
262+
263+
// Setup our expectation that the filter chain will not be invoked, as we redirect
264+
// to defaultTargetUrl
265+
MockFilterChain chain = new MockFilterChain(false);
266+
MockHttpServletResponse response = new MockHttpServletResponse();
267+
268+
// Setup our test object, to grant access
269+
MockAuthenticationFilter filter = new MockAuthenticationFilter(
270+
new AntPathRequestMatcher("/j_eradicate_corona_virus"), mock(AuthenticationManager.class));
271+
272+
filter.setSessionAuthenticationStrategy(
273+
mock(SessionAuthenticationStrategy.class));
274+
filter.setAuthenticationSuccessHandler(successHandler);
275+
filter.setAuthenticationFailureHandler(failureHandler);
276+
filter.afterPropertiesSet();
277+
278+
// Test
279+
filter.doFilter(request, response, chain);
280+
assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/logged_in.jsp");
281+
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull();
282+
assertThat(
283+
SecurityContextHolder.getContext().getAuthentication().getPrincipal().toString()).isEqualTo(
284+
"test");
285+
// Should still have the same session
286+
assertThat(request.getSession()).isEqualTo(sessionPreAuth);
287+
}
288+
215289
@Test
216290
public void testStartupDetectsInvalidAuthenticationManager() {
217291
AbstractAuthenticationProcessingFilter filter = new MockAuthenticationFilter();
@@ -430,20 +504,33 @@ public void setRememberMeServicesShouldntAllowNulls() {
430504
private class MockAuthenticationFilter
431505
extends AbstractAuthenticationProcessingFilter {
432506

507+
private static final String DEFAULT_FILTER_PROCESSING_URL = "/j_mock_post";
508+
433509
private AuthenticationException exceptionToThrow;
434510

435511
private boolean grantAccess;
436512

437513
MockAuthenticationFilter(boolean grantAccess) {
438514
this();
439-
setRememberMeServices(new NullRememberMeServices());
515+
setupRememberMeServicesAndAuthenticationException();
440516
this.grantAccess = grantAccess;
441-
this.exceptionToThrow = new BadCredentialsException(
442-
"Mock requested to do so");
443517
}
444518

445519
private MockAuthenticationFilter() {
446-
super("/j_mock_post");
520+
super(DEFAULT_FILTER_PROCESSING_URL);
521+
}
522+
523+
private MockAuthenticationFilter(String defaultFilterProcessingUrl, AuthenticationManager authenticationManager) {
524+
super(defaultFilterProcessingUrl, authenticationManager);
525+
setupRememberMeServicesAndAuthenticationException();
526+
this.grantAccess = true;
527+
}
528+
529+
private MockAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher,
530+
AuthenticationManager authenticationManager) {
531+
super(requiresAuthenticationRequestMatcher, authenticationManager);
532+
setupRememberMeServicesAndAuthenticationException();
533+
this.grantAccess = true;
447534
}
448535

449536
public Authentication attemptAuthentication(HttpServletRequest request,
@@ -456,6 +543,13 @@ public Authentication attemptAuthentication(HttpServletRequest request,
456543
throw exceptionToThrow;
457544
}
458545
}
546+
547+
private void setupRememberMeServicesAndAuthenticationException() {
548+
setRememberMeServices(new NullRememberMeServices());
549+
this.exceptionToThrow = new BadCredentialsException(
550+
"Mock requested to do so");
551+
}
552+
459553
}
460554

461555
private class MockFilterChain implements FilterChain {

‎web/src/test/java/org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilterTests.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,23 @@ public void testNormalOperation() {
5757
assertThat(((WebAuthenticationDetails) result.getDetails()).getRemoteAddress()).isEqualTo("127.0.0.1");
5858
}
5959

60+
@Test
61+
public void testConstructorInjectionOfAuthenticationManager() {
62+
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/");
63+
request.addParameter(
64+
UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_USERNAME_KEY,
65+
"rod");
66+
request.addParameter(
67+
UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_PASSWORD_KEY,
68+
"dokdo");
69+
70+
UsernamePasswordAuthenticationFilter filter =
71+
new UsernamePasswordAuthenticationFilter(createAuthenticationManager());
72+
73+
Authentication result = filter.attemptAuthentication(request, new MockHttpServletResponse());
74+
assertThat(result).isNotNull();
75+
}
76+
6077
@Test
6178
public void testNullPasswordHandledGracefully() {
6279
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/");

0 commit comments

Comments
 (0)