Added support for Anonymous Authentication by ankurpathak · Pull Request #6198 · spring-projects/spring-security

ankurpathak · 2018-11-30T14:22:54Z

Created new WebFilter AnonymousAuthenticationWebFilter to
for anonymous authentication
Created class AnonymousSpec, method anonymous to configure
anonymous authentication in ServerHttpSecurity
Added ANONYMOUS_AUTHENTICATION order after AUTHENTICATION for
anonymous authentication in SecurityWebFiltersOrder

Pull request for github issue:
#5934

rwinch

Thanks for the PR @ankurpathak! I have provided feedback inline. Can you als please add tests for this?

rwinch · 2018-12-03T20:03:07Z

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

please fix this Javadoc

This is fixed like this:

/** * @since 5.2.0 * @author Ankur Pathak * Configures annonymous authentication * * <pre class="code"> * @Bean * public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { * http * // ... * .anonymous.key("key") * .authorities("ROLE_ANONYMOUS"); * return http.build(); * } * </pre> */

rwinch · 2018-12-03T20:05:50Z

...org/springframework/security/web/server/authentication/AnonymousAuthenticationWebFilter.java

I don't think you will ever get a null value here since it would just be empty.

rwinch · 2018-12-03T20:07:22Z

...org/springframework/security/web/server/authentication/AnonymousAuthenticationWebFilter.java

We should only set the subscriberContext if it changes

I did it this way. But lots of tests are failing lile RequestCacheTests etc are failing. I have tried almost every thing:

@Override public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) { return ReactiveSecurityContextHolder.getContext() .switchIfEmpty(Mono.defer(() -> { SecurityContext securityContext = new SecurityContextImpl(); securityContext.setAuthentication(createAuthentication(exchange)); return chain.filter(exchange) .subscriberContext(ReactiveSecurityContextHolder.withSecurityContext(Mono.just(securityContext))) .then(Mono.empty()); })).flatMap(securityContext -> chain.filter(exchange)); }

I have written Test for it like this and this test is wrking fine:

@Test public void filterWhenDefaultsAndNoAuthenticationThenContinues() { WebTestClient client = WebTestClient.bindToController(HttpMeController.class) .webFilter(new AnonymousAuthenticationWebFilter(UUID.randomUUID().toString())) .argumentResolvers(config -> { }) .build(); client.get() .uri("/me") .exchange() .expectStatus().isOk() .expectBody(String.class).isEqualTo("anonymousUser"); } @RestController @RequestMapping("/me") public static class HttpMeController { @GetMapping public Mono<String> me(ServerWebExchange exchange){ return ReactiveSecurityContextHolder .getContext() .map(SecurityContext::getAuthentication) .map(Authentication::getPrincipal) .ofType(String.class); } }

This test is working fine. I don't know where i am going wrong. Can you please help??

Can you please push the code and point me to the tests that are failing?

I have pushed my changes.

Here is a list of failing tests:

org.springframework.security.config.web.server.RequestCacheTests > requestCacheNoOp FAILED org.junit.ComparisonFailure at RequestCacheTests.java:96 org.springframework.security.config.web.server.RequestCacheTests > defaultFormLoginRequestCache FAILED org.junit.ComparisonFailure at RequestCacheTests.java:64 org.springframework.security.config.web.server.OAuth2LoginTests > defaultLoginPageWithMultipleClientRegistrationsThenLinks FAILED org.junit.ComparisonFailure at OAuth2LoginTests.java:89 org.springframework.security.config.web.server.OAuth2LoginTests > defaultLoginPageWithSingleClientRegistrationThenRedirect FAILED java.lang.AssertionError at OAuth2LoginTests.java:123 org.springframework.security.config.web.server.FormLoginTests > defaultLoginPage FAILED org.junit.ComparisonFailure at FormLoginTests.java:69 org.springframework.security.config.web.server.FormLoginTests > customLoginPage FAILED org.junit.ComparisonFailure at FormLoginTests.java:115 org.springframework.security.config.web.server.LogoutSpecTests > customLogout FAILED org.junit.ComparisonFailure at LogoutSpecTests.java:99 org.springframework.security.config.web.server.LogoutSpecTests > defaultLogout FAILED org.junit.ComparisonFailure at LogoutSpecTests.java:54 org.springframework.security.config.web.server.AuthorizeExchangeSpecTests > antMatchersWhenMethodAndPatternsThenDiscriminatesByMethod FAILED java.lang.AssertionError at AuthorizeExchangeSpecTests.java:55 Caused by: java.lang.AssertionError at AuthorizeExchangeSpecTests.java:55 org.springframework.security.config.web.server.AuthorizeExchangeSpecTests > antMatchersWhenPatternsThenAnyMethod FAILED java.lang.AssertionError at AuthorizeExchangeSpecTests.java:77 Caused by: java.lang.AssertionError at AuthorizeExchangeSpecTests.java:77 org.springframework.security.config.web.server.ExceptionHandlingSpecTests > defaultAuthenticationEntryPoint FAILED java.lang.AssertionError at ExceptionHandlingSpecTests.java:55 Caused by: java.lang.AssertionError at ExceptionHandlingSpecTests.java:55 org.springframework.security.config.web.server.ExceptionHandlingSpecTests > customAuthenticationEntryPoint FAILED java.lang.AssertionError at ExceptionHandlingSpecTests.java:79 Caused by: java.lang.AssertionError at ExceptionHandlingSpecTests.java:79 org.springframework.security.config.web.server.ServerHttpSecurityTests > basicWhenNoCredentialsThenUnauthorized FAILED java.lang.AssertionError at ServerHttpSecurityTests.java:138 Caused by: java.lang.AssertionError at ServerHttpSecurityTests.java:138 org.springframework.security.config.web.server.ServerHttpSecurityTests > defaults FAILED java.lang.IllegalStateException at ServerHttpSecurityTests.java:96 org.springframework.security.config.web.server.OAuth2ResourceServerSpecTests > getWhenCustomBearerTokenEntryPointThenResponds FAILED java.lang.AssertionError at OAuth2ResourceServerSpecTests.java:260 Caused by: java.lang.AssertionError at OAuth2ResourceServerSpecTests.java:260 org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurityTests > defaultMediaAllThenUnAuthorized FAILED java.lang.AssertionError at EnableWebFluxSecurityTests.java:113 Caused by: java.lang.AssertionError at EnableWebFluxSecurityTests.java:113 org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurityTests > defaultRequiresAuthentication FAILED java.lang.AssertionError at EnableWebFluxSecurityTests.java:96 Caused by: java.lang.AssertionError at EnableWebFluxSecurityTests.java:96 org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurityTests > multiWorks FAILED java.lang.AssertionError at EnableWebFluxSecurityTests.java:298 Caused by: java.lang.AssertionError at EnableWebFluxSecurityTests.java:298

rwinch · 2018-12-05T17:43:42Z

At the moment the biggest problem seems to be that the default behavior has changed. We should require users to explicitly opt into anonymous authentication as making it a default is a breaking change.

I also created #6235 for AuthenticatedReactiveAuthorizationManager to consider AnonymousAuthenticationToken using an AuthenticationTrustResolver

ankurpathak · 2018-12-06T04:32:48Z

At the moment the biggest problem seems to be that the default behavior has changed. We should require users to explicitly opt into anonymous authentication as making it a default is a breaking change.

I also created #6235 for AuthenticatedReactiveAuthorizationManager to consider AnonymousAuthenticationToken using an AuthenticationTrustResolver

Thanks for helpling. I have made changes as per your comment making it non default. Now
all tests are passing. Also added few more tests for it in ServerHttpSecurityTests.

rwinch

Thanks for the changes. I replied inline. I think we will also need to wait until #6235 has been merged for this to be merged.

rwinch · 2018-12-06T20:03:46Z

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

This should be ROLE_ANONYMOUS. However given the defaults in AnonymousSpec you should just delete it

I removed it.

rwinch · 2018-12-07T20:30:49Z

Thanks we are now just waiting on #6235 being merged

1. Created new WebFilter AnonymousAuthenticationWebFilter to for anonymous authentication 2. Created class AnonymousSpec, method anonymous to configure anonymous authentication in ServerHttpSecurity 3. Added ANONYMOUS_AUTHENTICATION order after AUTHENTICATION for anonymous authentication in SecurityWebFiltersOrder 4. Added tests for anonymous authentication in AnonymousAuthenticationWebFilterTests and ServerHttpSecurityTests 5. Added support for Controller in WebTestClientBuilder Fixes: spring-projectsgh-5934

ankurpathak mentioned this pull request Nov 30, 2018

Support For ReactiveAnonymousAuthentication In Reactive Web Security #5934

Closed

ankurpathak force-pushed the gh-5934-fix branch 2 times, most recently from c983bc4 to f9e8b81 Compare December 1, 2018 07:12

rwinch requested changes Dec 3, 2018

View reviewed changes

rwinch added the status: waiting-for-feedback We need additional information before we can continue label Dec 3, 2018

ankurpathak force-pushed the gh-5934-fix branch from f9e8b81 to 902c9db Compare December 4, 2018 22:36

ankurpathak force-pushed the gh-5934-fix branch from 902c9db to 9c18218 Compare December 6, 2018 04:27

ankurpathak force-pushed the gh-5934-fix branch from 9c18218 to 219be63 Compare December 6, 2018 05:05

rwinch requested changes Dec 6, 2018

View reviewed changes

ankurpathak force-pushed the gh-5934-fix branch 2 times, most recently from 342f546 to 559952f Compare December 7, 2018 12:55

ankurpathak force-pushed the gh-5934-fix branch from 559952f to 48edf49 Compare December 8, 2018 03:22

mibo mentioned this pull request Dec 10, 2018

AuthenticatedReactiveAuthorizationManager support for AnonymousAuthenticationToken #6235

Closed

rwinch removed the status: waiting-for-feedback We need additional information before we can continue label Dec 12, 2018

rwinch self-assigned this Dec 12, 2018

rwinch added status: duplicate A duplicate of another issue in: web An issue in web modules (web, webmvc) type: enhancement A general enhancement Reactive labels Dec 12, 2018

rwinch added this to the 5.2.0.M1 milestone Dec 12, 2018

rwinch approved these changes Dec 12, 2018

View reviewed changes

rwinch merged commit 2b369cf into spring-projects:master Dec 12, 2018

Conversation

ankurpathak commented Nov 30, 2018

Uh oh!

rwinch left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ankurpathak Dec 4, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rwinch commented Dec 5, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ankurpathak commented Dec 6, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rwinch left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rwinch commented Dec 7, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rwinch left a comment •

edited

Loading

ankurpathak Dec 4, 2018 •

edited

Loading

rwinch commented Dec 5, 2018 •

edited

Loading

ankurpathak commented Dec 6, 2018 •

edited

Loading