HttpSecurityPreparer implements DeploymentProcessor { @SuppressWarnings("unchecked") @Override public void process() { if (deploymentConfigs == null || deploymentConfigs.isEmpty()) { return; } Optional<String> match = deploymentConfigs.keySet() .stream() .filter(c -> archive.getName().equals(c)) .findFirst(); if (!match.isPresent()) { return; } Map<String, Object> matchingConfig = (Map<String, Object>) deploymentConfigs.get(match.get()); if (!matchingConfig.containsKey("web")) { return; } Map<String, Object> deploymentConfig = (Map<String, Object>) matchingConfig.get("web"); WARArchive war = archive.as(WARArchive.class); WebXmlAsset webXml = war.findWebXmlAsset(); JBossWebAsset jbossWeb = war.findJbossWebAsset(); Map<String, Object> loginConfig = (Map<String, Object>) deploymentConfig.get("login-config"); if (loginConfig != null) { String authMethod = (String) loginConfig.getOrDefault("auth-method", "NONE"); webXml.setLoginConfig(authMethod, (String) loginConfig.getOrDefault("realm-name", "ignored")); if (loginConfig.containsKey("security-domain")) { jbossWeb.setSecurityDomain((String) loginConfig.get("security-domain")); } if (loginConfig.containsKey("form-login-config")) { Map<String, Object> formLoginConfig = (Map<String, Object>) loginConfig.get("form-login-config"); webXml.setFormLoginConfig( "Security Realm", (String) formLoginConfig.get("form-login-page"), (String) formLoginConfig.get("form-error-page") ); } } List<Map<String, Object>> securityConstraints = (List<Map<String, Object>>) deploymentConfig.getOrDefault("security-constraints", Collections.EMPTY_LIST); for (Map<String, Object> sc : securityConstraints) { SecurityConstraint securityConstraint = webXml .protect((String) sc.getOrDefault("url-pattern", "/*")); ((List<String>) sc.getOrDefault("methods", Collections.emptyList())) .forEach(securityConstraint::withMethod); List<String> roles = (List<String>) sc.get("roles"); if (roles != null) { securityConstraint.withRole(roles.toArray(new String[roles.size()])); } else { securityConstraint.permitAll(); } } } @Inject  HttpSecurityPreparer(Archive archive); @SuppressWarnings("unchecked") @Override void process();  }
@Test public void do_nothing_if_not_specified_security_constraints() throws Exception { preparer.process(); assertThat(archive.get(WebXmlAsset.NAME)).isNull(); }
@SuppressWarnings("unchecked") @Test public void yaml_parsing() throws Exception { InputStream in = getClass().getClassLoader().getResourceAsStream("security.yml"); assertThat(in).isNotNull().as("security.yml is null"); Yaml yaml = new Yaml(); Map<String, Object> httpConfig = (Map<String, Object>) yaml.load(in); preparer.deploymentConfigs = (Map) ((Map) httpConfig.get("swarm")).get("deployment"); preparer.process(); WebAppDescriptor webXml = Descriptors.importAs(WebAppDescriptor.class).fromStream(archive.get(WebXmlAsset.NAME).getAsset().openStream()); assertThat(webXml.getAllSecurityConstraint().size()).isEqualTo(1); assertThat(webXml.getAllSecurityConstraint().get(0).getAllWebResourceCollection().get(0).getAllUrlPattern().get(0)).isEqualTo("/protected"); }
@SuppressWarnings("unchecked") @Test public void yaml_parsing_again() throws Exception { InputStream in = getClass().getClassLoader().getResourceAsStream("security2.yml"); assertThat(in).isNotNull().as("security2.yml is null"); Yaml yaml = new Yaml(); Map<String, Object> httpConfig = (Map<String, Object>) yaml.load(in); preparer.deploymentConfigs = (Map) ((Map) httpConfig.get("swarm")).get("deployment"); preparer.process(); WebAppDescriptor webXml = Descriptors.importAs(WebAppDescriptor.class).fromStream(archive.get(WebXmlAsset.NAME).getAsset().openStream()); assertThat(webXml.getAllSecurityConstraint().size()).isEqualTo(1); assertThat(webXml.getAllSecurityConstraint().get(0).getAllWebResourceCollection().get(0).getAllUrlPattern().get(0)).isEqualTo("/protected"); }
@Test public void unsupported_auth_method() throws Exception { Map<String, Object> deploymentConfig = createConfigStub(); Map<String, Object> webConfig = findWebConfig(deploymentConfig); Map<String, Object> loginConfig = new HashMap<>(); loginConfig.put("auth-method", "foobar"); webConfig.put("login-config", loginConfig); preparer.deploymentConfigs = deploymentConfig; preparer.process(); WebAppDescriptor webXml = Descriptors.importAs(WebAppDescriptor.class).fromStream(archive.get(WebXmlAsset.NAME).getAsset().openStream()); assertThat(webXml.getOrCreateLoginConfig().getAuthMethod()).isEqualTo("foobar"); }
@Test public void set_1_security_constraint() throws Exception { Map<String, Object> deploymentConfig = createConfigStub(); Map<String, Object> webConfig = findWebConfig(deploymentConfig); Map<String, Object> securityConstraint = new HashMap<>(); securityConstraint.put("url-pattern", "/aaa"); webConfig.put("security-constraints", Collections.singletonList(securityConstraint)); preparer.deploymentConfigs = deploymentConfig; preparer.process(); WebAppDescriptor webXml = Descriptors.importAs(WebAppDescriptor.class).fromStream(archive.get(WebXmlAsset.NAME).getAsset().openStream()); assertThat(webXml.getAllSecurityConstraint().size()).isEqualTo(1); assertThat(webXml.getAllSecurityConstraint().get(0).getAllWebResourceCollection().get(0).getAllUrlPattern().get(0)).isEqualTo("/aaa"); }
@Test public void set_2_security_constraints() throws Exception { Map<String, Object> deploymentConfig = createConfigStub(); Map<String, Object> webConfig = findWebConfig(deploymentConfig); Map<String, Object> securityConstraint1 = new HashMap<>(); securityConstraint1.put("url-pattern", "/aaa"); Map<String, Object> securityConstraint2 = new HashMap<>(); securityConstraint2.put("url-pattern", "/bbb"); webConfig.put("security-constraints", Arrays.asList(securityConstraint1, securityConstraint2)); preparer.deploymentConfigs = deploymentConfig; preparer.process(); WebAppDescriptor webXml = Descriptors.importAs(WebAppDescriptor.class).fromStream(archive.get(WebXmlAsset.NAME).getAsset().openStream()); assertThat(webXml.getAllSecurityConstraint().size()).isEqualTo(2); assertThat(webXml.getAllSecurityConstraint().get(0).getAllWebResourceCollection().get(0).getAllUrlPattern().get(0)).isEqualTo("/aaa"); assertThat(webXml.getAllSecurityConstraint().get(1).getAllWebResourceCollection().get(0).getAllUrlPattern().get(0)).isEqualTo("/bbb"); }
@Test public void set_1_method() throws Exception { Map<String, Object> deploymentConfig = createConfigStub(); Map<String, Object> webConfig = findWebConfig(deploymentConfig); Map<String, Object> securityConstraint = new HashMap<>(); securityConstraint.put("methods", Arrays.asList("GET")); webConfig.put("security-constraints", Collections.singletonList(securityConstraint)); preparer.deploymentConfigs = deploymentConfig; preparer.process(); WebAppDescriptor webXml = Descriptors.importAs(WebAppDescriptor.class).fromStream(archive.get(WebXmlAsset.NAME).getAsset().openStream()); assertThat(webXml.getAllSecurityConstraint().size()).isEqualTo(1); assertThat(webXml.getAllSecurityConstraint().get(0).getAllWebResourceCollection().get(0).getAllHttpMethod().get(0)).isEqualTo("GET"); }
@Test public void set_2_methods() throws Exception { Map<String, Object> deploymentConfig = createConfigStub(); Map<String, Object> webConfig = findWebConfig(deploymentConfig); Map<String, Object> securityConstraint = new HashMap<>(); securityConstraint.put("methods", Arrays.asList("GET", "POST")); webConfig.put("security-constraints", Collections.singletonList(securityConstraint)); preparer.deploymentConfigs = deploymentConfig; preparer.process(); WebAppDescriptor webXml = Descriptors.importAs(WebAppDescriptor.class).fromStream(archive.get(WebXmlAsset.NAME).getAsset().openStream()); assertThat(webXml.getAllSecurityConstraint().size()).isEqualTo(1); assertThat(webXml.getAllSecurityConstraint().get(0).getAllWebResourceCollection().get(0).getAllHttpMethod().get(0)).isEqualTo("GET"); assertThat(webXml.getAllSecurityConstraint().get(0).getAllWebResourceCollection().get(0).getAllHttpMethod().get(1)).isEqualTo("POST"); }