PaverAuthorisation { public boolean isAuthorised(Authentication authentication) { if (paverAuthorities.contains("*")) { log.debug("Paver allows all"); return true; } List<String> userAuthorities = Mono .justOrEmpty(authentication) .flatMapIterable(Authentication::getAuthorities) .map(GrantedAuthority::getAuthority) .collectList() .block(); log.debug("Checking user authorities: {}", userAuthorities); for (String userAuthority : userAuthorities) { if (paverAuthorities.contains(userAuthority)) { log.debug("User authority {} is allowed by paver", userAuthority); return true; } } log.debug("User has no allowable authorities. Paver allows: {}", paverAuthorities); log.debug("Falling back to CIDR authorisation"); WebAuthenticationDetails details = (WebAuthenticationDetails) authentication.getDetails(); boolean cidrAuthorised = cidrBlockAuthorisation.isAuthorised(cidrBlocks, details.getRemoteAddress()); if (!cidrAuthorised) { log.debug("IP {} is not in the allowable range: {}", details.getRemoteAddress(), cidrBlocks); } return cidrAuthorised; } PaverAuthorisation(
      @Value("${paver.authorisation.authorities}") List<String> paverAuthorities,
      @Value("${paver.authorisation.cidr-blocks:192.168.0.0/16}") String cidrBlocks,
      CidrBlockAuthorisation cidrBlockAuthorisation); boolean isAuthorised(Authentication authentication);  }
@Test public void authorised() throws Exception { paverAuthorities.add("AUTHORIZED"); doReturn(singletonList(new SimpleGrantedAuthority("AUTHORIZED"))).when(authentication).getAuthorities(); boolean result = underTest.isAuthorised(authentication); assertThat(result, is(true)); }
@Test public void authorisedWildcard() throws Exception { paverAuthorities.add("*"); boolean result = underTest.isAuthorised(authentication); assertThat(result, is(true)); }
@Test public void authorisedCidr() throws Exception { paverAuthorities.add("AUTHORIZED"); cidrBlocks = "0.0.0.0/0"; PaverAuthorisation underTest = new PaverAuthorisation(paverAuthorities, cidrBlocks, cidrBlockAuthorisation); doReturn(singletonList(new SimpleGrantedAuthority("FOO"))).when(authentication).getAuthorities(); doReturn(details).when(authentication).getDetails(); String address = "0.0.0.0"; doReturn(address).when(details).getRemoteAddress(); doReturn(true).when(cidrBlockAuthorisation).isAuthorised(singletonList(cidrBlocks), address); boolean result = underTest.isAuthorised(authentication); assertThat(result, is(true)); }
@Test public void unauthorisedCidr() throws Exception { paverAuthorities.add("AUTHORIZED"); cidrBlocks = "0.0.0.0/0"; PaverAuthorisation underTest = new PaverAuthorisation(paverAuthorities, cidrBlocks, cidrBlockAuthorisation); doReturn(singletonList(new SimpleGrantedAuthority("FOO"))).when(authentication).getAuthorities(); doReturn(details).when(authentication).getDetails(); String address = "0.0.0.0"; doReturn(address).when(details).getRemoteAddress(); doReturn(false).when(cidrBlockAuthorisation).isAuthorised(singletonList(cidrBlocks), address); boolean result = underTest.isAuthorised(authentication); assertThat(result, is(false)); }
@Test public void cidr_list_is_parsed_correctly() throws Exception { paverAuthorities.add("AUTHORIZED"); cidrBlocks = "1.0.0.0/8,2.0.0.0/8"; PaverAuthorisation underTest = new PaverAuthorisation(paverAuthorities, cidrBlocks, cidrBlockAuthorisation); doReturn(singletonList(new SimpleGrantedAuthority("FOO"))).when(authentication).getAuthorities(); doReturn(details).when(authentication).getDetails(); String address = "1.0.0.10"; doReturn(address).when(details).getRemoteAddress(); doReturn(true).when(cidrBlockAuthorisation).isAuthorised(asList("1.0.0.0/8", "2.0.0.0/8"), address); boolean result = underTest.isAuthorised(authentication); assertThat(result, is(true)); }