Brian Clozel
5 years ago
parent
42492026a9
commit
ab72cc8fdb
@ -1,127 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright 2012-2020 the original author or authors.
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* https://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package org.springframework.boot.actuate.autoconfigure.integrationtest;
|
|
||||||
|
|
||||||
import org.junit.jupiter.api.AfterEach;
|
|
||||||
import org.junit.jupiter.api.Test;
|
|
||||||
|
|
||||||
import org.springframework.boot.actuate.autoconfigure.audit.AuditAutoConfiguration;
|
|
||||||
import org.springframework.boot.actuate.autoconfigure.beans.BeansEndpointAutoConfiguration;
|
|
||||||
import org.springframework.boot.actuate.autoconfigure.endpoint.EndpointAutoConfiguration;
|
|
||||||
import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration;
|
|
||||||
import org.springframework.boot.actuate.autoconfigure.web.server.ManagementContextAutoConfiguration;
|
|
||||||
import org.springframework.boot.actuate.autoconfigure.web.servlet.ServletManagementContextAutoConfiguration;
|
|
||||||
import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
|
|
||||||
import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration;
|
|
||||||
import org.springframework.boot.autoconfigure.http.HttpMessageConvertersAutoConfiguration;
|
|
||||||
import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration;
|
|
||||||
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
|
|
||||||
import org.springframework.boot.autoconfigure.web.servlet.DispatcherServletAutoConfiguration;
|
|
||||||
import org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration;
|
|
||||||
import org.springframework.boot.test.util.TestPropertyValues;
|
|
||||||
import org.springframework.boot.web.servlet.context.AnnotationConfigServletWebApplicationContext;
|
|
||||||
import org.springframework.context.annotation.Import;
|
|
||||||
import org.springframework.http.MediaType;
|
|
||||||
import org.springframework.mock.web.MockServletContext;
|
|
||||||
import org.springframework.security.authentication.TestingAuthenticationToken;
|
|
||||||
import org.springframework.security.test.context.TestSecurityContextHolder;
|
|
||||||
import org.springframework.test.web.servlet.MockMvc;
|
|
||||||
import org.springframework.test.web.servlet.setup.DefaultMockMvcBuilder;
|
|
||||||
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
|
|
||||||
import org.springframework.test.web.servlet.setup.MockMvcConfigurer;
|
|
||||||
|
|
||||||
import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
|
|
||||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
|
||||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Integration tests for the Actuator's MVC endpoints security features.
|
|
||||||
*
|
|
||||||
* @author Andy Wilkinson
|
|
||||||
*/
|
|
||||||
class WebMvcEndpointSecurityIntegrationTests {
|
|
||||||
|
|
||||||
private AnnotationConfigServletWebApplicationContext context;
|
|
||||||
|
|
||||||
@AfterEach
|
|
||||||
void close() {
|
|
||||||
TestSecurityContextHolder.clearContext();
|
|
||||||
this.context.close();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test
|
|
||||||
void endpointsAreSecureByDefault() throws Exception {
|
|
||||||
this.context = new AnnotationConfigServletWebApplicationContext();
|
|
||||||
this.context.register(SecureConfiguration.class);
|
|
||||||
MockMvc mockMvc = createSecureMockMvc();
|
|
||||||
mockMvc.perform(get("/actuator/beans").accept(MediaType.APPLICATION_JSON)).andExpect(status().isUnauthorized());
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test
|
|
||||||
void endpointsAreSecureByDefaultWithCustomBasePath() throws Exception {
|
|
||||||
this.context = new AnnotationConfigServletWebApplicationContext();
|
|
||||||
this.context.register(SecureConfiguration.class);
|
|
||||||
TestPropertyValues.of("management.endpoints.web.base-path:/management").applyTo(this.context);
|
|
||||||
MockMvc mockMvc = createSecureMockMvc();
|
|
||||||
mockMvc.perform(get("/management/beans").accept(MediaType.APPLICATION_JSON))
|
|
||||||
.andExpect(status().isUnauthorized());
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test
|
|
||||||
void endpointsAreSecureWithActuatorRoleWithCustomBasePath() throws Exception {
|
|
||||||
TestSecurityContextHolder.getContext()
|
|
||||||
.setAuthentication(new TestingAuthenticationToken("user", "N/A", "ROLE_ACTUATOR"));
|
|
||||||
this.context = new AnnotationConfigServletWebApplicationContext();
|
|
||||||
this.context.register(SecureConfiguration.class);
|
|
||||||
TestPropertyValues
|
|
||||||
.of("management.endpoints.web.base-path:/management", "management.endpoints.web.exposure.include=*")
|
|
||||||
.applyTo(this.context);
|
|
||||||
MockMvc mockMvc = createSecureMockMvc();
|
|
||||||
mockMvc.perform(get("/management/beans")).andExpect(status().isOk());
|
|
||||||
}
|
|
||||||
|
|
||||||
private MockMvc createSecureMockMvc() {
|
|
||||||
return doCreateMockMvc(springSecurity());
|
|
||||||
}
|
|
||||||
|
|
||||||
private MockMvc doCreateMockMvc(MockMvcConfigurer... configurers) {
|
|
||||||
this.context.setServletContext(new MockServletContext());
|
|
||||||
this.context.refresh();
|
|
||||||
DefaultMockMvcBuilder builder = MockMvcBuilders.webAppContextSetup(this.context);
|
|
||||||
for (MockMvcConfigurer configurer : configurers) {
|
|
||||||
builder.apply(configurer);
|
|
||||||
}
|
|
||||||
return builder.build();
|
|
||||||
}
|
|
||||||
|
|
||||||
@ImportAutoConfiguration({ JacksonAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class,
|
|
||||||
EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class,
|
|
||||||
ServletManagementContextAutoConfiguration.class, AuditAutoConfiguration.class,
|
|
||||||
PropertyPlaceholderAutoConfiguration.class, WebMvcAutoConfiguration.class,
|
|
||||||
ManagementContextAutoConfiguration.class, AuditAutoConfiguration.class,
|
|
||||||
DispatcherServletAutoConfiguration.class, BeansEndpointAutoConfiguration.class })
|
|
||||||
static class DefaultConfiguration {
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
@Import(DefaultConfiguration.class)
|
|
||||||
@ImportAutoConfiguration({ SecurityAutoConfiguration.class })
|
|
||||||
static class SecureConfiguration {
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,49 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright 2012-2020 the original author or authors.
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* https://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package org.springframework.boot.actuate.endpoint.json;
|
|
||||||
|
|
||||||
import com.fasterxml.jackson.databind.ObjectMapper;
|
|
||||||
import com.fasterxml.jackson.databind.SerializationFeature;
|
|
||||||
|
|
||||||
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Factory for an {@code ObjectMapper} instance to be shared within Actuator
|
|
||||||
* infrastructure.
|
|
||||||
*
|
|
||||||
* <p>
|
|
||||||
* The goal is to have a Jackson configuration separate from the rest of the application
|
|
||||||
* to keep a consistent serialization behavior between applications.
|
|
||||||
*
|
|
||||||
* @author Brian Clozel
|
|
||||||
* @since 2.3.0
|
|
||||||
*/
|
|
||||||
public class ActuatorJsonMapperProvider {
|
|
||||||
|
|
||||||
private ObjectMapper objectMapper;
|
|
||||||
|
|
||||||
public ObjectMapper getInstance() {
|
|
||||||
if (this.objectMapper == null) {
|
|
||||||
Jackson2ObjectMapperBuilder builder = new Jackson2ObjectMapperBuilder();
|
|
||||||
builder.featuresToDisable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
|
|
||||||
builder.featuresToDisable(SerializationFeature.WRITE_DURATIONS_AS_TIMESTAMPS);
|
|
||||||
this.objectMapper = builder.build();
|
|
||||||
}
|
|
||||||
return this.objectMapper;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright 2012-2020 the original author or authors.
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* https://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* JSON support for actuator endpoints.
|
|
||||||
*/
|
|
||||||
package org.springframework.boot.actuate.endpoint.json;
|
|
||||||
Loading…
Reference in New Issue