Skip to content

Polish Server|ServletBearerExchangeFilterFunction #7355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 4, 2019
Merged

Polish Server|ServletBearerExchangeFilterFunction #7355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d7c3a19
Polish Server|ServletBearerExchangeFilterFunction
jzheaux Sep 4, 2019
6871bc0
Simplify currentAuthentication()
jzheaux Sep 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
248 changes: 0 additions & 248 deletions ...ingframework/security/oauth2/server/resource/web/ServletBearerExchangeFilterFunction.java
View file
Open in desktop

This file was deleted.

50 changes: 7 additions & 43 deletions ...r/ServerBearerExchangeFilterFunction.java → ...t/ServerBearerExchangeFilterFunction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,11 @@
* limitations under the License.
*/

package org.springframework.security.oauth2.server.resource.web.server;

import java.util.Map;
import java.util.function.Consumer;
package org.springframework.security.oauth2.server.resource.web.reactive.function.client;

import reactor.core.publisher.Mono;

import org.springframework.security.authentication.AnonymousAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.oauth2.core.AbstractOAuth2Token;
Expand Down Expand Up @@ -52,61 +47,30 @@
* @author Josh Cummings
* @since 5.2
*/
public class ServerBearerExchangeFilterFunction
public final class ServerBearerExchangeFilterFunction
implements ExchangeFilterFunction {

private static final String AUTHENTICATION_ATTR_NAME = Authentication.class.getName();

private static final AnonymousAuthenticationToken ANONYMOUS_USER_TOKEN = new AnonymousAuthenticationToken("anonymous", "anonymousUser",
AuthorityUtils.createAuthorityList("ROLE_USER"));

/**
* Modifies the {@link ClientRequest#attributes()} to include the {@link Authentication} to be used for
* providing the Bearer Token. Example usage:
*
* <pre>
* WebClient webClient = WebClient.builder()
* .filter(new ServerBearerExchangeFilterFunction())
* .build();
* Mono<String> response = webClient
* .get()
* .uri(uri)
* .attributes(authentication(authentication))
* // ...
* .retrieve()
* .bodyToMono(String.class);
* </pre>
* @param authentication the {@link Authentication} to use
* @return the {@link Consumer} to populate the client request attributes
*/
public static Consumer<Map<String, Object>> authentication(Authentication authentication) {
return attributes -> attributes.put(AUTHENTICATION_ATTR_NAME, authentication);
}

/**
* {@inheritDoc}
*/
@Override
public Mono<ClientResponse> filter(ClientRequest request, ExchangeFunction next) {
return oauth2Token(request.attributes())
.map(oauth2Token -> bearer(request, oauth2Token))
return oauth2Token()
.map(token -> bearer(request, token))
.defaultIfEmpty(request)
.flatMap(next::exchange);
}

private Mono<AbstractOAuth2Token> oauth2Token(Map<String, Object> attrs) {
return Mono.justOrEmpty(attrs.get(AUTHENTICATION_ATTR_NAME))
.cast(Authentication.class)
.switchIfEmpty(currentAuthentication())
private Mono<AbstractOAuth2Token> oauth2Token() {
return currentAuthentication()
.filter(authentication -> authentication.getCredentials() instanceof AbstractOAuth2Token)
.map(Authentication::getCredentials)
.cast(AbstractOAuth2Token.class);
}

private Mono<Authentication> currentAuthentication() {
return ReactiveSecurityContextHolder.getContext()
.map(SecurityContext::getAuthentication)
.defaultIfEmpty(ANONYMOUS_USER_TOKEN);
.map(SecurityContext::getAuthentication);
}

private ClientRequest bearer(ClientRequest request, AbstractOAuth2Token token) {
Expand Down
Loading