Java 类org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler 实例源码

/**
 * Instantiates a new logout filter.
 *
 * @param logoutSuccessUrl
 *            the logout success url
 * @param handlers
 *            the handlers
 */
public CommunoteLogoutFilter(final String logoutSuccessUrl, LogoutHandler[] handlers) {
    super(new SimpleUrlLogoutSuccessHandler() {
        {
            setDefaultTargetUrl(logoutSuccessUrl);
            setRedirectStrategy(new DefaultRedirectStrategy() {
                @Override
                public void sendRedirect(HttpServletRequest request,
                        HttpServletResponse response, String url) throws java.io.IOException {
                    if (url.startsWith("http://") || url.startsWith("https://")) {
                        throw new IllegalArgumentException(
                                "could not add client id to this uri: '" + url + "'");
                    }
                    // reset session values
                    SessionHandler.instance().resetOverriddenCurrentUserLocale(request);
                    ControllerHelper.sendInternalRedirect(request, response, url);
                };
            });
        }
    }, handlers);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    SimpleUrlAuthenticationSuccessHandler simpleUrlAuthenticationSuccessHandler = new SimpleUrlAuthenticationSuccessHandler("/");
    simpleUrlAuthenticationSuccessHandler.setUseReferer(false);
    simpleUrlAuthenticationSuccessHandler.setTargetUrlParameter("url");
    DefaultRedirectStrategy defaultRedirectStrategy = new DefaultRedirectStrategy();

    simpleUrlAuthenticationSuccessHandler.setRedirectStrategy(defaultRedirectStrategy);

    SimpleUrlLogoutSuccessHandler simpleUrlLogoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();
    simpleUrlLogoutSuccessHandler.setUseReferer(true);

    // @formatter:off
    http
        .authorizeRequests()
            .antMatchers(ckfinder.getServlet().getPath()).hasAnyRole("ADMIN")
            .and()
        .csrf()
            .disable()
        .exceptionHandling()
            .authenticationEntryPoint(authenticationEntryPoint())
            .and()
        .formLogin()
            .loginPage("/login")
            .usernameParameter("user_id1")
            .passwordParameter("password1")
            .successHandler(simpleUrlAuthenticationSuccessHandler)
            .failureHandler(failureHandler())
            .permitAll()
            .and()
        .headers()
            .cacheControl().disable()
            .httpStrictTransportSecurity().disable()
            .frameOptions().sameOrigin()
            .and()
        .logout()
            .logoutUrl("/logout.html")
            .logoutSuccessHandler(simpleUrlLogoutSuccessHandler)
            .permitAll()
            .and()
        .rememberMe()
            .rememberMeParameter("rememberMe")
            .tokenRepository(persistentTokenRepository)
            .and()
        .requestCache()
            .requestCache(new NullRequestCache())
            .and()
        .servletApi();
    // @formatter:on
}

@Test
public void configure_defaults() throws Exception {
    LogoutConfigurer configurer = spy(new LogoutConfigurer());
    SimpleUrlLogoutSuccessHandler successHandler = mock(SimpleUrlLogoutSuccessHandler.class);
    SecurityContextLogoutHandler localHandler = mock(SecurityContextLogoutHandler.class);
    SecurityContextLogoutHandler globalHandler = mock(SecurityContextLogoutHandler.class);
    when(configurer.createDefaultSuccessHandler()).thenReturn(successHandler);
    when(configurer.createDefaultLocalHandler()).thenReturn(localHandler);
    when(configurer.createDefaultGlobalHandler()).thenReturn(globalHandler);
    configurer.init(builder);
    configurer.configure(builder);
    ArgumentCaptor<SAMLLogoutFilter> logoutFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutFilter.class);
    ArgumentCaptor<SAMLLogoutProcessingFilter> logoutProcessingFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutProcessingFilter.class);
    verify(builder).setSharedObject(eq(SAMLLogoutFilter.class), logoutFilterCaptor.capture());
    verify(builder).setSharedObject(eq(SAMLLogoutProcessingFilter.class), logoutProcessingFilterCaptor.capture());
    verify(logoutProperties).getDefaultTargetUrl();
    verify(logoutProperties, times(2)).isInvalidateSession();
    verify(logoutProperties, times(2)).isClearAuthentication();
    verify(logoutProperties).getLogoutUrl();
    verify(logoutProperties).getSingleLogoutUrl();
    verify(successHandler).setDefaultTargetUrl(eq(logoutProperties.getDefaultTargetUrl()));
    verify(localHandler).setClearAuthentication(eq(logoutProperties.isClearAuthentication()));
    verify(localHandler).setInvalidateHttpSession(eq(logoutProperties.isInvalidateSession()));
    verify(globalHandler).setClearAuthentication(eq(logoutProperties.isClearAuthentication()));
    verify(globalHandler).setInvalidateHttpSession(eq(logoutProperties.isInvalidateSession()));
    SAMLLogoutFilter logoutFilter = logoutFilterCaptor.getValue();
    SAMLLogoutProcessingFilter logoutProcessingFilter = logoutProcessingFilterCaptor.getValue();
    assertThat(logoutFilter).isNotNull();
    assertThat(logoutProcessingFilter).isNotNull();
    assertThat(logoutFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getLogoutUrl());
    assertThat(logoutProcessingFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getSingleLogoutUrl());
    assertThat(serviceProviderEndpoints.getLogoutURL()).isEqualTo(logoutProperties.getLogoutUrl());
    assertThat(serviceProviderEndpoints.getSingleLogoutURL()).isEqualTo(logoutProperties.getSingleLogoutUrl());
}

@Test
public void configure_handlers_defaults() throws Exception {
    LogoutConfigurer configurer = new LogoutConfigurer();
    SimpleUrlLogoutSuccessHandler successHandler = mock(SimpleUrlLogoutSuccessHandler.class);
    SecurityContextLogoutHandler localHandler = mock(SecurityContextLogoutHandler.class);
    SecurityContextLogoutHandler globalHandler = mock(SecurityContextLogoutHandler.class);
    configurer
            .successHandler(successHandler)
            .localHandler(localHandler)
            .globalHandler(globalHandler);
    configurer.init(builder);
    configurer.configure(builder);
    ArgumentCaptor<SAMLLogoutFilter> logoutFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutFilter.class);
    ArgumentCaptor<SAMLLogoutProcessingFilter> logoutProcessingFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutProcessingFilter.class);
    verify(builder).setSharedObject(eq(SAMLLogoutFilter.class), logoutFilterCaptor.capture());
    verify(builder).setSharedObject(eq(SAMLLogoutProcessingFilter.class), logoutProcessingFilterCaptor.capture());
    verify(logoutProperties, never()).getDefaultTargetUrl();
    verify(logoutProperties, never()).isInvalidateSession();
    verify(logoutProperties, never()).isClearAuthentication();
    verify(logoutProperties).getLogoutUrl();
    verify(logoutProperties).getSingleLogoutUrl();
    verifyZeroInteractions(successHandler, localHandler, globalHandler);
    SAMLLogoutFilter logoutFilter = logoutFilterCaptor.getValue();
    SAMLLogoutProcessingFilter logoutProcessingFilter = logoutProcessingFilterCaptor.getValue();
    assertThat(logoutFilter).isNotNull();
    assertThat(logoutProcessingFilter).isNotNull();
    assertThat(logoutFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getLogoutUrl());
    assertThat(logoutProcessingFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getSingleLogoutUrl());
    assertThat(serviceProviderEndpoints.getLogoutURL()).isEqualTo(logoutProperties.getLogoutUrl());
    assertThat(serviceProviderEndpoints.getSingleLogoutURL()).isEqualTo(logoutProperties.getSingleLogoutUrl());
}

@Test
public void configure_arguments() throws Exception {
    LogoutConfigurer configurer = spy(new LogoutConfigurer());
    SimpleUrlLogoutSuccessHandler successHandler = mock(SimpleUrlLogoutSuccessHandler.class);
    SecurityContextLogoutHandler localHandler = mock(SecurityContextLogoutHandler.class);
    SecurityContextLogoutHandler globalHandler = mock(SecurityContextLogoutHandler.class);
    when(configurer.createDefaultSuccessHandler()).thenReturn(successHandler);
    when(configurer.createDefaultLocalHandler()).thenReturn(localHandler);
    when(configurer.createDefaultGlobalHandler()).thenReturn(globalHandler);
    configurer
            .defaultTargetURL("/default")
            .clearAuthentication(false)
            .invalidateSession(true)
            .logoutURL("/lo")
            .singleLogoutURL("/slo");
    configurer.init(builder);
    configurer.configure(builder);
    ArgumentCaptor<SAMLLogoutFilter> logoutFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutFilter.class);
    ArgumentCaptor<SAMLLogoutProcessingFilter> logoutProcessingFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutProcessingFilter.class);
    verify(builder).setSharedObject(eq(SAMLLogoutFilter.class), logoutFilterCaptor.capture());
    verify(builder).setSharedObject(eq(SAMLLogoutProcessingFilter.class), logoutProcessingFilterCaptor.capture());
    verify(logoutProperties, never()).getDefaultTargetUrl();
    verify(logoutProperties, never()).isInvalidateSession();
    verify(logoutProperties, never()).isClearAuthentication();
    verify(logoutProperties, never()).getLogoutUrl();
    verify(logoutProperties, never()).getSingleLogoutUrl();
    verify(successHandler).setDefaultTargetUrl(eq("/default"));
    verify(localHandler).setClearAuthentication(eq(false));
    verify(localHandler).setInvalidateHttpSession(eq(true));
    verify(globalHandler).setClearAuthentication(eq(false));
    verify(globalHandler).setInvalidateHttpSession(eq(true));
    SAMLLogoutFilter logoutFilter = logoutFilterCaptor.getValue();
    SAMLLogoutProcessingFilter logoutProcessingFilter = logoutProcessingFilterCaptor.getValue();
    assertThat(logoutFilter).isNotNull();
    assertThat(logoutProcessingFilter).isNotNull();
    assertThat(logoutFilter.getFilterProcessesUrl()).isEqualTo("/lo");
    assertThat(logoutProcessingFilter.getFilterProcessesUrl()).isEqualTo("/slo");
    assertThat(serviceProviderEndpoints.getLogoutURL()).isEqualTo("/lo");
    assertThat(serviceProviderEndpoints.getSingleLogoutURL()).isEqualTo("/slo");
}

/**
 * Instantiates a new api logout filter.
 * 
 * @param handlers
 *            the handlers
 */
public ApiLogoutFilter(LogoutHandler[] handlers) {
    super(new SimpleUrlLogoutSuccessHandler() {
        @Override
        protected void handle(HttpServletRequest request, HttpServletResponse response,
                Authentication authentication) throws IOException, ServletException {
            response.getWriter().write(
                    "{\"message\":\"User logged out successfully.\",\"status\":\"OK\"}");
            super.handle(request, response, authentication);
        }
    }, handlers);
}

@Override
protected void configure(final HttpSecurity http) throws Exception {

    // workaround regex: we need to exclude the URL /UI/HEARTBEAT here
    // because we bound the vaadin application to /UI and not to root,
    // described in vaadin-forum:
    // https://vaadin.com/forum#!/thread/3200565.
    HttpSecurity httpSec = http.regexMatcher("(?!.*HEARTBEAT)^.*\\/UI.*$")
            // disable as CSRF is handled by Vaadin
            .csrf().disable();

    if (springSecurityProperties.isRequireSsl()) {
        httpSec = httpSec.requiresChannel().anyRequest().requiresSecure().and();
    } else {

        LOG.info(
                "\"******************\\n** Requires HTTPS Security has been disabled for UI, should only be used for developing purposes **\\n******************\"");
    }

    if (!StringUtils.isEmpty(hawkbitSecurityProperties.getContentSecurityPolicy())) {
        httpSec.headers().contentSecurityPolicy(hawkbitSecurityProperties.getContentSecurityPolicy());
    }

    final SimpleUrlLogoutSuccessHandler simpleUrlLogoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();
    simpleUrlLogoutSuccessHandler.setTargetUrlParameter("login");

    httpSec
            // UI
            .authorizeRequests().antMatchers("/UI/login/**").permitAll().antMatchers("/UI/UIDL/**").permitAll()
            .anyRequest().authenticated().and()
            // UI login / logout
            .exceptionHandling().authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/UI/login/#/"))
            .and().logout().logoutUrl("/UI/logout").logoutSuccessHandler(simpleUrlLogoutSuccessHandler);
}

@Bean(name = "dashboardLogoutSuccessHandler")
public LogoutSuccessHandler dashboardLogoutSuccessHandler() {
    final SimpleUrlLogoutSuccessHandler logoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();

    logoutSuccessHandler.setRedirectStrategy(new DashboardLogoutRedirectStrategy(logoutUrl));

    return logoutSuccessHandler;
}

/***
 * Must have a valid defaultLogoutSuccessUrl
 * 
 * @param defaultLogoutSuccessUrl - Madatory, must be valid.
 * @param casLogoutSuccessUrl - Optional, based on if CAS is provided, and if provided must be valid.
 */
public OzoneLogoutSuccessHandler(String defaultLogoutSuccessUrl,
                              String casLogoutSuccessUrl) {
    if (StringUtils.hasText(casLogoutSuccessUrl)) {
        Assert.isTrue(UrlUtils.isValidRedirectUrl(casLogoutSuccessUrl), casLogoutSuccessUrl + " isn't a valid redirect URL");
    }
    Assert.isTrue(!StringUtils.hasLength(defaultLogoutSuccessUrl) ||
               UrlUtils.isValidRedirectUrl(defaultLogoutSuccessUrl), defaultLogoutSuccessUrl + " isn't a valid redirect URL");

    this.casLogoutHandler = new SimpleUrlLogoutSuccessHandler();
       this.casLogoutHandler.setDefaultTargetUrl(casLogoutSuccessUrl);

    this.defaultLogoutHandler = new SimpleUrlLogoutSuccessHandler();
       this.defaultLogoutHandler.setDefaultTargetUrl(defaultLogoutSuccessUrl);
}

@VisibleForTesting
protected SimpleUrlLogoutSuccessHandler createDefaultSuccessHandler() {
    return new SimpleUrlLogoutSuccessHandler();
}

@Bean
public SimpleUrlLogoutSuccessHandler successLogoutHandler() {
    SimpleUrlLogoutSuccessHandler handler = new SimpleUrlLogoutSuccessHandler();
    handler.setDefaultTargetUrl("/");
    return handler;
}

private SimpleUrlLogoutSuccessHandler logoutSuccessHandler() {
  SimpleUrlLogoutSuccessHandler handler = new SimpleUrlLogoutSuccessHandler();
  handler.setUseReferer(true);
  return handler;
}

/***
 * If CAS authentication, we'll use the CAS Success Logout URL.
 * Else we'll use the default logout URL
 * 
 * @param authentication
 * @return
 */
private SimpleUrlLogoutSuccessHandler getUrlLogoutSuccessHandlerByAuthentication(final Authentication authentication){
    return (authentication instanceof CasAuthenticationToken) ? casLogoutHandler : defaultLogoutHandler;
}