Skip to content

Improve AAD default configuration condition for Spring Boot 3 branch #36126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Netyyyy merged 5 commits into from
Jul 28, 2023
Merged

Improve AAD default configuration condition for Spring Boot 3 branch #36126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2ed2a69
Update aad default configuration condition
moarychan Jul 27, 2023
65d9a35
Update changelog
moarychan Jul 27, 2023
bc87311
Fix failures
moarychan Jul 27, 2023
1250972
Sync comments; remove changelog since it's an improvement not a bug f…
moarychan Jul 27, 2023
a1d2c99
Update changelog
moarychan Jul 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions sdk/spring/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ This section includes changes in `spring-cloud-azure-autoconfigure` module.

#### Bugs Fixed
- Fix the issue that `AzureMessagingListenerAutoConfiguration` not included in spring.factories [#34690](https://github.com/Azure/azure-sdk-for-java/issues/34690), [#35717](https://github.com/Azure/azure-sdk-for-java/pull/35717).
- Improve default AAD configuration condition [#36126](https://github.com/Azure/azure-sdk-for-java/pull/36126).

## 5.3.0 (2023-06-28)
- This release is compatible with Spring Boot 3.0.0-3.1.0. (Note: 3.0.x (x>1) should be supported, but they aren't tested with this release.)
Expand Down
7 changes: 4 additions & 3 deletions .../cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,15 @@


import com.azure.spring.cloud.autoconfigure.implementation.aad.configuration.conditions.ResourceServerCondition;
import com.azure.spring.cloud.autoconfigure.implementation.aad.configuration.properties.AadAuthenticationProperties;
import com.azure.spring.cloud.autoconfigure.implementation.aad.configuration.properties.AadResourceServerProperties;
import com.azure.spring.cloud.autoconfigure.implementation.aad.security.constants.AadJwtClaimNames;
import com.azure.spring.cloud.autoconfigure.implementation.aad.security.jwt.AadJwtIssuerValidator;
import com.azure.spring.cloud.autoconfigure.implementation.aad.configuration.properties.AadAuthenticationProperties;
import com.azure.spring.cloud.autoconfigure.implementation.aad.security.properties.AadAuthorizationServerEndpoints;
import com.azure.spring.cloud.autoconfigure.implementation.aad.configuration.properties.AadResourceServerProperties;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.security.ConditionalOnDefaultWebSecurity;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
Expand Down Expand Up @@ -78,7 +79,7 @@ List<OAuth2TokenValidator<Jwt>> createDefaultValidator(AadAuthenticationProperti

@EnableWebSecurity
@EnableMethodSecurity
@ConditionalOnMissingBean(SecurityFilterChain.class)
@ConditionalOnDefaultWebSecurity
@ConditionalOnExpression("!'${spring.cloud.azure.active-directory.application-type}'.equalsIgnoreCase('web_application_and_resource_server')")
static class DefaultAadResourceServerConfiguration {

Expand Down
5 changes: 3 additions & 2 deletions .../cloud/autoconfigure/implementation/aad/configuration/AadWebApplicationConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,11 @@
package com.azure.spring.cloud.autoconfigure.implementation.aad.configuration;

import com.azure.spring.cloud.autoconfigure.implementation.aad.configuration.conditions.WebApplicationCondition;
import com.azure.spring.cloud.autoconfigure.implementation.aad.security.AadOAuth2UserService;
import com.azure.spring.cloud.autoconfigure.implementation.aad.configuration.properties.AadAuthenticationProperties;
import com.azure.spring.cloud.autoconfigure.implementation.aad.security.AadOAuth2UserService;
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.security.ConditionalOnDefaultWebSecurity;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
Expand Down Expand Up @@ -40,7 +41,7 @@ OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService(AadAuthenticationPr

@EnableWebSecurity
@EnableMethodSecurity
@ConditionalOnMissingBean(SecurityFilterChain.class)
@ConditionalOnDefaultWebSecurity
@ConditionalOnExpression("!'${spring.cloud.azure.active-directory.application-type}'.equalsIgnoreCase('web_application_and_resource_server')")
static class DefaultAadWebSecurityConfiguration {

Expand Down
35 changes: 35 additions & 0 deletions ...d/autoconfigure/implementation/aad/configuration/AadResourceServerConfigurationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,9 @@
import org.junit.jupiter.api.Test;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.http.HttpMessageConvertersAutoConfiguration;
import org.springframework.boot.autoconfigure.logging.ConditionEvaluationReportLoggingListener;
import org.springframework.boot.autoconfigure.web.client.RestTemplateAutoConfiguration;
import org.springframework.boot.logging.LogLevel;
import org.springframework.boot.test.context.FilteredClassLoader;
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
import org.springframework.context.annotation.Bean;
Expand All @@ -34,6 +36,7 @@
import java.util.Map;

import static com.azure.spring.cloud.autoconfigure.implementation.aad.WebApplicationContextRunnerUtils.resourceServerContextRunner;
import static com.azure.spring.cloud.autoconfigure.implementation.aad.WebApplicationContextRunnerUtils.resourceServerRunner;
import static com.azure.spring.cloud.autoconfigure.implementation.aad.WebApplicationContextRunnerUtils.withResourceServerPropertyValues;
import static com.azure.spring.cloud.autoconfigure.implementation.aad.security.AadResourceServerHttpSecurityConfigurer.aadResourceServer;
import static org.assertj.core.api.Assertions.assertThat;
Expand Down Expand Up @@ -145,6 +148,38 @@ void useCustomJwtGrantedAuthoritiesConverter() {
});
}

@Test
void useDefaultWebSecurityConfigurerAdapter() {
resourceServerRunner()
.withPropertyValues("spring.cloud.azure.active-directory.enabled=true",
"spring.cloud.azure.active-directory.credential.client-id=fake-client-id"
)
.run(context -> {
assertThat(context).hasSingleBean(SecurityFilterChain.class);
assertThat(context).hasBean("defaultAadResourceServerFilterChain");
});
}

@Test
void useCustomSecurityFilterChain() {
new WebApplicationContextRunner()
.withConfiguration(AutoConfigurations.of(
HttpMessageConvertersAutoConfiguration.class,
RestTemplateAutoConfiguration.class))
.withUserConfiguration(AzureGlobalPropertiesAutoConfiguration.class,
TestAadResourceServerConfiguration.class,
AadAutoConfiguration.class)
.withInitializer(ConditionEvaluationReportLoggingListener.forLogLevel(LogLevel.INFO))
.withClassLoader(new FilteredClassLoader(ClientRegistration.class))
.withPropertyValues("spring.cloud.azure.active-directory.enabled=true",
"spring.cloud.azure.active-directory.credential.client-id=fake-client-id"
)
.run(context -> {
assertThat(context).hasSingleBean(SecurityFilterChain.class);
assertThat(context).hasBean("testAadResourceServerFilterChain");
});
}

@EnableWebSecurity
@EnableMethodSecurity
static class TestAadResourceServerConfiguration {
Expand Down
63 changes: 63 additions & 0 deletions ...d/autoconfigure/implementation/aad/configuration/AadWebApplicationConfigurationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

package com.azure.spring.cloud.autoconfigure.implementation.aad.configuration;

import com.azure.spring.cloud.autoconfigure.implementation.context.AzureGlobalPropertiesAutoConfiguration;
import org.junit.jupiter.api.Test;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.http.HttpMessageConvertersAutoConfiguration;
import org.springframework.boot.autoconfigure.logging.ConditionEvaluationReportLoggingListener;
import org.springframework.boot.autoconfigure.web.client.RestTemplateAutoConfiguration;
import org.springframework.boot.logging.LogLevel;
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

import static com.azure.spring.cloud.autoconfigure.implementation.aad.WebApplicationContextRunnerUtils.webApplicationContextRunner;
import static org.assertj.core.api.Assertions.assertThat;

class AadWebApplicationConfigurationTests {
@Test
void useDefaultSecurityFilterChain() {
webApplicationContextRunner()
.withPropertyValues("spring.cloud.azure.active-directory.enabled=true",
"spring.cloud.azure.active-directory.credential.client-id=fake-client-id"
)
.run(context -> {
assertThat(context).hasSingleBean(SecurityFilterChain.class);
assertThat(context).hasBean("defaultAadWebApplicationFilterChain");
});
}

@Test
void useCustomSecurityFilterChain() {
new WebApplicationContextRunner()
.withConfiguration(AutoConfigurations.of(
HttpMessageConvertersAutoConfiguration.class,
RestTemplateAutoConfiguration.class))
.withUserConfiguration(AzureGlobalPropertiesAutoConfiguration.class,
TestSecurityFilterChain.class,
AadAutoConfiguration.class)
.withInitializer(ConditionEvaluationReportLoggingListener.forLogLevel(LogLevel.INFO))
.withPropertyValues("spring.cloud.azure.active-directory.enabled=true",
"spring.cloud.azure.active-directory.credential.client-id=fake-client-id"
)
.run(context -> {
assertThat(context).hasSingleBean(SecurityFilterChain.class);
assertThat(context).hasBean("testSecurityFilterChain");
});
}

@EnableWebSecurity
static class TestSecurityFilterChain {

@Bean
public SecurityFilterChain testSecurityFilterChain(HttpSecurity http) throws Exception {
return http.oauth2Login(Customizer.withDefaults()).authorizeRequests(request -> request.anyRequest().authenticated()).build();
}
}
}