Form認証で学ぶSpring Security入門

JSUG勉強会 2019その8 Spring for Beginner #jsug

Transcript

1. 'PSNೝূͰֶͿ
   4QSJOH
   4FDVSJUZ
   ೖ໳ JSUGษڧձ
   ೥ͦͷ̔
   ίΠχʔגࣜձࣾɹ಺ཱྑհ !b1a9idps
2. ࣗݾ঺հ ໊લ
   ಺ཱ
   ྑհʢ͏ͪͨͯ
   Γΐ͏͚͢ʣ
   ॴଐ
   ίΠχʔגࣜձࣾ
   'BTIJPO
   $IBSJUZ
   1SPKFDU
   ࠷ۙͷ࢓ࣄ
   4QSJOH
   #PPU
   Y΁ͷόʔδϣϯΞοϓ
3. ΞδΣϯμ w 4QSJOH
   4FDVSJUZ֓ཁ
   w ࠓճ࡞Δ΋ͷ
   w '03.ೝূ
   w 3PMF
   )JFSBSDIZ
   w (MPCBM
   .FUIPE
   4FDVSJUZ
   w 4QSJOH
   4FDVSJUZͷςετ
4. ΞδΣϯμ w4QSJOH
   4FDVSJUZ֓ཁ
   w ࠓճ࡞Δ΋ͷ
   w '03.ೝূ
   w 3PMF
   )JFSBSDIZ
   w (MPCBM
   .FUIPE
   4FDVSJUZ
   w 4QSJOH
   4FDVSJUZͷςετ
5. ొ৔͢ΔओͳϞδϡʔϧ܈
6. ϑϨʔϜϫʔΫͷΞʔΩςΫνϟ  ΫϥΠΞϯτ͔ΒϦΫΤετ͕ૹΒΕͯ͘Δ
    'JMUFS$IBJO1SPYZKBWB͕ϦΫΤετड͚औΔ
    )UUQ4FSWMFU3FRVFTUͱ)UUQ4FSWMFU3FTQPOTFʹରͯ͠ϑΝΠΞ΢Υʔϧػೳ Λ૊ΈࠐΉ
    4FDVSJUZ'JMUFS$IBJOʹઃఆ͞Ε͍ͯΔ4FDVSJUZ
   'JMUFSʹॲཧΛҕৡ͢Δ
7. ϑϨʔϜϫʔΫͷΞʔΩςΫνϟ  4FDVSJUZ
   'JMUFS͕ॱʹݺͼग़͞ΕͯॲཧΛߦ͏
    શ4FDVSJUZ
   'JMUFSͷॲཧ͕ਖ਼ৗऴྃͨ͠Βɺ8FCΞϓϦέʔγϣϯϦιʔε΁ ΞΫηεͰ͖Δ
8. 4FDVSJUZ
   'JMUFSͷྫ w -PHPVU'JMUFSKBWB
   w ϩάΞ΢τॲཧΛߦ͏
   w 6TFSOBNF1BTTXPSE"VUIFOUJDBUJPO'JMUFSKBWB
   w 'PSNೝূͰೝূॲཧΛߦ͏
   w #BTJD"VUIFOUJDBUJPO'JMUFSKBWB
   w ϕʔγοΫೝূͰೝূॲཧΛߦ͏
   w &YDFQUJPO5SBOTMBUJPO'JMUFSKBWB
   w ೝՄॲཧͰൃੜͨ͠ྫ֎ΛϋϯυϦϯά͠ɺΫϥΠΞϯτ΁
 ద੾ͳϨεϙϯεΛߦ͏
9. ΞδΣϯμ w 4QSJOH
   4FDVSJUZ֓ཁ
   wࠓճ࡞Δ΋ͷ
   w '03.ೝূ
   w 3PMF
   )JFSBSDIZ
   w (MPCBM
   .FUIPE
   4FDVSJUZ
   w 4QSJOH
   4FDVSJUZͷςετ
10. Ϣʔβ؅ཧγεςϜ ϢʔβҰཡɺৄࡉɺొ࿥ɺ࡟আ
11. ࢓༷ w ϖʔδͷࢀরʹ͸ೝূ͕ඞਢ
    w ݖݶ͸ɺ08/&3
    
    ."/"(&3
    
    45"'' ొ࿥ Ұཡɾৄࡉ ࡟আ 08/&3 Մ Մ Մ ."/"(&3 Մ MANAGERͱSTAFF ͷΈӾཡՄ ෆՄ 45"'' ෆՄ STAFFͷΈӾཡՄ ෆՄ
12. ΞδΣϯμ w 4QSJOH
    4FDVSJUZ֓ཁ
    w ࠓճ࡞Δ΋ͷ
    w'03.ೝূ
    w 3PMF
    )JFSBSDIZ
    w (MPCBM
    .FUIPE
    4FDVSJUZ
    w 4QSJOH
    4FDVSJUZͷςετ
13. ೝূͱೝՄ ೝূ
    w ର৅͕ɺ୭ʢԿʣͰ͋Δ͔Λ֬ೝ͢Δ͜ͱ ೝՄ
    w ߦಈ΍Ϧιʔε΁ͷΞΫηεΛڐՄ͢Δ͜ͱ
14. ࣮૷͢ΔΫϥε w 8FC4FDVSJUZ$POpHKBWB
    w 4QSJOH
    4FDVSJUZ༻ͷઃఆ
    w "VUIFOUJDBUFE6TFSKBWB
    w 6TFS%FUBJMTΠϯλʔϑΣʔεͷ࣮૷ɻೝূࡁͷϢʔβ৘ใ
    w 6TFS%FUBJMT.BOBHFSKBWB
    w 6TFS%FUBJMT4FSWJDFΠϯλʔϑΣʔεͷ࣮૷ɻࢿ֨৘ใͱϢʔβͷঢ়ଶΛ σʔλετΞ͔Βऔಘ
15. 8FC4FDVSJUZ$POpHKBWB @Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { private final UserDetailsManager userDetailsManager; public WebSecurityConfig(UserDetailsManager userDetailsManager) { this.userDetailsManager = userDetailsManager; } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/users/create").hasRole("OWNER", "MANAGER") .antMatchers("/users/delete/{id}").hasRole("OWNER") .anyRequest().authenticated() .and().formLogin().loginPage("/login").defaultSuccessUrl("/users", true) .and().logout().logoutSuccessUrl("/login").permitAll() .and().csrf().disable(); } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsManager) .passwordEncoder(passwordEncoder()); } }
16. 8FC4FDVSJUZ$POpHKBWBʢղઆʣ @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() // "/users/create"͸OWNERͱMANAGERݖݶͷΈϦΫΤετՄ .antMatchers("/users/create").hasAnyRole("OWNER", "MANAGER") // "/users/delete/{id}"͸OWNERͱMANAGERݖݶͷΈϦΫΤετՄ .antMatchers(“/users/delete/{id}").hasRole("OWNER") // ೝূࡁΈϢʔβͷΈ͕ϦΫΤετՄ .anyRequest().authenticated() // FORMೝূΛ༗ޮʹ͢ΔɺϩάΠϯϖʔδͷύε͸"/login"ɺϩάΠϯ੒ޭޙ͸"/users"ʹϦμΠ ϨΫτ .and().formLogin().loginPage("/login").defaultSuccessUrl("/users", true) // ϩάΞ΢τ੒ޭޙͷϦμΠϨΫτઌ͸"/login" .and().logout().logoutSuccessUrl("/login").permitAll() // CSRFରࡦػೳΛແޮʹ͢Δ .and().csrf().disable(); }
17. )UUQ4FDVSJUZGPSN-PHJO
    ͬͯԿͯ͠ΔΜ͚ͩͬʁ
18. 'PSN-PHJO$POpHVSFSKBWB public final class FormLoginConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractAuthenticationFilterConfigurer<H, FormLoginConfigurer<H>, UsernamePasswordAuthenticationFilter> { public FormLoginConfigurer() { // UsernamePasswordAuthenticationFilterΛAuthenticationFilterʹઃఆ super(new UsernamePasswordAuthenticationFilter(), null); // Formͷusernameύϥϝʔλ໊Λ"username"ʹ usernameParameter(“username"); // Formͷpasswordύϥϝʔλ໊Λ"password"ʹ passwordParameter("password"); } 'PSN-PHJO$POpHVSFSKBWBΛOFXͯ͠
    '03.ೝূΛ༗ޮʹ͢Δ
19. 8FC4FDVSJUZ$POpHKBWBʢղઆʣ @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { // ೝূ࣌ʹ࢖͏UserDetailsService.javaͷ࣮૷Λઃఆɺར༻͢ΔPasswordEncoder.javaΛઃఆ auth.userDetailsService(userDetailsManager) .passwordEncoder(passwordEncoder()); }
20. ϑΥʔϜೝূͷྲྀΕ  Ϣʔβ໊ͱύεϫʔυʢࢿ֨৘ใʣΛϦΫΤετύϥϝʔλͱͯ͠1045
     6TFSOBNF1BTTXPSE"VUIFOUJDBUJPO'JMUFSͰࢿ֨৘ใΛऔಘ
     "VUIFOUJDBUJPO.BOBHFSʹೝূॲཧΛҕৡ
21. 6TFSOBNF1BTTXPSE"VUIFOUJDBUJPO'JMUFSKBWB public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { if (postOnly && !request.getMethod().equals("POST")) { throw new AuthenticationServiceException( "Authentication method not supported: " + request.getMethod()); } // ϦΫΤετύϥϝʔλ͔Βೖྗ஋Λநग़ String username = obtainUsername(request); String password = obtainPassword(request); if (username == null) { username = ""; } if (password == null) { password = ""; } username = username.trim(); UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password); setDetails(request, authRequest); // AuthenticationManagerʹࢿ֨৘ใΛ౉͢ return this.getAuthenticationManager().authenticate(authRequest); }
22. ϑΥʔϜೝূͷྲྀΕ  ొ࿥͞Ε͍ͯΔ"VUIFOUJDBUJPO1SPWJEFSΛॱʹݺͿ
23. ϑΥʔϜೝূͷྲྀΕ  ࢿ֨৘ใ͕ਖ਼͍͔֬͠ೝΛߦ͏
24. ϑΥʔϜೝূͷྲྀΕ  Ϣʔβ৘ใΛऔಘ͢Δɻࠓճ͸%#͔Βऔಘ͢Δɻ
25. %BP"VUIFOUJDBUJPO1SPWJEFSKBWB protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException { prepareTimingAttackProtection(); try { // Ϣʔβ৘ใΛऔಘ UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username); if (loadedUser == null) { throw new InternalAuthenticationServiceException( "UserDetailsService returned null, which is an interface contract violation"); } return loadedUser; } catch (UsernameNotFoundException ex) { mitigateAgainstTimingAttack(authentication); throw ex; } catch (InternalAuthenticationServiceException ex) { throw ex; } catch (Exception ex) { throw new InternalAuthenticationServiceException(ex.getMessage(), ex); } }
26. %BP"VUIFOUJDBUJPO1SPWJEFSKBWB protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException { if (authentication.getCredentials() == null) { logger.debug("Authentication failed: no credentials provided"); throw new BadCredentialsException(messages.getMessage( "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials")); } String presentedPassword = authentication.getCredentials().toString(); // ύεϫʔυͷൺֱ if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) { logger.debug( "Authentication failed: password does not match stored value"); throw new BadCredentialsException(messages.getMessage( "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials”)); } }
27. 6TFS%FUBJMT.BOBHFSKBWB @Service public class UserDetailsManager implements UserDetailsService { private final UserRepository userRepository; public UserDetailsManager(UserRepository userRepository) { this.userRepository = userRepository; } @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { return userRepository.findByUsername(username) .map(AuthenticatedUser::new) .orElseThrow( () -> new UsernameNotFoundException("username not found")); } }
28. "VUIFOUJDBUFE6TFSKBWB public class AuthenticatedUser implements UserDetails { private final Integer id; private final String name; private final String username; private final String password; private final Role role; // ίϯετϥΫλ͸লུ public Integer getId() { return id; } public String getName() { return name; } @Override public Collection<? extends GrantedAuthority> getAuthorities() { return createAuthorityList("ROLE_" + role.name()); } @Override public String getPassword() { return password; } @Override public String getUsername() { return username; } @Override public boolean isAccountNonExpired() { return true; } @Override public boolean isAccountNonLocked() { return true; } @Override public boolean isCredentialsNonExpired() { return true; } @Override public boolean isEnabled() { return true; } }
29. ϑΥʔϜೝূͷྲྀΕ  ೝূ͕੒ޭͨ͠Βɺ4BWFE3FRVFTU"XBSF"VUIFOUJDBUJPO4VDDFTT)BOEMFS ͕ݺ͹Εͯೝূ੒ޭ࣌ͷॲཧޙʹTVDDFTT6SMʹϦμΠϨΫτ
 ೝূ͕ࣦഊͨ͠Βɺ4JNQMF6SM"VUIFOUJDBUJPO'BJMVSF)BOEMFS͕ݺ͹Εͯೝূ ࣦഊ࣌ͷॲཧޙʹGBJMVSF6SMʹϦμΠϨΫτ
30. ิ଍ w ೝূ৘ใ͸ηογϣϯͰ؅ཧ
    w 4FTTJPO$POUFYU1FSTJTUFODF'JMUFSKBWBͰطʹೝূࡁΈ͔νΣοΫ
    w ೝূࣦഊͨ͠Ϣʔβ΋ೝূ৘ใ͸࡞ΒΕΔ
    w σϑΥϧτͰ3PMF͕30-&@"/0/:.064ʹͳΔ
31. ೝՄॲཧͷྲྀΕ  4QSJOH
    4FDVSJUZ಺Ͱى͖ͨྫ֎ΛϋϯυϦϯάͯ͠ద੾ͳϨεϙϯεΛߦ͏
 ະೝূϢʔβ͔ΒͷΞΫηεͷ৔߹͸ೝূΛଅ͢ϨεϙϯεΛฦ͠ɺೝূࡁ Ϣʔβ͔ΒͷΞΫηεͷ৔߹͸ೝՄΤϥʔΛ௨஌͢ΔϨεϙϯεΛฦ͢
32. ೝՄॲཧͷྲྀΕ  )551ϦΫΤετʹରͯ͠ೝՄॲཧΛద༻͢Δ
     ೝՄॲཧ͸"DDFTT%FDJTJPO.BOBHFSʹҕৡ
33. ೝՄॲཧͷྲྀΕ  "DDFTT%FDJTJPO.BOBHFS͕ొ࿥͞Εͯ͋Δ"DDFTT%FDJTJPO7PUFSΛݺͿ
     "DDFTT%FDJTJPO7PUFSͰΞΫηεݖͷ༗ແΛ౤ථ͢Δ
34. "DDFTT%FDJTJPO7PUFSKBWB w ΞΫηεݖΛ෇༩͢Δ͔Λ౤ථ͢Δ
    w 8FC&YQSFTTJPO7PUFSKBWB͕σϑΥϧτద༻ public interface AccessDecisionVoter<S> { int ACCESS_GRANTED = 1; int ACCESS_ABSTAIN = 0; int ACCESS_DENIED = -1;
35. "DDFTT%FDJTJPO.BOBHFSKBWB w ౤ථ݁Ռ͔Β࠷ऴతͳΞΫηεݖΛ൑அ
    w "DDFTT%FDJTJPO7PUFSΛݺΜͰΞΫηεݖΛ
 ౤ථͯ͠΋Β͏
    w ࣮૷͸̏Ϋϥεɻ౤ථ݁Ռͷѻ͍ํ͕ҟͳΔɻ
 "⒏SNBUJWF#BTFEKBWBɺ$POTFOTVT#BTFEKBWBɺ 6OBOJNPVT#BTFEKBWB
36. "⒏SNBUJWF#BTFEKBWB શ7PUFSͷ͏ͪ̍ͭͰ΋ࢍ੒͢Ε͹ΞΫηεڐՄ
37. $POTFOTVT#BTFEKBWB શ7PUFSͰࢍ੒͕ଟ͚Ε͹ΞΫηεڐՄ
38. 6OBOJNPVT#BTFEKBWB શ7PUFS͕ࢍ੒ͳΒΞΫηεڐՄ
39. ೝՄॲཧͷྲྀΕ  ೝՄ੒ޭͷ৔߹ͷΈϦιʔε΁ΞΫηεͰ͖ΔɻೝՄࣦഊͷ৔߹͸ɺ "DDFTT%FOJFE&YDFQUJPO͕౤͛ΒΕΔɻ
40. ʹΜ͔͠ΐΓͷ͘͠Έ ౤ථ݁Ռͷѻ͍ํΛܾΊΔ ౤ථ͢Δ
41. ೝূɾೝՄͷྲྀΕΛཧղ͓͔ͯ͠ͳ͍ͱ w 4QSJOH
    4FDVSJUZ
    8BZʹ৐࣮ͬͨ૷͕Ͱ͖ͳ͍
    w 'JMUFS͚ͩͰೝূॲཧͪ͠Ό͏Έ͍ͨͳμα͍͜ͱʹ ͳΔ
42. ΞδΣϯμ w 4QSJOH
    4FDVSJUZ֓ཁ
    w ࠓճ࡞Δ΋ͷ
    w '03.ೝূ
    w3PMF
    )JFSBSDIZ
    w (MPCBM
    .FUIPE
    4FDVSJUZ
    w 4QSJOH
    4FDVSJUZͷςετ
43. 3PMF
    )JFSBSDIZ w 3PMFʹ֊૚Λ࣋ͨͤΔ͜ͱ
    w Լͷ3PMF͸ؚΜͰ͍ΔͱΈͳ͢
    w 08/&3
    
    ."/"(&3ͷ৔߹ɺ08/&3͸."/"(&3͕Ͱ͖Δ͜ͱશͯ Ͱ͖Δ
44. ࣮૷͢ΔΫϥε w 8FC4FDVSJUZ$POpHKBWB
    w 4FDVSJUZ3PMFT1SPQFSUJFTKBWB
    w 3PMF
    )JFSBSDIZʹؔ͢ΔઃఆΛ࣋ͭΫϥε
45. 8FC4FDVSJUZ$POpHKBWB @Bean public RoleHierarchy roleHierarchy(SecurityRolesProperties rolesProperties) { return rolesProperties.getRoleHierarchy(); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/users/create").hasRole("MANAGER") .antMatchers("/users/delete/{id}").hasRole("OWNER") .anyRequest().authenticated() .and() .formLogin().loginPage("/login").defaultSuccessUrl("/users", true) .and() .logout().logoutSuccessUrl("/login").permitAll() .and() .csrf().disable(); }
46. 8FC4FDVSJUZ$POpHKBWBʢղઆʣ @Bean public RoleHierarchy roleHierarchy(SecurityRolesProperties rolesProperties) { // RoleHierarchyImpl.javaΛBeanొ࿥ return rolesProperties.getRoleHierarchy(); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() // ԼͷRoleΛؚΈ࣋ͭͷͰMANAGERͷΈͰΑ͍ .antMatchers("/users/create").hasRole("MANAGER") .antMatchers("/users/delete/{id}").hasRole("OWNER") .anyRequest().authenticated() .and() .formLogin().loginPage("/login").defaultSuccessUrl("/users", true) .and() .logout().logoutSuccessUrl("/login").permitAll() .and() .csrf().disable(); }
47. 4FDVSJUZ3PMFT1SPQFSUJFTKBWB @Component @ConfigurationProperties("security.roles") public class SecurityRolesProperties { private Map<String, List<String>> hierarchyMap = new LinkedHashMap<>(); public Map<String, List<String>> getHierarchyMap() { return hierarchyMap; } public void setHierarchyMap(Map<String, List<String>> hierarchyMap) { this.hierarchyMap = hierarchyMap; } public RoleHierarchy getRoleHierarchy() { RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl(); String hierarchy = isEmpty(hierarchyMap) ? "" : roleHierarchyFromMap(hierarchyMap); roleHierarchy.setHierarchy(hierarchy); return roleHierarchy; } }
48. 4FDVSJUZ3PMF1SPQFSUJFTKBWBʢղઆʣ @Component @ConfigurationProperties("security.roles") public class SecurityRolesProperties { private Map<String, List<String>> hierarchyMap = new LinkedHashMap<>(); public Map<String, List<String>> getHierarchyMap() { return hierarchyMap; } public void setHierarchyMap(Map<String, List<String>> hierarchyMap) { this.hierarchyMap = hierarchyMap; } public RoleHierarchy getRoleHierarchy() { RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl(); String hierarchy = isEmpty(hierarchyMap) ? "" : roleHierarchyFromMap(hierarchyMap); // HierarchyΛจࣈྻͰηοτ͢Δ // hierarchy = "ROLE_OWNER > ROLE_MANAGER\nROLE_MANAGER > ROLE_STAFF\n" roleHierarchy.setHierarchy(hierarchy); return roleHierarchy; } }
49. ΞδΣϯμ w 4QSJOH
    4FDVSJUZ֓ཁ
    w ࠓճ࡞Δ΋ͷ
    w '03.ೝূ
    w 3PMF
    )JFSBSDIZ
    w(MPCBM
    .FUIPE
    4FDVSJUZ
    w 4QSJOH
    4FDVSJUZͷςετ
50. (MPCBM
    .FUIPE
    4FDVSJUZ w ΞϊςʔγϣϯΛ࢖ͬͯɺϝιουϨϕϧͰΞΫη ε੍ޚ͕Ͱ͖Δɻछྨ͸̐ͭɻ
    w αʔϏε૚Ͱͷར༻Λਪ঑͍ͯ͠Δ
    w ϝιου࣮ߦલͱޙʹॲཧΛೖΕΔ͜ͱ͕Ͱ͖Δ
    w !1SF999͸ϝιουͷॲཧલʹɺ!1PTU999͸ϝ ιουͷॲཧޙʹΞΫηε੍ޚ͕ߦΘΕΔ
51. !1SF"VUIPSJ[F // ϩάΠϯϢʔβͷRole͕OWNERͷͱ͖ϝιουʹೖΕΔ @PreAuthorize("hasRole('OWNER')") public List<User> list() { return userRepository.findAll(); } // Ҿ਺role͕"OWNER"ʹҰக͢Δͱ͖ϝιουʹೖΕΔ @PreAuthorize("#role == 'OWNER'") public List<User> list(String role) { return userRepository.findAll(); } // Ҿ਺request.name͕"ruchitate"ʹҰக͢Δͱ͖ϝιουʹೖΕΔ @PreAuthorize("#r.name == 'ruchitate'") public List<User> list(@P("r") UserRequest request) { return userRepository.findAll(); } ϝιουΛݺ΂ΔݖݶΛ͍࣋ͬͯΔ͔
52. !1PTU"VUIPSJ[F // ໭Γ஋ͷม਺໊͸σϑΥϧτͰreturnObject @PostAuthorize("returnObject != null && returnObject.username == 'ruchitate'") public User get(Integer id) { return userRepository.findById(id).orElse(null); } औಘͰ͖ΔݖݶΛ͍࣋ͬͯΔ͔
53. !1SF'JMUFS // Ҿ਺ͷม਺໊͸σϑΥϧτͰfilterObject @PreFilter("filterObject.name.equals('ruchitate')") public List<User> list(List<UserRequest> requests) { List<String> usernameList = requests.stream() .map(UserRequest::getName) .collect(Collectors.toList()); return userRepository.findAllByUsernameIn(usernameList); } Ҿ਺ͷதͰ৚݅ʹҰக͢ΔΦϒδΣΫτͷΈநग़
54. !1PTU'JMUFS // ໭Γ஋ͷม਺໊͸σϑΥϧτͰfilterObject @PostFilter("filterObject.username == 'ruchitate'") public List<User> list() { return userRepository.findAll(); } ৚݅ʹҰக͢ΔΦϒδΣΫτΛ໭Γ஋͔Βநग़
55. ࠓճͷαϯϓϧʹద༻͢Δ @Override // Beanొ࿥ͨ͠Ϋϥε΋࢖͑Δ @PostFilter("@roleEvaluator.hasRole(principal, filterObject.role)") public List<UserDto> findAll() { List<UserDto> userDtoList = new ArrayList<>(); userRepository.findAll().iterator() .forEachRemaining(user -> userDtoList.add(UserDto.newUserDto(user))); return userDtoList; } @Override @PostAuthorize("returnObject != null && @roleEvaluator.hasRole(principal, returnObject.role)") public UserDto findOne(Integer id) { return userRepository.findById(id) .map(UserDto::newUserDto) .get(); }
56. ࠓճͷαϯϓϧʹద༻͢Δ @Override // MANAGER or OWNER @PreAuthorize("hasRole('MANAGER')") public UserDto create(UserCreateForm form) { User user = new User(); BeanUtils.copyProperties(form, user, "password"); user.setPassword(passwordEncoder.encode(form.getPassword())); return UserDto.newUserDto(userRepository.save(user)); } @Override @PreAuthorize("hasRole('OWNER')") public void delete(Integer id) { User user = userRepository.findById(id) .filter(u -> u.getRole() != Role.OWNER) .orElseThrow(NotAllowedOperationException::new); userRepository.delete(user); }
57. ΞδΣϯμ w 4QSJOH
    4FDVSJUZ֓ཁ
    w ࠓճ࡞Δ΋ͷ
    w '03.ೝূ
    w 3PMF
    )JFSBSDIZ
    w (MPCBM
    .FUIPE
    4FDVSJUZ
    w4QSJOH
    4FDVSJUZͷςετ
58. ґଘؔ܎ʹ௥Ճ dependencies { testImplementation 'org.springframework.security:spring-security-test' } <dependencies> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-test</artifactId> <scope>test</scope> </dependency> </dependencies>
59. 6TFS$POUSPMMFS5FTUKBWB @Nested @SpringBootTest class ListTest { @Autowired private WebApplicationContext context; private MockMvc mockMvc; @BeforeEach void beforeEach() { // SecurityFilterΛ௥Ճ mockMvc = webAppContextSetup(context).apply(springSecurity()).build(); } @Test void success() throws Exception { User user = new User(); user.setId(1); user.setName("಺ཱྑհ"); user.setUsername("ruchitate"); user.setPassword("12345678"); user.setRole(Role.OWNER); mockMvc.perform(get("/users") // ΞΫηε͢ΔϢʔβʔ .with(user(new AuthenticatedUser(user)))) .andExpect(status().isOk()); } }
60. 6TFS4FSWJDF*NQM5FTUKBWB @Test // ΞΫηε͢ΔϢʔβ @WithUserDetails(value = "yaragaki", userDetailsServiceBeanName = "userDetailsManager") void findAllForManager() { List<UserDto> result = userService.findAll(); // ࣗ෼ͷRoleҎԼͷϢʔβͷΈࢀরՄೳ Assertions.assertThat(result) .extracting( UserDto::getId, UserDto::getName, UserDto::getAge, UserDto::getGender, UserDto::getRole) .containsExactly( Tuple.tuple(2, "৽֞ɹ݁ҥ", 31, WOMAN, MANAGER), Tuple.tuple(3, "ࢁ࡚ɹݡਓ", 24, MAN, STAFF)); }
61. 6TFS4FSWJDF*NQM5FTUKBWB @Test @WithUserDetails(value = "ruchitate", userDetailsServiceBeanName = "userDetailsManager") void deleteForOwner() { userService.delete(2); Assertions.assertThatThrownBy(() -> userService.findOne(2)) .isInstanceOf(NotFoundException.class); } @Test @WithUserDetails(value = "yaragaki", userDetailsServiceBeanName = "userDetailsManager") void deleteForManager() { Assertions.assertThatThrownBy(() -> userService.delete(3)) .isInstanceOf(AccessDeniedException.class); } 08/&3ͷΈ࡟আՄ
62. '03.ೝূͷςετ @Test void loginSuccess() throws Exception { MvcResult result // ϩάΠϯϢʔβΛઃఆ = mockMvc.perform(formLogin().user("ruchitate").password("12345678")) .andReturn(); Assertions.assertThat(result.getResponse()) .extracting( MockHttpServletResponse::getStatus, MockHttpServletResponse::getRedirectedUrl) .containsExactly(HttpStatus.FOUND.value(), "/users"); } @Test void loginFailed() throws Exception { MvcResult result = mockMvc.perform(formLogin().user("ruchitate").password("test")) .andReturn(); Assertions.assertThat(result.getResponse()) .extracting( MockHttpServletResponse::getStatus, MockHttpServletResponse::getRedirectedUrl) .containsExactly(HttpStatus.FOUND.value(), "/login?error"); }
63. ࠓճ঺հͨ͠αϯϓϧ
    IUUQTHJUIVCDPNCBJETQSJOH TFDVSJUZTBNQMFKTVH
64. ͓ΘΓ