Examples of org.springframework.security.access.intercept.AfterInvocationManager

Package org.springframework.security.access.intercept

Examples of org.springframework.security.access.intercept.AfterInvocationManager

org.springframework.security.access.intercept.AfterInvocationManager
Reviews the Object returned from a secure object invocation, being able to modify the Object or throw an {@link AccessDeniedException}.
Typically used to ensure the principal is permitted to access the domain object instance returned by a service layer bean. Can also be used to mutate the domain object instance so the principal is only able to access authorised bean properties or Collection elements.
Special consideration should be given to using an AfterInvocationManager on bean methods that modify a database. Typically an AfterInvocationManager is used with read-only methods, such as public DomainObject getById(id). If used with methods that modify a database, a transaction manager should be used to ensure any AccessDeniedException will cause a rollback of the changes made by the transaction.
@author Ben Alex

        FilterChain chain = fi.getChain();


        doThrow(new RuntimeException()).when(chain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
        when(ods.getAttributes(fi)).thenReturn(SecurityConfig.createList("MOCK_OK"));


        AfterInvocationManager aim = mock(AfterInvocationManager.class);
        interceptor.setAfterInvocationManager(aim);


        try {
            interceptor.invoke(fi);
            fail("Expected exception");

View Full Code Here

        FilterChain chain = fi.getChain();


        doThrow(new RuntimeException()).when(chain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
        when(ods.getAttributes(fi)).thenReturn(SecurityConfig.createList("MOCK_OK"));


        AfterInvocationManager aim = mock(AfterInvocationManager.class);
        interceptor.setAfterInvocationManager(aim);


        try {
            interceptor.invoke(fi);
            fail("Expected exception");

View Full Code Here

    @Test
    public void afterInvocationManagerIsNotInvokedIfExceptionIsRaised() throws Throwable {
        token.setAuthenticated(true);
        SecurityContextHolder.getContext().setAuthentication(token);


        AfterInvocationManager aim = mock(AfterInvocationManager.class);
        interceptor.setAfterInvocationManager(aim);


        when(aspectJCallback.proceedWithObject()).thenThrow(new RuntimeException());


        try {

View Full Code Here

    }


    @Test
    public void gettersReturnExpectedData() {
        RunAsManager runAs = mock(RunAsManager.class);
        AfterInvocationManager aim = mock(AfterInvocationManager.class);
        interceptor.setRunAsManager(runAs);
        interceptor.setAfterInvocationManager(aim);
        assertEquals(adm, interceptor.getAccessDecisionManager());
        assertEquals(runAs, interceptor.getRunAsManager());
        assertEquals(authman, interceptor.getAuthenticationManager());

View Full Code Here

        interceptor.afterPropertiesSet();
    }


    @Test(expected=IllegalArgumentException.class)
    public void intitalizationRejectsAfterInvocationManagerThatDoesNotSupportMethodInvocation() throws Exception {
        final AfterInvocationManager aim = mock(AfterInvocationManager.class);
        when(aim.supports(MethodInvocation.class)).thenReturn(false);
        interceptor.setAfterInvocationManager(aim);
        interceptor.afterPropertiesSet();
    }

View Full Code Here

        MethodInvocation mi = mock(MethodInvocation.class);
        token.setAuthenticated(true);
        SecurityContextHolder.getContext().setAuthentication(token);
        mdsReturnsUserRole();


        AfterInvocationManager aim = mock(AfterInvocationManager.class);
        interceptor.setAfterInvocationManager(aim);


        when(mi.proceed()).thenThrow(new Throwable());


        try {

View Full Code Here

TOP

Related Classes of org.springframework.security.access.intercept.AfterInvocationManager

org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptorTests

org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptorTests

org.springframework.security.web.access.intercept.FilterSecurityInterceptorTests

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.