Propagate security context via channel interceptor #12532
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
spring-projects-issues
added
the
status: waiting-for-triage
sjohnr
added
in: messaging
jzheaux
requested changes
Apr 14, 2023
There was a problem hiding this comment.
@artembilan, thanks for the PR! I've left some questions inline.
...a/org/springframework/security/messaging/context/SecurityContextChannelInterceptorTests.java
Outdated
Show resolved
Hide resolved
...a/org/springframework/security/messaging/context/SecurityContextChannelInterceptorTests.java
Outdated
Show resolved
Hide resolved
jzheaux
requested changes
May 17, 2023
There was a problem hiding this comment.
Thanks, @artembilan! I've left some additional feedback inline.
...n/java/org/springframework/security/messaging/context/SecurityContextChannelInterceptor.java
Outdated
Show resolved
Hide resolved
...a/org/springframework/security/messaging/context/SecurityContextChannelInterceptorTests.java
Outdated
Show resolved
Hide resolved
...n/java/org/springframework/security/messaging/context/SecurityContextChannelInterceptor.java
Outdated
Show resolved
Hide resolved
artembilan
force-pushed
the
propagate_context_via_channel_interceptor
branch
from
f26515f
to
0130a47
Compare
|
@jzheaux , any feedback, please? |
|
Here is some simple Spring Boot sample to demonstrate how a new |
artembilan
force-pushed
the
propagate_context_via_channel_interceptor
branch
from
bdd0914
to
4f2989d
Compare
jzheaux
requested changes
Oct 13, 2023
...springframework/security/messaging/context/SecurityContextPropagationChannelInterceptor.java
Outdated
Show resolved
Hide resolved
...a/org/springframework/security/messaging/context/SecurityContextChannelInterceptorTests.java
Outdated
Show resolved
Hide resolved
...n/java/org/springframework/security/messaging/context/SecurityContextChannelInterceptor.java
Outdated
Show resolved
Hide resolved
...springframework/security/messaging/context/SecurityContextPropagationChannelInterceptor.java
Outdated
Show resolved
Hide resolved
...springframework/security/messaging/context/SecurityContextPropagationChannelInterceptor.java
Outdated
Show resolved
Hide resolved
artembilan
force-pushed
the
propagate_context_via_channel_interceptor
branch
from
4f2989d
to
e8c9869
Compare
|
Just pushed the rest of requested changes. Thanks |
|
Pushed an anonymous propagation as was requested. |
jzheaux
approved these changes
Oct 16, 2023
Add `SecurityContextPropagationChannelInterceptor` that propagates the current security context through the Spring Messaging API. Namely, it adds the current security context into any message before it is sent and then populates the security context when that message is received, typically in a separate thread.
jzheaux
force-pushed
the
propagate_context_via_channel_interceptor
branch
from
9847108
to
60a00bb
Compare
jzheaux
added a commit
that referenced
this pull request
Oct 31, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
SecurityContextChannelInterceptorcurrently has an ability to populate a security context with anAuthenticationfrom message header. But doesn't look like there is a way in the framework to populate such a header and therefore propagate context downstream the messaging flowSecurityContextChannelInterceptorto supportpostReceive()contract for context population andafterReceiveCompletion()to clean it up, respectivelysetup()function logic to not re-populate context if it already has the sameAuthenticationpreSend()to populate header with the value from current security context if it is missed in a messageThe change is driven by this Spring Integration feature: https://docs.spring.io/spring-integration/reference/html/security.html#security-context-propagation.
There is now only a single class in the Spring Integration Security modules and it is that
SecurityContextPropagationChannelInterceptor.When we will have such a propagation feature in Spring Security for Messaging by itself, there won't be a reason in that module in Spring Integration at all.