How configuration path roles CustomCasSecurityConfiguration HttpSecurity about cas-security-spring-boot-starter

[kakawait]

@liyiorg thank you for reporting i will check that asap but I'm currently on vacation. So I'm not sure to do something before January. Sorry

[kakawait]

@liyiorg I fixed something on develop branch. I will push asap 0.6.1-SNAPSHOT on maven central (I will say you when it will be available) in order to test the fix if you're ok.

PS: I updated the sample to add method based security using annotation but I also tested using your code/way (but not commited).

[liyiorg]

@kakawait I change project dependency to 0.6.1-SNAPSHOT,Test in two ways.
user list

• usera has roles A
• userb has roles B

Cas client service config

server:
  port: 9090
security:
  cas:
    server:
      base-url: https://localhost:8443/cas
    service:
      resolution-mode: dynamic
    user:
      roles-attributes:
      - roles

test 1

use @secured annotation,it's work ok.
The user "usera" only access path /testa .
The user "userb" only access path /testb.

@Controller
public class TestController {

	@Secured("ROLE_A")
	@RequestMapping("/testa")
	public String testa(HttpServletRequest request){
		System.out.println("hasRoleA:" + request.isUserInRole("A"));
		return "test_cas";
	}
	
	@Secured("ROLE_B")
	@RequestMapping("/testb")
	public String testb(HttpServletRequest request){
		System.out.println("hasRoleB:" + request.isUserInRole("B"));
		return "test_cas";
	}
}

test 2

Override method configure(HttpSecurity http) and remove @secured annotation.

The usera access path http://localhost:9090/testa

print  hasRoleA:true

The usera access path http://localhost:9090/testb

print  hasRoleB:false

The user usera can access any path!

@Configuration
class CustomCasSecurityConfiguration extends CasSecurityConfigurerAdapter {
	
	@Override
	public void configure(CasAuthenticationFilterConfigurer filter) {
		// Here you can configure CasAuthenticationFilter
	}

	@Override
	public void configure(CasSingleSignOutFilterConfigurer filter) {
		// Here you can configure SingleSignOutFilter
	}

	@Override
	public void configure(CasAuthenticationProviderSecurityBuilder provider) {
		// Here you can configure CasAuthenticationProvider
	}

	@Override
	public void configure(HttpSecurity http) throws Exception {
		// Here you can configure Spring Security HttpSecurity object during
		// init configure
		http
			.authorizeRequests()
				.antMatchers("/testa").hasRole("A")
				.antMatchers("/testb").hasRole("B");
	}

	@Override
	public void configure(CasTicketValidatorBuilder ticketValidator) {
		// Here you can configure CasTicketValidator
	}
}

@Controller
public class TestController {

	//@Secured("ROLE_A")
	@RequestMapping("/testa")
	public String testa(HttpServletRequest request){
		System.out.println("hasRoleA:" + request.isUserInRole("A"));
		return "test_cas";
	}
	
	//@Secured("ROLE_B")
	@RequestMapping("/testb")
	public String testb(HttpServletRequest request){
		System.out.println("hasRoleB:" + request.isUserInRole("B"));
		return "test_cas";
	}
}

[kakawait]

@liyiorg you said

I change project dependency to 0.6.1-SNAPSHOT

And it works without any other operations? Because you have to add snapshot repository or mvn clean install project in develop branch.

I asking, I'm not able to reproduce. (Just I don't use security.cas.user.roles-attribute.roles I will try with that asap)

[kakawait]

@liyiorg could you please tell me how do you upgrade to 0.6.1-SNAPSHOT? It may missing something

[liyiorg]

@kakawait , I run the right way in your way ，0.6.1-SNAPSHOT run ok.
thank you very much for your support and the unselfish contribution of open source!

[kakawait]

@liyiorg Nice I will release version really soon

I'm happy when everyone are happy :)

[liyiorg]

@kakawait When will it be released 0.6.1-release

[kakawait]

Sorry I get busy i will release it today