protected IUser getLoggedInUser() { if(this.loggedInUser != null) { return this.loggedInUser; } IUser user = null; try { final Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if(auth == null) { LOGGER.warn(() -> "Failed to determine loggedIn User!"); } else { final String email = auth.getName(); // get logged in email user = serviceUser.findUserByEmail(email); if(user == null) { // Perhaps the user's email has been changed ..? // we need force them to be logged-out new SecurityContextLogoutHandler().setClearAuthentication(true); LOGGER.warn(() -> "Failed to determine loggedIn User!"); } } } catch(final Exception e) { LOGGER.error(() -> e.getMessage(), e); } return user; }
/** * @see org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.HttpSecurity) */ @Override protected void configure(HttpSecurity http) throws Exception { http.exceptionHandling() .authenticationEntryPoint(casEntryPoint()) .and() .authorizeRequests() .antMatchers(ConstanteUtils.SECURITY_CONNECT_PATH+"/**").authenticated() .antMatchers("/**").permitAll() .antMatchers(ConstanteUtils.SECURITY_SWITCH_PATH).hasAuthority(NomenclatureUtils.DROIT_PROFIL_ADMIN) .antMatchers(ConstanteUtils.SECURITY_SWITCH_BACK_PATH).hasAuthority(SwitchUserFilter.ROLE_PREVIOUS_ADMINISTRATOR) .anyRequest().authenticated() .and() .addFilterBefore(singleSignOutFilter(), LogoutFilter.class) .addFilter(new LogoutFilter(casUrl + ConstanteUtils.SECURITY_LOGOUT_PATH, new SecurityContextLogoutHandler())) .addFilter(casAuthenticationFilter()) .addFilterAfter(switchUserFilter(), FilterSecurityInterceptor.class) /* La protection Spring Security contre le Cross Scripting Request Forgery est désactivée, Vaadin implémente sa propre protection */ .csrf().disable() .headers() /* Autorise l'affichage en iFrame */ .frameOptions().disable() /* Supprime la gestion du cache du navigateur, pour corriger le bug IE de chargement des polices cf. http://stackoverflow.com/questions/7748140/font-face-eot-not-loading-over-https */ .cacheControl().disable(); }
@RequestMapping(value = "/logout", method = RequestMethod.GET) public String logoutPage(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout";//You can redirect wherever you want, but generally it's a good practice to show login screen again. }
@RequestMapping(value="/logout", method = RequestMethod.GET) public String logoutPage (HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout"; }
@Inject public MainResource(ApplicationContext applicationContext, List<SocialNetwork> networks, SecurityContextLogoutHandler securityContextLogoutHandler, AccountRepository accountRepository, EntityRepository entityRepository, CommandMetadataRepository commandMetadataRepository, EmoteMetadataRepository emoteMetadataRepository, CapabilityRepository capabilityRepository, WorldManager worldManager, EntityService entityService, Emote emote, @Qualifier("worldExtent") int worldExtent) { this.WORLD_EXTENT = worldExtent; this.applicationContext = applicationContext; this.networks = networks; this.securityContextLogoutHandler = securityContextLogoutHandler; this.accountRepository = accountRepository; this.entityRepository = entityRepository; this.commandMetadataRepository = commandMetadataRepository; this.emoteMetadataRepository = emoteMetadataRepository; this.capabilityRepository = capabilityRepository; this.worldManager = worldManager; this.entityService = entityService; this.emote = emote; }
@Override public void configure(HttpSecurity http) throws Exception { http.logout() .permitAll() .logoutSuccessUrl("/logout.html") .logoutRequestMatcher(new AntPathRequestMatcher("/logout")); String logoutUrl = UriComponentsBuilder .fromUri(casSecurityProperties.getServer().getBaseUrl()) .path(casSecurityProperties.getServer().getPaths().getLogout()) .toUriString(); LogoutFilter filter = new LogoutFilter(logoutUrl, new SecurityContextLogoutHandler()); filter.setFilterProcessesUrl("/cas/logout"); http.addFilterBefore(filter, LogoutFilter.class); }
@RequestMapping(value = "/logout", method = RequestMethod.GET) public String logout(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); request.getSession().invalidate(); } return "redirect:/"; }
/** * This method handles logout requests. * Toggle the handlers if you are RememberMe functionality is useless in your app. */ @RequestMapping(value="/admin/logout", method = RequestMethod.GET) public String logout(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null){ new SecurityContextLogoutHandler().logout(request, response, auth); SecurityContextHolder.getContext().setAuthentication(null); } return "redirect:/admin/login"; }
@GetMapping("/logout") public String loginOut(HttpServletRequest request, HttpServletResponse response){ Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null){ new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login"; }
@RequestMapping(value = "/userlogout", method = GET) public String logout(HttpServletRequest request, HttpServletResponse response) throws IOException { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } URL url = new URL(request.getRequestURL().toString()); String urlStr = url.getProtocol() + "://" + url.getAuthority(); return "redirect:" + ssoServiceUrl + "/logout.do?redirect=" + urlStr + "&clientId=" + clientId; }
@RequestMapping(value = "/secure/logout", method = RequestMethod.GET) public String logout(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext() .getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); request.getSession().invalidate(); } return "redirect:/secure/welcome"; }
@RequestMapping(value="/logout", method = RequestMethod.GET) public String logoutPage (HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null){ new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout"; }
@RequestMapping(value="/logout", method = RequestMethod.GET) public String logoutPage(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if(auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout"; }
@GetMapping("/logout") public String logoutPage (HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null){ new SecurityContextLogoutHandler().logout(request, response, auth); } Cookie[] cookies = request.getCookies(); for(int i = 0,len = cookies.length; i < len; i++) { Cookie cookie = new Cookie(cookies[i].getName(),null); cookie.setMaxAge(0); cookie.setPath("/"); response.addCookie(cookie); } return "redirect:/"; }
/** * Request single point exit filter */ @Bean public LogoutFilter casLogoutFilter() { LogoutFilter logoutFilter = new LogoutFilter( casServerLogout, new SecurityContextLogoutHandler()); logoutFilter.setFilterProcessesUrl("/logout"); return logoutFilter; }
/** * Create a simple filter that allows logout on a REST Url /services/rest/logout and returns a simple HTTP status 200 * ok. * * @return the filter. */ protected Filter getSimpleRestLogoutFilter() { LogoutFilter logoutFilter = new LogoutFilter(new LogoutSuccessHandlerReturningOkHttpStatusCode(), new SecurityContextLogoutHandler()); // configure logout for rest logouts logoutFilter.setLogoutRequestMatcher(new AntPathRequestMatcher("/services/rest/logout")); return logoutFilter; }
/** * 请求单点退出过滤器 */ @Bean public LogoutFilter requestSingleLogoutFilter() { LogoutFilter logoutFilter = new LogoutFilter(casProperties.getCasServerLogoutUrl(), new SecurityContextLogoutHandler()); logoutFilter.setFilterProcessesUrl(casProperties.getAppLogoutUrl()); return logoutFilter; }
@RequestMapping(value="logout", method = RequestMethod.GET) public String logout (HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null){ new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/account/login?logout=true"; }
@RequestMapping(value = "/signout", method = RequestMethod.GET) public String signOut(HttpServletRequest request, HttpServletResponse response) { new SecurityContextLogoutHandler() .logout(request, response, null); new CookieClearingLogoutHandler(AbstractRememberMeServices.SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY) .logout(request, response, null); return "redirect:/manager/signin"; }
/** * 退出登录 * * @return */ @GetMapping("/LogOut") public String logout(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/"; }
@Autowired public SsoEndpoint(TokenServicesFacade tokenServicesFacade) { this.tokenServicesFacade = tokenServicesFacade; this.logoutHandler = new SecurityContextLogoutHandler(); this.logoutHandler.setClearAuthentication(true); this.logoutHandler.setInvalidateHttpSession(true); }
/** * NOTE that this method assumes that the user performing this action is authenticated. * This is implied by the implementation, noting it here in addition to this. */ @RequestMapping(value="/logout", method = RequestMethod.GET) public String logoutPage (HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/"; }
@Test public void configure_defaults() throws Exception { LogoutConfigurer configurer = spy(new LogoutConfigurer()); SimpleUrlLogoutSuccessHandler successHandler = mock(SimpleUrlLogoutSuccessHandler.class); SecurityContextLogoutHandler localHandler = mock(SecurityContextLogoutHandler.class); SecurityContextLogoutHandler globalHandler = mock(SecurityContextLogoutHandler.class); when(configurer.createDefaultSuccessHandler()).thenReturn(successHandler); when(configurer.createDefaultLocalHandler()).thenReturn(localHandler); when(configurer.createDefaultGlobalHandler()).thenReturn(globalHandler); configurer.init(builder); configurer.configure(builder); ArgumentCaptor<SAMLLogoutFilter> logoutFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutFilter.class); ArgumentCaptor<SAMLLogoutProcessingFilter> logoutProcessingFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutProcessingFilter.class); verify(builder).setSharedObject(eq(SAMLLogoutFilter.class), logoutFilterCaptor.capture()); verify(builder).setSharedObject(eq(SAMLLogoutProcessingFilter.class), logoutProcessingFilterCaptor.capture()); verify(logoutProperties).getDefaultTargetUrl(); verify(logoutProperties, times(2)).isInvalidateSession(); verify(logoutProperties, times(2)).isClearAuthentication(); verify(logoutProperties).getLogoutUrl(); verify(logoutProperties).getSingleLogoutUrl(); verify(successHandler).setDefaultTargetUrl(eq(logoutProperties.getDefaultTargetUrl())); verify(localHandler).setClearAuthentication(eq(logoutProperties.isClearAuthentication())); verify(localHandler).setInvalidateHttpSession(eq(logoutProperties.isInvalidateSession())); verify(globalHandler).setClearAuthentication(eq(logoutProperties.isClearAuthentication())); verify(globalHandler).setInvalidateHttpSession(eq(logoutProperties.isInvalidateSession())); SAMLLogoutFilter logoutFilter = logoutFilterCaptor.getValue(); SAMLLogoutProcessingFilter logoutProcessingFilter = logoutProcessingFilterCaptor.getValue(); assertThat(logoutFilter).isNotNull(); assertThat(logoutProcessingFilter).isNotNull(); assertThat(logoutFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getLogoutUrl()); assertThat(logoutProcessingFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getSingleLogoutUrl()); assertThat(serviceProviderEndpoints.getLogoutURL()).isEqualTo(logoutProperties.getLogoutUrl()); assertThat(serviceProviderEndpoints.getSingleLogoutURL()).isEqualTo(logoutProperties.getSingleLogoutUrl()); }
@Test public void configure_handlers_defaults() throws Exception { LogoutConfigurer configurer = new LogoutConfigurer(); SimpleUrlLogoutSuccessHandler successHandler = mock(SimpleUrlLogoutSuccessHandler.class); SecurityContextLogoutHandler localHandler = mock(SecurityContextLogoutHandler.class); SecurityContextLogoutHandler globalHandler = mock(SecurityContextLogoutHandler.class); configurer .successHandler(successHandler) .localHandler(localHandler) .globalHandler(globalHandler); configurer.init(builder); configurer.configure(builder); ArgumentCaptor<SAMLLogoutFilter> logoutFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutFilter.class); ArgumentCaptor<SAMLLogoutProcessingFilter> logoutProcessingFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutProcessingFilter.class); verify(builder).setSharedObject(eq(SAMLLogoutFilter.class), logoutFilterCaptor.capture()); verify(builder).setSharedObject(eq(SAMLLogoutProcessingFilter.class), logoutProcessingFilterCaptor.capture()); verify(logoutProperties, never()).getDefaultTargetUrl(); verify(logoutProperties, never()).isInvalidateSession(); verify(logoutProperties, never()).isClearAuthentication(); verify(logoutProperties).getLogoutUrl(); verify(logoutProperties).getSingleLogoutUrl(); verifyZeroInteractions(successHandler, localHandler, globalHandler); SAMLLogoutFilter logoutFilter = logoutFilterCaptor.getValue(); SAMLLogoutProcessingFilter logoutProcessingFilter = logoutProcessingFilterCaptor.getValue(); assertThat(logoutFilter).isNotNull(); assertThat(logoutProcessingFilter).isNotNull(); assertThat(logoutFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getLogoutUrl()); assertThat(logoutProcessingFilter.getFilterProcessesUrl()).isEqualTo(logoutProperties.getSingleLogoutUrl()); assertThat(serviceProviderEndpoints.getLogoutURL()).isEqualTo(logoutProperties.getLogoutUrl()); assertThat(serviceProviderEndpoints.getSingleLogoutURL()).isEqualTo(logoutProperties.getSingleLogoutUrl()); }
@Test public void configure_arguments() throws Exception { LogoutConfigurer configurer = spy(new LogoutConfigurer()); SimpleUrlLogoutSuccessHandler successHandler = mock(SimpleUrlLogoutSuccessHandler.class); SecurityContextLogoutHandler localHandler = mock(SecurityContextLogoutHandler.class); SecurityContextLogoutHandler globalHandler = mock(SecurityContextLogoutHandler.class); when(configurer.createDefaultSuccessHandler()).thenReturn(successHandler); when(configurer.createDefaultLocalHandler()).thenReturn(localHandler); when(configurer.createDefaultGlobalHandler()).thenReturn(globalHandler); configurer .defaultTargetURL("/default") .clearAuthentication(false) .invalidateSession(true) .logoutURL("/lo") .singleLogoutURL("/slo"); configurer.init(builder); configurer.configure(builder); ArgumentCaptor<SAMLLogoutFilter> logoutFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutFilter.class); ArgumentCaptor<SAMLLogoutProcessingFilter> logoutProcessingFilterCaptor = ArgumentCaptor.forClass(SAMLLogoutProcessingFilter.class); verify(builder).setSharedObject(eq(SAMLLogoutFilter.class), logoutFilterCaptor.capture()); verify(builder).setSharedObject(eq(SAMLLogoutProcessingFilter.class), logoutProcessingFilterCaptor.capture()); verify(logoutProperties, never()).getDefaultTargetUrl(); verify(logoutProperties, never()).isInvalidateSession(); verify(logoutProperties, never()).isClearAuthentication(); verify(logoutProperties, never()).getLogoutUrl(); verify(logoutProperties, never()).getSingleLogoutUrl(); verify(successHandler).setDefaultTargetUrl(eq("/default")); verify(localHandler).setClearAuthentication(eq(false)); verify(localHandler).setInvalidateHttpSession(eq(true)); verify(globalHandler).setClearAuthentication(eq(false)); verify(globalHandler).setInvalidateHttpSession(eq(true)); SAMLLogoutFilter logoutFilter = logoutFilterCaptor.getValue(); SAMLLogoutProcessingFilter logoutProcessingFilter = logoutProcessingFilterCaptor.getValue(); assertThat(logoutFilter).isNotNull(); assertThat(logoutProcessingFilter).isNotNull(); assertThat(logoutFilter.getFilterProcessesUrl()).isEqualTo("/lo"); assertThat(logoutProcessingFilter.getFilterProcessesUrl()).isEqualTo("/slo"); assertThat(serviceProviderEndpoints.getLogoutURL()).isEqualTo("/lo"); assertThat(serviceProviderEndpoints.getSingleLogoutURL()).isEqualTo("/slo"); }
@RequestMapping(value = "/logout", method = RequestMethod.GET) public String logoutPage(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout"; }
/** * deconnecte l'utilisateur du système. * * @param request * : la requete * @param response * : la reponse * @return nom de la vue */ @RequestMapping(value = "/logout", method = RequestMethod.GET) @LogMe(logExit = true) public String logoutPage(final HttpServletRequest request, final HttpServletResponse response) { final Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout"; }
@RequestMapping(value = "/logout", method = RequestMethod.GET) public void logoutPage(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } }
@RequestMapping(path = "/logout", method = RequestMethod.GET) public String logout(HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { new SecurityContextLogoutHandler().logout(request, response, auth); } SecurityContextHolder.getContext().setAuthentication(null); return "redirect:/home"; }
@RequestMapping(value="/logout", method = RequestMethod.GET) public String logoutPage (HttpServletRequest request, HttpServletResponse response) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null){ new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout";//You can redirect wherever you want, but generally it's a good idea to show login screen again. }
@GetMapping(value = "/logout") public String logout(HttpServletRequest request, HttpServletResponse response, Model model) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null){ new SecurityContextLogoutHandler().logout(request, response, auth); } return "redirect:/login?logout"; }
@Bean public SecurityContextLogoutHandler logoutHandler() { SecurityContextLogoutHandler handler = new SecurityContextLogoutHandler(); //handler.setInvalidateHttpSession(true); handler.setClearAuthentication(true); return handler; }
@RequestMapping("/logout") public String logout(HttpServletRequest req, HttpServletResponse resp) { sLog.debug("Request to log user out..."); Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth != null) { sLog.debug("The user is logged in, logging user out."); new SecurityContextLogoutHandler().logout(req, resp, auth); return "redirect:/login?logout"; } else{ sLog.debug("The user was not logged in."); } return "redirect:/tempss/profiles"; }