signature:
public class HttpSecurity { /** * Allows restricting access based upon the { @ link HttpServletRequest } using
 * < h2 > Example Configurations < / h2 >
 * The most basic example is to configure all URLs to require the role " ROLE _ USER " .
 * The configuration below requires authentication to every URL and will grant access
 * to both the user " admin " and " user " .
 * < pre >
 * & # 064 ; Configuration
 * & # 064 ; EnableWebSecurity
 * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
 * & # 064 ; Override
 * protected void configure ( HttpSecurity http ) throws Exception {
 * http . authorizeRequests ( ) . antMatchers ( & quot ; / * * & quot ; ) . hasRole ( & quot ; USER & quot ; ) . and ( ) . formLogin ( ) ;
 * & # 064 ; Override
 * protected void configure ( AuthenticationManagerBuilder auth ) throws Exception {
 * auth . inMemoryAuthentication ( ) . withUser ( & quot ; user & quot ; ) . password ( & quot ; password & quot ; ) . roles ( & quot ; USER & quot ; )
 * . and ( ) . withUser ( & quot ; admin & quot ; ) . password ( & quot ; password & quot ; ) . roles ( & quot ; ADMIN & quot ; , & quot ; USER & quot ; ) ;
 * < / pre >
 * We can also configure multiple URLs . The configuration below requires
 * authentication to every URL and will grant access to URLs starting with / admin / to
 * only the " admin " user . All other URLs either user can access .
 * < pre >
 * & # 064 ; Configuration
 * & # 064 ; EnableWebSecurity
 * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
 * & # 064 ; Override
 * protected void configure ( HttpSecurity http ) throws Exception {
 * http . authorizeRequests ( ) . antMatchers ( & quot ; / admin / * * & quot ; ) . hasRole ( & quot ; ADMIN & quot ; )
 * . antMatchers ( & quot ; / * * & quot ; ) . hasRole ( & quot ; USER & quot ; ) . and ( ) . formLogin ( ) ;
 * & # 064 ; Override
 * protected void configure ( AuthenticationManagerBuilder auth ) throws Exception {
 * auth . inMemoryAuthentication ( ) . withUser ( & quot ; user & quot ; ) . password ( & quot ; password & quot ; ) . roles ( & quot ; USER & quot ; )
 * . and ( ) . withUser ( & quot ; admin & quot ; ) . password ( & quot ; password & quot ; ) . roles ( & quot ; ADMIN & quot ; , & quot ; USER & quot ; ) ;
 * < / pre >
 * Note that the matchers are considered in order . Therefore , the following is invalid
 * because the first matcher matches every request and will never get to the second
 * mapping :
 * < pre >
 * http . authorizeRequests ( ) . antMatchers ( & quot ; / * * & quot ; ) . hasRole ( & quot ; USER & quot ; ) . antMatchers ( & quot ; / admin / * * & quot ; )
 * . hasRole ( & quot ; ADMIN & quot ; )
 * < / pre >
 * @ see # requestMatcher ( RequestMatcher )
 * @ return the { @ link ExpressionUrlAuthorizationConfigurer } for further customizations
 * @ throws Exception */
public ExpressionUrlAuthorizationConfigurer < HttpSecurity > . ExpressionInterceptUrlRegistry authorizeRequests ( ) throws Exception { } }

implementation: ApplicationContext context = getContext ( ) ; return getOrApply ( new ExpressionUrlAuthorizationConfigurer < > ( context ) ) . getRegistry ( ) ;


signature:
public class HttpSecurity { /** * Adds CSRF support . This is activated by default when using
 * { @ link WebSecurityConfigurerAdapter } ' s default constructor . You can disable it
 * using :
 * < pre >
 * & # 064 ; Configuration
 * & # 064 ; EnableWebSecurity
 * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
 * & # 064 ; Override
 * protected void configure ( HttpSecurity http ) throws Exception {
 * http
 * . csrf ( ) . disable ( )
 * < / pre >
 * @ return the { @ link ServletApiConfigurer } for further customizations
 * @ throws Exception */
public CsrfConfigurer < HttpSecurity > csrf ( ) throws Exception { } }

implementation: ApplicationContext context = getContext ( ) ; return getOrApply ( new CsrfConfigurer < > ( context ) ) ;


signature:
public class HttpSecurity { /** * Configures OAuth 2.0 Client support .
 * @ since 5.1
 * @ see < a target = " _ blank " href = " https : / / tools . ietf . org / html / rfc6749 # section - 1.1 " > OAuth 2.0 Authorization Framework < / a >
 * @ return the { @ link OAuth2ClientConfigurer } for further customizations
 * @ throws Exception */
public OAuth2ClientConfigurer < HttpSecurity > oauth2Client ( ) throws Exception { } }

implementation: OAuth2ClientConfigurer < HttpSecurity > configurer = getOrApply ( new OAuth2ClientConfigurer < > ( ) ) ; this . postProcess ( configurer ) ; return configurer ;


signature:
public class HttpSecurity { /** * Configures OAuth 2.0 Resource Server support .
 * @ since 5.1
 * @ see < a target = " _ blank " href = " https : / / tools . ietf . org / html / rfc6749 # section - 1.1 " > OAuth 2.0 Authorization Framework < / a >
 * @ return the { @ link OAuth2ResourceServerConfigurer } for further customizations
 * @ throws Exception */
public OAuth2ResourceServerConfigurer < HttpSecurity > oauth2ResourceServer ( ) throws Exception { } }

implementation: OAuth2ResourceServerConfigurer < HttpSecurity > configurer = getOrApply ( new OAuth2ResourceServerConfigurer < > ( getContext ( ) ) ) ; this . postProcess ( configurer ) ; return configurer ;


signature:
public class HttpSecurity { /** * Configures channel security . In order for this configuration to be useful at least
 * one mapping to a required channel must be provided .
 * < h2 > Example Configuration < / h2 >
 * The example below demonstrates how to require HTTPs for every request . Only
 * requiring HTTPS for some requests is supported , but not recommended since an
 * application that allows for HTTP introduces many security vulnerabilities . For one
 * such example , read about < a
 * href = " https : / / en . wikipedia . org / wiki / Firesheep " > Firesheep < / a > .
 * < pre >
 * & # 064 ; Configuration
 * & # 064 ; EnableWebSecurity
 * public class ChannelSecurityConfig extends WebSecurityConfigurerAdapter {
 * & # 064 ; Override
 * protected void configure ( HttpSecurity http ) throws Exception {
 * http . authorizeRequests ( ) . antMatchers ( & quot ; / * * & quot ; ) . hasRole ( & quot ; USER & quot ; ) . and ( ) . formLogin ( )
 * . and ( ) . requiresChannel ( ) . anyRequest ( ) . requiresSecure ( ) ;
 * & # 064 ; Override
 * protected void configure ( AuthenticationManagerBuilder auth ) throws Exception {
 * auth . inMemoryAuthentication ( ) . withUser ( & quot ; user & quot ; ) . password ( & quot ; password & quot ; ) . roles ( & quot ; USER & quot ; ) ;
 * < / pre >
 * @ return the { @ link ChannelSecurityConfigurer } for further customizations
 * @ throws Exception */
public ChannelSecurityConfigurer < HttpSecurity > . ChannelRequestMatcherRegistry requiresChannel ( ) throws Exception { } }

implementation: ApplicationContext context = getContext ( ) ; return getOrApply ( new ChannelSecurityConfigurer < > ( context ) ) . getRegistry ( ) ;


signature:
public class HttpSecurity { /** * ( non - Javadoc )
 * @ see
 * org . springframework . security . config . annotation . web . HttpSecurityBuilder # addFilterAfter ( javax
 * . servlet . Filter , java . lang . Class ) */
public HttpSecurity addFilterAfter ( Filter filter , Class < ? extends Filter > afterFilter ) { } }

implementation: comparator . registerAfter ( filter . getClass ( ) , afterFilter ) ; return addFilter ( filter ) ;


signature:
public class HttpSecurity { /** * ( non - Javadoc )
 * @ see
 * org . springframework . security . config . annotation . web . HttpSecurityBuilder # addFilterBefore (
 * javax . servlet . Filter , java . lang . Class ) */
public HttpSecurity addFilterBefore ( Filter filter , Class < ? extends Filter > beforeFilter ) { } }

implementation: comparator . registerBefore ( filter . getClass ( ) , beforeFilter ) ; return addFilter ( filter ) ;


signature:
public class HttpSecurity { /** * ( non - Javadoc )
 * @ see
 * org . springframework . security . config . annotation . web . HttpSecurityBuilder # addFilter ( javax .
 * servlet . Filter ) */
public HttpSecurity addFilter ( Filter filter ) { } }

implementation: Class < ? extends Filter > filterClass = filter . getClass ( ) ; if ( ! comparator . isRegistered ( filterClass ) ) { throw new IllegalArgumentException ( "The Filter class " + filterClass . getName ( ) + " does not have a registered order and cannot be added without a specified order. Consider using addFilterBefore or addFilterAfter instead." ) ; } this . filters . add ( filter ) ; return this ;


signature:
public class HttpSecurity { /** * Adds the Filter at the location of the specified Filter class . For example , if you
 * want the filter CustomFilter to be registered in the same position as
 * { @ link UsernamePasswordAuthenticationFilter } , you can invoke :
 * < pre >
 * addFilterAt ( new CustomFilter ( ) , UsernamePasswordAuthenticationFilter . class )
 * < / pre >
 * Registration of multiple Filters in the same location means their ordering is not
 * deterministic . More concretely , registering multiple Filters in the same location
 * does not override existing Filters . Instead , do not register Filters you do not
 * want to use .
 * @ param filter the Filter to register
 * @ param atFilter the location of another { @ link Filter } that is already registered
 * ( i . e . known ) with Spring Security .
 * @ return the { @ link HttpSecurity } for further customizations */
public HttpSecurity addFilterAt ( Filter filter , Class < ? extends Filter > atFilter ) { } }

implementation: this . comparator . registerAt ( filter . getClass ( ) , atFilter ) ; return addFilter ( filter ) ;


signature:
public class HttpSecurity { /** * Allows configuring the { @ link HttpSecurity } to only be invoked when matching the
 * provided Spring MVC pattern . If more advanced configuration is necessary , consider using
 * { @ link # requestMatchers ( ) } or { @ link # requestMatcher ( RequestMatcher ) } .
 * Invoking { @ link # mvcMatcher ( String ) } will override previous invocations of { @ link # mvcMatcher ( String ) } } ,
 * { @ link # requestMatchers ( ) } , { @ link # antMatcher ( String ) } ,
 * { @ link # regexMatcher ( String ) } , and { @ link # requestMatcher ( RequestMatcher ) } .
 * @ param mvcPattern the Spring MVC Pattern to match on ( i . e . " / admin / * * " )
 * @ return the { @ link HttpSecurity } for further customizations
 * @ see MvcRequestMatcher */
public HttpSecurity mvcMatcher ( String mvcPattern ) { } }

implementation: HandlerMappingIntrospector introspector = new HandlerMappingIntrospector ( getContext ( ) ) ; return requestMatcher ( new MvcRequestMatcher ( introspector , mvcPattern ) ) ;


signature:
public class HttpSecurity { /** * If the { @ link SecurityConfigurer } has already been specified get the original ,
 * otherwise apply the new { @ link SecurityConfigurerAdapter } .
 * @ param configurer the { @ link SecurityConfigurer } to apply if one is not found for
 * this { @ link SecurityConfigurer } class .
 * @ return the current { @ link SecurityConfigurer } for the configurer passed in
 * @ throws Exception */
@ SuppressWarnings ( "unchecked" ) private < C extends SecurityConfigurerAdapter < DefaultSecurityFilterChain , HttpSecurity > > C getOrApply ( C configurer ) throws Exception { } }

implementation: C existingConfig = ( C ) getConfigurer ( configurer . getClass ( ) ) ; if ( existingConfig != null ) { return existingConfig ; } return apply ( configurer ) ;


signature:
public class AbstractServerWebExchangeMatcherRegistry { /** * Maps a { @ link List } of
 * { @ link PathPatternParserServerWebExchangeMatcher }
 * instances .
 * @ param method the { @ link HttpMethod } to use or { @ code null } for any
 * { @ link HttpMethod } .
 * @ param antPatterns the ant patterns to create . If { @ code null } or empty , then matches on nothing .
 * { @ link PathPatternParserServerWebExchangeMatcher } from
 * @ return the object that is chained after creating the { @ link ServerWebExchangeMatcher } */
public T pathMatchers ( HttpMethod method , String ... antPatterns ) { } }

implementation: return matcher ( ServerWebExchangeMatchers . pathMatchers ( method , antPatterns ) ) ;


signature:
public class SpringSecurityLdapTemplate { /** * Performs an LDAP compare operation of the value of an attribute for a particular
 * directory entry .
 * @ param dn the entry who ' s attribute is to be used
 * @ param attributeName the attribute who ' s value we want to compare
 * @ param value the value to be checked against the directory value
 * @ return true if the supplied value matches that in the directory */
public boolean compare ( final String dn , final String attributeName , final Object value ) { } }

implementation: final String comparisonFilter = "(" + attributeName + "={0})" ; class LdapCompareCallback implements ContextExecutor { public Object executeWithContext ( DirContext ctx ) throws NamingException { SearchControls ctls = new SearchControls ( ) ; ctls . setReturningAttributes ( NO_ATTRS ) ; ctls . setSearchScope ( SearchControls . OBJECT_SCOPE ) ; NamingEnumeration < SearchResult > results = ctx . search ( dn , comparisonFilter , new Object [ ] { value } , ctls ) ; Boolean match = Boolean . valueOf ( results . hasMore ( ) ) ; LdapUtils . closeEnumeration ( results ) ; return match ; } } Boolean matches = ( Boolean ) executeReadOnly ( new LdapCompareCallback ( ) ) ; return matches . booleanValue ( ) ;


signature:
public class SpringSecurityLdapTemplate { /** * Composes an object from the attributes of the given DN .
 * @ param dn the directory entry which will be read
 * @ param attributesToRetrieve the named attributes which will be retrieved from the
 * directory entry .
 * @ return the object created by the mapper */
public DirContextOperations retrieveEntry ( final String dn , final String [ ] attributesToRetrieve ) { } }

implementation:
return ( DirContextOperations ) executeReadOnly ( new ContextExecutor ( ) { public Object executeWithContext ( DirContext ctx ) throws NamingException { Attributes attrs = ctx . getAttributes ( dn , attributesToRetrieve ) ; // Object object = ctx . lookup ( LdapUtils . getRelativeName ( dn , ctx ) ) ;
return new DirContextAdapter ( attrs , new DistinguishedName ( dn ) , new DistinguishedName ( ctx . getNameInNamespace ( ) ) ) ; } } ) ;


signature:
public class SpringSecurityLdapTemplate { /** * Performs a search using the supplied filter and returns the union of the values of
 * the named attribute found in all entries matched by the search . Note that one
 * directory entry may have several values for the attribute . Intended for role
 * searches and similar scenarios .
 * @ param base the DN to search in
 * @ param filter search filter to use
 * @ param params the parameters to substitute in the search filter
 * @ param attributeName the attribute who ' s values are to be retrieved .
 * @ return the set of String values for the attribute as a union of the values found
 * in all the matching entries . */
public Set < String > searchForSingleAttributeValues ( final String base , final String filter , final Object [ ] params , final String attributeName ) { } }

implementation: String [ ] attributeNames = new String [ ] { attributeName } ; Set < Map < String , List < String > > > multipleAttributeValues = searchForMultipleAttributeValues ( base , filter , params , attributeNames ) ; Set < String > result = new HashSet < > ( ) ; for ( Map < String , List < String > > map : multipleAttributeValues ) { List < String > values = map . get ( attributeName ) ; if ( values != null ) { result . addAll ( values ) ; } } return result ;


signature:
public class SpringSecurityLdapTemplate { /** * Performs a search using the supplied filter and returns the values of each named
 * attribute found in all entries matched by the search . Note that one directory entry
 * may have several values for the attribute . Intended for role searches and similar
 * scenarios .
 * @ param base the DN to search in
 * @ param filter search filter to use
 * @ param params the parameters to substitute in the search filter
 * @ param attributeNames the attributes ' values that are to be retrieved .
 * @ return the set of String values for each attribute found in all the matching
 * entries . The attribute name is the key for each set of values . In addition each map
 * contains the DN as a String with the key predefined key { @ link # DN _ KEY } . */
public Set < Map < String , List < String > > > searchForMultipleAttributeValues ( final String base , final String filter , final Object [ ] params , final String [ ] attributeNames ) { } }

implementation:
// Escape the params acording to RFC2254
Object [ ] encodedParams = new String [ params . length ] ; for ( int i = 0 ; i < params . length ; i ++ ) { encodedParams [ i ] = LdapEncoder . filterEncode ( params [ i ] . toString ( ) ) ; } String formattedFilter = MessageFormat . format ( filter , encodedParams ) ; logger . debug ( "Using filter: " + formattedFilter ) ; final HashSet < Map < String , List < String > > > set = new HashSet < Map < String , List < String > > > ( ) ; ContextMapper roleMapper = new ContextMapper ( ) { public Object mapFromContext ( Object ctx ) { DirContextAdapter adapter = ( DirContextAdapter ) ctx ; Map < String , List < String > > record = new HashMap < String , List < String > > ( ) ; if ( attributeNames == null || attributeNames . length == 0 ) { try { for ( NamingEnumeration ae = adapter . getAttributes ( ) . getAll ( ) ; ae . hasMore ( ) ; ) { Attribute attr = ( Attribute ) ae . next ( ) ; extractStringAttributeValues ( adapter , record , attr . getID ( ) ) ; } } catch ( NamingException x ) { org . springframework . ldap . support . LdapUtils . convertLdapException ( x ) ; } } else { for ( String attributeName : attributeNames ) { extractStringAttributeValues ( adapter , record , attributeName ) ; } } record . put ( DN_KEY , Arrays . asList ( getAdapterDN ( adapter ) ) ) ; set . add ( record ) ; return null ; } } ; SearchControls ctls = new SearchControls ( ) ; ctls . setSearchScope ( searchControls . getSearchScope ( ) ) ; ctls . setReturningAttributes ( attributeNames != null && attributeNames . length > 0 ? attributeNames : null ) ; search ( base , formattedFilter , ctls , roleMapper ) ; return set ;


signature:
public class SpringSecurityLdapTemplate { /** * Extracts String values for a specified attribute name and places them in the map
 * representing the ldap record If a value is not of type String , it will derive it ' s
 * value from the { @ link Object # toString ( ) }
 * @ param adapter - the adapter that contains the values
 * @ param record - the map holding the attribute names and values
 * @ param attributeName - the name for which to fetch the values from */
private void extractStringAttributeValues ( DirContextAdapter adapter , Map < String , List < String > > record , String attributeName ) { } }

implementation: Object [ ] values = adapter . getObjectAttributes ( attributeName ) ; if ( values == null || values . length == 0 ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "No attribute value found for '" + attributeName + "'" ) ; } return ; } List < String > svalues = new ArrayList < > ( ) ; for ( Object o : values ) { if ( o != null ) { if ( String . class . isAssignableFrom ( o . getClass ( ) ) ) { svalues . add ( ( String ) o ) ; } else { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Attribute:" + attributeName + " contains a non string value of type[" + o . getClass ( ) + "]" ) ; } svalues . add ( o . toString ( ) ) ; } } } record . put ( attributeName , svalues ) ;


signature:
public class SpringSecurityLdapTemplate { /** * Performs a search , with the requirement that the search shall return a single
 * directory entry , and uses the supplied mapper to create the object from that entry .
 * Ignores < tt > PartialResultException < / tt > if thrown , for compatibility with Active
 * Directory ( see { @ link LdapTemplate # setIgnorePartialResultException ( boolean ) } ) .
 * @ param base the search base , relative to the base context supplied by the context
 * source .
 * @ param filter the LDAP search filter
 * @ param params parameters to be substituted in the search .
 * @ return a DirContextOperations instance created from the matching entry .
 * @ throws IncorrectResultSizeDataAccessException if no results are found or the
 * search returns more than one result . */
public DirContextOperations searchForSingleEntry ( final String base , final String filter , final Object [ ] params ) { } }

implementation: return ( DirContextOperations ) executeReadOnly ( new ContextExecutor ( ) { public Object executeWithContext ( DirContext ctx ) throws NamingException { return searchForSingleEntryInternal ( ctx , searchControls , base , filter , params ) ; } } ) ;


signature:
public class SpringSecurityLdapTemplate { /** * Internal method extracted to avoid code duplication in AD search . */
public static DirContextOperations searchForSingleEntryInternal ( DirContext ctx , SearchControls searchControls , String base , String filter , Object [ ] params ) throws NamingException { } }

implementation: final DistinguishedName ctxBaseDn = new DistinguishedName ( ctx . getNameInNamespace ( ) ) ; final DistinguishedName searchBaseDn = new DistinguishedName ( base ) ; final NamingEnumeration < SearchResult > resultsEnum = ctx . search ( searchBaseDn , filter , params , buildControls ( searchControls ) ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Searching for entry under DN '" + ctxBaseDn + "', base = '" + searchBaseDn + "', filter = '" + filter + "'" ) ; } Set < DirContextOperations > results = new HashSet < > ( ) ; try { while ( resultsEnum . hasMore ( ) ) { SearchResult searchResult = resultsEnum . next ( ) ; DirContextAdapter dca = ( DirContextAdapter ) searchResult . getObject ( ) ; Assert . notNull ( dca , "No object returned by search, DirContext is not correctly configured" ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Found DN: " + dca . getDn ( ) ) ; } results . add ( dca ) ; } } catch ( PartialResultException e ) { LdapUtils . closeEnumeration ( resultsEnum ) ; logger . info ( "Ignoring PartialResultException" ) ; } if ( results . size ( ) == 0 ) { throw new IncorrectResultSizeDataAccessException ( 1 , 0 ) ; } if ( results . size ( ) > 1 ) { throw new IncorrectResultSizeDataAccessException ( 1 , results . size ( ) ) ; } return results . iterator ( ) . next ( ) ;


signature:
public class SpringSecurityLdapTemplate { /** * We need to make sure the search controls has the return object flag set to true , in
 * order for the search to return DirContextAdapter instances .
 * @ param originalControls
 * @ return */
private static SearchControls buildControls ( SearchControls originalControls ) { } }

implementation: return new SearchControls ( originalControls . getSearchScope ( ) , originalControls . getCountLimit ( ) , originalControls . getTimeLimit ( ) , originalControls . getReturningAttributes ( ) , RETURN_OBJECT , originalControls . getDerefLinkFlag ( ) ) ;


signature: public class BasicLookupStrategy { private String computeRepeatingSql ( String repeatingSql , int requiredRepetitions ) { } }

implementation: assert requiredRepetitions > 0 : "requiredRepetitions must be > 0" ; final String startSql = selectClause ; final String endSql = orderByClause ; StringBuilder sqlStringBldr = new StringBuilder ( startSql . length ( ) + endSql . length ( ) + requiredRepetitions * ( repeatingSql . length ( ) + 4 ) ) ; sqlStringBldr . append ( startSql ) ; for ( int i = 1 ; i <= requiredRepetitions ; i ++ ) { sqlStringBldr . append ( repeatingSql ) ; if ( i != requiredRepetitions ) { sqlStringBldr . append ( " or " ) ; } } sqlStringBldr . append ( endSql ) ; return sqlStringBldr . toString ( ) ;


signature:
public class BasicLookupStrategy { /** * Locates the primary key IDs specified in " findNow " , adding AclImpl instances with
 * StubAclParents to the " acls " Map .
 * @ param acls the AclImpls ( with StubAclParents )
 * @ param findNow Long - based primary keys to retrieve
 * @ param sids */
private void lookupPrimaryKeys ( final Map < Serializable , Acl > acls , final Set < Long > findNow , final List < Sid > sids ) { } }

implementation:
Assert . notNull ( acls , "ACLs are required" ) ; Assert . notEmpty ( findNow , "Items to find now required" ) ; String sql = computeRepeatingSql ( lookupPrimaryKeysWhereClause , findNow . size ( ) ) ; Set < Long > parentsToLookup = jdbcTemplate . query ( sql , new PreparedStatementSetter ( ) { public void setValues ( PreparedStatement ps ) throws SQLException { int i = 0 ; for ( Long toFind : findNow ) { i ++ ; ps . setLong ( i , toFind ) ; } } } , new ProcessResultSet ( acls , sids ) ) ; // Lookup the parents , now that our JdbcTemplate has released the database
// connection ( SEC - 547)
if ( parentsToLookup . size ( ) > 0 ) { lookupPrimaryKeys ( acls , parentsToLookup , sids ) ; }


signature:
public class BasicLookupStrategy { /** * The main method .
 * WARNING : This implementation completely disregards the " sids " argument ! Every item
 * in the cache is expected to contain all SIDs . If you have serious performance needs
 * ( e . g . a very large number of SIDs per object identity ) , you ' ll probably want to
 * develop a custom { @ link LookupStrategy } implementation instead .
 * The implementation works in batch sizes specified by { @ link # batchSize } .
 * @ param objects the identities to lookup ( required )
 * @ param sids the SIDs for which identities are required ( ignored by this
 * implementation )
 * @ return a < tt > Map < / tt > where keys represent the { @ link ObjectIdentity } of the
 * located { @ link Acl } and values are the located { @ link Acl } ( never < tt > null < / tt >
 * although some entries may be missing ; this method should not throw
 * { @ link NotFoundException } , as a chain of { @ link LookupStrategy } s may be used to
 * automatically create entries if required ) */
public final Map < ObjectIdentity , Acl > readAclsById ( List < ObjectIdentity > objects , List < Sid > sids ) { } }

implementation:
Assert . isTrue ( batchSize >= 1 , "BatchSize must be >= 1" ) ; Assert . notEmpty ( objects , "Objects to lookup required" ) ; // Map < ObjectIdentity , Acl >
Map < ObjectIdentity , Acl > result = new HashMap < > ( ) ; // contains
// FULLY
// loaded
// Acl
// objects
Set < ObjectIdentity > currentBatchToLoad = new HashSet < > ( ) ; for ( int i = 0 ; i < objects . size ( ) ; i ++ ) { final ObjectIdentity oid = objects . get ( i ) ; boolean aclFound = false ; // Check we don ' t already have this ACL in the results
if ( result . containsKey ( oid ) ) { aclFound = true ; } // Check cache for the present ACL entry
if ( ! aclFound ) { Acl acl = aclCache . getFromCache ( oid ) ; // Ensure any cached element supports all the requested SIDs
// ( they should always , as our base impl doesn ' t filter on SID )
if ( acl != null ) { if ( acl . isSidLoaded ( sids ) ) { result . put ( acl . getObjectIdentity ( ) , acl ) ; aclFound = true ; } else { throw new IllegalStateException ( "Error: SID-filtered element detected when implementation does not perform SID filtering " + "- have you added something to the cache manually?" ) ; } } } // Load the ACL from the database
if ( ! aclFound ) { currentBatchToLoad . add ( oid ) ; } // Is it time to load from JDBC the currentBatchToLoad ?
if ( ( currentBatchToLoad . size ( ) == this . batchSize ) || ( ( i + 1 ) == objects . size ( ) ) ) { if ( currentBatchToLoad . size ( ) > 0 ) { Map < ObjectIdentity , Acl > loadedBatch = lookupObjectIdentities ( currentBatchToLoad , sids ) ; // Add loaded batch ( all elements 100 % initialized ) to results
result . putAll ( loadedBatch ) ; // Add the loaded batch to the cache
for ( Acl loadedAcl : loadedBatch . values ( ) ) { aclCache . putInCache ( ( AclImpl ) loadedAcl ) ; } currentBatchToLoad . clear ( ) ; } } } return result ;


signature:
public class BasicLookupStrategy { /** * Looks up a batch of < code > ObjectIdentity < / code > s directly from the database .
 * The caller is responsible for optimization issues , such as selecting the identities
 * to lookup , ensuring the cache doesn ' t contain them already , and adding the returned
 * elements to the cache etc .
 * This subclass is required to return fully valid < code > Acl < / code > s , including
 * properly - configured parent ACLs . */
private Map < ObjectIdentity , Acl > lookupObjectIdentities ( final Collection < ObjectIdentity > objectIdentities , List < Sid > sids ) { } }

implementation:
Assert . notEmpty ( objectIdentities , "Must provide identities to lookup" ) ; final Map < Serializable , Acl > acls = new HashMap < > ( ) ; // contains
// Acls
// with
// StubAclParents
// Make the " acls " map contain all requested objectIdentities
// ( including markers to each parent in the hierarchy )
String sql = computeRepeatingSql ( lookupObjectIdentitiesWhereClause , objectIdentities . size ( ) ) ; Set < Long > parentsToLookup = jdbcTemplate . query ( sql , new PreparedStatementSetter ( ) { public void setValues ( PreparedStatement ps ) throws SQLException { int i = 0 ; for ( ObjectIdentity oid : objectIdentities ) { // Determine prepared statement values for this iteration
String type = oid . getType ( ) ; // No need to check for nulls , as guaranteed non - null by
// ObjectIdentity . getIdentifier ( ) interface contract
String identifier = oid . getIdentifier ( ) . toString ( ) ; // Inject values
ps . setString ( ( 2 * i ) + 1 , identifier ) ; ps . setString ( ( 2 * i ) + 2 , type ) ; i ++ ; } } } , new ProcessResultSet ( acls , sids ) ) ; // Lookup the parents , now that our JdbcTemplate has released the database
// connection ( SEC - 547)
if ( parentsToLookup . size ( ) > 0 ) { lookupPrimaryKeys ( acls , parentsToLookup , sids ) ; } // Finally , convert our " acls " containing StubAclParents into true Acls
Map < ObjectIdentity , Acl > resultMap = new HashMap < > ( ) ; for ( Acl inputAcl : acls . values ( ) ) { Assert . isInstanceOf ( AclImpl . class , inputAcl , "Map should have contained an AclImpl" ) ; Assert . isInstanceOf ( Long . class , ( ( AclImpl ) inputAcl ) . getId ( ) , "Acl.getId() must be Long" ) ; Acl result = convert ( acls , ( Long ) ( ( AclImpl ) inputAcl ) . getId ( ) ) ; resultMap . put ( result . getObjectIdentity ( ) , result ) ; } return resultMap ;


signature:
public class BasicLookupStrategy { /** * The final phase of converting the < code > Map < / code > of < code > AclImpl < / code >
 * instances which contain < code > StubAclParent < / code > s into proper , valid
 * < code > AclImpl < / code > s with correct ACL parents .
 * @ param inputMap the unconverted < code > AclImpl < / code > s
 * @ param currentIdentity the current < code > Acl < / code > that we wish to convert ( this
 * may be */
private AclImpl convert ( Map < Serializable , Acl > inputMap , Long currentIdentity ) { } }

implementation:
Assert . notEmpty ( inputMap , "InputMap required" ) ; Assert . notNull ( currentIdentity , "CurrentIdentity required" ) ; // Retrieve this Acl from the InputMap
Acl uncastAcl = inputMap . get ( currentIdentity ) ; Assert . isInstanceOf ( AclImpl . class , uncastAcl , "The inputMap contained a non-AclImpl" ) ; AclImpl inputAcl = ( AclImpl ) uncastAcl ; Acl parent = inputAcl . getParentAcl ( ) ; if ( ( parent != null ) && parent instanceof StubAclParent ) { // Lookup the parent
StubAclParent stubAclParent = ( StubAclParent ) parent ; parent = convert ( inputMap , stubAclParent . getId ( ) ) ; } // Now we have the parent ( if there is one ) , create the true AclImpl
AclImpl result = new AclImpl ( inputAcl . getObjectIdentity ( ) , ( Long ) inputAcl . getId ( ) , aclAuthorizationStrategy , grantingStrategy , parent , null , inputAcl . isEntriesInheriting ( ) , inputAcl . getOwner ( ) ) ; // Copy the " aces " from the input to the destination
// Obtain the " aces " from the input ACL
List < AccessControlEntryImpl > aces = readAces ( inputAcl ) ; // Create a list in which to store the " aces " for the " result " AclImpl instance
List < AccessControlEntryImpl > acesNew = new ArrayList < > ( ) ; // Iterate over the " aces " input and replace each nested
// AccessControlEntryImpl . getAcl ( ) with the new " result " AclImpl instance
// This ensures StubAclParent instances are removed , as per SEC - 951
for ( AccessControlEntryImpl ace : aces ) { setAclOnAce ( ace , result ) ; acesNew . add ( ace ) ; } // Finally , now that the " aces " have been converted to have the " result " AclImpl
// instance , modify the " result " AclImpl instance
setAces ( result , acesNew ) ; return result ;


signature:
public class BasicLookupStrategy { /** * Creates a particular implementation of { @ link Sid } depending on the arguments .
 * @ param sid the name of the sid representing its unique identifier . In typical ACL
 * database schema it ' s located in table { @ code acl _ sid } table , { @ code sid } column .
 * @ param isPrincipal whether it ' s a user or granted authority like role
 * @ return the instance of Sid with the { @ code sidName } as an identifier */
protected Sid createSid ( boolean isPrincipal , String sid ) { } }

implementation: if ( isPrincipal ) { return new PrincipalSid ( sid ) ; } else { return new GrantedAuthoritySid ( sid ) ; }


signature:
public class J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource { /** * Obtains the list of user roles based on the current user ' s JEE roles . The
 * { @ link javax . servlet . http . HttpServletRequest # isUserInRole ( String ) } method is called
 * for each of the values in the { @ code j2eeMappableRoles } set to determine if that
 * role should be assigned to the user .
 * @ param request the request which should be used to extract the user ' s roles .
 * @ return The subset of { @ code j2eeMappableRoles } which applies to the current user
 * making the request . */
protected Collection < String > getUserRoles ( HttpServletRequest request ) { } }

implementation: ArrayList < String > j2eeUserRolesList = new ArrayList < > ( ) ; for ( String role : j2eeMappableRoles ) { if ( request . isUserInRole ( role ) ) { j2eeUserRolesList . add ( role ) ; } } return j2eeUserRolesList ;


signature:
public class J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource { /** * Builds the authentication details object .
 * @ see org . springframework . security . authentication . AuthenticationDetailsSource # buildDetails ( Object ) */
public PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails buildDetails ( HttpServletRequest context ) { } }

implementation: Collection < String > j2eeUserRoles = getUserRoles ( context ) ; Collection < ? extends GrantedAuthority > userGas = j2eeUserRoles2GrantedAuthoritiesMapper . getGrantedAuthorities ( j2eeUserRoles ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "J2EE roles [" + j2eeUserRoles + "] mapped to Granted Authorities: [" + userGas + "]" ) ; } PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails result = new PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails ( context , userGas ) ; return result ;


signature:
public class OidcIdTokenDecoderFactory { /** * Sets the factory that provides an { @ link OAuth2TokenValidator } , which is used by the { @ link JwtDecoder } .
 * The default is { @ link OidcIdTokenValidator } .
 * @ param jwtValidatorFactory the factory that provides an { @ link OAuth2TokenValidator } */
public final void setJwtValidatorFactory ( Function < ClientRegistration , OAuth2TokenValidator < Jwt > > jwtValidatorFactory ) { } }

implementation: Assert . notNull ( jwtValidatorFactory , "jwtValidatorFactory cannot be null" ) ; this . jwtValidatorFactory = jwtValidatorFactory ;


signature:
public class OidcIdTokenDecoderFactory { /** * Sets the resolver that provides the expected { @ link JwsAlgorithm JWS algorithm }
 * used for the signature or MAC on the { @ link OidcIdToken ID Token } .
 * The default resolves to { @ link SignatureAlgorithm # RS256 RS256 } for all { @ link ClientRegistration clients } .
 * @ param jwsAlgorithmResolver the resolver that provides the expected { @ link JwsAlgorithm JWS algorithm }
 * for a specific { @ link ClientRegistration client } */
public final void setJwsAlgorithmResolver ( Function < ClientRegistration , JwsAlgorithm > jwsAlgorithmResolver ) { } }

implementation: Assert . notNull ( jwsAlgorithmResolver , "jwsAlgorithmResolver cannot be null" ) ; this . jwsAlgorithmResolver = jwsAlgorithmResolver ;


signature:
public class LdapServerBeanDefinitionParser { /** * Will be called if no url attribute is supplied .
 * Registers beans to create an embedded apache directory server .
 * @ return the BeanDefinition for the ContextSource for the embedded server .
 * @ see ApacheDSContainer */
private RootBeanDefinition createEmbeddedServer ( Element element , ParserContext parserContext ) { } }

implementation: Object source = parserContext . extractSource ( element ) ; String suffix = element . getAttribute ( ATT_ROOT_SUFFIX ) ; if ( ! StringUtils . hasText ( suffix ) ) { suffix = OPT_DEFAULT_ROOT_SUFFIX ; } String port = element . getAttribute ( ATT_PORT ) ; if ( ! StringUtils . hasText ( port ) ) { port = getDefaultPort ( ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Using default port of " + port ) ; } } String url = "ldap://127.0.0.1:" + port + "/" + suffix ; BeanDefinitionBuilder contextSource = BeanDefinitionBuilder . rootBeanDefinition ( CONTEXT_SOURCE_CLASS ) ; contextSource . addConstructorArgValue ( url ) ; contextSource . addPropertyValue ( "userDn" , "uid=admin,ou=system" ) ; contextSource . addPropertyValue ( "password" , "secret" ) ; RootBeanDefinition apacheContainer = new RootBeanDefinition ( "org.springframework.security.ldap.server.ApacheDSContainer" , null , null ) ; apacheContainer . setSource ( source ) ; apacheContainer . getConstructorArgumentValues ( ) . addGenericArgumentValue ( suffix ) ; String ldifs = element . getAttribute ( ATT_LDIF_FILE ) ; if ( ! StringUtils . hasText ( ldifs ) ) { ldifs = OPT_DEFAULT_LDIF_FILE ; } apacheContainer . getConstructorArgumentValues ( ) . addGenericArgumentValue ( ldifs ) ; apacheContainer . getPropertyValues ( ) . addPropertyValue ( "port" , port ) ; logger . info ( "Embedded LDAP server bean definition created for URL: " + url ) ; if ( parserContext . getRegistry ( ) . containsBeanDefinition ( BeanIds . EMBEDDED_APACHE_DS ) ) { parserContext . getReaderContext ( ) . error ( "Only one embedded server bean is allowed per application context" , element ) ; } parserContext . getRegistry ( ) . registerBeanDefinition ( BeanIds . EMBEDDED_APACHE_DS , apacheContainer ) ; return ( RootBeanDefinition ) contextSource . getBeanDefinition ( ) ;


signature:
public class StrictTransportSecurityServerHttpHeadersWriter { /** * / * ( non - Javadoc )
 * @ see org . springframework . security . web . server . HttpHeadersWriter # writeHttpHeaders ( org . springframework . http . HttpHeaders ) */
@ Override public Mono < Void > writeHttpHeaders ( ServerWebExchange exchange ) { } }

implementation: return isSecure ( exchange ) ? delegate . writeHttpHeaders ( exchange ) : Mono . empty ( ) ;


signature:
public class HttpConfigurationBuilder { /** * Adds the servlet - api integration filter if required */
private void createServletApiFilter ( BeanReference authenticationManager ) { } }

implementation: final String ATT_SERVLET_API_PROVISION = "servlet-api-provision" ; final String DEF_SERVLET_API_PROVISION = "true" ; String provideServletApi = httpElt . getAttribute ( ATT_SERVLET_API_PROVISION ) ; if ( ! StringUtils . hasText ( provideServletApi ) ) { provideServletApi = DEF_SERVLET_API_PROVISION ; } if ( "true" . equals ( provideServletApi ) ) { servApiFilter = GrantedAuthorityDefaultsParserUtils . registerWithDefaultRolePrefix ( pc , SecurityContextHolderAwareRequestFilterBeanFactory . class ) ; servApiFilter . getPropertyValues ( ) . add ( "authenticationManager" , authenticationManager ) ; }


signature:
public class HttpConfigurationBuilder { /** * Adds the jaas - api integration filter if required */
private void createJaasApiFilter ( ) { } }

implementation: final String ATT_JAAS_API_PROVISION = "jaas-api-provision" ; final String DEF_JAAS_API_PROVISION = "false" ; String provideJaasApi = httpElt . getAttribute ( ATT_JAAS_API_PROVISION ) ; if ( ! StringUtils . hasText ( provideJaasApi ) ) { provideJaasApi = DEF_JAAS_API_PROVISION ; } if ( "true" . equals ( provideJaasApi ) ) { jaasApiFilter = new RootBeanDefinition ( JaasApiIntegrationFilter . class ) ; }


signature:
public class HttpConfigurationBuilder { /** * Parses the intercept - url elements to obtain the map used by channel security . This
 * will be empty unless the < tt > requires - channel < / tt > attribute has been used on a URL
 * path . */
private ManagedMap < BeanMetadataElement , BeanDefinition > parseInterceptUrlsForChannelSecurity ( ) { } }

implementation: ManagedMap < BeanMetadataElement , BeanDefinition > channelRequestMap = new ManagedMap < > ( ) ; for ( Element urlElt : interceptUrls ) { String path = urlElt . getAttribute ( ATT_PATH_PATTERN ) ; String method = urlElt . getAttribute ( ATT_HTTP_METHOD ) ; String matcherRef = urlElt . getAttribute ( ATT_REQUEST_MATCHER_REF ) ; boolean hasMatcherRef = StringUtils . hasText ( matcherRef ) ; if ( ! hasMatcherRef && ! StringUtils . hasText ( path ) ) { pc . getReaderContext ( ) . error ( "pattern attribute cannot be empty or null" , urlElt ) ; } String requiredChannel = urlElt . getAttribute ( ATT_REQUIRES_CHANNEL ) ; if ( StringUtils . hasText ( requiredChannel ) ) { BeanMetadataElement matcher = hasMatcherRef ? new RuntimeBeanReference ( matcherRef ) : matcherType . createMatcher ( pc , path , method ) ; RootBeanDefinition channelAttributes = new RootBeanDefinition ( ChannelAttributeFactory . class ) ; channelAttributes . getConstructorArgumentValues ( ) . addGenericArgumentValue ( requiredChannel ) ; channelAttributes . setFactoryMethodName ( "createChannelAttributes" ) ; channelRequestMap . put ( matcher , channelAttributes ) ; } } return channelRequestMap ;


signature:
public class HstsHeaderWriter { /** * ( non - Javadoc )
 * @ see org . springframework . security . web . headers . HeaderWriter # writeHeaders ( javax
 * . servlet . http . HttpServletRequest , javax . servlet . http . HttpServletResponse ) */
public void writeHeaders ( HttpServletRequest request , HttpServletResponse response ) { } }

implementation: if ( this . requestMatcher . matches ( request ) ) { if ( ! response . containsHeader ( HSTS_HEADER_NAME ) ) { response . setHeader ( HSTS_HEADER_NAME , this . hstsHeaderValue ) ; } } else if ( this . logger . isDebugEnabled ( ) ) { this . logger . debug ( "Not injecting HSTS header since it did not match the requestMatcher " + this . requestMatcher ) ; }


signature:
public class SpringWebMvcImportSelector { /** * ( non - Javadoc )
 * @ see org . springframework . context . annotation . ImportSelector # selectImports ( org .
 * springframework . core . type . AnnotationMetadata ) */
public String [ ] selectImports ( AnnotationMetadata importingClassMetadata ) { } }

implementation: boolean webmvcPresent = ClassUtils . isPresent ( "org.springframework.web.servlet.DispatcherServlet" , getClass ( ) . getClassLoader ( ) ) ; return webmvcPresent ? new String [ ] { "org.springframework.security.config.annotation.web.configuration.WebMvcSecurityConfiguration" } : new String [ ] { } ;


signature:
public class ContextPropagatingRemoteInvocation { /** * Invoked on the server - side .
 * The transmitted principal and credentials will be used to create an unauthenticated
 * { @ code Authentication } instance for processing by the { @ code AuthenticationManager } .
 * @ param targetObject the target object to apply the invocation to
 * @ return the invocation result
 * @ throws NoSuchMethodException if the method name could not be resolved
 * @ throws IllegalAccessException if the method could not be accessed
 * @ throws InvocationTargetException if the method invocation resulted in an exception */
public Object invoke ( Object targetObject ) throws NoSuchMethodException , IllegalAccessException , InvocationTargetException { } }

implementation: if ( principal != null ) { Authentication request = createAuthenticationRequest ( principal , credentials ) ; request . setAuthenticated ( false ) ; SecurityContextHolder . getContext ( ) . setAuthentication ( request ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Set SecurityContextHolder to contain: " + request ) ; } } try { return super . invoke ( targetObject ) ; } finally { SecurityContextHolder . clearContext ( ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Cleared SecurityContextHolder." ) ; } }


signature:
public class WebXmlMappableAttributesRetriever { /** * Loads the web . xml file using the configured < tt > ResourceLoader < / tt > and parses the
 * role - name elements from it , using these as the set of < tt > mappableAttributes < / tt > . */
public void afterPropertiesSet ( ) throws Exception { } }

implementation: Resource webXml = resourceLoader . getResource ( "/WEB-INF/web.xml" ) ; Document doc = getDocument ( webXml . getInputStream ( ) ) ; NodeList webApp = doc . getElementsByTagName ( "web-app" ) ; if ( webApp . getLength ( ) != 1 ) { throw new IllegalArgumentException ( "Failed to find 'web-app' element in resource" + webXml ) ; } NodeList securityRoles = ( ( Element ) webApp . item ( 0 ) ) . getElementsByTagName ( "security-role" ) ; ArrayList < String > roleNames = new ArrayList < > ( ) ; for ( int i = 0 ; i < securityRoles . getLength ( ) ; i ++ ) { Element secRoleElt = ( Element ) securityRoles . item ( i ) ; NodeList roles = secRoleElt . getElementsByTagName ( "role-name" ) ; if ( roles . getLength ( ) > 0 ) { String roleName = ( ( Element ) roles . item ( 0 ) ) . getTextContent ( ) . trim ( ) ; roleNames . add ( roleName ) ; logger . info ( "Retrieved role-name '" + roleName + "' from web.xml" ) ; } else { logger . info ( "No security-role elements found in " + webXml ) ; } } mappableAttributes = Collections . unmodifiableSet ( new HashSet < > ( roleNames ) ) ;


signature: public class SidRetrievalStrategyImpl { public List < Sid > getSids ( Authentication authentication ) { } }

implementation: Collection < ? extends GrantedAuthority > authorities = roleHierarchy . getReachableGrantedAuthorities ( authentication . getAuthorities ( ) ) ; List < Sid > sids = new ArrayList < > ( authorities . size ( ) + 1 ) ; sids . add ( new PrincipalSid ( authentication ) ) ; for ( GrantedAuthority authority : authorities ) { sids . add ( new GrantedAuthoritySid ( authority ) ) ; } return sids ;


signature:
public class SecurityJackson2Modules { /** * Creates a TypeResolverBuilder that performs whitelisting .
 * @ return a TypeResolverBuilder that performs whitelisting . */
private static TypeResolverBuilder < ? extends TypeResolverBuilder > createWhitelistedDefaultTyping ( ) { } }

implementation: TypeResolverBuilder < ? extends TypeResolverBuilder > result = new WhitelistTypeResolverBuilder ( ObjectMapper . DefaultTyping . NON_FINAL ) ; result = result . init ( JsonTypeInfo . Id . CLASS , null ) ; result = result . inclusion ( JsonTypeInfo . As . PROPERTY ) ; return result ;


signature:
public class AbstractSecurityWebApplicationInitializer { /** * ( non - Javadoc )
 * @ see org . springframework . web . WebApplicationInitializer # onStartup ( javax . servlet .
 * ServletContext ) */
public final void onStartup ( ServletContext servletContext ) throws ServletException { } }

implementation: beforeSpringSecurityFilterChain ( servletContext ) ; if ( this . configurationClasses != null ) { AnnotationConfigWebApplicationContext rootAppContext = new AnnotationConfigWebApplicationContext ( ) ; rootAppContext . register ( this . configurationClasses ) ; servletContext . addListener ( new ContextLoaderListener ( rootAppContext ) ) ; } if ( enableHttpSessionEventPublisher ( ) ) { servletContext . addListener ( "org.springframework.security.web.session.HttpSessionEventPublisher" ) ; } servletContext . setSessionTrackingModes ( getSessionTrackingModes ( ) ) ; insertSpringSecurityFilterChain ( servletContext ) ; afterSpringSecurityFilterChain ( servletContext ) ;


signature:
public class AbstractSecurityWebApplicationInitializer { /** * Registers the springSecurityFilterChain
 * @ param servletContext the { @ link ServletContext } */
private void insertSpringSecurityFilterChain ( ServletContext servletContext ) { } }

implementation: String filterName = DEFAULT_FILTER_NAME ; DelegatingFilterProxy springSecurityFilterChain = new DelegatingFilterProxy ( filterName ) ; String contextAttribute = getWebApplicationContextAttribute ( ) ; if ( contextAttribute != null ) { springSecurityFilterChain . setContextAttribute ( contextAttribute ) ; } registerFilter ( servletContext , true , filterName , springSecurityFilterChain ) ;


signature:
public class AbstractSecurityWebApplicationInitializer { /** * Registers the provided { @ link Filter } s using default generated names ,
 * { @ link # getSecurityDispatcherTypes ( ) } , and { @ link # isAsyncSecuritySupported ( ) } .
 * @ param servletContext the { @ link ServletContext } to use
 * @ param insertBeforeOtherFilters if true , will insert the provided { @ link Filter } s
 * before other { @ link Filter } s . Otherwise , will insert the { @ link Filter } s after
 * other { @ link Filter } s .
 * @ param filters the { @ link Filter } s to register */
private void registerFilters ( ServletContext servletContext , boolean insertBeforeOtherFilters , Filter ... filters ) { } }

implementation: Assert . notEmpty ( filters , "filters cannot be null or empty" ) ; for ( Filter filter : filters ) { if ( filter == null ) { throw new IllegalArgumentException ( "filters cannot contain null values. Got " + Arrays . asList ( filters ) ) ; } String filterName = Conventions . getVariableName ( filter ) ; registerFilter ( servletContext , insertBeforeOtherFilters , filterName , filter ) ; }


signature:
public class AbstractSecurityWebApplicationInitializer { /** * Registers the provided filter using the { @ link # isAsyncSecuritySupported ( ) } and
 * { @ link # getSecurityDispatcherTypes ( ) } .
 * @ param servletContext
 * @ param insertBeforeOtherFilters should this Filter be inserted before or after
 * other { @ link Filter }
 * @ param filterName
 * @ param filter */
private final void registerFilter ( ServletContext servletContext , boolean insertBeforeOtherFilters , String filterName , Filter filter ) { } }

implementation: Dynamic registration = servletContext . addFilter ( filterName , filter ) ; if ( registration == null ) { throw new IllegalStateException ( "Duplicate Filter registration for '" + filterName + "'. Check to ensure the Filter is only configured once." ) ; } registration . setAsyncSupported ( isAsyncSecuritySupported ( ) ) ; EnumSet < DispatcherType > dispatcherTypes = getSecurityDispatcherTypes ( ) ; registration . addMappingForUrlPatterns ( dispatcherTypes , ! insertBeforeOtherFilters , "/*" ) ;


signature:
public class AbstractSecurityWebApplicationInitializer { /** * Returns the { @ link DelegatingFilterProxy # getContextAttribute ( ) } or null if the
 * parent { @ link ApplicationContext } should be used . The default behavior is to use
 * the parent { @ link ApplicationContext } .
 * If { @ link # getDispatcherWebApplicationContextSuffix ( ) } is non - null the
 * { @ link WebApplicationContext } for the Dispatcher will be used . This means the child
 * { @ link ApplicationContext } is used to look up the springSecurityFilterChain bean .
 * @ return the { @ link DelegatingFilterProxy # getContextAttribute ( ) } or null if the
 * parent { @ link ApplicationContext } should be used */
private String getWebApplicationContextAttribute ( ) { } }

implementation: String dispatcherServletName = getDispatcherWebApplicationContextSuffix ( ) ; if ( dispatcherServletName == null ) { return null ; } return SERVLET_CONTEXT_PREFIX + dispatcherServletName ;


signature:
public class AbstractSecurityWebApplicationInitializer { /** * Get the { @ link DispatcherType } for the springSecurityFilterChain .
 * @ return */
protected EnumSet < DispatcherType > getSecurityDispatcherTypes ( ) { } }

implementation: return EnumSet . of ( DispatcherType . REQUEST , DispatcherType . ERROR , DispatcherType . ASYNC ) ;


signature:
public class JdbcTokenRepositoryImpl { /** * Loads the token data for the supplied series identifier .
 * If an error occurs , it will be reported and null will be returned ( since the result
 * should just be a failed persistent login ) .
 * @ param seriesId
 * @ return the token matching the series , or null if no match found or an exception
 * occurred . */
public PersistentRememberMeToken getTokenForSeries ( String seriesId ) { } }

implementation: try { return getJdbcTemplate ( ) . queryForObject ( tokensBySeriesSql , new RowMapper < PersistentRememberMeToken > ( ) { public PersistentRememberMeToken mapRow ( ResultSet rs , int rowNum ) throws SQLException { return new PersistentRememberMeToken ( rs . getString ( 1 ) , rs . getString ( 2 ) , rs . getString ( 3 ) , rs . getTimestamp ( 4 ) ) ; } } , seriesId ) ; } catch ( EmptyResultDataAccessException zeroResults ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Querying token for series '" + seriesId + "' returned no results." , zeroResults ) ; } } catch ( IncorrectResultSizeDataAccessException moreThanOne ) { logger . error ( "Querying token for series '" + seriesId + "' returned more than one value. Series" + " should be unique" ) ; } catch ( DataAccessException e ) { logger . error ( "Failed to load token for series " + seriesId , e ) ; } return null ;


signature:
public class DefaultPermissionFactory { /** * Registers the public static fields of type { @ link Permission } for a give class .
 * These permissions will be registered under the name of the field . See
 * { @ link BasePermission } for an example .
 * @ param clazz a { @ link Permission } class with public static fields to register */
protected void registerPublicPermissions ( Class < ? extends Permission > clazz ) { } }

implementation:
Assert . notNull ( clazz , "Class required" ) ; Field [ ] fields = clazz . getFields ( ) ; for ( Field field : fields ) { try { Object fieldValue = field . get ( null ) ; if ( Permission . class . isAssignableFrom ( fieldValue . getClass ( ) ) ) { // Found a Permission static field
Permission perm = ( Permission ) fieldValue ; String permissionName = field . getName ( ) ; registerPermission ( perm , permissionName ) ; } } catch ( Exception ignore ) { } }


signature:
public class BearerTokenAuthenticationFilter { /** * Extract any < a href = " https : / / tools . ietf . org / html / rfc6750 # section - 1.2 " target = " _ blank " > Bearer Token < / a > from
 * the request and attempt an authentication .
 * @ param request
 * @ param response
 * @ param filterChain
 * @ throws ServletException
 * @ throws IOException */
@ Override protected void doFilterInternal ( HttpServletRequest request , HttpServletResponse response , FilterChain filterChain ) throws ServletException , IOException { } }

implementation: final boolean debug = this . logger . isDebugEnabled ( ) ; String token ; try { token = this . bearerTokenResolver . resolve ( request ) ; } catch ( OAuth2AuthenticationException invalid ) { this . authenticationEntryPoint . commence ( request , response , invalid ) ; return ; } if ( token == null ) { filterChain . doFilter ( request , response ) ; return ; } BearerTokenAuthenticationToken authenticationRequest = new BearerTokenAuthenticationToken ( token ) ; authenticationRequest . setDetails ( this . authenticationDetailsSource . buildDetails ( request ) ) ; try { AuthenticationManager authenticationManager = this . authenticationManagerResolver . resolve ( request ) ; Authentication authenticationResult = authenticationManager . authenticate ( authenticationRequest ) ; SecurityContext context = SecurityContextHolder . createEmptyContext ( ) ; context . setAuthentication ( authenticationResult ) ; SecurityContextHolder . setContext ( context ) ; filterChain . doFilter ( request , response ) ; } catch ( AuthenticationException failed ) { SecurityContextHolder . clearContext ( ) ; if ( debug ) { this . logger . debug ( "Authentication request for failed: " + failed ) ; } this . authenticationEntryPoint . commence ( request , response , failed ) ; }


signature:
public class SimpleAttributes2GrantedAuthoritiesMapper { /** * Map the given list of string attributes one - to - one to Spring Security
 * GrantedAuthorities . */
public List < GrantedAuthority > getGrantedAuthorities ( Collection < String > attributes ) { } }

implementation: List < GrantedAuthority > result = new ArrayList < > ( attributes . size ( ) ) ; for ( String attribute : attributes ) { result . add ( getGrantedAuthority ( attribute ) ) ; } return result ;


signature:
public class SimpleAttributes2GrantedAuthoritiesMapper { /** * Map the given role one - on - one to a Spring Security GrantedAuthority , optionally
 * doing case conversion and / or adding a prefix .
 * @ param attribute The attribute for which to get a GrantedAuthority
 * @ return GrantedAuthority representing the given role . */
private GrantedAuthority getGrantedAuthority ( String attribute ) { } }

implementation: if ( isConvertAttributeToLowerCase ( ) ) { attribute = attribute . toLowerCase ( Locale . getDefault ( ) ) ; } else if ( isConvertAttributeToUpperCase ( ) ) { attribute = attribute . toUpperCase ( Locale . getDefault ( ) ) ; } if ( isAddPrefixIfAlreadyExisting ( ) || ! attribute . startsWith ( getAttributePrefix ( ) ) ) { return new SimpleGrantedAuthority ( getAttributePrefix ( ) + attribute ) ; } else { return new SimpleGrantedAuthority ( attribute ) ; }


signature:
public class FormLoginConfigurer { /** * If available , initializes the { @ link DefaultLoginPageGeneratingFilter } shared
 * object .
 * @ param http the { @ link HttpSecurityBuilder } to use */
private void initDefaultLoginFilter ( H http ) { } }

implementation: DefaultLoginPageGeneratingFilter loginPageGeneratingFilter = http . getSharedObject ( DefaultLoginPageGeneratingFilter . class ) ; if ( loginPageGeneratingFilter != null && ! isCustomLoginPage ( ) ) { loginPageGeneratingFilter . setFormLoginEnabled ( true ) ; loginPageGeneratingFilter . setUsernameParameter ( getUsernameParameter ( ) ) ; loginPageGeneratingFilter . setPasswordParameter ( getPasswordParameter ( ) ) ; loginPageGeneratingFilter . setLoginPageUrl ( getLoginPage ( ) ) ; loginPageGeneratingFilter . setFailureUrl ( getFailureUrl ( ) ) ; loginPageGeneratingFilter . setAuthenticationUrl ( getLoginProcessingUrl ( ) ) ; }


signature:
public class JwtIssuerValidator { /** * { @ inheritDoc } */
@ Override public OAuth2TokenValidatorResult validate ( Jwt token ) { } }

implementation: Assert . notNull ( token , "token cannot be null" ) ; String tokenIssuer = token . getClaimAsString ( JwtClaimNames . ISS ) ; if ( this . issuer . equals ( tokenIssuer ) ) { return OAuth2TokenValidatorResult . success ( ) ; } else { return OAuth2TokenValidatorResult . failure ( INVALID_ISSUER ) ; }


signature:
public class SessionManagementConfigurer { /** * Setting this attribute will inject the provided invalidSessionStrategy into the
 * { @ link SessionManagementFilter } . When an invalid session ID is submitted , the
 * strategy will be invoked , redirecting to the configured URL .
 * @ param invalidSessionStrategy the strategy to use when an invalid session ID is
 * submitted .
 * @ return the { @ link SessionManagementConfigurer } for further customization */
public SessionManagementConfigurer < H > invalidSessionStrategy ( InvalidSessionStrategy invalidSessionStrategy ) { } }

implementation: Assert . notNull ( invalidSessionStrategy , "invalidSessionStrategy" ) ; this . invalidSessionStrategy = invalidSessionStrategy ; return this ;


signature:
public class SessionManagementConfigurer { /** * Allows specifying the { @ link SessionCreationPolicy }
 * @ param sessionCreationPolicy the { @ link SessionCreationPolicy } to use . Cannot be
 * null .
 * @ return the { @ link SessionManagementConfigurer } for further customizations
 * @ see SessionCreationPolicy
 * @ throws IllegalArgumentException if { @ link SessionCreationPolicy } is null . */
public SessionManagementConfigurer < H > sessionCreationPolicy ( SessionCreationPolicy sessionCreationPolicy ) { } }

implementation: Assert . notNull ( sessionCreationPolicy , "sessionCreationPolicy cannot be null" ) ; this . sessionPolicy = sessionCreationPolicy ; return this ;


signature:
public class SessionManagementConfigurer { /** * Gets the { @ link InvalidSessionStrategy } to use . If null and
 * { @ link # invalidSessionUrl } is not null defaults to
 * { @ link SimpleRedirectInvalidSessionStrategy } .
 * @ return the { @ link InvalidSessionStrategy } to use */
InvalidSessionStrategy getInvalidSessionStrategy ( ) { } }

implementation: if ( this . invalidSessionStrategy != null ) { return this . invalidSessionStrategy ; } if ( this . invalidSessionUrl != null ) { this . invalidSessionStrategy = new SimpleRedirectInvalidSessionStrategy ( this . invalidSessionUrl ) ; } if ( this . invalidSessionUrl == null ) { return null ; } if ( this . invalidSessionStrategy == null ) { this . invalidSessionStrategy = new SimpleRedirectInvalidSessionStrategy ( this . invalidSessionUrl ) ; } return this . invalidSessionStrategy ;


signature:
public class SessionManagementConfigurer { /** * Gets the { @ link SessionCreationPolicy } . Can not be null .
 * @ return the { @ link SessionCreationPolicy } */
SessionCreationPolicy getSessionCreationPolicy ( ) { } }

implementation: if ( this . sessionPolicy != null ) { return this . sessionPolicy ; } SessionCreationPolicy sessionPolicy = getBuilder ( ) . getSharedObject ( SessionCreationPolicy . class ) ; return sessionPolicy == null ? SessionCreationPolicy . IF_REQUIRED : sessionPolicy ;


signature:
public class SessionManagementConfigurer { /** * Returns true if the { @ link SessionCreationPolicy } allows session creation , else
 * false
 * @ return true if the { @ link SessionCreationPolicy } allows session creation */
private boolean isAllowSessionCreation ( ) { } }

implementation: SessionCreationPolicy sessionPolicy = getSessionCreationPolicy ( ) ; return SessionCreationPolicy . ALWAYS == sessionPolicy || SessionCreationPolicy . IF_REQUIRED == sessionPolicy ;


signature:
public class SessionManagementConfigurer { /** * Gets the customized { @ link SessionAuthenticationStrategy } if
 * { @ link # sessionAuthenticationStrategy ( SessionAuthenticationStrategy ) } was
 * specified . Otherwise creates a default { @ link SessionAuthenticationStrategy } .
 * @ return the { @ link SessionAuthenticationStrategy } to use */
private SessionAuthenticationStrategy getSessionAuthenticationStrategy ( H http ) { } }

implementation:
if ( this . sessionAuthenticationStrategy != null ) { return this . sessionAuthenticationStrategy ; } List < SessionAuthenticationStrategy > delegateStrategies = this . sessionAuthenticationStrategies ; SessionAuthenticationStrategy defaultSessionAuthenticationStrategy ; if ( this . providedSessionAuthenticationStrategy == null ) { // If the user did not provide a SessionAuthenticationStrategy
// then default to sessionFixationAuthenticationStrategy
defaultSessionAuthenticationStrategy = postProcess ( this . sessionFixationAuthenticationStrategy ) ; } else { defaultSessionAuthenticationStrategy = this . providedSessionAuthenticationStrategy ; } if ( isConcurrentSessionControlEnabled ( ) ) { SessionRegistry sessionRegistry = getSessionRegistry ( http ) ; ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy = new ConcurrentSessionControlAuthenticationStrategy ( sessionRegistry ) ; concurrentSessionControlStrategy . setMaximumSessions ( this . maximumSessions ) ; concurrentSessionControlStrategy . setExceptionIfMaximumExceeded ( this . maxSessionsPreventsLogin ) ; concurrentSessionControlStrategy = postProcess ( concurrentSessionControlStrategy ) ; RegisterSessionAuthenticationStrategy registerSessionStrategy = new RegisterSessionAuthenticationStrategy ( sessionRegistry ) ; registerSessionStrategy = postProcess ( registerSessionStrategy ) ; delegateStrategies . addAll ( Arrays . asList ( concurrentSessionControlStrategy , defaultSessionAuthenticationStrategy , registerSessionStrategy ) ) ; } else { delegateStrategies . add ( defaultSessionAuthenticationStrategy ) ; } this . sessionAuthenticationStrategy = postProcess ( new CompositeSessionAuthenticationStrategy ( delegateStrategies ) ) ; return this . sessionAuthenticationStrategy ;


signature: public class ServiceProperties { public void afterPropertiesSet ( ) throws Exception { } }

implementation: Assert . hasLength ( this . service , "service cannot be empty." ) ; Assert . hasLength ( this . artifactParameter , "artifactParameter cannot be empty." ) ; Assert . hasLength ( this . serviceParameter , "serviceParameter cannot be empty." ) ;


signature:
public class AbstractAuthenticationProcessingFilter { /** * Invokes the
 * { @ link # requiresAuthentication ( HttpServletRequest , HttpServletResponse )
 * requiresAuthentication } method to determine whether the request is for
 * authentication and should be handled by this filter . If it is an authentication
 * request , the
 * { @ link # attemptAuthentication ( HttpServletRequest , HttpServletResponse )
 * attemptAuthentication } will be invoked to perform the authentication . There are
 * then three possible outcomes :
 * < ol >
 * < li > An < tt > Authentication < / tt > object is returned . The configured
 * { @ link SessionAuthenticationStrategy } will be invoked ( to handle any
 * session - related behaviour such as creating a new session to protect against
 * session - fixation attacks ) followed by the invocation of
 * { @ link # successfulAuthentication ( HttpServletRequest , HttpServletResponse , FilterChain , Authentication ) }
 * method < / li >
 * < li > An < tt > AuthenticationException < / tt > occurs during authentication . The
 * { @ link # unsuccessfulAuthentication ( HttpServletRequest , HttpServletResponse , AuthenticationException )
 * unsuccessfulAuthentication } method will be invoked < / li >
 * < li > Null is returned , indicating that the authentication process is incomplete . The
 * method will then return immediately , assuming that the subclass has done any
 * necessary work ( such as redirects ) to continue the authentication process . The
 * assumption is that a later request will be received by this method where the
 * returned < tt > Authentication < / tt > object is not null .
 * < / ol > */
public void doFilter ( ServletRequest req , ServletResponse res , FilterChain chain ) throws IOException , ServletException { } }

implementation:
HttpServletRequest request = ( HttpServletRequest ) req ; HttpServletResponse response = ( HttpServletResponse ) res ; if ( ! requiresAuthentication ( request , response ) ) { chain . doFilter ( request , response ) ; return ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Request is to process authentication" ) ; } Authentication authResult ; try { authResult = attemptAuthentication ( request , response ) ; if ( authResult == null ) { // return immediately as subclass has indicated that it hasn ' t completed
// authentication
return ; } sessionStrategy . onAuthentication ( authResult , request , response ) ; } catch ( InternalAuthenticationServiceException failed ) { logger . error ( "An internal error occurred while trying to authenticate the user." , failed ) ; unsuccessfulAuthentication ( request , response , failed ) ; return ; } catch ( AuthenticationException failed ) { // Authentication failed
unsuccessfulAuthentication ( request , response , failed ) ; return ; } // Authentication success
if ( continueChainBeforeSuccessfulAuthentication ) { chain . doFilter ( request , response ) ; } successfulAuthentication ( request , response , chain , authResult ) ;


signature:
public class AbstractAuthenticationProcessingFilter { /** * Default behaviour for successful authentication .
 * < ol >
 * < li > Sets the successful < tt > Authentication < / tt > object on the
 * { @ link SecurityContextHolder } < / li >
 * < li > Informs the configured < tt > RememberMeServices < / tt > of the successful login < / li >
 * < li > Fires an { @ link InteractiveAuthenticationSuccessEvent } via the configured
 * < tt > ApplicationEventPublisher < / tt > < / li >
 * < li > Delegates additional behaviour to the { @ link AuthenticationSuccessHandler } . < / li >
 * < / ol >
 * Subclasses can override this method to continue the { @ link FilterChain } after
 * successful authentication .
 * @ param request
 * @ param response
 * @ param chain
 * @ param authResult the object returned from the < tt > attemptAuthentication < / tt >
 * method .
 * @ throws IOException
 * @ throws ServletException */
protected void successfulAuthentication ( HttpServletRequest request , HttpServletResponse response , FilterChain chain , Authentication authResult ) throws IOException , ServletException { } }

implementation:
if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Authentication success. Updating SecurityContextHolder to contain: " + authResult ) ; } SecurityContextHolder . getContext ( ) . setAuthentication ( authResult ) ; rememberMeServices . loginSuccess ( request , response , authResult ) ; // Fire event
if ( this . eventPublisher != null ) { eventPublisher . publishEvent ( new InteractiveAuthenticationSuccessEvent ( authResult , this . getClass ( ) ) ) ; } successHandler . onAuthenticationSuccess ( request , response , authResult ) ;


signature:
public class AbstractAuthenticationProcessingFilter { /** * Default behaviour for unsuccessful authentication .
 * < ol >
 * < li > Clears the { @ link SecurityContextHolder } < / li >
 * < li > Stores the exception in the session ( if it exists or
 * < tt > allowSesssionCreation < / tt > is set to < tt > true < / tt > ) < / li >
 * < li > Informs the configured < tt > RememberMeServices < / tt > of the failed login < / li >
 * < li > Delegates additional behaviour to the { @ link AuthenticationFailureHandler } . < / li >
 * < / ol > */
protected void unsuccessfulAuthentication ( HttpServletRequest request , HttpServletResponse response , AuthenticationException failed ) throws IOException , ServletException { } }

implementation: SecurityContextHolder . clearContext ( ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Authentication request failed: " + failed . toString ( ) , failed ) ; logger . debug ( "Updated SecurityContextHolder to contain null Authentication" ) ; logger . debug ( "Delegating to authentication failure handler " + failureHandler ) ; } rememberMeServices . loginFail ( request , response ) ; failureHandler . onAuthenticationFailure ( request , response , failed ) ;


signature:
public class CsrfBeanDefinitionParser { /** * Populate the AccessDeniedHandler on the { @ link CsrfFilter }
 * @ param invalidSessionStrategy the { @ link InvalidSessionStrategy } to use
 * @ param defaultDeniedHandler the { @ link AccessDeniedHandler } to use */
void initAccessDeniedHandler ( BeanDefinition invalidSessionStrategy , BeanMetadataElement defaultDeniedHandler ) { } }

implementation: BeanMetadataElement accessDeniedHandler = createAccessDeniedHandler ( invalidSessionStrategy , defaultDeniedHandler ) ; this . csrfFilter . getPropertyValues ( ) . addPropertyValue ( "accessDeniedHandler" , accessDeniedHandler ) ;


signature:
public class CsrfBeanDefinitionParser { /** * Creates the { @ link AccessDeniedHandler } from the result of
 * { @ link # getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } and
 * { @ link # getInvalidSessionStrategy ( HttpSecurityBuilder ) } . If
 * { @ link # getInvalidSessionStrategy ( HttpSecurityBuilder ) } is non - null , then a
 * { @ link DelegatingAccessDeniedHandler } is used in combination with
 * { @ link InvalidSessionAccessDeniedHandler } and the
 * { @ link # getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } . Otherwise , only
 * { @ link # getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } is used .
 * @ param invalidSessionStrategy the { @ link InvalidSessionStrategy } to use
 * @ param defaultDeniedHandler the { @ link AccessDeniedHandler } to use
 * @ return the { @ link BeanMetadataElement } that is the { @ link AccessDeniedHandler } to
 * populate on the { @ link CsrfFilter } */
private BeanMetadataElement createAccessDeniedHandler ( BeanDefinition invalidSessionStrategy , BeanMetadataElement defaultDeniedHandler ) { } }

implementation: if ( invalidSessionStrategy == null ) { return defaultDeniedHandler ; } ManagedMap < Class < ? extends AccessDeniedException > , BeanDefinition > handlers = new ManagedMap < Class < ? extends AccessDeniedException > , BeanDefinition > ( ) ; BeanDefinitionBuilder invalidSessionHandlerBldr = BeanDefinitionBuilder . rootBeanDefinition ( InvalidSessionAccessDeniedHandler . class ) ; invalidSessionHandlerBldr . addConstructorArgValue ( invalidSessionStrategy ) ; handlers . put ( MissingCsrfTokenException . class , invalidSessionHandlerBldr . getBeanDefinition ( ) ) ; BeanDefinitionBuilder deniedBldr = BeanDefinitionBuilder . rootBeanDefinition ( DelegatingAccessDeniedHandler . class ) ; deniedBldr . addConstructorArgValue ( handlers ) ; deniedBldr . addConstructorArgValue ( defaultDeniedHandler ) ; return deniedBldr . getBeanDefinition ( ) ;


signature:
public class CipherUtils { /** * Generates a SecretKey . */
public static SecretKey newSecretKey ( String algorithm , String password ) { } }

implementation: return newSecretKey ( algorithm , new PBEKeySpec ( password . toCharArray ( ) ) ) ;


signature:
public class CipherUtils { /** * Generates a SecretKey . */
public static SecretKey newSecretKey ( String algorithm , PBEKeySpec keySpec ) { } }

implementation: try { SecretKeyFactory factory = SecretKeyFactory . getInstance ( algorithm ) ; return factory . generateSecret ( keySpec ) ; } catch ( NoSuchAlgorithmException e ) { throw new IllegalArgumentException ( "Not a valid encryption algorithm" , e ) ; } catch ( InvalidKeySpecException e ) { throw new IllegalArgumentException ( "Not a valid secret key" , e ) ; }


signature:
public class CipherUtils { /** * Constructs a new Cipher . */
public static Cipher newCipher ( String algorithm ) { } }

implementation: try { return Cipher . getInstance ( algorithm ) ; } catch ( NoSuchAlgorithmException e ) { throw new IllegalArgumentException ( "Not a valid encryption algorithm" , e ) ; } catch ( NoSuchPaddingException e ) { throw new IllegalStateException ( "Should not happen" , e ) ; }


signature:
public class CipherUtils { /** * Initializes the Cipher for use . */
public static < T extends AlgorithmParameterSpec > T getParameterSpec ( Cipher cipher , Class < T > parameterSpecClass ) { } }

implementation: try { return cipher . getParameters ( ) . getParameterSpec ( parameterSpecClass ) ; } catch ( InvalidParameterSpecException e ) { throw new IllegalArgumentException ( "Unable to access parameter" , e ) ; }


signature:
public class CipherUtils { /** * Initializes the Cipher for use . */
public static void initCipher ( Cipher cipher , int mode , SecretKey secretKey ) { } }

implementation: initCipher ( cipher , mode , secretKey , null ) ;


signature:
public class CipherUtils { /** * Initializes the Cipher for use . */
public static void initCipher ( Cipher cipher , int mode , SecretKey secretKey , byte [ ] salt , int iterationCount ) { } }

implementation: initCipher ( cipher , mode , secretKey , new PBEParameterSpec ( salt , iterationCount ) ) ;


signature:
public class CipherUtils { /** * Initializes the Cipher for use . */
public static void initCipher ( Cipher cipher , int mode , SecretKey secretKey , AlgorithmParameterSpec parameterSpec ) { } }

implementation: try { if ( parameterSpec != null ) { cipher . init ( mode , secretKey , parameterSpec ) ; } else { cipher . init ( mode , secretKey ) ; } } catch ( InvalidKeyException e ) { throw new IllegalArgumentException ( "Unable to initialize due to invalid secret key" , e ) ; } catch ( InvalidAlgorithmParameterException e ) { throw new IllegalStateException ( "Unable to initialize due to invalid decryption parameter spec" , e ) ; }


signature:
public class CipherUtils { /** * Invokes the Cipher to perform encryption or decryption ( depending on the
 * initialized mode ) . */
public static byte [ ] doFinal ( Cipher cipher , byte [ ] input ) { } }

implementation: try { return cipher . doFinal ( input ) ; } catch ( IllegalBlockSizeException e ) { throw new IllegalStateException ( "Unable to invoke Cipher due to illegal block size" , e ) ; } catch ( BadPaddingException e ) { throw new IllegalStateException ( "Unable to invoke Cipher due to bad padding" , e ) ; }


signature:
public class AbstractPreAuthenticatedProcessingFilter { /** * Check whether all required properties have been set . */
@ Override public void afterPropertiesSet ( ) { } }

implementation:
try { super . afterPropertiesSet ( ) ; } catch ( ServletException e ) { // convert to RuntimeException for passivity on afterPropertiesSet signature
throw new RuntimeException ( e ) ; } Assert . notNull ( authenticationManager , "An AuthenticationManager must be set" ) ;


signature:
public class AbstractPreAuthenticatedProcessingFilter { /** * Try to authenticate a pre - authenticated user with Spring Security if the user has
 * not yet been authenticated . */
public void doFilter ( ServletRequest request , ServletResponse response , FilterChain chain ) throws IOException , ServletException { } }

implementation: if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Checking secure context token: " + SecurityContextHolder . getContext ( ) . getAuthentication ( ) ) ; } if ( requiresAuthentication ( ( HttpServletRequest ) request ) ) { doAuthenticate ( ( HttpServletRequest ) request , ( HttpServletResponse ) response ) ; } chain . doFilter ( request , response ) ;


signature:
public class AbstractPreAuthenticatedProcessingFilter { /** * Determines if the current principal has changed . The default implementation tries
 * < ul >
 * < li > If the { @ link # getPreAuthenticatedPrincipal ( HttpServletRequest ) } is a String , the { @ link Authentication # getName ( ) } is compared against the pre authenticated principal < / li >
 * < li > Otherwise , the { @ link # getPreAuthenticatedPrincipal ( HttpServletRequest ) } is compared against the { @ link Authentication # getPrincipal ( ) }
 * < / ul >
 * Subclasses can override this method to determine when a principal has changed .
 * @ param request
 * @ param currentAuthentication
 * @ return true if the principal has changed , else false */
protected boolean principalChanged ( HttpServletRequest request , Authentication currentAuthentication ) { } }

implementation: Object principal = getPreAuthenticatedPrincipal ( request ) ; if ( ( principal instanceof String ) && currentAuthentication . getName ( ) . equals ( principal ) ) { return false ; } if ( principal != null && principal . equals ( currentAuthentication . getPrincipal ( ) ) ) { return false ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Pre-authenticated principal has changed to " + principal + " and will be reauthenticated" ) ; } return true ;


signature:
public class AbstractPreAuthenticatedProcessingFilter { /** * Do the actual authentication for a pre - authenticated user . */
private void doAuthenticate ( HttpServletRequest request , HttpServletResponse response ) throws IOException , ServletException { } }

implementation: Authentication authResult ; Object principal = getPreAuthenticatedPrincipal ( request ) ; Object credentials = getPreAuthenticatedCredentials ( request ) ; if ( principal == null ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "No pre-authenticated principal found in request" ) ; } return ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "preAuthenticatedPrincipal = " + principal + ", trying to authenticate" ) ; } try { PreAuthenticatedAuthenticationToken authRequest = new PreAuthenticatedAuthenticationToken ( principal , credentials ) ; authRequest . setDetails ( authenticationDetailsSource . buildDetails ( request ) ) ; authResult = authenticationManager . authenticate ( authRequest ) ; successfulAuthentication ( request , response , authResult ) ; } catch ( AuthenticationException failed ) { unsuccessfulAuthentication ( request , response , failed ) ; if ( ! continueFilterChainOnUnsuccessfulAuthentication ) { throw failed ; } }


signature:
public class AbstractPreAuthenticatedProcessingFilter { /** * Puts the < code > Authentication < / code > instance returned by the authentication
 * manager into the secure context . */
protected void successfulAuthentication ( HttpServletRequest request , HttpServletResponse response , Authentication authResult ) throws IOException , ServletException { } }

implementation:
if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Authentication success: " + authResult ) ; } SecurityContextHolder . getContext ( ) . setAuthentication ( authResult ) ; // Fire event
if ( this . eventPublisher != null ) { eventPublisher . publishEvent ( new InteractiveAuthenticationSuccessEvent ( authResult , this . getClass ( ) ) ) ; } if ( authenticationSuccessHandler != null ) { authenticationSuccessHandler . onAuthenticationSuccess ( request , response , authResult ) ; }


signature:
public class AbstractPreAuthenticatedProcessingFilter { /** * Ensures the authentication object in the secure context is set to null when
 * authentication fails .
 * Caches the failure exception as a request attribute */
protected void unsuccessfulAuthentication ( HttpServletRequest request , HttpServletResponse response , AuthenticationException failed ) throws IOException , ServletException { } }

implementation: SecurityContextHolder . clearContext ( ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Cleared security context due to exception" , failed ) ; } request . setAttribute ( WebAttributes . AUTHENTICATION_EXCEPTION , failed ) ; if ( authenticationFailureHandler != null ) { authenticationFailureHandler . onAuthenticationFailure ( request , response , failed ) ; }


signature:
public class OnCommittedResponseWrapper { /** * Makes sure { @ link OnCommittedResponseWrapper # onResponseCommitted ( ) } is invoked
 * before calling the superclass < code > sendError ( ) < / code > */
@ Override public final void sendError ( int sc , String msg ) throws IOException { } }

implementation: doOnResponseCommitted ( ) ; super . sendError ( sc , msg ) ;


signature:
public class OnCommittedResponseWrapper { /** * Adds the contentLengthToWrite to the total contentWritten size and checks to see if
 * the response should be written .
 * @ param contentLengthToWrite the size of the content that is about to be written . */
private void checkContentLength ( long contentLengthToWrite ) { } }

implementation: this . contentWritten += contentLengthToWrite ; boolean isBodyFullyWritten = this . contentLength > 0 && this . contentWritten >= this . contentLength ; int bufferSize = getBufferSize ( ) ; boolean requiresFlush = bufferSize > 0 && this . contentWritten >= bufferSize ; if ( isBodyFullyWritten || requiresFlush ) { doOnResponseCommitted ( ) ; }


signature:
public class ExpressionBasedAnnotationAttributeFactory { /** * Delay the lookup of the { @ link ExpressionParser } to prevent SEC - 2136
 * @ return */
private ExpressionParser getParser ( ) { } }

implementation: if ( this . parser != null ) { return this . parser ; } synchronized ( parserLock ) { this . parser = handler . getExpressionParser ( ) ; this . handler = null ; } return this . parser ;


signature:
public class StrictHttpFirewall { /** * Determines which HTTP methods should be allowed . The default is to allow " DELETE " , " GET " , " HEAD " , " OPTIONS " ,
 * " PATCH " , " POST " , and " PUT " .
 * @ param allowedHttpMethods the case - sensitive collection of HTTP methods that are allowed .
 * @ see # setUnsafeAllowAnyHttpMethod ( boolean )
 * @ since 5.1 */
public void setAllowedHttpMethods ( Collection < String > allowedHttpMethods ) { } }

implementation: if ( allowedHttpMethods == null ) { throw new IllegalArgumentException ( "allowedHttpMethods cannot be null" ) ; } if ( allowedHttpMethods == ALLOW_ANY_HTTP_METHOD ) { this . allowedHttpMethods = ALLOW_ANY_HTTP_METHOD ; } else { this . allowedHttpMethods = new HashSet < > ( allowedHttpMethods ) ; }


signature:
public class StrictHttpFirewall { /** * Determines if a percent " % " that is URL encoded " % 25 " should be allowed in the path
 * or not . The default is not to allow this behavior because it is a frequent source
 * of security exploits .
 * For example , this can lead to exploits that involve double URL encoding that lead
 * to bypassing security constraints .
 * @ param allowUrlEncodedPercent if a percent " % " that is URL encoded " % 25 " should be
 * allowed in the path or not . Default is false */
public void setAllowUrlEncodedPercent ( boolean allowUrlEncodedPercent ) { } }

implementation: if ( allowUrlEncodedPercent ) { this . encodedUrlBlacklist . remove ( ENCODED_PERCENT ) ; this . decodedUrlBlacklist . remove ( PERCENT ) ; } else { this . encodedUrlBlacklist . add ( ENCODED_PERCENT ) ; this . decodedUrlBlacklist . add ( PERCENT ) ; }


signature:
public class SimpleAuthorityMapper { /** * Creates a mapping of the supplied authorities based on the case - conversion and
 * prefix settings . The mapping will be one - to - one unless duplicates are produced
 * during the conversion . If a default authority has been set , this will also be
 * assigned to each mapping .
 * @ param authorities the original authorities
 * @ return the converted set of authorities */
public Set < GrantedAuthority > mapAuthorities ( Collection < ? extends GrantedAuthority > authorities ) { } }

implementation: HashSet < GrantedAuthority > mapped = new HashSet < > ( authorities . size ( ) ) ; for ( GrantedAuthority authority : authorities ) { mapped . add ( mapAuthority ( authority . getAuthority ( ) ) ) ; } if ( defaultAuthority != null ) { mapped . add ( defaultAuthority ) ; } return mapped ;


signature:
public class AbstractAuthenticationFilterConfigurer { /** * Specifies where users will go after authenticating successfully if they have not
 * visited a secured page prior to authenticating or { @ code alwaysUse } is true . This
 * is a shortcut for calling { @ link # successHandler ( AuthenticationSuccessHandler ) } .
 * @ param defaultSuccessUrl the default success url
 * @ param alwaysUse true if the { @ code defaultSuccesUrl } should be used after
 * authentication despite if a protected page had been previously visited
 * @ return the { @ link FormLoginConfigurer } for additional customization */
public final T defaultSuccessUrl ( String defaultSuccessUrl , boolean alwaysUse ) { } }

implementation: SavedRequestAwareAuthenticationSuccessHandler handler = new SavedRequestAwareAuthenticationSuccessHandler ( ) ; handler . setDefaultTargetUrl ( defaultSuccessUrl ) ; handler . setAlwaysUseDefaultTargetUrl ( alwaysUse ) ; this . defaultSuccessHandler = handler ; return successHandler ( handler ) ;


signature:
public class AbstractAuthenticationFilterConfigurer { /** * Specifies the URL to validate the credentials .
 * @ param loginProcessingUrl the URL to validate username and password
 * @ return the { @ link FormLoginConfigurer } for additional customization */
public T loginProcessingUrl ( String loginProcessingUrl ) { } }

implementation: this . loginProcessingUrl = loginProcessingUrl ; authFilter . setRequiresAuthenticationRequestMatcher ( createLoginProcessingUrlMatcher ( loginProcessingUrl ) ) ; return getSelf ( ) ;


signature:
public class AbstractAuthenticationFilterConfigurer { /** * The URL to send users if authentication fails . This is a shortcut for invoking
 * { @ link # failureHandler ( AuthenticationFailureHandler ) } . The default is
 * " / login ? error " .
 * @ param authenticationFailureUrl the URL to send users if authentication fails ( i . e .
 * " / login ? error " ) .
 * @ return the { @ link FormLoginConfigurer } for additional customization */
public final T failureUrl ( String authenticationFailureUrl ) { } }

implementation: T result = failureHandler ( new SimpleUrlAuthenticationFailureHandler ( authenticationFailureUrl ) ) ; this . failureUrl = authenticationFailureUrl ; return result ;


signature:
public class AbstractAuthenticationFilterConfigurer { /** * Specifies the URL to send users to if login is required . If used with
 * { @ link WebSecurityConfigurerAdapter } a default login page will be generated when
 * this attribute is not specified .
 * If a URL is specified or this is not being used in conjuction with
 * { @ link WebSecurityConfigurerAdapter } , users are required to process the specified
 * URL to generate a login page . */
protected T loginPage ( String loginPage ) { } }

implementation: setLoginPage ( loginPage ) ; updateAuthenticationDefaults ( ) ; this . customLoginPage = true ; return getSelf ( ) ;


signature:
public class AbstractAuthenticationFilterConfigurer { /** * Updates the default values for authentication .
 * @ throws Exception */
protected final void updateAuthenticationDefaults ( ) { } }

implementation: if ( loginProcessingUrl == null ) { loginProcessingUrl ( loginPage ) ; } if ( failureHandler == null ) { failureUrl ( loginPage + "?error" ) ; } final LogoutConfigurer < B > logoutConfigurer = getBuilder ( ) . getConfigurer ( LogoutConfigurer . class ) ; if ( logoutConfigurer != null && ! logoutConfigurer . isCustomLogoutSuccess ( ) ) { logoutConfigurer . logoutSuccessUrl ( loginPage + "?logout" ) ; }


signature:
public class AbstractAuthenticationFilterConfigurer { /** * Updates the default values for access . */
protected final void updateAccessDefaults ( B http ) { } }

implementation: if ( permitAll ) { PermitAllSupport . permitAll ( http , loginPage , loginProcessingUrl , failureUrl ) ; }


signature:
public class OAuth2LoginConfigurer { /** * Sets the repository of client registrations .
 * @ param clientRegistrationRepository the repository of client registrations
 * @ return the { @ link OAuth2LoginConfigurer } for further configuration */
public OAuth2LoginConfigurer < B > clientRegistrationRepository ( ClientRegistrationRepository clientRegistrationRepository ) { } }

implementation: Assert . notNull ( clientRegistrationRepository , "clientRegistrationRepository cannot be null" ) ; this . getBuilder ( ) . setSharedObject ( ClientRegistrationRepository . class , clientRegistrationRepository ) ; return this ;


signature:
public class OAuth2LoginConfigurer { /** * Sets the repository for authorized client ( s ) .
 * @ since 5.1
 * @ param authorizedClientRepository the authorized client repository
 * @ return the { @ link OAuth2LoginConfigurer } for further configuration */
public OAuth2LoginConfigurer < B > authorizedClientRepository ( OAuth2AuthorizedClientRepository authorizedClientRepository ) { } }

implementation: Assert . notNull ( authorizedClientRepository , "authorizedClientRepository cannot be null" ) ; this . getBuilder ( ) . setSharedObject ( OAuth2AuthorizedClientRepository . class , authorizedClientRepository ) ; return this ;


signature:
public class OAuth2LoginConfigurer { /** * Sets the service for authorized client ( s ) .
 * @ param authorizedClientService the authorized client service
 * @ return the { @ link OAuth2LoginConfigurer } for further configuration */
public OAuth2LoginConfigurer < B > authorizedClientService ( OAuth2AuthorizedClientService authorizedClientService ) { } }

implementation: Assert . notNull ( authorizedClientService , "authorizedClientService cannot be null" ) ; this . authorizedClientRepository ( new AuthenticatedPrincipalOAuth2AuthorizedClientRepository ( authorizedClientService ) ) ; return this ;


signature:
public class ExpressionUrlAuthorizationConfigurer { /** * Allows registering multiple { @ link RequestMatcher } instances to a collection of
 * { @ link ConfigAttribute } instances
 * @ param requestMatchers the { @ link RequestMatcher } instances to register to the
 * { @ link ConfigAttribute } instances
 * @ param configAttributes the { @ link ConfigAttribute } to be mapped by the
 * { @ link RequestMatcher } instances */
private void interceptUrl ( Iterable < ? extends RequestMatcher > requestMatchers , Collection < ConfigAttribute > configAttributes ) { } }

implementation: for ( RequestMatcher requestMatcher : requestMatchers ) { REGISTRY . addMapping ( new AbstractConfigAttributeRequestMatcherRegistry . UrlMapping ( requestMatcher , configAttributes ) ) ; }


signature:
public class JwtTimestampValidator { /** * { @ inheritDoc } */
@ Override public OAuth2TokenValidatorResult validate ( Jwt jwt ) { } }

implementation: Assert . notNull ( jwt , "jwt cannot be null" ) ; Instant expiry = jwt . getExpiresAt ( ) ; if ( expiry != null ) { if ( Instant . now ( this . clock ) . minus ( clockSkew ) . isAfter ( expiry ) ) { OAuth2Error error = new OAuth2Error ( OAuth2ErrorCodes . INVALID_REQUEST , String . format ( "Jwt expired at %s" , jwt . getExpiresAt ( ) ) , "https://tools.ietf.org/html/rfc6750#section-3.1" ) ; return OAuth2TokenValidatorResult . failure ( error ) ; } } Instant notBefore = jwt . getNotBefore ( ) ; if ( notBefore != null ) { if ( Instant . now ( this . clock ) . plus ( clockSkew ) . isBefore ( notBefore ) ) { OAuth2Error error = new OAuth2Error ( OAuth2ErrorCodes . INVALID_REQUEST , String . format ( "Jwt used before %s" , jwt . getNotBefore ( ) ) , "https://tools.ietf.org/html/rfc6750#section-3.1" ) ; return OAuth2TokenValidatorResult . failure ( error ) ; } } return OAuth2TokenValidatorResult . success ( ) ;


signature:
public class GlobalMethodSecurityAspectJAutoProxyRegistrar { /** * Register , escalate , and configure the AspectJ auto proxy creator based on the value
 * of the @ { @ link EnableGlobalMethodSecurity # proxyTargetClass ( ) } attribute on the
 * importing { @ code @ Configuration } class . */
public void registerBeanDefinitions ( AnnotationMetadata importingClassMetadata , BeanDefinitionRegistry registry ) { } }

implementation: BeanDefinition interceptor = registry . getBeanDefinition ( "methodSecurityInterceptor" ) ; BeanDefinitionBuilder aspect = BeanDefinitionBuilder . rootBeanDefinition ( "org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect" ) ; aspect . setFactoryMethod ( "aspectOf" ) ; aspect . setRole ( BeanDefinition . ROLE_INFRASTRUCTURE ) ; aspect . addPropertyValue ( "securityInterceptor" , interceptor ) ; registry . registerBeanDefinition ( "annotationSecurityAspect$0" , aspect . getBeanDefinition ( ) ) ;


signature: public class LdapUserDetailsMapper { @ Override public UserDetails mapUserFromContext ( DirContextOperations ctx , String username , Collection < ? extends GrantedAuthority > authorities ) { } }

implementation:
String dn = ctx . getNameInNamespace ( ) ; this . logger . debug ( "Mapping user details from context with DN: " + dn ) ; LdapUserDetailsImpl . Essence essence = new LdapUserDetailsImpl . Essence ( ) ; essence . setDn ( dn ) ; Object passwordValue = ctx . getObjectAttribute ( this . passwordAttributeName ) ; if ( passwordValue != null ) { essence . setPassword ( mapPassword ( passwordValue ) ) ; } essence . setUsername ( username ) ; // Map the roles
for ( int i = 0 ; ( this . roleAttributes != null ) && ( i < this . roleAttributes . length ) ; i ++ ) { String [ ] rolesForAttribute = ctx . getStringAttributes ( this . roleAttributes [ i ] ) ; if ( rolesForAttribute == null ) { this . logger . debug ( "Couldn't read role attribute '" + this . roleAttributes [ i ] + "' for user " + dn ) ; continue ; } for ( String role : rolesForAttribute ) { GrantedAuthority authority = createAuthority ( role ) ; if ( authority != null ) { essence . addAuthority ( authority ) ; } } } // Add the supplied authorities
for ( GrantedAuthority authority : authorities ) { essence . addAuthority ( authority ) ; } // Check for PPolicy data
PasswordPolicyResponseControl ppolicy = ( PasswordPolicyResponseControl ) ctx . getObjectAttribute ( PasswordPolicyControl . OID ) ; if ( ppolicy != null ) { essence . setTimeBeforeExpiration ( ppolicy . getTimeBeforeExpiration ( ) ) ; essence . setGraceLoginsRemaining ( ppolicy . getGraceLoginsRemaining ( ) ) ; } return essence . createUserDetails ( ) ;


signature:
public class LdapUserDetailsMapper { /** * Extension point to allow customized creation of the user ' s password from the
 * attribute stored in the directory .
 * @ param passwordValue the value of the password attribute
 * @ return a String representation of the password . */
protected String mapPassword ( Object passwordValue ) { } }

implementation:
if ( ! ( passwordValue instanceof String ) ) { // Assume it ' s binary
passwordValue = new String ( ( byte [ ] ) passwordValue ) ; } return ( String ) passwordValue ;


signature:
public class LdapUserDetailsMapper { /** * Creates a GrantedAuthority from a role attribute . Override to customize authority
 * object creation .
 * The default implementation converts string attributes to roles , making use of the
 * < tt > rolePrefix < / tt > and < tt > convertToUpperCase < / tt > properties . Non - String
 * attributes are ignored .
 * @ param role the attribute returned from
 * @ return the authority to be added to the list of authorities for the user , or null
 * if this attribute should be ignored . */
protected GrantedAuthority createAuthority ( Object role ) { } }

implementation: if ( role instanceof String ) { if ( this . convertToUpperCase ) { role = ( ( String ) role ) . toUpperCase ( ) ; } return new SimpleGrantedAuthority ( this . rolePrefix + role ) ; } return null ;


signature:
public class NimbusJwtDecoderJwkSupport { /** * Use this { @ link Jwt } Validator
 * @ param jwtValidator - the Jwt Validator to use */
public void setJwtValidator ( OAuth2TokenValidator < Jwt > jwtValidator ) { } }

implementation: Assert . notNull ( jwtValidator , "jwtValidator cannot be null" ) ; this . jwtValidator = jwtValidator ; this . delegate . setJwtValidator ( jwtValidator ) ;


signature:
public class NimbusJwtDecoderJwkSupport { /** * Sets the { @ link RestOperations } used when requesting the JSON Web Key ( JWK ) Set .
 * @ since 5.1
 * @ param restOperations the { @ link RestOperations } used when requesting the JSON Web Key ( JWK ) Set */
public final void setRestOperations ( RestOperations restOperations ) { } }

implementation: Assert . notNull ( restOperations , "restOperations cannot be null" ) ; this . jwtDecoderBuilder = this . jwtDecoderBuilder . restOperations ( restOperations ) ; this . delegate = makeDelegate ( ) ;