Skip to content

Commit 638b193

Browse files
authored
dubbo-security Jackson error (apache#11622)
1 parent e7925ce commit 638b193

File tree

12 files changed

+314
-74
lines changed

12 files changed

+314
-74
lines changed

dubbo-distribution/dubbo-all/pom.xml

+8
Original file line numberDiff line numberDiff line change
@@ -1256,6 +1256,14 @@
12561256
META-INF/dubbo/internal/org.apache.dubbo.metrics.collector.MetricsCollector
12571257
</resource>
12581258
</transformer>
1259+
1260+
<transformer
1261+
implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
1262+
<resource>
1263+
META-INF/dubbo/internal/org.apache.dubbo.spring.security.jackson.ObjectMapperCodecCustomer
1264+
</resource>
1265+
</transformer>
1266+
12591267
</transformers>
12601268
<filters>
12611269
<filter>

dubbo-plugin/dubbo-spring-security/pom.xml

+13
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@
5757
<groupId>org.springframework.security</groupId>
5858
<artifactId>spring-security-core</artifactId>
5959
</dependency>
60+
61+
<dependency>
62+
<groupId>org.springframework.security</groupId>
63+
<artifactId>spring-security-oauth2-client</artifactId>
64+
<optional>true</optional>
65+
<scope>test</scope>
66+
</dependency>
67+
6068
<!-- spring security -->
6169

6270
<!-- jackson -->
@@ -65,6 +73,11 @@
6573
<artifactId>jackson-core</artifactId>
6674
</dependency>
6775

76+
<dependency>
77+
<groupId> com.fasterxml.jackson.datatype</groupId>
78+
<artifactId>jackson-datatype-jsr310</artifactId>
79+
</dependency>
80+
6881
<dependency>
6982
<groupId>com.fasterxml.jackson.core</groupId>
7083
<artifactId>jackson-databind</artifactId>

dubbo-plugin/dubbo-spring-security/src/main/java/org/apache/dubbo/spring/security/filter/AuthenticationExceptionTranslatorFilter.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
import org.apache.dubbo.rpc.RpcException;
2727
import org.springframework.security.access.AccessDeniedException;
2828
import org.springframework.security.core.AuthenticationException;
29-
import static org.apache.dubbo.rpc.RpcException.FORBIDDEN_EXCEPTION;
29+
import static org.apache.dubbo.rpc.RpcException.AUTHORIZATION_EXCEPTION;
3030
import static org.apache.dubbo.spring.security.utils.SecurityNames.SECURITY_CONTEXT_HOLDER_CLASS_NAME;
3131

3232
@Activate(group = CommonConstants.PROVIDER, order =Integer.MAX_VALUE,onClass = SECURITY_CONTEXT_HOLDER_CLASS_NAME)
@@ -43,7 +43,7 @@ public void onResponse(Result result, Invoker<?> invoker, Invocation invocation)
4343
if (this.isTranslate(result)) {
4444
RpcException rpcException = new RpcException(result.getException().getMessage());
4545

46-
rpcException.setCode(FORBIDDEN_EXCEPTION);
46+
rpcException.setCode(AUTHORIZATION_EXCEPTION);
4747

4848
result.setException(rpcException);
4949
}

dubbo-plugin/dubbo-spring-security/src/main/java/org/apache/dubbo/spring/security/filter/ContextHolderAuthenticationPrepareFilter.java

+8-3
Original file line numberDiff line numberDiff line change
@@ -23,17 +23,22 @@
2323
import org.apache.dubbo.rpc.Result;
2424
import org.apache.dubbo.rpc.RpcException;
2525
import org.apache.dubbo.rpc.cluster.filter.ClusterFilter;
26-
import org.apache.dubbo.spring.security.utils.ObjectMapperCodec;
26+
import org.apache.dubbo.rpc.model.ApplicationModel;
27+
import org.apache.dubbo.spring.security.jackson.ObjectMapperCodec;
2728
import org.apache.dubbo.spring.security.utils.SecurityNames;
2829
import org.springframework.security.core.Authentication;
2930
import org.springframework.security.core.context.SecurityContext;
3031
import org.springframework.security.core.context.SecurityContextHolder;
3132
import static org.apache.dubbo.spring.security.utils.SecurityNames.SECURITY_CONTEXT_HOLDER_CLASS_NAME;
3233

3334
@Activate(group = CommonConstants.CONSUMER, order = -10000,onClass = SECURITY_CONTEXT_HOLDER_CLASS_NAME)
34-
public class ContextHolderAuthenticationPrepareFilter implements ClusterFilter {
35+
public class ContextHolderAuthenticationPrepareFilter implements ClusterFilter{
3536

36-
private ObjectMapperCodec mapper = new ObjectMapperCodec();
37+
private final ObjectMapperCodec mapper;
38+
39+
public ContextHolderAuthenticationPrepareFilter(ApplicationModel applicationModel) {
40+
this.mapper = applicationModel.getBeanFactory().getBean(ObjectMapperCodec.class);
41+
}
3742

3843
@Override
3944
public Result invoke(Invoker<?> invoker, Invocation invocation) throws RpcException {

dubbo-plugin/dubbo-spring-security/src/main/java/org/apache/dubbo/spring/security/filter/ContextHolderAuthenticationResolverFilter.java

+7-3
Original file line numberDiff line numberDiff line change
@@ -24,17 +24,21 @@
2424
import org.apache.dubbo.rpc.Invoker;
2525
import org.apache.dubbo.rpc.Result;
2626
import org.apache.dubbo.rpc.RpcException;
27-
import org.apache.dubbo.spring.security.utils.ObjectMapperCodec;
27+
import org.apache.dubbo.rpc.model.ApplicationModel;
28+
import org.apache.dubbo.spring.security.jackson.ObjectMapperCodec;
2829
import org.apache.dubbo.spring.security.utils.SecurityNames;
2930
import org.springframework.security.core.Authentication;
3031
import org.springframework.security.core.context.SecurityContextHolder;
31-
3232
import static org.apache.dubbo.spring.security.utils.SecurityNames.SECURITY_CONTEXT_HOLDER_CLASS_NAME;
3333

3434
@Activate(group = CommonConstants.PROVIDER, order = -10000,onClass = SECURITY_CONTEXT_HOLDER_CLASS_NAME)
3535
public class ContextHolderAuthenticationResolverFilter implements Filter {
3636

37-
private ObjectMapperCodec mapper = new ObjectMapperCodec();
37+
private final ObjectMapperCodec mapper;
38+
39+
public ContextHolderAuthenticationResolverFilter(ApplicationModel applicationModel) {
40+
this.mapper = applicationModel.getBeanFactory().getBean(ObjectMapperCodec.class);
41+
}
3842

3943
@Override
4044
public Result invoke(Invoker<?> invoker, Invocation invocation) throws RpcException {
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
package org.apache.dubbo.spring.security.jackson;
19+
20+
import com.fasterxml.jackson.databind.ObjectMapper;
21+
import com.fasterxml.jackson.databind.module.SimpleModule;
22+
import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
23+
import org.apache.dubbo.common.utils.ClassUtils;
24+
import org.apache.dubbo.common.utils.StringUtils;
25+
import org.springframework.security.jackson2.CoreJackson2Module;
26+
27+
import java.util.ArrayList;
28+
import java.util.List;
29+
import java.util.function.Consumer;
30+
31+
public class ObjectMapperCodec {
32+
33+
private ObjectMapper mapper = new ObjectMapper();
34+
35+
public ObjectMapperCodec() {
36+
registerDefaultModule();
37+
}
38+
39+
public <T> T deserialize(byte[] bytes, Class<T> clazz) {
40+
try {
41+
42+
if (bytes == null || bytes.length == 0) {
43+
return null;
44+
}
45+
46+
return mapper.readValue(bytes, clazz);
47+
48+
} catch (Exception exception) {
49+
throw new RuntimeException(
50+
String.format("objectMapper! deserialize error %s", exception));
51+
}
52+
}
53+
54+
public <T> T deserialize(String content, Class<T> clazz) {
55+
if (StringUtils.isBlank(content)) {
56+
return null;
57+
}
58+
return deserialize(content.getBytes(), clazz);
59+
}
60+
61+
public String serialize(Object object) {
62+
try {
63+
64+
if (object == null) {
65+
return null;
66+
}
67+
68+
return mapper.writeValueAsString(object);
69+
70+
} catch (Exception ex) {
71+
throw new RuntimeException(String.format("objectMapper! serialize error %s", ex));
72+
}
73+
}
74+
75+
public ObjectMapperCodec addModule(SimpleModule simpleModule) {
76+
mapper.registerModule(simpleModule);
77+
return this;
78+
}
79+
80+
public ObjectMapperCodec configureMapper(Consumer<ObjectMapper> objectMapperConfigure) {
81+
objectMapperConfigure.accept(this.mapper);
82+
return this;
83+
}
84+
85+
private void registerDefaultModule() {
86+
mapper.registerModule(new CoreJackson2Module());
87+
mapper.registerModule(new JavaTimeModule());
88+
89+
List<String> jacksonModuleClassNameList = new ArrayList<>();
90+
jacksonModuleClassNameList.add("org.springframework.security.oauth2.server.authorization.jackson2.OAuth2AuthorizationServerJackson2Module");
91+
jacksonModuleClassNameList.add("org.springframework.security.oauth2.client.jackson2.OAuth2ClientJackson2Module");
92+
jacksonModuleClassNameList.add("org.springframework.security.web.server.jackson2.WebServerJackson2Module");
93+
jacksonModuleClassNameList.add("com.fasterxml.jackson.module.paramnames.ParameterNamesModule");
94+
jacksonModuleClassNameList.add("org.springframework.security.web.jackson2.WebServletJackson2Module");
95+
jacksonModuleClassNameList.add("org.springframework.security.web.jackson2.WebJackson2Module");
96+
jacksonModuleClassNameList.add("org.springframework.boot.jackson.JsonMixinModule");
97+
jacksonModuleClassNameList.add("org.springframework.security.ldap.jackson2.LdapJackson2Module");
98+
loadModuleIfPresent(jacksonModuleClassNameList);
99+
100+
}
101+
102+
private void loadModuleIfPresent(List<String> jacksonModuleClassNameList) {
103+
for (String moduleClassName : jacksonModuleClassNameList) {
104+
try {
105+
SimpleModule objectMapperModule = (SimpleModule) ClassUtils.forName(moduleClassName,
106+
ObjectMapperCodec.class.getClassLoader()).newInstance();
107+
mapper.registerModule(objectMapperModule);
108+
109+
} catch (Throwable ex) {
110+
}
111+
}
112+
}
113+
114+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
package org.apache.dubbo.spring.security.jackson;
19+
import org.apache.dubbo.common.extension.ExtensionScope;
20+
import org.apache.dubbo.common.extension.SPI;
21+
22+
@SPI(scope = ExtensionScope.FRAMEWORK)
23+
public interface ObjectMapperCodecCustomer {
24+
25+
void customize(ObjectMapperCodec objectMapperCodec);
26+
27+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
package org.apache.dubbo.spring.security.model;
19+
20+
import org.apache.dubbo.common.beans.factory.ScopeBeanFactory;
21+
import org.apache.dubbo.common.extension.Activate;
22+
import org.apache.dubbo.rpc.model.ApplicationModel;
23+
import org.apache.dubbo.rpc.model.FrameworkModel;
24+
import org.apache.dubbo.rpc.model.ModuleModel;
25+
import org.apache.dubbo.rpc.model.ScopeModelInitializer;
26+
import org.apache.dubbo.spring.security.jackson.ObjectMapperCodec;
27+
import org.apache.dubbo.spring.security.jackson.ObjectMapperCodecCustomer;
28+
import java.util.Set;
29+
import static org.apache.dubbo.spring.security.utils.SecurityNames.SECURITY_CONTEXT_HOLDER_CLASS_NAME;
30+
31+
@Activate(onClass = SECURITY_CONTEXT_HOLDER_CLASS_NAME)
32+
public class SecurityScopeModelInitializer implements ScopeModelInitializer {
33+
34+
@Override
35+
public void initializeFrameworkModel(FrameworkModel frameworkModel) {
36+
ScopeBeanFactory beanFactory = frameworkModel.getBeanFactory();
37+
38+
ObjectMapperCodec objectMapperCodec = beanFactory.getOrRegisterBean(ObjectMapperCodec.class);
39+
40+
Set<ObjectMapperCodecCustomer> objectMapperCodecCustomerList = frameworkModel.getExtensionLoader(ObjectMapperCodecCustomer.class).getSupportedExtensionInstances();
41+
42+
for (ObjectMapperCodecCustomer objectMapperCodecCustomer : objectMapperCodecCustomerList) {
43+
objectMapperCodecCustomer.customize(objectMapperCodec);
44+
}
45+
}
46+
47+
@Override
48+
public void initializeApplicationModel(ApplicationModel applicationModel) {
49+
}
50+
51+
@Override
52+
public void initializeModuleModel(ModuleModel moduleModel) {
53+
54+
55+
}
56+
57+
}

dubbo-plugin/dubbo-spring-security/src/main/java/org/apache/dubbo/spring/security/utils/ObjectMapperCodec.java

-66
This file was deleted.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
securityApplicationScopeModelInitializer = org.apache.dubbo.spring.security.model.SecurityScopeModelInitializer

0 commit comments

Comments
 (0)