Skip to content

Commit 0357cc6

Browse files
basilbasil
authored
Migrate from Acegi to Spring Security (#253)
1 parent e5face7 commit 0357cc6

File tree

8 files changed

+64
-74
lines changed

8 files changed

+64
-74
lines changed

‎src/main/java/hudson/plugins/copyartifact/CopyArtifact.java‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -94,9 +94,9 @@
9494
import jenkins.model.Jenkins;
9595

9696
import jenkins.tasks.SimpleBuildStep;
97-
import org.acegisecurity.Authentication;
98-
import org.acegisecurity.GrantedAuthority;
99-
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
97+
import org.springframework.security.core.Authentication;
98+
import org.springframework.security.core.GrantedAuthority;
99+
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
100100
import org.apache.commons.lang.StringUtils;
101101
import org.jenkinsci.Symbol;
102102
import org.kohsuke.stapler.AncestorInPath;
@@ -126,7 +126,7 @@ public class CopyArtifact extends Builder implements SimpleBuildStep {
126126
private static final Authentication AUTHENTICATED_ANONYMOUS = new UsernamePasswordAuthenticationToken(
127127
"authenticated",
128128
"",
129-
new GrantedAuthority[]{ SecurityRealm.AUTHENTICATED_AUTHORITY }
129+
List.of(SecurityRealm.AUTHENTICATED_AUTHORITY2)
130130
);
131131

132132
@Deprecated private transient String projectName;
@@ -464,7 +464,7 @@ public void perform(@NonNull Run<?, ?> build, @NonNull FilePath workspace, @NonN
464464

465465
Date buildStartedAt = new Date(build.getStartTimeInMillis());
466466
// will be System if there is no QueueItemAuthenticator
467-
String currentUserName = Jenkins.getAuthentication().getName();
467+
String currentUserName = Jenkins.getAuthentication2().getName();
468468
LegacyJobConfigMigrationMonitor.get().addLegacyJob(build.getParent(), job, buildStartedAt, currentUserName);
469469

470470
// but let the process goes on
@@ -581,8 +581,8 @@ private boolean canReadFrom(Job<?, ?> job, Run<?, ?> build) {
581581
Job<?, ?> fromJob = job;
582582
Job<?, ?> toJob = build.getParent();
583583

584-
Authentication a = Jenkins.getAuthentication();
585-
if (!ACL.SYSTEM.equals(a)) {
584+
Authentication a = Jenkins.getAuthentication2();
585+
if (!ACL.SYSTEM2.equals(a)) {
586586
// if the build does not run on SYSTEM authorization,
587587
// Jenkins is configured to use QueueItemAuthenticator.
588588
// In this case, the permission is already checked by Jenkins
@@ -603,7 +603,7 @@ private boolean canReadFrom(Job<?, ?> job, Run<?, ?> build) {
603603
}
604604

605605
// Test the permission as an anonymous authenticated user.
606-
if (fromJob.getACL().hasPermission(
606+
if (fromJob.getACL().hasPermission2(
607607
AUTHENTICATED_ANONYMOUS,
608608
Item.READ)) {
609609
LOGGER.log(Level.FINE, "The copy-artifact step (of {0}) was accepted because the target project {1}" +
@@ -631,11 +631,11 @@ private boolean canReadArtifact(Run<?, ?> srcBuild, Run<?, ?> destBuild) {
631631
return true;
632632
}
633633

634-
Authentication a = Jenkins.getAuthentication();
635-
if (ACL.SYSTEM.equals(a)) {
634+
Authentication a = Jenkins.getAuthentication2();
635+
if (ACL.SYSTEM2.equals(a)) {
636636
a = AUTHENTICATED_ANONYMOUS;
637637
}
638-
if (srcBuild.hasPermission(a, Run.ARTIFACTS)) {
638+
if (srcBuild.hasPermission2(a, Run.ARTIFACTS)) {
639639
return true;
640640
}
641641

‎src/main/java/hudson/plugins/copyartifact/monitor/LegacyJobConfigMigrationMonitor.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ public HttpResponse doMigrateAllSelected(@JsonBody MigrateAllSelectedModel conte
298298
}
299299
// to avoid issue when a project is not visible for the regular admin
300300
// like with early version of ProjectMatrix
301-
try (ACLContext acl = ACL.as(ACL.SYSTEM)) {
301+
try (ACLContext acl = ACL.as2(ACL.SYSTEM2)) {
302302
try (BulkChange bc = new BulkChange(this)) {
303303
for (MigrateAllSelectedFromAndTo value : content.values) {
304304
if (value.jobFrom == null || value.jobTo == null) {

‎src/main/java/hudson/plugins/copyartifact/monitor/LegacyMonitorData.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ private JobInfoModel retrieveOrBuildJobInfoForCurrentUser(
236236
Job<?, ?> job = jenkins.getItem(jobFullName, jenkins, Job.class);
237237
if (job == null) {
238238
hasAccessTo = false;
239-
try (ACLContext acl = ACL.as(ACL.SYSTEM)) {
239+
try (ACLContext acl = ACL.as2(ACL.SYSTEM2)) {
240240
job = jenkins.getItem(jobFullName, jenkins, Job.class);
241241
}
242242
}

‎src/test/java/hudson/plugins/copyartifact/CopyArtifactPermissionPropertyTest.java‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
import jenkins.model.Jenkins;
5252
import jenkins.security.QueueItemAuthenticatorConfiguration;
5353

54-
import org.acegisecurity.Authentication;
54+
import org.springframework.security.core.Authentication;
5555
import org.apache.commons.lang.StringUtils;
5656
import org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition;
5757
import org.junit.After;
@@ -347,10 +347,8 @@ public void testNotWorkWithQueueItemAuthenticator() throws Exception {
347347
// if the permission is configured with QueueItemAuthenticator.
348348
{
349349
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
350-
Map<String, Authentication> authMap = new HashMap<>();
351-
authMap.put(downstream.getFullName(), User.getById("bob", true).impersonate());
352350
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
353-
new MockQueueItemAuthenticator(authMap)
351+
new MockQueueItemAuthenticator().authenticate(downstream.getFullName(), User.getById("bob", true).impersonate2())
354352
);
355353
j.assertBuildStatus(Result.FAILURE, downstream.scheduleBuild2(0));
356354
}
@@ -360,10 +358,8 @@ public void testNotWorkWithQueueItemAuthenticator() throws Exception {
360358
// (actually, you don't need to configure copyArtifactPermission)
361359
{
362360
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
363-
Map<String, Authentication> authMap = new HashMap<>();
364-
authMap.put(downstream.getFullName(), User.getById("alice", true).impersonate());
365361
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
366-
new MockQueueItemAuthenticator(authMap)
362+
new MockQueueItemAuthenticator().authenticate(downstream.getFullName(), User.getById("alice", true).impersonate2())
367363
);
368364
j.buildAndAssertSuccess(downstream);
369365
}

‎src/test/java/hudson/plugins/copyartifact/CopyArtifactTest.java‎

Lines changed: 30 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -89,10 +89,10 @@
8989
import jenkins.model.Jenkins;
9090
import jenkins.security.QueueItemAuthenticatorConfiguration;
9191

92-
import org.acegisecurity.Authentication;
93-
import org.acegisecurity.context.SecurityContext;
94-
import org.acegisecurity.context.SecurityContextHolder;
95-
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
92+
import org.springframework.security.core.Authentication;
93+
import org.springframework.security.core.context.SecurityContext;
94+
import org.springframework.security.core.context.SecurityContextHolder;
95+
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
9696
import org.apache.commons.lang.StringUtils;
9797
import org.jenkinsci.plugins.workflow.DirectArtifactManagerFactory;
9898
import org.junit.After;
@@ -1026,11 +1026,9 @@ public void testPermission() throws Exception {
10261026
assertEquals(src.getName(), ca.getProjectName());
10271027

10281028
// Build should succeed when run as joe.
1029-
Map<String, Authentication> authMap = new HashMap<>();
1030-
authMap.put(dest.getFullName(), User.getById("joe", true).impersonate());
10311029
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
10321030
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
1033-
new MockQueueItemAuthenticator(authMap)
1031+
new MockQueueItemAuthenticator().authenticate(dest.getFullName(), User.getById("joe", true).impersonate2())
10341032
);
10351033
rule.assertBuildStatusSuccess(dest.scheduleBuild2(0));
10361034
}
@@ -1074,7 +1072,7 @@ public void testPermissionWhenParameterized() throws Exception {
10741072
rule.assertBuildStatusSuccess(b);
10751073
// Build step should fail for a job not accessible to all authenticated users,
10761074
// even when accessible to the user starting the job, as in this case:
1077-
SecurityContext old = ACL.impersonate(
1075+
SecurityContext old = ACL.impersonate2(
10781076
new UsernamePasswordAuthenticationToken("joe","joe"));
10791077
try {
10801078
b = p.scheduleBuild2(0, new Cause.UserIdCause(),
@@ -1678,10 +1676,10 @@ public void testCopyArtifactPermissionProperty() throws Exception {
16781676

16791677
// test permissions
16801678
// not all user can access projects.
1681-
assertFalse(copiee.getACL().hasPermission(test1.impersonate(), Item.READ));
1682-
assertFalse(copier.getACL().hasPermission(test1.impersonate(), Item.READ));
1683-
assertFalse(matrixCopiee.getACL().hasPermission(test1.impersonate(), Item.READ));
1684-
assertFalse(matrixCopier.getACL().hasPermission(test1.impersonate(), Item.READ));
1679+
assertFalse(copiee.getACL().hasPermission2(test1.impersonate2(), Item.READ));
1680+
assertFalse(copier.getACL().hasPermission2(test1.impersonate2(), Item.READ));
1681+
assertFalse(matrixCopiee.getACL().hasPermission2(test1.impersonate2(), Item.READ));
1682+
assertFalse(matrixCopier.getACL().hasPermission2(test1.impersonate2(), Item.READ));
16851683

16861684
// prepare an artifact
16871685
rule.assertBuildStatusSuccess(copiee.scheduleBuild2(0));
@@ -2093,15 +2091,15 @@ public void testCliCannotBypassPermission() throws Exception {
20932091
}
20942092

20952093
private static class TestQueueItemAuthenticator extends jenkins.security.QueueItemAuthenticator {
2096-
private final transient org.acegisecurity.Authentication auth;
2094+
private final transient Authentication auth;
20972095

2098-
public TestQueueItemAuthenticator(org.acegisecurity.Authentication auth) {
2096+
public TestQueueItemAuthenticator(Authentication auth) {
20992097
this.auth = auth;
21002098
}
21012099

21022100
@Override
21032101
@edu.umd.cs.findbugs.annotations.CheckForNull
2104-
public org.acegisecurity.Authentication authenticate(Queue.Item item) {
2102+
public Authentication authenticate2(Queue.Item item) {
21052103
return auth;
21062104
}
21072105

@@ -2146,20 +2144,20 @@ public void testQueueItemAuthenticator() throws Exception {
21462144
auth.grant(Item.READ).onItems(copier).to(test1,test2);
21472145

21482146
// test permissions
2149-
assertTrue (copiee.getACL().hasPermission(admin.impersonate(), Item.READ));
2150-
assertTrue (copiee.getACL().hasPermission(test1.impersonate(), Item.READ));
2151-
assertFalse(copiee.getACL().hasPermission(test2.impersonate(), Item.READ));
2147+
assertTrue (copiee.getACL().hasPermission2(admin.impersonate2(), Item.READ));
2148+
assertTrue (copiee.getACL().hasPermission2(test1.impersonate2(), Item.READ));
2149+
assertFalse(copiee.getACL().hasPermission2(test2.impersonate2(), Item.READ));
21522150

2153-
assertTrue (copier.getACL().hasPermission(admin.impersonate(), Item.BUILD));
2154-
assertTrue (copier.getACL().hasPermission(test1.impersonate(), Item.BUILD));
2155-
assertTrue (copier.getACL().hasPermission(test2.impersonate(), Item.BUILD));
2156-
assertTrue (copier.getACL().hasPermission(Jenkins.ANONYMOUS, Item.BUILD));
2151+
assertTrue (copier.getACL().hasPermission2(admin.impersonate2(), Item.BUILD));
2152+
assertTrue (copier.getACL().hasPermission2(test1.impersonate2(), Item.BUILD));
2153+
assertTrue (copier.getACL().hasPermission2(test2.impersonate2(), Item.BUILD));
2154+
assertTrue (copier.getACL().hasPermission2(Jenkins.ANONYMOUS2, Item.BUILD));
21572155

21582156
// Computer.BUILD is required since Jenkins 1.521.
2159-
assertTrue(rule.jenkins.getACL().hasPermission(admin.impersonate(), Computer.BUILD));
2160-
assertTrue(rule.jenkins.getACL().hasPermission(test1.impersonate(), Computer.BUILD));
2161-
assertTrue(rule.jenkins.getACL().hasPermission(test2.impersonate(), Computer.BUILD));
2162-
assertTrue(rule.jenkins.getACL().hasPermission(Jenkins.ANONYMOUS, Computer.BUILD));
2157+
assertTrue(rule.jenkins.getACL().hasPermission2(admin.impersonate2(), Computer.BUILD));
2158+
assertTrue(rule.jenkins.getACL().hasPermission2(test1.impersonate2(), Computer.BUILD));
2159+
assertTrue(rule.jenkins.getACL().hasPermission2(test2.impersonate2(), Computer.BUILD));
2160+
assertTrue(rule.jenkins.getACL().hasPermission2(Jenkins.ANONYMOUS2, Computer.BUILD));
21632161

21642162
// prepare an artifact
21652163
rule.assertBuildStatusSuccess(copiee.scheduleBuild2(0));
@@ -2174,7 +2172,7 @@ public void testQueueItemAuthenticator() throws Exception {
21742172
{
21752173
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
21762174
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
2177-
new TestQueueItemAuthenticator(admin.impersonate())
2175+
new TestQueueItemAuthenticator(admin.impersonate2())
21782176
);
21792177
rule.assertBuildStatus(Result.SUCCESS, copier.scheduleBuild2(0).get(TIMEOUT, TimeUnit.SECONDS));
21802178
}
@@ -2184,7 +2182,7 @@ public void testQueueItemAuthenticator() throws Exception {
21842182
{
21852183
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
21862184
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
2187-
new TestQueueItemAuthenticator(test1.impersonate())
2185+
new TestQueueItemAuthenticator(test1.impersonate2())
21882186
);
21892187
rule.assertBuildStatus(Result.SUCCESS, copier.scheduleBuild2(0).get(TIMEOUT, TimeUnit.SECONDS));
21902188
}
@@ -2194,7 +2192,7 @@ public void testQueueItemAuthenticator() throws Exception {
21942192
{
21952193
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
21962194
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
2197-
new TestQueueItemAuthenticator(test2.impersonate())
2195+
new TestQueueItemAuthenticator(test2.impersonate2())
21982196
);
21992197
rule.assertBuildStatus(Result.FAILURE, copier.scheduleBuild2(0).get(TIMEOUT, TimeUnit.SECONDS));
22002198
}
@@ -2204,7 +2202,7 @@ public void testQueueItemAuthenticator() throws Exception {
22042202
{
22052203
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
22062204
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
2207-
new TestQueueItemAuthenticator(Jenkins.ANONYMOUS)
2205+
new TestQueueItemAuthenticator(Jenkins.ANONYMOUS2)
22082206
);
22092207
rule.assertBuildStatus(Result.FAILURE, copier.scheduleBuild2(0).get(TIMEOUT, TimeUnit.SECONDS));
22102208
}
@@ -2482,11 +2480,9 @@ public void artifactsPermissionWithAuthSuccess() throws Exception {
24822480
true
24832481
));
24842482

2485-
Map<String, Authentication> authMap = new HashMap<>();
2486-
authMap.put(dest.getFullName(), User.getById("joe", true).impersonate());
24872483
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
24882484
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
2489-
new MockQueueItemAuthenticator(authMap)
2485+
new MockQueueItemAuthenticator().authenticate(dest.getFullName(), User.getById("joe", true).impersonate2())
24902486
);
24912487
rule.assertBuildStatusSuccess(dest.scheduleBuild2(0));
24922488
}
@@ -2520,11 +2516,9 @@ public void artifactsPermissionWithAuthFailure() throws Exception {
25202516
true
25212517
));
25222518

2523-
Map<String, Authentication> authMap = new HashMap<>();
2524-
authMap.put(dest.getFullName(), User.getById("joe", true).impersonate());
25252519
QueueItemAuthenticatorConfiguration.get().getAuthenticators().clear();
25262520
QueueItemAuthenticatorConfiguration.get().getAuthenticators().add(
2527-
new MockQueueItemAuthenticator(authMap)
2521+
new MockQueueItemAuthenticator().authenticate(dest.getFullName(), User.getById("joe", true).impersonate2())
25282522
);
25292523
rule.assertBuildStatus(Result.FAILURE, dest.scheduleBuild2(0));
25302524
}

‎src/test/java/hudson/plugins/copyartifact/DownstreamBuildSelectorTest.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@
5252
import hudson.tasks.Fingerprinter;
5353
import hudson.util.FormValidation;
5454

55-
import org.acegisecurity.Authentication;
56-
import org.acegisecurity.context.SecurityContextHolder;
55+
import org.springframework.security.core.Authentication;
56+
import org.springframework.security.core.context.SecurityContextHolder;
5757
import org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition;
5858
import org.jenkinsci.plugins.workflow.job.WorkflowJob;
5959
import org.jenkinsci.plugins.workflow.job.WorkflowRun;
@@ -554,9 +554,9 @@ public void testCheckUpstreamProjectName() throws Exception {
554554
assertEquals(FormValidation.Kind.OK, d.doCheckUpstreamProjectName(null, "folder1/project2").kind);
555555

556556
// permission check
557-
Authentication a = Jenkins.getAuthentication();
557+
Authentication a = Jenkins.getAuthentication2();
558558
try {
559-
SecurityContextHolder.getContext().setAuthentication(User.get("devel").impersonate());
559+
SecurityContextHolder.getContext().setAuthentication(User.get("devel").impersonate2());
560560
assertEquals(FormValidation.Kind.OK, d.doCheckUpstreamProjectName(project2, "../project1").kind);
561561
assertEquals(FormValidation.Kind.ERROR, d.doCheckUpstreamProjectName(project2, "project3").kind);
562562
assertEquals(FormValidation.Kind.OK, d.doCheckUpstreamProjectName(null, "/project1").kind);
@@ -625,9 +625,9 @@ public void testCheckUpstreamBuildNumber() throws Exception {
625625
assertEquals(FormValidation.Kind.OK, d.doCheckUpstreamBuildNumber(null, "project2", "NosuchBuild").kind);
626626

627627
// permission check
628-
Authentication a = Jenkins.getAuthentication();
628+
Authentication a = Jenkins.getAuthentication2();
629629
try {
630-
SecurityContextHolder.getContext().setAuthentication(User.get("devel").impersonate());
630+
SecurityContextHolder.getContext().setAuthentication(User.get("devel").impersonate2());
631631
assertEquals(FormValidation.Kind.OK, d.doCheckUpstreamBuildNumber(project1, "project3", "nosuchbuild").kind); // limitation
632632
assertEquals(FormValidation.Kind.OK, d.doCheckUpstreamBuildNumber(null, "project3", "nosuchbuild").kind);
633633
} finally {

0 commit comments

Comments
 (0)