root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 14 Packages Projects Releases Wiki Activity

Merge 540cc356ee into 8525f0e3fd

This commit is contained in:
Max Batischev 2025-04-23 23:36:12 +03:00 committed by GitHub
parent 8525f0e3fd 540cc356ee
commit d391fe2e61
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
web/src/main/java/org/springframework/security/web/authentication/preauth/x509/SubjectDnX509PrincipalExtractor.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2020 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -43,6 +43,7 @@ import org.springframework.util.Assert;
* "EMAILADDRESS=jimi@hendrix.org, CN=..." giving a user name "jimi@hendrix.org" * "EMAILADDRESS=jimi@hendrix.org, CN=..." giving a user name "jimi@hendrix.org"
* *
* @author Luke Taylor * @author Luke Taylor
* @author Max Batischev
*/ */
public class SubjectDnX509PrincipalExtractor implements X509PrincipalExtractor, MessageSourceAware { public class SubjectDnX509PrincipalExtractor implements X509PrincipalExtractor, MessageSourceAware {
@ -52,14 +53,16 @@ public class SubjectDnX509PrincipalExtractor implements X509PrincipalExtractor,
private Pattern subjectDnPattern; private Pattern subjectDnPattern;
private boolean extractPrincipalNameFromX500Principal = false;
public SubjectDnX509PrincipalExtractor() { public SubjectDnX509PrincipalExtractor() {
setSubjectDnRegex("CN=(.*?)(?:,|$)"); setSubjectDnRegex("CN=(.*?)(?:,|$)");
} }
@Override @Override
public Object extractPrincipal(X509Certificate clientCert) { public Object extractPrincipal(X509Certificate clientCert) {
// String subjectDN = clientCert.getSubjectX500Principal().getName(); String subjectDN = this.extractPrincipalNameFromX500Principal ? clientCert.getSubjectX500Principal().getName()
String subjectDN = clientCert.getSubjectDN().getName(); : clientCert.getSubjectDN().getName();
this.logger.debug(LogMessage.format("Subject DN is '%s'", subjectDN)); this.logger.debug(LogMessage.format("Subject DN is '%s'", subjectDN));
Matcher matcher = this.subjectDnPattern.matcher(subjectDN); Matcher matcher = this.subjectDnPattern.matcher(subjectDN);
if (!matcher.find()) { if (!matcher.find()) {
@ -98,4 +101,14 @@ public class SubjectDnX509PrincipalExtractor implements X509PrincipalExtractor,
this.messages = new MessageSourceAccessor(messageSource); this.messages = new MessageSourceAccessor(messageSource);
} }
/**
* If true then extracts principal name from X500Principal, defaults to {@code false}
* @param extractPrincipalNameFromX500Principal whether to extract the principal name
* from X500Principal
* @since 7.0
*/
public void setExtractPrincipalNameFromX500Principal(boolean extractPrincipalNameFromX500Principal) {
this.extractPrincipalNameFromX500Principal = extractPrincipalNameFromX500Principal;
}
} }

9
web/src/test/java/org/springframework/security/web/authentication/preauth/x509/SubjectDnX509PrincipalExtractorTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2020 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -54,6 +54,13 @@ public class SubjectDnX509PrincipalExtractorTests {
assertThat(principal).isEqualTo("Luke Taylor"); assertThat(principal).isEqualTo("Luke Taylor");
} }
@Test
public void defaultCNPatternReturnsPrincipalWhenExtractPrincipalNameFromX500PrincipalIsTrue() throws Exception {
this.extractor.setExtractPrincipalNameFromX500Principal(true);
Object principal = this.extractor.extractPrincipal(X509TestUtils.buildTestCertificate());
assertThat(principal).isEqualTo("Luke Taylor");
}
@Test @Test
public void matchOnEmailReturnsExpectedPrincipal() throws Exception { public void matchOnEmailReturnsExpectedPrincipal() throws Exception {
this.extractor.setSubjectDnRegex("emailAddress=(.*?),"); this.extractor.setSubjectDnRegex("emailAddress=(.*?),");