SEC-2218: JEE preauth : make mappable-roles non-mandatory and default to WebXmlMappableAttributesRetriever strategy

Gaetan Pitteloud (Migrated from SEC-2218) said:

When using the http/jee element, the mappable-roles attributes is mandatory, and the MappableAttributesRetriever implementation is set to a SimpleMappableAttributesRetriever with injected mappable-roles.

Since the jee pre-authentication scenario is most often (or even always ?) based on security-roles declared in web.xml, it would be nice to automatically support a WebXmlMappableAttributesRetriever when no mappable-roles are provided.

In order to achieve this, mappable-roles use must be changed to optional in XSD, and AuthenticationConfigBuilder.createJeeFilter(BeanReference) must be changed this way:

  RootBeanDefinition mappableRolesRetriever;
  String roles = jeeElt.getAttribute(ATT_MAPPABLE_ROLES);
  if (roles != null) {
    BeanDefinitionBuilder rolesBuilder = BeanDefinitionBuilder.rootBeanDefinition(StringUtils.class);
    rolesBuilder.addConstructorArgValue(roles);
    rolesBuilder.setFactoryMethod("commaDelimitedListToSet");

    mappableRolesRetriever = new RootBeanDefinition(SimpleMappableAttributesRetriever.class);
    mappableRolesRetriever.getPropertyValues().addPropertyValue("mappableAttributes", rolesBuilder.getBeanDefinition());
  } else {
    mappableRolesRetriever = new RootBeanDefinition(WebXmlMappableAttributesRetriever.class);
  }
  adsBldr.addPropertyValue("mappableRolesRetriever", mappableRolesRetriever);

Start with the JEE pre-authentication XSD declaration and AuthenticationConfigBuilder.createJeeFilter(BeanReference). Trace how mappable-roles is read and how SimpleMappableAttributesRetriever and WebXmlMappableAttributesRetriever are configured. Done means the attribute is optional, with the existing explicit-role behavior preserved and the web.xml strategy used when it is omitted.