Add option to disable anonymous authentication in RSocketSecurity

[therepanic]

Adding anonymous interceptor hardcoded to RSocketSecurity#payloadInterceptors and is added anyway. I think you should add an option to disable adding anonymous interceptor.

I think the most logical way is to add a flag, as in our case I did. I also added a method disableAnonymous which sets the field to true and we no longer add the anonymous interceptor.

Fixes: #17132

[therepanic]

Hmmm, is the build going down by my mistake or is it not about me?

[jzheaux]

Thanks for the PR, @therepanic! I've left feedback inline.

Also, are you able to add a test that confirms that when anonymous is disabled then it isn't active in the filter chain?

[therepanic]

Thanks for review, @jzheaux! I'd be happy to add the test. I just have one question about it.

I think we could make a test that checks the functionality you described by creating a new test class, let's call it AnonymousAuthenticationITests (similar to SimpleAuthenticationITests). And, similar to how SimpleAuthenticationITests works, we will check the functionality of disabling the addition of the anonymous auth interceptor. I think this is okay, what do you think? Or is there an easier way?

[jzheaux]

@therepanic, that sounds like a good approach. Also, you might consider a test like AnonymousConfigurerTests#requestWhenAnonymousDisabledInLambdaThenRespondsWithForbidden that authorizes only anonymous users. When anonymous is disabled, the requests in that test should fail.

RSocketSecurity doesn't expose the anonymous() access rule, but you can use access(ReactiveAuthorizationManager) to provide one:

AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
ReactiveAuthorizationManager<PayloadExchange> anonymous = (authentication, exchange) -> 
    authentication.map(trustResolver::isAnonymous).map(AuthorizationDecision::new);
// ...

.anyExchange().access(anonymous)

[therepanic]

Thanks for review @jzheaux again.

Yes, you are right, I did make a mistake. In a separate commit, for your convenience, I added the creation of an anonymousAuthSpec instance by default, and also added a disable method to AnonymousAuthenticationSpec. In addition, I rolled back all changes in RSocketMessageHandlerITests (as unnecessary), and in our AnonymousAuthenticationITests#requestWhenAnonymousDisabledThenRespondsWithForbidden test, we manually disable anonymous authentication using the disable method.

[jzheaux]

Thanks for your help with this, @therepanic! This will merge to main once the build completes.