Add option to disable anonymous authentication in RSocketSecurity

[therepanic]

Adding anonymous interceptor hardcoded to RSocketSecurity#payloadInterceptors and is added anyway. I think you should add an option to disable adding anonymous interceptor.

I think the most logical way is to add a flag, as in our case I did. I also added a method disableAnonymous which sets the field to true and we no longer add the anonymous interceptor.

Fixes: #17132

[therepanic]

Hmmm, is the build going down by my mistake or is it not about me?

[jzheaux]

Thanks for the PR, @therepanic! I've left feedback inline.

Also, are you able to add a test that confirms that when anonymous is disabled then it isn't active in the filter chain?

[jzheaux]

While I agree that this is a straightforward way to expose the feature, I see some additional benefit in exposing it in a way that's similar to HttpSecurity and ServerHttpSecurity. Are you able to add this feature in the following way instead?

[therepanic]

I agree, that would indeed be better. I think we should add a class similar to RSocketSecurity.BasicAuthenticationSpec, but without fields, and the build() method will execute the logic of the current anonymous() method. And I think we can remove it as unnecessary.

[therepanic]

Thanks for review, @jzheaux! I'd be happy to add the test. I just have one question about it.

I think we could make a test that checks the functionality you described by creating a new test class, let's call it AnonymousAuthenticationITests (similar to SimpleAuthenticationITests). And, similar to how SimpleAuthenticationITests works, we will check the functionality of disabling the addition of the anonymous auth interceptor. I think this is okay, what do you think? Or is there an easier way?

[jzheaux]

@therepanic, that sounds like a good approach. Also, you might consider a test like AnonymousConfigurerTests#requestWhenAnonymousDisabledInLambdaThenRespondsWithForbidden that authorizes only anonymous users. When anonymous is disabled, the requests in that test should fail.

RSocketSecurity doesn't expose the anonymous() access rule, but you can use access(ReactiveAuthorizationManager) to provide one:

AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
ReactiveAuthorizationManager<PayloadExchange> anonymous = (authentication, exchange) -> 
    authentication.map(trustResolver::isAnonymous).map(AuthorizationDecision::new);
// ...

.anyExchange().access(anonymous)