Skip to content

Commit d58c5e9

Browse files
thomaswoehlkethomaswoehlke
committed
work
1 parent 0e12799 commit d58c5e9

File tree

2 files changed

+230
-41
lines changed

2 files changed

+230
-41
lines changed

‎pom.xml‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1517,13 +1517,30 @@
15171517
<activeByDefault>true</activeByDefault>
15181518
</activation>
15191519
<properties>
1520+
<skipTests>true</skipTests>
15201521
<skip.unit.tests>true</skip.unit.tests>
15211522
<skip.integration.tests>true</skip.integration.tests>
15221523
</properties>
1524+
<build>
1525+
<finalName>${project.artifactId}</finalName>
1526+
<defaultGoal>clean install spring-boot:run</defaultGoal>
1527+
</build>
1528+
</profile>
1529+
1530+
<profile>
1531+
<id>site</id>
1532+
<activation>
1533+
<activeByDefault>false</activeByDefault>
1534+
</activation>
1535+
<properties>
1536+
<skipTests>false</skipTests>
1537+
<skip.unit.tests>false</skip.unit.tests>
1538+
<skip.integration.tests>false</skip.integration.tests>
1539+
</properties>
15231540
<build>
15241541
<finalName>${project.artifactId}</finalName>
15251542
<defaultGoal>
1526-
clean dependency:purge-local-repository dependency:resolve dependency:resolve-plugins dependency:sources install spring-boot:run
1543+
clean dependency:purge-local-repository dependency:resolve dependency:resolve-plugins dependency:sources install spring-boot:repackage site site:deploy
15271544
</defaultGoal>
15281545
</build>
15291546
</profile>
@@ -1534,12 +1551,15 @@
15341551
<activeByDefault>false</activeByDefault>
15351552
</activation>
15361553
<properties>
1554+
<skipTests>true</skipTests>
15371555
<skip.unit.tests>true</skip.unit.tests>
15381556
<skip.integration.tests>true</skip.integration.tests>
15391557
</properties>
15401558
<build>
15411559
<finalName>${project.artifactId}</finalName>
1542-
<defaultGoal>clean dependency:purge-local-repository install spring-boot:repackage</defaultGoal>
1560+
<defaultGoal>
1561+
clean dependency:purge-local-repository dependency:resolve dependency:resolve-plugins dependency:sources install spring-boot:repackage
1562+
</defaultGoal>
15431563
</build>
15441564
</profile>
15451565

@@ -1603,6 +1623,7 @@
16031623
<activeByDefault>false</activeByDefault>
16041624
</activation>
16051625
<properties>
1626+
<skipTests>true</skipTests>
16061627
<skip.unit.tests>true</skip.unit.tests>
16071628
<skip.integration.tests>true</skip.integration.tests>
16081629
</properties>

‎src/main/java/org/woehlke/java/simpleworklist/config/WebSecurityConfig.java‎

Lines changed: 207 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -3,54 +3,73 @@
33
import org.springframework.beans.factory.annotation.Autowired;
44
import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
55
import org.springframework.boot.context.properties.EnableConfigurationProperties;
6+
import org.springframework.context.ApplicationContext;
67
import org.springframework.context.annotation.Bean;
78
import org.springframework.context.annotation.Configuration;
9+
import org.springframework.core.io.support.SpringFactoriesLoader;
810
import org.springframework.data.jpa.repository.config.EnableJpaAuditing;
911
import org.springframework.data.web.config.EnableSpringDataWebSupport;
1012
import org.springframework.scheduling.annotation.EnableAsync;
11-
import org.springframework.security.authentication.AuthenticationManager;
13+
import org.springframework.security.authentication.*;
14+
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
15+
import org.springframework.security.config.annotation.ObjectPostProcessor;
1216
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
13-
import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
17+
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
1418
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
1519
import org.springframework.security.config.annotation.web.builders.WebSecurity;
20+
//import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
1621
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
22+
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
23+
import org.springframework.security.config.annotation.web.configurers.DefaultLoginPageConfigurer;
1724
import org.springframework.security.core.userdetails.UserDetailsService;
1825
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
1926
import org.springframework.security.crypto.password.PasswordEncoder;
2027
import org.springframework.security.web.SecurityFilterChain;
28+
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
2129
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
2230
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
31+
import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;
32+
import org.springframework.web.accept.ContentNegotiationStrategy;
33+
import org.springframework.web.accept.HeaderContentNegotiationStrategy;
2334
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
2435
import org.woehlke.java.simpleworklist.domain.security.access.ApplicationUserDetailsService;
2536

37+
import java.util.HashMap;
38+
import java.util.List;
39+
import java.util.Map;
40+
2641

2742
@Configuration
2843
@EnableAsync
2944
@EnableJpaAuditing
3045
@EnableWebMvc
3146
@EnableSpringDataWebSupport
32-
@EnableWebSecurity
3347
@ImportAutoConfiguration({
3448
WebMvcConfig.class
3549
})
3650
@EnableConfigurationProperties({
3751
SimpleworklistProperties.class
3852
})
39-
public class WebSecurityConfig implements WebSecurityConfigurer<WebSecurity> {
53+
@EnableWebSecurity
54+
public class WebSecurityConfig /* extends WebSecurityConfigurerAdapter implements WebSecurityConfigurer<WebSecurity> */ {
4055

41-
private final AuthenticationManagerBuilder authenticationManagerBuilder;
42-
private final AuthenticationSuccessHandler authenticationSuccessHandler;
56+
//private final AuthenticationManagerBuilder authenticationManagerBuilder;
57+
//private final AuthenticationSuccessHandler authenticationSuccessHandler;
58+
//private final AuthenticationManager authenticationManager;
4359
private final ApplicationUserDetailsService applicationUserDetailsService;
4460
private final SimpleworklistProperties simpleworklistProperties;
4561

4662
@Autowired
4763
public WebSecurityConfig(
48-
AuthenticationManagerBuilder auth,
49-
AuthenticationSuccessHandler authenticationSuccessHandler,
64+
//AuthenticationManagerBuilder auth,
65+
//AuthenticationSuccessHandler authenticationSuccessHandler,
66+
//AuthenticationManager authenticationManager,
5067
ApplicationUserDetailsService applicationUserDetailsService,
51-
SimpleworklistProperties simpleworklistProperties) {
52-
this.authenticationManagerBuilder = auth;
53-
this.authenticationSuccessHandler = authenticationSuccessHandler;
68+
SimpleworklistProperties simpleworklistProperties
69+
) {
70+
//this.authenticationManagerBuilder = auth;
71+
//this.authenticationSuccessHandler = authenticationSuccessHandler;
72+
//this.authenticationManager = authenticationManager;
5473
this.applicationUserDetailsService = applicationUserDetailsService;
5574
this.simpleworklistProperties = simpleworklistProperties;
5675
}
@@ -70,63 +89,212 @@ public PasswordEncoder encoder(){
7089
return new BCryptPasswordEncoder(strength);
7190
}
7291

92+
/*
7393
@Bean
7494
public AuthenticationManager authenticationManager() throws Exception {
7595
return authenticationManagerBuilder
7696
.userDetailsService(userDetailsService())
7797
.passwordEncoder(encoder()).and().build();
7898
}
99+
*/
100+
101+
/*
102+
@Bean
103+
public AuthenticationManager authenticationManager(
104+
AuthenticationConfiguration authenticationConfiguration
105+
) throws Exception {
106+
return authenticationConfiguration.getAuthenticationManager();
107+
}
79108
80109
@Bean
81110
public UsernamePasswordAuthenticationFilter authenticationFilter() throws Exception {
82111
UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter();
83-
filter.setAuthenticationManager(authenticationManager());
112+
filter.setAuthenticationManager(authenticationManager);
84113
filter.setFilterProcessesUrl(simpleworklistProperties.getWebSecurity().getLoginProcessingUrl());
85114
return filter;
86115
}
87116
88-
@Override
89-
public void init(WebSecurity builder) throws Exception {
117+
private AuthenticationManagerBuilder authenticationBuilder;
118+
119+
private AuthenticationManagerBuilder localConfigureAuthenticationBldr;
120+
121+
private ApplicationContext context;
122+
123+
private HttpSecurity http;
124+
125+
private boolean disableDefaults;
126+
127+
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
128+
129+
private ContentNegotiationStrategy contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
130+
131+
private ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<Object>() {
132+
@Override
133+
public <T> T postProcess(T object) {
134+
throw new IllegalStateException(ObjectPostProcessor.class.getName()
135+
+ " is a required bean. Ensure you have used @EnableWebSecurity and @Configuration");
136+
}
137+
};
138+
139+
private AuthenticationEventPublisher getAuthenticationEventPublisher() {
140+
if (this.context.getBeanNamesForType(AuthenticationEventPublisher.class).length > 0) {
141+
return this.context.getBean(AuthenticationEventPublisher.class);
142+
}
143+
return this.objectPostProcessor.postProcess(new DefaultAuthenticationEventPublisher());
144+
}
145+
*/
146+
147+
/**
148+
* Creates the shared objects
149+
* @return the shared Objects
150+
*/
151+
/*
152+
private Map<Class<?>, Object> createSharedObjects() {
153+
Map<Class<?>, Object> sharedObjects = new HashMap<>();
154+
sharedObjects.putAll(this.localConfigureAuthenticationBldr.getSharedObjects());
155+
sharedObjects.put(UserDetailsService.class, userDetailsService());
156+
sharedObjects.put(ApplicationContext.class, this.context);
157+
sharedObjects.put(ContentNegotiationStrategy.class, this.contentNegotiationStrategy);
158+
sharedObjects.put(AuthenticationTrustResolver.class, this.trustResolver);
159+
return sharedObjects;
160+
}
161+
162+
private void applyDefaultConfiguration(HttpSecurity http) throws Exception {
163+
http.csrf();
164+
http.addFilter(new WebAsyncManagerIntegrationFilter());
165+
http.exceptionHandling();
166+
http.headers();
167+
http.sessionManagement();
168+
http.securityContext();
169+
http.requestCache();
170+
http.anonymous();
171+
http.servletApi();
172+
http.apply(new DefaultLoginPageConfigurer<>());
173+
http.logout();
174+
}
175+
*/
176+
/**
177+
* Creates the {@link HttpSecurity} or returns the current instance
178+
* @return the {@link HttpSecurity}
179+
* @throws Exception
180+
*/
181+
@SuppressWarnings({ "rawtypes", "unchecked" })
182+
/*
183+
protected final HttpSecurity getHttp() throws Exception {
184+
if (this.http != null) {
185+
return this.http;
186+
}
187+
AuthenticationEventPublisher eventPublisher = getAuthenticationEventPublisher();
188+
this.localConfigureAuthenticationBldr.authenticationEventPublisher(eventPublisher);
189+
this.authenticationBuilder.parentAuthenticationManager(authenticationManager);
190+
Map<Class<?>, Object> sharedObjects = createSharedObjects();
191+
this.http = new HttpSecurity(this.objectPostProcessor, this.authenticationBuilder, sharedObjects);
192+
if (!this.disableDefaults) {
193+
applyDefaultConfiguration(this.http);
194+
ClassLoader classLoader = this.context.getClassLoader();
195+
List<AbstractHttpConfigurer> defaultHttpConfigurers = SpringFactoriesLoader
196+
.loadFactories(AbstractHttpConfigurer.class, classLoader);
197+
for (AbstractHttpConfigurer configurer : defaultHttpConfigurers) {
198+
this.http.apply(configurer);
199+
}
200+
}
201+
configure(this.http);
202+
return this.http;
203+
}
204+
90205
206+
///@Override
207+
public void init(WebSecurity web) throws Exception {
208+
HttpSecurity http = getHttp();
209+
web.addSecurityFilterChainBuilder(http).postBuildAction(() -> {
210+
FilterSecurityInterceptor securityInterceptor = http.getSharedObject(FilterSecurityInterceptor.class);
211+
web.securityInterceptor(securityInterceptor);
212+
});
91213
}
92214
93-
@Override
215+
216+
//@Override
94217
public void configure(WebSecurity builder) throws Exception {
95218
96219
}
220+
*/
221+
222+
/*
223+
public void configure(HttpSecurity builder) throws Exception {
97224
98-
@Bean
99-
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
100225
http
101-
.headers()
102-
.disable()
103-
.authorizeRequests()
104-
.antMatchers(
105-
simpleworklistProperties.getWebSecurity().getAntPatternsPublic()
226+
.headers((headers) -> headers.disable() )
227+
.authorizeRequests((authorizeRequests) -> authorizeRequests
228+
.antMatchers(
229+
simpleworklistProperties.getWebSecurity().getAntPatternsPublic()
230+
)
231+
.permitAll()
232+
.anyRequest()
233+
.fullyAuthenticated()
106234
)
107-
.permitAll()
108-
.anyRequest()
109-
.fullyAuthenticated()
235+
.csrf()
110236
.and()
237+
.formLogin((formLogin) -> formLogin
238+
.loginPage(simpleworklistProperties.getWebSecurity().getLoginPage())
239+
.usernameParameter(simpleworklistProperties.getWebSecurity().getUsernameParameter())
240+
.passwordParameter(simpleworklistProperties.getWebSecurity().getPasswordParameter())
241+
.loginProcessingUrl(simpleworklistProperties.getWebSecurity().getLoginProcessingUrl())
242+
.failureForwardUrl(simpleworklistProperties.getWebSecurity().getFailureForwardUrl())
243+
.defaultSuccessUrl(simpleworklistProperties.getWebSecurity().getDefaultSuccessUrl())
244+
//.successHandler(authenticationSuccessHandler)
245+
.permitAll()
246+
)
111247
.csrf()
112248
.and()
113-
.formLogin()
114-
.loginPage(simpleworklistProperties.getWebSecurity().getLoginPage())
115-
.usernameParameter(simpleworklistProperties.getWebSecurity().getUsernameParameter())
116-
.passwordParameter(simpleworklistProperties.getWebSecurity().getPasswordParameter())
117-
.loginProcessingUrl(simpleworklistProperties.getWebSecurity().getLoginProcessingUrl())
118-
.failureForwardUrl(simpleworklistProperties.getWebSecurity().getFailureForwardUrl())
119-
.defaultSuccessUrl(simpleworklistProperties.getWebSecurity().getDefaultSuccessUrl())
120-
//.successHandler(authenticationSuccessHandler)
121-
.permitAll()
249+
.logout((logout)-> logout
250+
.logoutUrl(simpleworklistProperties.getWebSecurity().getLogoutUrl())
251+
.deleteCookies(simpleworklistProperties.getWebSecurity().getCookieNamesToClear())
252+
.invalidateHttpSession(simpleworklistProperties.getWebSecurity().getInvalidateHttpSession())
253+
.permitAll()
254+
);
255+
256+
}
257+
*/
258+
@Bean
259+
public DaoAuthenticationProvider authenticationProvider(){
260+
DaoAuthenticationProvider d = new DaoAuthenticationProvider();
261+
d.setPasswordEncoder(encoder());
262+
d.setUserDetailsService(userDetailsService());
263+
return d;
264+
}
265+
266+
@Bean
267+
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
268+
http
269+
.headers((headers) -> headers.disable() )
270+
.authorizeRequests((authorizeRequests) -> authorizeRequests
271+
.antMatchers(
272+
simpleworklistProperties.getWebSecurity().getAntPatternsPublic()
273+
)
274+
.permitAll()
275+
.anyRequest()
276+
.fullyAuthenticated()
277+
)
278+
.csrf()
122279
.and()
280+
.formLogin((formLogin) -> formLogin
281+
.loginPage(simpleworklistProperties.getWebSecurity().getLoginPage())
282+
.usernameParameter(simpleworklistProperties.getWebSecurity().getUsernameParameter())
283+
.passwordParameter(simpleworklistProperties.getWebSecurity().getPasswordParameter())
284+
.loginProcessingUrl(simpleworklistProperties.getWebSecurity().getLoginProcessingUrl())
285+
.failureForwardUrl(simpleworklistProperties.getWebSecurity().getFailureForwardUrl())
286+
.defaultSuccessUrl(simpleworklistProperties.getWebSecurity().getDefaultSuccessUrl())
287+
//.successHandler(authenticationSuccessHandler)
288+
.permitAll()
289+
)
123290
.csrf()
124291
.and()
125-
.logout()
126-
.logoutUrl(simpleworklistProperties.getWebSecurity().getLogoutUrl())
127-
.deleteCookies(simpleworklistProperties.getWebSecurity().getCookieNamesToClear())
128-
.invalidateHttpSession(simpleworklistProperties.getWebSecurity().getInvalidateHttpSession())
129-
.permitAll();
292+
.logout((logout)-> logout
293+
.logoutUrl(simpleworklistProperties.getWebSecurity().getLogoutUrl())
294+
.deleteCookies(simpleworklistProperties.getWebSecurity().getCookieNamesToClear())
295+
.invalidateHttpSession(simpleworklistProperties.getWebSecurity().getInvalidateHttpSession())
296+
.permitAll()
297+
);
130298
return http.build();
131299
}
132300

0 commit comments

Comments
 (0)