treshenkov/clearing
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'keycloak-extract' into dev

Browse source
This commit is contained in:
ialbert 2022-09-02 14:24:20 +03:00
commit 84e2bc62d2
6 changed files with 277 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java
View file

@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.http.converter.StringHttpMessageConverter;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.servlet.config.annotation.*;
import java.util.List;
@ -17,6 +18,8 @@ import java.util.function.Consumer;
@SuppressWarnings("Duplicates")
@Configuration
@EnableWebMvc
//todo remove? see ClearingCorsFilter
@CrossOrigin
public class WebConfig implements WebMvcConfigurer {
private final MappingJackson2HttpMessageConverter customJsonHttpConverter;
@ -61,4 +64,9 @@ public class WebConfig implements WebMvcConfigurer {
public WebServerFactoryCustomizer<ConfigurableServletWebServerFactory> enableDefaultServlet() {
return (factory) -> factory.setRegisterDefaultServlet(true);
}
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**").allowedMethods("*");
}
}

95
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java Normal file
View file

@ -0,0 +1,95 @@
package ru.spcex.clearing.backendapi.filter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
import ru.spcex.platform.utils.log.ExceptionUtils;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class ClearingCorsFilter extends OncePerRequestFilter {
private final Logger log = LoggerFactory.getLogger(getClass());
// private final AConfigurationProperties configuration;
//todo cors settings
private final String[] meth = new String[] {};//"*"
private final String[] orig = new String[] {};//"/**"
private final String[] head = new String[] {};
private final CorsAllowedOriginsService allowedOriginsService;
public ClearingCorsFilter(
// AConfigurationProperties configuration,
CorsAllowedOriginsService allowedOriginsService
) {
// this.configuration = configuration;
this.allowedOriginsService = allowedOriginsService;
}
final String H_ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
final String H_ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";
final String H_ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";
final String H_ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";
private void setHeaderValue(HttpServletResponse httpServletResponse, String headerName, String value) {
httpServletResponse.setHeader(headerName, value);
log.trace("cors filter -> set {} = {}", headerName, value);
}
@Override
protected void doFilterInternal(
HttpServletRequest httpServletRequest,
HttpServletResponse httpServletResponse,
FilterChain filterChain
) throws ServletException, IOException {
log.trace("cors filter -> url = {}{} ({})",
httpServletRequest.getServletPath(),
httpServletRequest.getRequestURI(),
httpServletRequest.getMethod()
);
try {
String requestedOrigin = httpServletRequest.getHeader("Origin");
String effectiveOrigin = allowedOriginsService.isAllowedOrigin(requestedOrigin)
? requestedOrigin
: "not-allowed-origin";
log.trace("cors filter -> effectiveOrigin={}", effectiveOrigin);
if (effectiveOrigin != null) {
setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_ORIGIN, effectiveOrigin);
// String methods;
// if (meth.length > 0) {
// methods = String.join(", ", meth).toUpperCase(Locale.ROOT);
// } else {
// methods = "*";
// }
// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, methods);
// String headers;
// if (head.length > 0) {
// headers = String.join(", ", head).toLowerCase(Locale.ROOT);
// } else {
// headers = "*";
// }
// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, headers);
setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
log.trace("cors filter -> added ok");
}
} catch (Exception e) {
log.error("cors filter -> {}", ExceptionUtils.getStackTrace(e));
}
if ("OPTIONS".equals(httpServletRequest.getMethod())) {
httpServletResponse.setStatus(HttpServletResponse.SC_OK);
} else {
filterChain.doFilter(httpServletRequest, httpServletResponse);
}
}
}

34
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java Normal file
View file

@ -0,0 +1,34 @@
package ru.spcex.clearing.backendapi.filter;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@Service
public class CorsAllowedOriginsService {
private final List<Pattern> originPatterns = new ArrayList<>();
//todo cors settings
public CorsAllowedOriginsService() {
for (String originRegex : new String[]{".*"}) {
originPatterns.add(Pattern.compile(originRegex));
}
}
public boolean isAllowedOrigin(String origin) {
String effectiveOrigin = origin == null ? "" : origin;
if (originPatterns.size() == 0)
return true;
for (Pattern originPattern : originPatterns) {
Matcher matcher = originPattern.matcher(effectiveOrigin);
if (matcher.find()) {
return true;
}
}
return false;
}
}

104
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java Normal file
View file

@ -0,0 +1,104 @@
package ru.spcex.clearing.backendapi.security;
import org.keycloak.KeycloakPrincipal;
import org.keycloak.adapters.AdapterUtils;
import org.keycloak.adapters.KeycloakConfigResolver;
import org.keycloak.adapters.KeycloakDeployment;
import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
import org.keycloak.adapters.rotation.AdapterTokenVerifier;
import org.keycloak.adapters.spi.KeycloakAccount;
import org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount;
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken;
import org.keycloak.common.VerificationException;
import org.keycloak.representations.AccessToken;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.http.*;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.stereotype.Component;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import org.springframework.web.client.HttpClientErrorException;
import org.springframework.web.client.RestTemplate;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Collections;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.stream.Collectors;
@Component("keycloakRestAuthenticationProvider")
public class KeycloakRestTemplateAuthenticationProvider implements AuthenticationProvider {
private final KeycloakConfigResolver resolver;
private final HttpServletRequest currentHttpRequest;
private final HttpServletResponse currentHttpResponse;
private final RestTemplate restTemplate;
public KeycloakRestTemplateAuthenticationProvider(KeycloakConfigResolver resolver, HttpServletRequest currentHttpRequest, HttpServletResponse currentHttpResponse,
@Qualifier("clearing-rest") RestTemplate restTemplate) {
this.resolver = resolver;
this.currentHttpRequest = currentHttpRequest;
this.currentHttpResponse = currentHttpResponse;
this.restTemplate = restTemplate;
}
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
try {
KeycloakDeployment deployment = resolver.resolve(null);
HttpHeaders headers = new HttpHeaders();
headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
MultiValueMap<String, String> map = new LinkedMultiValueMap<>();
map.add("username", authentication.getName());
map.add("password", (String) authentication.getCredentials());
map.add("grant_type", "password");
map.add("client_id", deployment.getResourceName());
map.add("client_secret", (String) deployment.getResourceCredentials().get("secret"));
ResponseEntity<Map> response = restTemplate.exchange(deployment.getTokenUrl(), HttpMethod.POST, new HttpEntity<>(map, headers), Map.class);
if (!response.getStatusCode().equals(HttpStatus.OK) || response.getBody() == null) {
throw new AuthenticationServiceException("keycloak direct access grant http status " + response.getStatusCode().value());
}
String accessTokenString = (String) response.getBody().get("access_token");
String refreshTokenString = (String) response.getBody().get("refresh_token");
if (accessTokenString == null || refreshTokenString == null) {
throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token");
}
AccessToken accessToken = AdapterTokenVerifier.verifyToken(accessTokenString, deployment);
//todo cors settings
accessToken.setAllowedOrigins(Collections.singleton("*"));
System.out.println("login successful");
List<SimpleGrantedAuthority> realmRoles = accessToken.getRealmAccess().getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList());
RefreshableKeycloakSecurityContext skSession = new RefreshableKeycloakSecurityContext(deployment, null, accessTokenString, accessToken, null, null, refreshTokenString);
String principalName = AdapterUtils.getPrincipalName(deployment, accessToken);
final KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = new KeycloakPrincipal<>(principalName, skSession);
final Set<String> roles = AdapterUtils.getRolesFromSecurityContext(skSession);
final KeycloakAccount account = new SimpleKeycloakAccount(principal, roles, skSession);
KeycloakAuthenticationToken keycloakAuthenticationToken = new KeycloakAuthenticationToken(account, false, realmRoles);
keycloakAuthenticationToken.setAuthenticated(true);
return keycloakAuthenticationToken;
} catch (VerificationException vex) {
throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token", vex);
} catch (HttpClientErrorException.Unauthorized hceex) {
throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad credentials", hceex);
}
}
@Override
public boolean supports(Class<?> type) {
return UsernamePasswordAuthenticationToken.class.equals(type);
}
}

35
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java
View file

@ -4,11 +4,17 @@ import org.keycloak.adapters.springsecurity.KeycloakConfiguration;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.config.core.GrantedAuthorityDefaults;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler;
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
import ru.spcex.clearing.backendapi.config.element.BackendApiSettings;
@ -42,17 +48,44 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
// .formLogin()
// .loginProcessingUrl("/backend-api-login/perform-login")
// .and()
//todo remove? see ClearingCorsFilter
.cors()
.and()
.csrf().disable()
.authorizeRequests()
.antMatchers("/anonymous/**").permitAll()
.antMatchers("/sso/login").permitAll()
.antMatchers("/login").permitAll()
.antMatchers("/error").permitAll()
.antMatchers("/backend-api-login/**").permitAll()
.anyRequest();
if (securityDisabled) {
anyReq.permitAll();
} else {
anyReq.hasAnyRole("admin", "default-roles-master");
anyReq.hasAnyRole("admin", "default-roles-master")
.and()
.formLogin()
.successHandler((req, res, auth) -> res.setStatus(HttpStatus.OK.value()))
.failureHandler(new SimpleUrlAuthenticationFailureHandler())
.and()
.logout()
.logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK))
;
}
}
@Bean
public GrantedAuthorityDefaults grantedAuthorityDefaults() {
// Remove the ROLE_ prefix
return new GrantedAuthorityDefaults("");
}
@Autowired
private AuthenticationProvider authenticationProvider;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authenticationProvider);
}
}

4
clearing-parent/backend-api/src/main/resources/keycloak.json
View file

@ -8,10 +8,10 @@
"cors-max-age" : 1000,
"cors-allowed-methods" : "POST, PUT, DELETE, GET",
"cors-exposed-headers" : "WWW-Authenticate",
"bearer-only" : false,
"bearer-only" : true,
"enable-basic-auth" : false,
"expose-token" : false,
"verify-token-audience" : true,
"verify-token-audience" : false,
"credentials" : {
"secret" : "WnOVCxcAmrUYc8IjiFHOuRif5Oesoyfr"
},