diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java index 5fae605c4..2efd544b8 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java @@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration; import org.springframework.http.converter.HttpMessageConverter; import org.springframework.http.converter.StringHttpMessageConverter; import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter; +import org.springframework.web.bind.annotation.CrossOrigin; import org.springframework.web.servlet.config.annotation.*; import java.util.List; @@ -17,6 +18,8 @@ import java.util.function.Consumer; @SuppressWarnings("Duplicates") @Configuration @EnableWebMvc +//todo remove? see ClearingCorsFilter +@CrossOrigin public class WebConfig implements WebMvcConfigurer { private final MappingJackson2HttpMessageConverter customJsonHttpConverter; @@ -61,4 +64,9 @@ public class WebConfig implements WebMvcConfigurer { public WebServerFactoryCustomizer enableDefaultServlet() { return (factory) -> factory.setRegisterDefaultServlet(true); } + + @Override + public void addCorsMappings(CorsRegistry registry) { + registry.addMapping("/**").allowedMethods("*"); + } } diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java new file mode 100644 index 000000000..e805b0671 --- /dev/null +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java @@ -0,0 +1,95 @@ +package ru.spcex.clearing.backendapi.filter; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.core.Ordered; +import org.springframework.core.annotation.Order; +import org.springframework.stereotype.Component; +import org.springframework.web.filter.OncePerRequestFilter; +import ru.spcex.platform.utils.log.ExceptionUtils; + +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + +@Component +@Order(Ordered.HIGHEST_PRECEDENCE) +public class ClearingCorsFilter extends OncePerRequestFilter { + private final Logger log = LoggerFactory.getLogger(getClass()); + +// private final AConfigurationProperties configuration; + //todo cors settings + private final String[] meth = new String[] {};//"*" + private final String[] orig = new String[] {};//"/**" + private final String[] head = new String[] {}; + private final CorsAllowedOriginsService allowedOriginsService; + + public ClearingCorsFilter( +// AConfigurationProperties configuration, + CorsAllowedOriginsService allowedOriginsService + ) { +// this.configuration = configuration; + this.allowedOriginsService = allowedOriginsService; + } + + final String H_ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin"; + final String H_ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods"; + final String H_ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers"; + final String H_ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials"; + + private void setHeaderValue(HttpServletResponse httpServletResponse, String headerName, String value) { + httpServletResponse.setHeader(headerName, value); + log.trace("cors filter -> set {} = {}", headerName, value); + } + + @Override + protected void doFilterInternal( + HttpServletRequest httpServletRequest, + HttpServletResponse httpServletResponse, + FilterChain filterChain + ) throws ServletException, IOException { + log.trace("cors filter -> url = {}{} ({})", + httpServletRequest.getServletPath(), + httpServletRequest.getRequestURI(), + httpServletRequest.getMethod() + ); + try { + String requestedOrigin = httpServletRequest.getHeader("Origin"); + String effectiveOrigin = allowedOriginsService.isAllowedOrigin(requestedOrigin) + ? requestedOrigin + : "not-allowed-origin"; + log.trace("cors filter -> effectiveOrigin={}", effectiveOrigin); + if (effectiveOrigin != null) { + setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_ORIGIN, effectiveOrigin); + +// String methods; +// if (meth.length > 0) { +// methods = String.join(", ", meth).toUpperCase(Locale.ROOT); +// } else { +// methods = "*"; +// } +// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, methods); + +// String headers; +// if (head.length > 0) { +// headers = String.join(", ", head).toLowerCase(Locale.ROOT); +// } else { +// headers = "*"; +// } +// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, headers); + + setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + log.trace("cors filter -> added ok"); + } + } catch (Exception e) { + log.error("cors filter -> {}", ExceptionUtils.getStackTrace(e)); + } + if ("OPTIONS".equals(httpServletRequest.getMethod())) { + httpServletResponse.setStatus(HttpServletResponse.SC_OK); + } else { + filterChain.doFilter(httpServletRequest, httpServletResponse); + } + } +} diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java new file mode 100644 index 000000000..a6e40a570 --- /dev/null +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java @@ -0,0 +1,34 @@ +package ru.spcex.clearing.backendapi.filter; + +import org.springframework.stereotype.Service; + +import java.util.ArrayList; +import java.util.List; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +@Service +public class CorsAllowedOriginsService { + + private final List originPatterns = new ArrayList<>(); + + //todo cors settings + public CorsAllowedOriginsService() { + for (String originRegex : new String[]{".*"}) { + originPatterns.add(Pattern.compile(originRegex)); + } + } + + public boolean isAllowedOrigin(String origin) { + String effectiveOrigin = origin == null ? "" : origin; + if (originPatterns.size() == 0) + return true; + for (Pattern originPattern : originPatterns) { + Matcher matcher = originPattern.matcher(effectiveOrigin); + if (matcher.find()) { + return true; + } + } + return false; + } +} diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java new file mode 100644 index 000000000..5999a8cbf --- /dev/null +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java @@ -0,0 +1,104 @@ +package ru.spcex.clearing.backendapi.security; + +import org.keycloak.KeycloakPrincipal; +import org.keycloak.adapters.AdapterUtils; +import org.keycloak.adapters.KeycloakConfigResolver; +import org.keycloak.adapters.KeycloakDeployment; +import org.keycloak.adapters.RefreshableKeycloakSecurityContext; +import org.keycloak.adapters.rotation.AdapterTokenVerifier; +import org.keycloak.adapters.spi.KeycloakAccount; +import org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount; +import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken; +import org.keycloak.common.VerificationException; +import org.keycloak.representations.AccessToken; +import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.http.*; +import org.springframework.security.authentication.AuthenticationProvider; +import org.springframework.security.authentication.AuthenticationServiceException; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.AuthenticationException; +import org.springframework.security.core.authority.SimpleGrantedAuthority; +import org.springframework.stereotype.Component; +import org.springframework.util.LinkedMultiValueMap; +import org.springframework.util.MultiValueMap; +import org.springframework.web.client.HttpClientErrorException; +import org.springframework.web.client.RestTemplate; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.util.Collections; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.stream.Collectors; + +@Component("keycloakRestAuthenticationProvider") +public class KeycloakRestTemplateAuthenticationProvider implements AuthenticationProvider { + private final KeycloakConfigResolver resolver; + private final HttpServletRequest currentHttpRequest; + private final HttpServletResponse currentHttpResponse; + private final RestTemplate restTemplate; + + public KeycloakRestTemplateAuthenticationProvider(KeycloakConfigResolver resolver, HttpServletRequest currentHttpRequest, HttpServletResponse currentHttpResponse, + @Qualifier("clearing-rest") RestTemplate restTemplate) { + this.resolver = resolver; + this.currentHttpRequest = currentHttpRequest; + this.currentHttpResponse = currentHttpResponse; + this.restTemplate = restTemplate; + } + + @Override + public Authentication authenticate(Authentication authentication) throws AuthenticationException { + + try { + KeycloakDeployment deployment = resolver.resolve(null); + + HttpHeaders headers = new HttpHeaders(); + headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED); + + MultiValueMap map = new LinkedMultiValueMap<>(); + map.add("username", authentication.getName()); + map.add("password", (String) authentication.getCredentials()); + map.add("grant_type", "password"); + map.add("client_id", deployment.getResourceName()); + map.add("client_secret", (String) deployment.getResourceCredentials().get("secret")); + + ResponseEntity response = restTemplate.exchange(deployment.getTokenUrl(), HttpMethod.POST, new HttpEntity<>(map, headers), Map.class); + if (!response.getStatusCode().equals(HttpStatus.OK) || response.getBody() == null) { + throw new AuthenticationServiceException("keycloak direct access grant http status " + response.getStatusCode().value()); + } + String accessTokenString = (String) response.getBody().get("access_token"); + String refreshTokenString = (String) response.getBody().get("refresh_token"); + if (accessTokenString == null || refreshTokenString == null) { + throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token"); + } + AccessToken accessToken = AdapterTokenVerifier.verifyToken(accessTokenString, deployment); + //todo cors settings + accessToken.setAllowedOrigins(Collections.singleton("*")); + + System.out.println("login successful"); + List realmRoles = accessToken.getRealmAccess().getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()); + + RefreshableKeycloakSecurityContext skSession = new RefreshableKeycloakSecurityContext(deployment, null, accessTokenString, accessToken, null, null, refreshTokenString); + String principalName = AdapterUtils.getPrincipalName(deployment, accessToken); + final KeycloakPrincipal principal = new KeycloakPrincipal<>(principalName, skSession); + + final Set roles = AdapterUtils.getRolesFromSecurityContext(skSession); + final KeycloakAccount account = new SimpleKeycloakAccount(principal, roles, skSession); + KeycloakAuthenticationToken keycloakAuthenticationToken = new KeycloakAuthenticationToken(account, false, realmRoles); + keycloakAuthenticationToken.setAuthenticated(true); + return keycloakAuthenticationToken; + + } catch (VerificationException vex) { + throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token", vex); + } catch (HttpClientErrorException.Unauthorized hceex) { + throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad credentials", hceex); + } + } + + @Override + public boolean supports(Class type) { + return UsernamePasswordAuthenticationToken.class.equals(type); + } +} diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java index da522ad13..fffe02360 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java @@ -4,11 +4,17 @@ import org.keycloak.adapters.springsecurity.KeycloakConfiguration; import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider; import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Bean; +import org.springframework.http.HttpStatus; +import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; +import org.springframework.security.config.core.GrantedAuthorityDefaults; import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper; +import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler; +import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler; import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy; import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy; import ru.spcex.clearing.backendapi.config.element.BackendApiSettings; @@ -42,17 +48,44 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter { // .formLogin() // .loginProcessingUrl("/backend-api-login/perform-login") // .and() + //todo remove? see ClearingCorsFilter + .cors() + .and() .csrf().disable() .authorizeRequests() .antMatchers("/anonymous/**").permitAll() .antMatchers("/sso/login").permitAll() + .antMatchers("/login").permitAll() .antMatchers("/error").permitAll() .antMatchers("/backend-api-login/**").permitAll() .anyRequest(); if (securityDisabled) { anyReq.permitAll(); } else { - anyReq.hasAnyRole("admin", "default-roles-master"); + anyReq.hasAnyRole("admin", "default-roles-master") + .and() + .formLogin() + .successHandler((req, res, auth) -> res.setStatus(HttpStatus.OK.value())) + .failureHandler(new SimpleUrlAuthenticationFailureHandler()) + .and() + .logout() + .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)) + ; } } + + + @Bean + public GrantedAuthorityDefaults grantedAuthorityDefaults() { + // Remove the ROLE_ prefix + return new GrantedAuthorityDefaults(""); + } + + @Autowired + private AuthenticationProvider authenticationProvider; + + @Override + protected void configure(AuthenticationManagerBuilder auth) throws Exception { + auth.authenticationProvider(authenticationProvider); + } } diff --git a/clearing-parent/backend-api/src/main/resources/keycloak.json b/clearing-parent/backend-api/src/main/resources/keycloak.json index 4c07b528d..2db328740 100644 --- a/clearing-parent/backend-api/src/main/resources/keycloak.json +++ b/clearing-parent/backend-api/src/main/resources/keycloak.json @@ -8,10 +8,10 @@ "cors-max-age" : 1000, "cors-allowed-methods" : "POST, PUT, DELETE, GET", "cors-exposed-headers" : "WWW-Authenticate", - "bearer-only" : false, + "bearer-only" : true, "enable-basic-auth" : false, "expose-token" : false, - "verify-token-audience" : true, + "verify-token-audience" : false, "credentials" : { "secret" : "WnOVCxcAmrUYc8IjiFHOuRif5Oesoyfr" },