diff --git a/clearing-parent/backend-api/pom.xml b/clearing-parent/backend-api/pom.xml index ea35a674c..f904cac27 100644 --- a/clearing-parent/backend-api/pom.xml +++ b/clearing-parent/backend-api/pom.xml @@ -57,6 +57,10 @@ ru.spcex.clearing dictionary + + ru.spcex.platform + platform-enum + diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java index 938127416..8f09f25c5 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java @@ -27,13 +27,11 @@ import org.springframework.util.MultiValueMap; import org.springframework.web.client.HttpClientErrorException; import org.springframework.web.client.RestTemplate; import ru.spcex.clearing.backendapi.service.UserAuthProcessor; +import ru.spcex.platform.enumeration.UserRole; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import java.util.Collections; -import java.util.List; -import java.util.Map; -import java.util.Set; +import java.util.*; import java.util.stream.Collectors; @Component("keycloakRestAuthenticationProvider") @@ -44,6 +42,13 @@ public class KeycloakRestTemplateAuthenticationProvider implements Authenticatio private final HttpServletResponse currentHttpResponse; private final RestTemplate restTemplate; private final UserAuthProcessor userAutoCreation; + private final static Map roleMapping = new HashMap<>(); + + static { + roleMapping.put("CS_MKR_ADMIN", UserRole.Admin); + roleMapping.put("CS_MKR_SUPERVISER", UserRole.Superviser); + roleMapping.put("CS_MKR_SECURITY", UserRole.Security); + } public KeycloakRestTemplateAuthenticationProvider(KeycloakConfigResolver resolver, HttpServletRequest currentHttpRequest, HttpServletResponse currentHttpResponse, @Qualifier("clearing-rest") RestTemplate restTemplate, UserAuthProcessor userAutoCreation) { @@ -82,12 +87,20 @@ public class KeycloakRestTemplateAuthenticationProvider implements Authenticatio AccessToken accessToken = AdapterTokenVerifier.verifyToken(accessTokenString, deployment); //todo cors settings accessToken.setAllowedOrigins(Collections.singleton("*")); - List realmRoles = accessToken.getRealmAccess().getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()); RefreshableKeycloakSecurityContext skSession = new RefreshableKeycloakSecurityContext(deployment, null, accessTokenString, accessToken, null, null, refreshTokenString); String principalName = AdapterUtils.getPrincipalName(deployment, accessToken); final KeycloakPrincipal principal = new KeycloakPrincipal<>(principalName, skSession); - final Set roles = AdapterUtils.getRolesFromSecurityContext(skSession); + Set roles = AdapterUtils.getRolesFromSecurityContext(skSession); + roles = roles + .stream() + .map(s -> { + UserRole userRole = roleMapping.get(s); + return userRole != null ? userRole.getKey() : null; + }) + .filter(Objects::nonNull) + .collect(Collectors.toSet()); + List realmRoles = roles.stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()); final KeycloakAccount account = new SimpleKeycloakAccount(principal, roles, skSession); KeycloakAuthenticationToken keycloakAuthenticationToken = new KeycloakAuthenticationToken(account, false, realmRoles); keycloakAuthenticationToken.setAuthenticated(true); diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java index 3d5a25a21..2100f9166 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java @@ -18,6 +18,7 @@ import org.springframework.security.web.authentication.session.SessionAuthentica import ru.spcex.clearing.backendapi.config.element.BackendApiSettings; import ru.spcex.clearing.backendapi.security.handlers.AuthAuditSuccessLoginHandler; import ru.spcex.clearing.backendapi.security.handlers.LogoutAuditSuccessHandler; +import ru.spcex.platform.enumeration.UserRole; @KeycloakConfiguration @EnableGlobalMethodSecurity(prePostEnabled = true) @@ -68,7 +69,7 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter { if (securityDisabled) { anyReq.permitAll(); } else { - anyReq.hasAnyRole("admin", "default-roles-master") + anyReq.hasAnyRole(UserRole.Admin.getKey(), UserRole.Security.getKey(), UserRole.Superviser.getKey()) .and() .formLogin() .successHandler(loginSuccessHandler) diff --git a/clearing-parent/utility-service/src/main/java/ru/spcex/clearing/utility/service/UserService.java b/clearing-parent/utility-service/src/main/java/ru/spcex/clearing/utility/service/UserService.java index 703844915..6856fe3d7 100644 --- a/clearing-parent/utility-service/src/main/java/ru/spcex/clearing/utility/service/UserService.java +++ b/clearing-parent/utility-service/src/main/java/ru/spcex/clearing/utility/service/UserService.java @@ -20,12 +20,12 @@ import ru.spcex.platform.enumeration.Status; import ru.spcex.platform.enumeration.UserRole; import ru.spcex.platform.imdg.api.Imdg; import ru.spcex.platform.imdg.api.ImdgProvider; +import ru.spcex.platform.utils.enumeration.IEnumKey; import java.time.Instant; import java.time.LocalDate; import java.util.Collection; import java.util.Collections; -import java.util.HashMap; import java.util.Map; import java.util.function.Function; import java.util.stream.Collectors; @@ -33,14 +33,6 @@ import java.util.stream.Stream; @Service public class UserService extends QueueConsumer implements InitializingBean { - private final static Map roleMapping = new HashMap<>(); - - static { - roleMapping.put("CS_MKR_ADMIN", UserRole.Admin); - roleMapping.put("CS_MKR_SUPERVISER", UserRole.Superviser); - roleMapping.put("CS_MKR_SECURITY", UserRole.Security); - } - private final Logger log = LoggerFactory.getLogger(getClass()); private final Imdg userMap; private final Imdg userRoleSessionImdg; @@ -55,11 +47,16 @@ public class UserService extends QueueConsumer implements InitializingBean { } static Collection defineAllRoleChanges(Collection presentRoles, Collection authRoles) { - Collection finalAuthRoles = authRoles.stream().flatMap((Function>) keycloakRole -> { - UserRole userRole = roleMapping.get(keycloakRole); - if (userRole == null) return Stream.empty(); - return Stream.of(userRole.getKey()); - }).collect(Collectors.toList()); + Collection finalAuthRoles = authRoles + .stream() + .flatMap((Function>) s -> { + if (IEnumKey.getEnumByKey(UserRole.class, s) != null) { + return Stream.of(s); + } else { + return Stream.empty(); + } + }) + .collect(Collectors.toList()); return Stream.concat( presentRoles .stream() diff --git a/clearing-parent/utility-service/src/test/java/ru/spcex/clearing/utility/service/UserServiceChangeRolesTest.java b/clearing-parent/utility-service/src/test/java/ru/spcex/clearing/utility/service/UserServiceChangeRolesTest.java index 7345be000..caee92fae 100644 --- a/clearing-parent/utility-service/src/test/java/ru/spcex/clearing/utility/service/UserServiceChangeRolesTest.java +++ b/clearing-parent/utility-service/src/test/java/ru/spcex/clearing/utility/service/UserServiceChangeRolesTest.java @@ -20,7 +20,7 @@ class UserServiceChangeRolesTest { public void testTwoNewRoles() { Collection userRoles = new ArrayList<>(); userRoles.add(generate(UserRole.Admin.getKey(), Status.Active)); - Collection methodsFromAuth = List.of("CS_MKR_ADMIN", "CS_MKR_SUPERVISER", "CS_MKR_SECURITY"); + Collection methodsFromAuth = List.of(UserRole.Admin.getKey(), UserRole.Superviser.getKey(), UserRole.Security.getKey()); Collection roleActions = UserService.defineAllRoleChanges(userRoles, methodsFromAuth); assertEquals(2, roleActions.size()); @@ -35,7 +35,7 @@ class UserServiceChangeRolesTest { Collection userRoles = new ArrayList<>(); userRoles.add(generate(UserRole.Admin.getKey(), Status.Active)); userRoles.add(generate(UserRole.Superviser.getKey(), Status.Active)); - Collection methodsFromAuth = List.of("CS_MKR_ADMIN", "CS_MKR_SECURITY"); + Collection methodsFromAuth = List.of(UserRole.Admin.getKey(), UserRole.Security.getKey()); Collection roleActions = UserService.defineAllRoleChanges(userRoles, methodsFromAuth); assertEquals(2, roleActions.size()); @@ -49,7 +49,7 @@ class UserServiceChangeRolesTest { @Test public void testAllNew() { Collection userRoles = new ArrayList<>(); - Collection methodsFromAuth = List.of("CS_MKR_ADMIN", "CS_MKR_SUPERVISER", "CS_MKR_SECURITY", "unknownRole"); + Collection methodsFromAuth = List.of(UserRole.Admin.getKey(), UserRole.Superviser.getKey(), UserRole.Security.getKey(), "unknownRole"); Collection roleActions = UserService.defineAllRoleChanges(userRoles, methodsFromAuth); assertEquals(3, roleActions.size()); @@ -66,7 +66,7 @@ class UserServiceChangeRolesTest { Collection userRoles = new ArrayList<>(); userRoles.add(generate(UserRole.Admin.getKey(), Status.Active)); userRoles.add(generate(UserRole.Superviser.getKey(), Status.Active)); - Collection methodsFromAuth = List.of("CS_MKR_ADMIN", "CS_MKR_SUPERVISER", "CS_MKR_SECURITY", "Cs_mkr_superviser", "unknownRole"); + Collection methodsFromAuth = List.of(UserRole.Admin.getKey(), UserRole.Superviser.getKey(), UserRole.Security.getKey(), "Cs_mkr_superviser", "unknownRole"); Collection roleActions = UserService.defineAllRoleChanges(userRoles, methodsFromAuth); assertEquals(1, roleActions.size());