treshenkov/clearing
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

http://jira.mfd.msk:8088/browse/CLS-9 --- keycloak custom login/logout endpoint

Browse source
This commit is contained in:
ialbert 2022-09-01 18:46:02 +03:00
parent a378efdb0b
commit ca94f3a784
5 changed files with 178 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java
View file

@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.http.converter.StringHttpMessageConverter;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.servlet.config.annotation.*;
import java.util.List;
@ -17,6 +18,8 @@ import java.util.function.Consumer;
@SuppressWarnings("Duplicates")
@Configuration
@EnableWebMvc
//todo remove? see ClearingCorsFilter
@CrossOrigin
public class WebConfig implements WebMvcConfigurer {
private final MappingJackson2HttpMessageConverter customJsonHttpConverter;
@ -61,4 +64,9 @@ public class WebConfig implements WebMvcConfigurer {
public WebServerFactoryCustomizer<ConfigurableServletWebServerFactory> enableDefaultServlet() {
return (factory) -> factory.setRegisterDefaultServlet(true);
}
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**").allowedMethods("*");
}
}

95
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java Normal file
View file

@ -0,0 +1,95 @@
package ru.spcex.clearing.backendapi.filter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
import ru.spcex.platform.utils.log.ExceptionUtils;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class ClearingCorsFilter extends OncePerRequestFilter {
private final Logger log = LoggerFactory.getLogger(getClass());
// private final AConfigurationProperties configuration;
//todo cors settings
private final String[] meth = new String[] {};//"*"
private final String[] orig = new String[] {};//"/**"
private final String[] head = new String[] {};
private final CorsAllowedOriginsService allowedOriginsService;
public ClearingCorsFilter(
// AConfigurationProperties configuration,
CorsAllowedOriginsService allowedOriginsService
) {
// this.configuration = configuration;
this.allowedOriginsService = allowedOriginsService;
}
final String H_ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
final String H_ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";
final String H_ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";
final String H_ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";
private void setHeaderValue(HttpServletResponse httpServletResponse, String headerName, String value) {
httpServletResponse.setHeader(headerName, value);
log.trace("cors filter -> set {} = {}", headerName, value);
}
@Override
protected void doFilterInternal(
HttpServletRequest httpServletRequest,
HttpServletResponse httpServletResponse,
FilterChain filterChain
) throws ServletException, IOException {
log.trace("cors filter -> url = {}{} ({})",
httpServletRequest.getServletPath(),
httpServletRequest.getRequestURI(),
httpServletRequest.getMethod()
);
try {
String requestedOrigin = httpServletRequest.getHeader("Origin");
String effectiveOrigin = allowedOriginsService.isAllowedOrigin(requestedOrigin)
? requestedOrigin
: "not-allowed-origin";
log.trace("cors filter -> effectiveOrigin={}", effectiveOrigin);
if (effectiveOrigin != null) {
setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_ORIGIN, effectiveOrigin);
// String methods;
// if (meth.length > 0) {
// methods = String.join(", ", meth).toUpperCase(Locale.ROOT);
// } else {
// methods = "*";
// }
// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, methods);
// String headers;
// if (head.length > 0) {
// headers = String.join(", ", head).toLowerCase(Locale.ROOT);
// } else {
// headers = "*";
// }
// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, headers);
setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
log.trace("cors filter -> added ok");
}
} catch (Exception e) {
log.error("cors filter -> {}", ExceptionUtils.getStackTrace(e));
}
if ("OPTIONS".equals(httpServletRequest.getMethod())) {
httpServletResponse.setStatus(HttpServletResponse.SC_OK);
} else {
filterChain.doFilter(httpServletRequest, httpServletResponse);
}
}
}

34
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java Normal file
View file

@ -0,0 +1,34 @@
package ru.spcex.clearing.backendapi.filter;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@Service
public class CorsAllowedOriginsService {
private final List<Pattern> originPatterns = new ArrayList<>();
//todo cors settings
public CorsAllowedOriginsService() {
for (String originRegex : new String[]{".*"}) {
originPatterns.add(Pattern.compile(originRegex));
}
}
public boolean isAllowedOrigin(String origin) {
String effectiveOrigin = origin == null ? "" : origin;
if (originPatterns.size() == 0)
return true;
for (Pattern originPattern : originPatterns) {
Matcher matcher = originPattern.matcher(effectiveOrigin);
if (matcher.find()) {
return true;
}
}
return false;
}
}

30
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java
View file

@ -1,8 +1,14 @@
package ru.spcex.clearing.backendapi.security;
import org.keycloak.KeycloakPrincipal;
import org.keycloak.adapters.AdapterUtils;
import org.keycloak.adapters.KeycloakConfigResolver;
import org.keycloak.adapters.KeycloakDeployment;
import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
import org.keycloak.adapters.rotation.AdapterTokenVerifier;
import org.keycloak.adapters.spi.KeycloakAccount;
import org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount;
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken;
import org.keycloak.common.VerificationException;
import org.keycloak.representations.AccessToken;
import org.springframework.beans.factory.annotation.Qualifier;
@ -21,8 +27,10 @@ import org.springframework.web.client.RestTemplate;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Collections;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.stream.Collectors;
@Component("keycloakRestAuthenticationProvider")
@ -57,22 +65,36 @@ public class KeycloakRestTemplateAuthenticationProvider implements Authenticatio
map.add("client_secret", (String) deployment.getResourceCredentials().get("secret"));
ResponseEntity<Map> response = restTemplate.exchange(deployment.getTokenUrl(), HttpMethod.POST, new HttpEntity<>(map, headers), Map.class);
if (!response.getStatusCode().equals(HttpStatus.OK) || response.getBody() == null) {
throw new AuthenticationServiceException("keycloak direct access grant http status " + response.getStatusCode().value());
}
String accessTokenString = (String) response.getBody().get("access_token");
String refreshTokenString = (String) response.getBody().get("refresh_token");
if (accessTokenString == null || refreshTokenString == null) {
throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token");
}
AccessToken accessToken = AdapterTokenVerifier.verifyToken(accessTokenString, deployment);
//todo cors settings
accessToken.setAllowedOrigins(Collections.singleton("*"));
System.out.println("login successful");
List<SimpleGrantedAuthority> realmRoles = accessToken.getRealmAccess().getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList());
return new UsernamePasswordAuthenticationToken(authentication.getName(), authentication.getCredentials(), realmRoles);
RefreshableKeycloakSecurityContext skSession = new RefreshableKeycloakSecurityContext(deployment, null, accessTokenString, accessToken, null, null, refreshTokenString);
String principalName = AdapterUtils.getPrincipalName(deployment, accessToken);
final KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = new KeycloakPrincipal<>(principalName, skSession);
final Set<String> roles = AdapterUtils.getRolesFromSecurityContext(skSession);
final KeycloakAccount account = new SimpleKeycloakAccount(principal, roles, skSession);
KeycloakAuthenticationToken keycloakAuthenticationToken = new KeycloakAuthenticationToken(account, false, realmRoles);
keycloakAuthenticationToken.setAuthenticated(true);
return keycloakAuthenticationToken;
} catch (VerificationException vex) {
throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token", vex);
} catch (HttpClientErrorException.Unauthorized hceex) {
throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad credentials", hceex);
}
}
@Override

16
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java
View file

@ -5,6 +5,7 @@ import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticatio
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
@ -12,6 +13,8 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.config.core.GrantedAuthorityDefaults;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler;
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
import ru.spcex.clearing.backendapi.config.element.BackendApiSettings;
@ -45,6 +48,9 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
// .formLogin()
// .loginProcessingUrl("/backend-api-login/perform-login")
// .and()
//todo remove? see ClearingCorsFilter
.cors()
.and()
.csrf().disable()
.authorizeRequests()
.antMatchers("/anonymous/**").permitAll()
@ -56,7 +62,15 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
if (securityDisabled) {
anyReq.permitAll();
} else {
anyReq.hasAnyRole("admin", "default-roles-master").and().formLogin();
anyReq.hasAnyRole("admin", "default-roles-master")
.and()
.formLogin()
.successHandler((req, res, auth) -> res.setStatus(HttpStatus.OK.value()))
.failureHandler(new SimpleUrlAuthenticationFailureHandler())
.and()
.logout()
.logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK))
;
}
}