diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java index 5fae605c4..2efd544b8 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java @@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration; import org.springframework.http.converter.HttpMessageConverter; import org.springframework.http.converter.StringHttpMessageConverter; import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter; +import org.springframework.web.bind.annotation.CrossOrigin; import org.springframework.web.servlet.config.annotation.*; import java.util.List; @@ -17,6 +18,8 @@ import java.util.function.Consumer; @SuppressWarnings("Duplicates") @Configuration @EnableWebMvc +//todo remove? see ClearingCorsFilter +@CrossOrigin public class WebConfig implements WebMvcConfigurer { private final MappingJackson2HttpMessageConverter customJsonHttpConverter; @@ -61,4 +64,9 @@ public class WebConfig implements WebMvcConfigurer { public WebServerFactoryCustomizer enableDefaultServlet() { return (factory) -> factory.setRegisterDefaultServlet(true); } + + @Override + public void addCorsMappings(CorsRegistry registry) { + registry.addMapping("/**").allowedMethods("*"); + } } diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java new file mode 100644 index 000000000..e805b0671 --- /dev/null +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java @@ -0,0 +1,95 @@ +package ru.spcex.clearing.backendapi.filter; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.core.Ordered; +import org.springframework.core.annotation.Order; +import org.springframework.stereotype.Component; +import org.springframework.web.filter.OncePerRequestFilter; +import ru.spcex.platform.utils.log.ExceptionUtils; + +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + +@Component +@Order(Ordered.HIGHEST_PRECEDENCE) +public class ClearingCorsFilter extends OncePerRequestFilter { + private final Logger log = LoggerFactory.getLogger(getClass()); + +// private final AConfigurationProperties configuration; + //todo cors settings + private final String[] meth = new String[] {};//"*" + private final String[] orig = new String[] {};//"/**" + private final String[] head = new String[] {}; + private final CorsAllowedOriginsService allowedOriginsService; + + public ClearingCorsFilter( +// AConfigurationProperties configuration, + CorsAllowedOriginsService allowedOriginsService + ) { +// this.configuration = configuration; + this.allowedOriginsService = allowedOriginsService; + } + + final String H_ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin"; + final String H_ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods"; + final String H_ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers"; + final String H_ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials"; + + private void setHeaderValue(HttpServletResponse httpServletResponse, String headerName, String value) { + httpServletResponse.setHeader(headerName, value); + log.trace("cors filter -> set {} = {}", headerName, value); + } + + @Override + protected void doFilterInternal( + HttpServletRequest httpServletRequest, + HttpServletResponse httpServletResponse, + FilterChain filterChain + ) throws ServletException, IOException { + log.trace("cors filter -> url = {}{} ({})", + httpServletRequest.getServletPath(), + httpServletRequest.getRequestURI(), + httpServletRequest.getMethod() + ); + try { + String requestedOrigin = httpServletRequest.getHeader("Origin"); + String effectiveOrigin = allowedOriginsService.isAllowedOrigin(requestedOrigin) + ? requestedOrigin + : "not-allowed-origin"; + log.trace("cors filter -> effectiveOrigin={}", effectiveOrigin); + if (effectiveOrigin != null) { + setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_ORIGIN, effectiveOrigin); + +// String methods; +// if (meth.length > 0) { +// methods = String.join(", ", meth).toUpperCase(Locale.ROOT); +// } else { +// methods = "*"; +// } +// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, methods); + +// String headers; +// if (head.length > 0) { +// headers = String.join(", ", head).toLowerCase(Locale.ROOT); +// } else { +// headers = "*"; +// } +// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, headers); + + setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + log.trace("cors filter -> added ok"); + } + } catch (Exception e) { + log.error("cors filter -> {}", ExceptionUtils.getStackTrace(e)); + } + if ("OPTIONS".equals(httpServletRequest.getMethod())) { + httpServletResponse.setStatus(HttpServletResponse.SC_OK); + } else { + filterChain.doFilter(httpServletRequest, httpServletResponse); + } + } +} diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java new file mode 100644 index 000000000..a6e40a570 --- /dev/null +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/CorsAllowedOriginsService.java @@ -0,0 +1,34 @@ +package ru.spcex.clearing.backendapi.filter; + +import org.springframework.stereotype.Service; + +import java.util.ArrayList; +import java.util.List; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +@Service +public class CorsAllowedOriginsService { + + private final List originPatterns = new ArrayList<>(); + + //todo cors settings + public CorsAllowedOriginsService() { + for (String originRegex : new String[]{".*"}) { + originPatterns.add(Pattern.compile(originRegex)); + } + } + + public boolean isAllowedOrigin(String origin) { + String effectiveOrigin = origin == null ? "" : origin; + if (originPatterns.size() == 0) + return true; + for (Pattern originPattern : originPatterns) { + Matcher matcher = originPattern.matcher(effectiveOrigin); + if (matcher.find()) { + return true; + } + } + return false; + } +} diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java index 585362485..5999a8cbf 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/KeycloakRestTemplateAuthenticationProvider.java @@ -1,8 +1,14 @@ package ru.spcex.clearing.backendapi.security; +import org.keycloak.KeycloakPrincipal; +import org.keycloak.adapters.AdapterUtils; import org.keycloak.adapters.KeycloakConfigResolver; import org.keycloak.adapters.KeycloakDeployment; +import org.keycloak.adapters.RefreshableKeycloakSecurityContext; import org.keycloak.adapters.rotation.AdapterTokenVerifier; +import org.keycloak.adapters.spi.KeycloakAccount; +import org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount; +import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken; import org.keycloak.common.VerificationException; import org.keycloak.representations.AccessToken; import org.springframework.beans.factory.annotation.Qualifier; @@ -21,8 +27,10 @@ import org.springframework.web.client.RestTemplate; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import java.util.Collections; import java.util.List; import java.util.Map; +import java.util.Set; import java.util.stream.Collectors; @Component("keycloakRestAuthenticationProvider") @@ -57,22 +65,36 @@ public class KeycloakRestTemplateAuthenticationProvider implements Authenticatio map.add("client_secret", (String) deployment.getResourceCredentials().get("secret")); ResponseEntity response = restTemplate.exchange(deployment.getTokenUrl(), HttpMethod.POST, new HttpEntity<>(map, headers), Map.class); - + if (!response.getStatusCode().equals(HttpStatus.OK) || response.getBody() == null) { + throw new AuthenticationServiceException("keycloak direct access grant http status " + response.getStatusCode().value()); + } String accessTokenString = (String) response.getBody().get("access_token"); - + String refreshTokenString = (String) response.getBody().get("refresh_token"); + if (accessTokenString == null || refreshTokenString == null) { + throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token"); + } AccessToken accessToken = AdapterTokenVerifier.verifyToken(accessTokenString, deployment); + //todo cors settings + accessToken.setAllowedOrigins(Collections.singleton("*")); System.out.println("login successful"); List realmRoles = accessToken.getRealmAccess().getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()); - return new UsernamePasswordAuthenticationToken(authentication.getName(), authentication.getCredentials(), realmRoles); + RefreshableKeycloakSecurityContext skSession = new RefreshableKeycloakSecurityContext(deployment, null, accessTokenString, accessToken, null, null, refreshTokenString); + String principalName = AdapterUtils.getPrincipalName(deployment, accessToken); + final KeycloakPrincipal principal = new KeycloakPrincipal<>(principalName, skSession); + + final Set roles = AdapterUtils.getRolesFromSecurityContext(skSession); + final KeycloakAccount account = new SimpleKeycloakAccount(principal, roles, skSession); + KeycloakAuthenticationToken keycloakAuthenticationToken = new KeycloakAuthenticationToken(account, false, realmRoles); + keycloakAuthenticationToken.setAuthenticated(true); + return keycloakAuthenticationToken; } catch (VerificationException vex) { throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad token", vex); } catch (HttpClientErrorException.Unauthorized hceex) { throw new AuthenticationServiceException("keycloak direct access grant auth failed: bad credentials", hceex); } - } @Override diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java index 5be99a5c0..fffe02360 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/WebSecurityConfig.java @@ -5,6 +5,7 @@ import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticatio import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; +import org.springframework.http.HttpStatus; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; @@ -12,6 +13,8 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer; import org.springframework.security.config.core.GrantedAuthorityDefaults; import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper; +import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler; +import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler; import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy; import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy; import ru.spcex.clearing.backendapi.config.element.BackendApiSettings; @@ -45,6 +48,9 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter { // .formLogin() // .loginProcessingUrl("/backend-api-login/perform-login") // .and() + //todo remove? see ClearingCorsFilter + .cors() + .and() .csrf().disable() .authorizeRequests() .antMatchers("/anonymous/**").permitAll() @@ -56,7 +62,15 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter { if (securityDisabled) { anyReq.permitAll(); } else { - anyReq.hasAnyRole("admin", "default-roles-master").and().formLogin(); + anyReq.hasAnyRole("admin", "default-roles-master") + .and() + .formLogin() + .successHandler((req, res, auth) -> res.setStatus(HttpStatus.OK.value())) + .failureHandler(new SimpleUrlAuthenticationFailureHandler()) + .and() + .logout() + .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)) + ; } }