diff --git a/servlet/java-configuration/authentication/x509/build.gradle b/servlet/java-configuration/authentication/x509/build.gradle new file mode 100644 index 0000000..fff1dc6 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/build.gradle @@ -0,0 +1,35 @@ +plugins { + id "java" + id "nebula.integtest" version "7.0.9" + id "org.gretty" version "3.0.3" + id "war" +} + +apply from: "gradle/gretty.gradle" + +repositories { + jcenter() + maven { url "https://repo.spring.io/snapshot" } +} + +dependencies { + implementation platform("org.springframework:spring-framework-bom:5.3.0") + implementation platform("org.springframework.security:spring-security-bom:5.5.0-SNAPSHOT") + implementation platform("org.junit:junit-bom:5.7.0") + + implementation "org.springframework.security:spring-security-config" + implementation "org.springframework.security:spring-security-web" + implementation "org.springframework:spring-webmvc" + implementation "org.apache.httpcomponents:httpclient:4.5.13" + + testImplementation "org.assertj:assertj-core:3.18.0" + testImplementation "org.springframework:spring-test" + testImplementation "org.springframework.security:spring-security-test" + testImplementation("org.junit.jupiter:junit-jupiter-api") + + testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine") +} + +tasks.withType(Test).configureEach { + useJUnitPlatform() +} diff --git a/servlet/java-configuration/authentication/x509/gradle.properties b/servlet/java-configuration/authentication/x509/gradle.properties new file mode 100644 index 0000000..fe89f6a --- /dev/null +++ b/servlet/java-configuration/authentication/x509/gradle.properties @@ -0,0 +1 @@ +tomcat85Version=8.5.54 diff --git a/servlet/java-configuration/authentication/x509/gradle/gretty.gradle b/servlet/java-configuration/authentication/x509/gradle/gretty.gradle new file mode 100644 index 0000000..3df1479 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/gradle/gretty.gradle @@ -0,0 +1,41 @@ +gretty { + servletContainer = "tomcat85" + contextPath = "/" + fileLogEnabled = false + integrationTestTask = 'integrationTest' +} + +Task prepareAppServerForIntegrationTests = project.tasks.create('prepareAppServerForIntegrationTests') { + group = 'Verification' + description = 'Prepares the app server for integration tests' + doFirst { + project.gretty { + httpPort = -1 + } + } +} + +project.tasks.matching { it.name == "appBeforeIntegrationTest" }.all { task -> + task.dependsOn prepareAppServerForIntegrationTests +} + +project.tasks.matching { it.name == "integrationTest" }.all { + task -> task.doFirst { + def gretty = project.gretty + String host = project.gretty.host ?: 'localhost' + boolean isHttps = gretty.httpsEnabled + Integer httpPort = integrationTest.systemProperties['gretty.httpPort'] + Integer httpsPort = integrationTest.systemProperties['gretty.httpsPort'] + int port = isHttps ? httpsPort : httpPort + String contextPath = project.gretty.contextPath + String httpBaseUrl = "http://${host}:${httpPort}${contextPath}" + String httpsBaseUrl = "https://${host}:${httpsPort}${contextPath}" + String baseUrl = isHttps ? httpsBaseUrl : httpBaseUrl + integrationTest.systemProperty 'app.port', port + integrationTest.systemProperty 'app.httpPort', httpPort + integrationTest.systemProperty 'app.httpsPort', httpsPort + integrationTest.systemProperty 'app.baseURI', baseUrl + integrationTest.systemProperty 'app.httpBaseURI', httpBaseUrl + integrationTest.systemProperty 'app.httpsBaseURI', httpsBaseUrl + } +} \ No newline at end of file diff --git a/servlet/java-configuration/authentication/x509/gradle/wrapper/gradle-wrapper.jar b/servlet/java-configuration/authentication/x509/gradle/wrapper/gradle-wrapper.jar new file mode 100644 index 0000000..62d4c05 Binary files /dev/null and b/servlet/java-configuration/authentication/x509/gradle/wrapper/gradle-wrapper.jar differ diff --git a/servlet/java-configuration/authentication/x509/gradle/wrapper/gradle-wrapper.properties b/servlet/java-configuration/authentication/x509/gradle/wrapper/gradle-wrapper.properties new file mode 100644 index 0000000..be52383 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/gradle/wrapper/gradle-wrapper.properties @@ -0,0 +1,5 @@ +distributionBase=GRADLE_USER_HOME +distributionPath=wrapper/dists +distributionUrl=https\://services.gradle.org/distributions/gradle-6.7-bin.zip +zipStoreBase=GRADLE_USER_HOME +zipStorePath=wrapper/dists diff --git a/servlet/java-configuration/authentication/x509/gradlew b/servlet/java-configuration/authentication/x509/gradlew new file mode 100755 index 0000000..fbd7c51 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/gradlew @@ -0,0 +1,185 @@ +#!/usr/bin/env sh + +# +# Copyright 2015 the original author or authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +############################################################################## +## +## Gradle start up script for UN*X +## +############################################################################## + +# Attempt to set APP_HOME +# Resolve links: $0 may be a link +PRG="$0" +# Need this for relative symlinks. +while [ -h "$PRG" ] ; do + ls=`ls -ld "$PRG"` + link=`expr "$ls" : '.*-> \(.*\)$'` + if expr "$link" : '/.*' > /dev/null; then + PRG="$link" + else + PRG=`dirname "$PRG"`"/$link" + fi +done +SAVED="`pwd`" +cd "`dirname \"$PRG\"`/" >/dev/null +APP_HOME="`pwd -P`" +cd "$SAVED" >/dev/null + +APP_NAME="Gradle" +APP_BASE_NAME=`basename "$0"` + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD="maximum" + +warn () { + echo "$*" +} + +die () { + echo + echo "$*" + echo + exit 1 +} + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "`uname`" in + CYGWIN* ) + cygwin=true + ;; + Darwin* ) + darwin=true + ;; + MINGW* ) + msys=true + ;; + NONSTOP* ) + nonstop=true + ;; +esac + +CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD="$JAVA_HOME/jre/sh/java" + else + JAVACMD="$JAVA_HOME/bin/java" + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD="java" + which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." +fi + +# Increase the maximum file descriptors if we can. +if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then + MAX_FD_LIMIT=`ulimit -H -n` + if [ $? -eq 0 ] ; then + if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then + MAX_FD="$MAX_FD_LIMIT" + fi + ulimit -n $MAX_FD + if [ $? -ne 0 ] ; then + warn "Could not set maximum file descriptor limit: $MAX_FD" + fi + else + warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" + fi +fi + +# For Darwin, add options to specify how the application appears in the dock +if $darwin; then + GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" +fi + +# For Cygwin or MSYS, switch paths to Windows format before running java +if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then + APP_HOME=`cygpath --path --mixed "$APP_HOME"` + CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` + + JAVACMD=`cygpath --unix "$JAVACMD"` + + # We build the pattern for arguments to be converted via cygpath + ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` + SEP="" + for dir in $ROOTDIRSRAW ; do + ROOTDIRS="$ROOTDIRS$SEP$dir" + SEP="|" + done + OURCYGPATTERN="(^($ROOTDIRS))" + # Add a user-defined pattern to the cygpath arguments + if [ "$GRADLE_CYGPATTERN" != "" ] ; then + OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" + fi + # Now convert the arguments - kludge to limit ourselves to /bin/sh + i=0 + for arg in "$@" ; do + CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` + CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option + + if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition + eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` + else + eval `echo args$i`="\"$arg\"" + fi + i=`expr $i + 1` + done + case $i in + 0) set -- ;; + 1) set -- "$args0" ;; + 2) set -- "$args0" "$args1" ;; + 3) set -- "$args0" "$args1" "$args2" ;; + 4) set -- "$args0" "$args1" "$args2" "$args3" ;; + 5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; + 6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; + 7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; + 8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; + 9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; + esac +fi + +# Escape application args +save () { + for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done + echo " " +} +APP_ARGS=`save "$@"` + +# Collect all arguments for the java command, following the shell quoting and substitution rules +eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" + +exec "$JAVACMD" "$@" diff --git a/servlet/java-configuration/authentication/x509/gradlew.bat b/servlet/java-configuration/authentication/x509/gradlew.bat new file mode 100644 index 0000000..a9f778a --- /dev/null +++ b/servlet/java-configuration/authentication/x509/gradlew.bat @@ -0,0 +1,104 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem + +@if "%DEBUG%" == "" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%" == "" set DIRNAME=. +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if "%ERRORLEVEL%" == "0" goto init + +echo. +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto init + +echo. +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:init +@rem Get command-line arguments, handling Windows variants + +if not "%OS%" == "Windows_NT" goto win9xME_args + +:win9xME_args +@rem Slurp the command line arguments. +set CMD_LINE_ARGS= +set _SKIP=2 + +:win9xME_args_slurp +if "x%~1" == "x" goto execute + +set CMD_LINE_ARGS=%* + +:execute +@rem Setup the command line + +set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS% + +:end +@rem End local scope for the variables with windows NT shell +if "%ERRORLEVEL%"=="0" goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 +exit /b 1 + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega diff --git a/servlet/java-configuration/authentication/x509/server/ca.pem b/servlet/java-configuration/authentication/x509/server/ca.pem new file mode 100644 index 0000000..a5b52ca --- /dev/null +++ b/servlet/java-configuration/authentication/x509/server/ca.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDojCCAoqgAwIBAgIEMKX1dzANBgkqhkiG9w0BAQUFADCBiTELMAkGA1UEBhMC +R0IxETAPBgNVBAgTCFNjb3RsYW5kMRAwDgYDVQQHEwdHbGFzZ293MRkwFwYDVQQK +ExBTcHJpbmcgRnJhbWV3b3JrMRgwFgYDVQQLEw9TcHJpbmcgU2VjdXJpdHkxIDAe +BgNVBAMTF1NwcmluZyBTZWN1cml0eSBUZXN0IENBMB4XDTA4MDEyNTExMTIyMVoX +DTE4MDIyNTAwMDAwMFowgYkxCzAJBgNVBAYTAkdCMREwDwYDVQQIEwhTY290bGFu +ZDEQMA4GA1UEBxMHR2xhc2dvdzEZMBcGA1UEChMQU3ByaW5nIEZyYW1ld29yazEY +MBYGA1UECxMPU3ByaW5nIFNlY3VyaXR5MSAwHgYDVQQDExdTcHJpbmcgU2VjdXJp +dHkgVGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALzl/wEe +snYrwqaGZuB8hmwACtptazh1+eXCfd66FkioxlLF7yTnjCC7DT+vmMgSuThIEIsN +xlxLpEgyU3bU8GIuR8wyYIyvuSMcptdFJLV7NKYuRycxpDuqimTM7Br0nfNgKVEv +1QwguGWr6YN3aZ68/xe/D5xyPhakKu++7VFXIXw9f0+nqojdrFTqQ6l9GAVRgfX6 +h4JOaV1VFx83y2pnFj0iFneVxRcvXyWnyXlcOvJDIyVuyS/hYxb+E5rtBvp5XQ0o +5CP4OMwCZGx/jEqlL8oO7BwEgu9aEBxKvoIKJmHDTHgWIxgawTrKabmong4utnMI +yNrhsI77bmh2U7UCAwEAAaMQMA4wDAYDVR0PBAUDAwcGADANBgkqhkiG9w0BAQUF +AAOCAQEAuD8W9Ukkfyi0y65mwguFVAqBC3RSTMRXcjbLQV4rMDM/Q9kjA6acY4Ta +WgxGTwNCydqaqwDVsmn+6Je8Lp2xm9KLDLypVdNopGs+Mlfo55dhwqymXkQw1oJI +CPhR3nBmGEnSWW0UY9bPlpxRF2D5GDVwpuxDtXvWa4baPwRRI9MxwPWHA3ITl+fc +s9QVKy+pRAnuP9MSIp755cJ1CODOn2ElNCqnxxsZmcWcmI3LkHAwTmegl3PVvhrk +MKMEA/neshh/M/hWGNTFt77Hoa7pU9dv5RCWFvZPqsUgPrwGrmUvcmSDir3lSWQm +SuSED2LKVo+BFqwWS+jp49AR9b8B/Q== +-----END CERTIFICATE----- diff --git a/servlet/java-configuration/authentication/x509/server/dianne.p12 b/servlet/java-configuration/authentication/x509/server/dianne.p12 new file mode 100644 index 0000000..6e5ba21 Binary files /dev/null and b/servlet/java-configuration/authentication/x509/server/dianne.p12 differ diff --git a/servlet/java-configuration/authentication/x509/server/rod.p12 b/servlet/java-configuration/authentication/x509/server/rod.p12 new file mode 100644 index 0000000..4cd0564 Binary files /dev/null and b/servlet/java-configuration/authentication/x509/server/rod.p12 differ diff --git a/servlet/java-configuration/authentication/x509/server/scott.p12 b/servlet/java-configuration/authentication/x509/server/scott.p12 new file mode 100644 index 0000000..f0a6357 Binary files /dev/null and b/servlet/java-configuration/authentication/x509/server/scott.p12 differ diff --git a/servlet/java-configuration/authentication/x509/server/server.jks b/servlet/java-configuration/authentication/x509/server/server.jks new file mode 100644 index 0000000..aaa1119 Binary files /dev/null and b/servlet/java-configuration/authentication/x509/server/server.jks differ diff --git a/servlet/java-configuration/authentication/x509/server/tomcat.xml b/servlet/java-configuration/authentication/x509/server/tomcat.xml new file mode 100644 index 0000000..5e60156 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/server/tomcat.xml @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/servlet/java-configuration/authentication/x509/settings.gradle b/servlet/java-configuration/authentication/x509/settings.gradle new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/settings.gradle @@ -0,0 +1 @@ + diff --git a/servlet/java-configuration/authentication/x509/src/integTest/java/example/X509Tests.java b/servlet/java-configuration/authentication/x509/src/integTest/java/example/X509Tests.java new file mode 100644 index 0000000..859272a --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/integTest/java/example/X509Tests.java @@ -0,0 +1,84 @@ +/* + * Copyright 2002-2018 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package example; + +import java.security.KeyStore; + +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLHandshakeException; + +import org.apache.http.conn.ssl.SSLConnectionSocketFactory; +import org.apache.http.impl.client.CloseableHttpClient; +import org.apache.http.impl.client.HttpClients; +import org.apache.http.ssl.SSLContexts; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; + +import org.springframework.core.io.ClassPathResource; +import org.springframework.http.ResponseEntity; +import org.springframework.http.client.ClientHttpRequestFactory; +import org.springframework.http.client.HttpComponentsClientHttpRequestFactory; +import org.springframework.web.client.RestTemplate; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatCode; + +/** + * Test the Hello World application. + * + * @author Michael Simons + */ +public class X509Tests { + + private int port; + + @BeforeEach + void setup() { + this.port = Integer.parseInt(System.getProperty("app.httpPort", "8443")); + } + + @Test + void notCertificateThenSslHandshakeException() { + RestTemplate rest = new RestTemplate(); + assertThatCode(() -> rest.getForEntity("https://localhost:8443/", String.class)) + .hasCauseInstanceOf(SSLHandshakeException.class); + } + + @Test + void certificateThenStatusOk() throws Exception { + ClassPathResource serverKeystore = new ClassPathResource("/certs/server.p12"); + KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); + keyStore.load(serverKeystore.getInputStream(), "password".toCharArray()); + // @formatter:off + SSLContext sslContext = SSLContexts.custom() + .loadKeyMaterial(keyStore, "password".toCharArray(), (aliases, socket) -> "client") + .loadTrustMaterial(keyStore, null) + .build(); + + SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext, + new String[]{"TLSv1.2", "TLSv1.1"}, + null, + SSLConnectionSocketFactory.getDefaultHostnameVerifier()); + // @formatter:on + + CloseableHttpClient httpClient = HttpClients.custom().setSSLSocketFactory(socketFactory).build(); + ClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory(httpClient); + RestTemplate rest = new RestTemplate(requestFactory); + ResponseEntity responseEntity = rest.getForEntity("https://localhost:8443/me", String.class); + assertThat(responseEntity).extracting((result) -> result.getStatusCode().is2xxSuccessful()).isEqualTo(true); + } + +} diff --git a/servlet/java-configuration/authentication/x509/src/main/java/example/ApplicationConfiguration.java b/servlet/java-configuration/authentication/x509/src/main/java/example/ApplicationConfiguration.java new file mode 100644 index 0000000..9b01227 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/java/example/ApplicationConfiguration.java @@ -0,0 +1,26 @@ +/* + * Copyright 2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package example; + +import org.springframework.context.annotation.ComponentScan; +import org.springframework.context.annotation.Configuration; + +@Configuration +@ComponentScan +public class ApplicationConfiguration { + +} diff --git a/servlet/java-configuration/authentication/x509/src/main/java/example/MeController.java b/servlet/java-configuration/authentication/x509/src/main/java/example/MeController.java new file mode 100644 index 0000000..ff4c7ea --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/java/example/MeController.java @@ -0,0 +1,38 @@ +/* + * Copyright 2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package example; + +import java.security.Principal; + +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RestController; + +/** + * Says hello to the current user. + * + * @author Rob Winch + * @since 5.5 + */ +@RestController +public class MeController { + + @GetMapping("/me") + public String me(Principal principal) { + return "Hello, " + principal.getName(); + } + +} diff --git a/servlet/java-configuration/authentication/x509/src/main/java/example/MvcWebApplicationInitializer.java b/servlet/java-configuration/authentication/x509/src/main/java/example/MvcWebApplicationInitializer.java new file mode 100644 index 0000000..a45eec0 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/java/example/MvcWebApplicationInitializer.java @@ -0,0 +1,46 @@ +/* + * Copyright 2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package example; + +import javax.servlet.Filter; + +import org.springframework.web.filter.HiddenHttpMethodFilter; +import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer; + +public class MvcWebApplicationInitializer extends AbstractAnnotationConfigDispatcherServletInitializer { + + @Override + protected Class[] getRootConfigClasses() { + return null; + } + + @Override + protected Class[] getServletConfigClasses() { + return new Class[] { ApplicationConfiguration.class }; + } + + @Override + protected String[] getServletMappings() { + return new String[] { "/" }; + } + + @Override + protected Filter[] getServletFilters() { + return new Filter[] { new HiddenHttpMethodFilter() }; + } + +} diff --git a/servlet/java-configuration/authentication/x509/src/main/java/example/SecurityConfiguration.java b/servlet/java-configuration/authentication/x509/src/main/java/example/SecurityConfiguration.java new file mode 100644 index 0000000..2006a22 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/java/example/SecurityConfiguration.java @@ -0,0 +1,71 @@ +/* + * Copyright 2002-2016 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package example; + +import org.springframework.context.annotation.Bean; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.core.userdetails.User; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.security.core.userdetails.UserDetailsService; +import org.springframework.security.provisioning.InMemoryUserDetailsManager; + +import static org.springframework.security.config.Customizer.withDefaults; + +@EnableWebSecurity +public class SecurityConfiguration extends WebSecurityConfigurerAdapter { + + @Override + // @formatter:off + protected void configure(HttpSecurity http) throws Exception { + http + .authorizeRequests((authorizeRequests) -> + authorizeRequests + .anyRequest().authenticated() + ) + .x509(withDefaults()); + } + // @formatter:on + + // @formatter:off + @Bean + public UserDetailsService userDetailsService() { + UserDetails user = User.withDefaultPasswordEncoder() + .username("client") + .password("password") + .roles("USER") + .build(); + UserDetails dianne = User.withDefaultPasswordEncoder() + .username("dianne") + .password("password") + .roles("USER") + .build(); + UserDetails rod = User.withDefaultPasswordEncoder() + .username("rod") + .password("password") + .roles("USER", "ADMIN") + .build(); + UserDetails scott = User.withDefaultPasswordEncoder() + .username("scott") + .password("password") + .roles("USER") + .build(); + return new InMemoryUserDetailsManager(user, dianne, rod, scott); + } + // @formatter:on + +} diff --git a/servlet/java-configuration/authentication/x509/src/main/java/example/SecurityWebApplicationInitializer.java b/servlet/java-configuration/authentication/x509/src/main/java/example/SecurityWebApplicationInitializer.java new file mode 100644 index 0000000..848385d --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/java/example/SecurityWebApplicationInitializer.java @@ -0,0 +1,35 @@ +/* + * Copyright 2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package example; + +import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer; +import org.springframework.security.web.session.HttpSessionEventPublisher; + +/** + * We customize {@link AbstractSecurityWebApplicationInitializer} to enable the + * {@link HttpSessionEventPublisher}. + * + * @author Rob Winch + */ +public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer { + + @Override + protected boolean enableHttpSessionEventPublisher() { + return true; + } + +} diff --git a/servlet/java-configuration/authentication/x509/src/main/java/example/WebMvcConfiguration.java b/servlet/java-configuration/authentication/x509/src/main/java/example/WebMvcConfiguration.java new file mode 100644 index 0000000..07f5af3 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/java/example/WebMvcConfiguration.java @@ -0,0 +1,26 @@ +/* + * Copyright 2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package example; + +import org.springframework.context.annotation.Configuration; +import org.springframework.web.servlet.config.annotation.EnableWebMvc; + +@EnableWebMvc +@Configuration +public class WebMvcConfiguration { + +} diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.cer b/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.cer new file mode 100644 index 0000000..c9ddc65 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.cer @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDXTCCAkWgAwIBAgIEKA49bjANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJV +UzELMAkGA1UECBMCSUwxEDAOBgNVBAcTB0NoaWNhZ28xDzANBgNVBAoTBnNwcmlu +ZzERMA8GA1UECxMIc2VjdXJpdHkxDTALBgNVBAMTBHVzZXIwHhcNMjAwNzI3MTk0 +MjUyWhcNMjAxMDI1MTk0MjUyWjBfMQswCQYDVQQGEwJVUzELMAkGA1UECBMCSUwx +EDAOBgNVBAcTB0NoaWNhZ28xDzANBgNVBAoTBnNwcmluZzERMA8GA1UECxMIc2Vj +dXJpdHkxDTALBgNVBAMTBHVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQC33N+wH+nJ5XmAOmX1JqMeqTRInJvoyOxV4x1mf4sUjbbXl0awFmUHQE8M +WgzzcmThUrqc2z4Qk/QA8Wm7WRduFv249zqkzUrAS6/pjq7S5D23xjvFXTrhv9QI +6orwEr4iiucY2CEyw116p20LGvh8dc4SX45HsNHrX4ubvWRL2MXEDdvnL36Ns5Pv +ZVJfGDfNDxLoP9oInAhi8IlrGC//Sc+i232E37/xgdJuT20Fsy2P2ZILUYonUm6S +LihzcXigC5e0dUn1qinFaJWxW61Tkm4vFbIAdlskmlAB21ZRyTfRAM5p4GJyc/LV +zMBb5d6ETyvrtK/dC/b1QLdqb9jxAgMBAAGjITAfMB0GA1UdDgQWBBRRhhAO2eX1 +10oOKyHWbKWPItZr0TANBgkqhkiG9w0BAQsFAAOCAQEAAHiqijmO473ATu3Qc60n +I6SwfHYa4nDMNO2zPkIA/GWb5aHtyyi8aODVUhGpU5TK+2IJ+H5eK1aRm4nC+NHm +r8+UkWfxmi0KPboPTjU+kgPONrKe+6Wz3T9ba6lbQHNXeF0oUOB/TIpznujfhKfh +6tJOK5A/Y4dw21hE36PO1LlY0IL4xjsZisvcgg1QvvpfBi5bbS0HxuXmK1+sGc4B +G5oZ5pLGV39Y10PliS7CoSf1ItisgrZsfIsaZsQuyE9/NhuwT6i+E35qVNMH0Ak3 +YJgrlseA9CrQ72HJgWTORwutrbXjyA3UxE3CZ7YYaFKhCOqT+rm9blTUckzXxqL7 +sg== +-----END CERTIFICATE----- diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.keystore b/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.keystore new file mode 100644 index 0000000..e69de29 diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.pem b/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.pem new file mode 100644 index 0000000..abfcdba --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/resources/certs/client.pem @@ -0,0 +1,32 @@ +Bag Attributes + friendlyName: user + localKeyID: 54 69 6D 65 20 31 35 39 35 38 37 38 39 37 32 38 39 35 +Key Attributes: +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC33N+wH+nJ5XmA +OmX1JqMeqTRInJvoyOxV4x1mf4sUjbbXl0awFmUHQE8MWgzzcmThUrqc2z4Qk/QA +8Wm7WRduFv249zqkzUrAS6/pjq7S5D23xjvFXTrhv9QI6orwEr4iiucY2CEyw116 +p20LGvh8dc4SX45HsNHrX4ubvWRL2MXEDdvnL36Ns5PvZVJfGDfNDxLoP9oInAhi +8IlrGC//Sc+i232E37/xgdJuT20Fsy2P2ZILUYonUm6SLihzcXigC5e0dUn1qinF +aJWxW61Tkm4vFbIAdlskmlAB21ZRyTfRAM5p4GJyc/LVzMBb5d6ETyvrtK/dC/b1 +QLdqb9jxAgMBAAECggEAOjSPD8eakFK3+xMBsfEQVKWGKrKBXNk2kB388bTQx6nx +RyDZvObqBriiDav4S51cOESjVQLHDCJ6bU3/hdK3ax+WJNcHVqKy1ltfjhWgXJzq +uOHljB5uhIbgzg3J/CRC0tacQC4znElir3CPQaPBJE169jAP77wXSGcP4Da9qJCm +6Lb8EOMccciBowaZ9yhp7Nv7tPh4kQ/syfunjOwBQPtBhH7OFI8vQ/jmfbDfGVbR +dwTqVbifJHjpcETagKtKxi2+UH6mXfANH172JSuA2Fya2GuMyqmz5E2EQGCaXqRe +TOf7ZnVOBi2YR5Glj/UMyqRG2qHOXFaOO8vI/85cAQKBgQDe8PSq/fs62s10GAL5 +zJoxYSFKnkiyrNUy9tfjFVhQDJZ8CNU31JXN4YFTW5p/lNVVRRQKMEnxq1xQfq7H +d2wIN8vf1Y2nAYSwQFqSUVRhOnfIYPQVCbh9yHjseIb6dqW/KQPuxx1/nW718G7e +B4740hQUQNAX4V0Lzm2ZHf/jMQKBgQDTIHdREX0/D4ReW29D4eojuUJihC3lVmpa +jOA6iH5W6OjGBofmaec1wMhcJWI7tJWzTSX7N/fziJVqsy/hcNN1yypUFMpO4UMp +ciZwNGOq9oY3ujxZdCzZLUYQ87HUs9RN3FbYxRFVEv3Gs1HzVnEe+nBHxEEJ3x6E +2xyNEnBhwQKBgEx99BSvLAHXjOKmUm8O6mDC6L9Ha74SWtwvoYcCjdh5WTCZfz62 +q+eF1e+Z4HqhwEiPeP697sECgJwFu0YpDWIMcuELzpxcgwBONEU7rm3lt6+CxHxr +Z2eQ3xyThgxtpRTfp7/HhbGBfM7ZfdCkW0O4ILeKPVvUMS6Z1zTP/DohAoGBAIEI +mKPNYpTF8QqSK2B7lFQdB7uaOUqvE/UfoHNltIF9e7Z7i1eBZjPuDQZ0OqNu7QdW +oV32iO4ojdlWhm7sO/EEKGyXAEZRWnDcOS3edwOoA8PPaM7rN/XLu8Tki80J0zl6 +7wExADTUlJF6Sx3DuQNL4I+cHHviB47/M2Xs3Q6BAoGBANNWN4mHYe+JH4Lrfc1K +SSAeJRGvtne3HRP/4QtKDVbQhAeU9YqKfWgY3BsHrqlF5bTYd/Otti3IeWLA0gIt +D+bFtVWc3hDl+Tb2W3mvMoETi41qlCXaNGzSTHx283QsC/6DdxOHt1vtMwtsxJ7m +5Hjzfx2RXONw7tC9IRzjc63f +-----END PRIVATE KEY----- diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/certs/curl_app.sh b/servlet/java-configuration/authentication/x509/src/main/resources/certs/curl_app.sh new file mode 100644 index 0000000..dbf7af4 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/resources/certs/curl_app.sh @@ -0,0 +1,2 @@ + curl -vvvv --cacert out/DevCA.crt --cert out/localhost.crt --key out/localhost.key https://localhost:8443/me + diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/certs/server.p12 b/servlet/java-configuration/authentication/x509/src/main/resources/certs/server.p12 new file mode 100644 index 0000000..8096cc7 Binary files /dev/null and b/servlet/java-configuration/authentication/x509/src/main/resources/certs/server.p12 differ diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/certs/tomcat.keystore b/servlet/java-configuration/authentication/x509/src/main/resources/certs/tomcat.keystore new file mode 100644 index 0000000..e69de29 diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/logback.xml b/servlet/java-configuration/authentication/x509/src/main/resources/logback.xml new file mode 100644 index 0000000..3ebbcc0 --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/resources/logback.xml @@ -0,0 +1,12 @@ + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n + + + + + + + + diff --git a/servlet/java-configuration/authentication/x509/src/main/resources/templates/index.html b/servlet/java-configuration/authentication/x509/src/main/resources/templates/index.html new file mode 100644 index 0000000..09634dc --- /dev/null +++ b/servlet/java-configuration/authentication/x509/src/main/resources/templates/index.html @@ -0,0 +1,29 @@ + + + + + Hello Security + + +
+

Hello Security

+
+ +
+
+ + \ No newline at end of file diff --git a/settings.gradle b/settings.gradle index 7907bfb..3777ed7 100644 --- a/settings.gradle +++ b/settings.gradle @@ -33,6 +33,7 @@ include ":servlet:java-configuration:authentication:username-password:form" include ":servlet:java-configuration:authentication:username-password:in-memory" include ":servlet:java-configuration:authentication:username-password:jdbc" include ":servlet:java-configuration:authentication:username-password:ldap" +include ":servlet:java-configuration:authentication:x509" include ":servlet:java-configuration:data" include ":servlet:java-configuration:hello-mvc-security" include ":servlet:java-configuration:hello-security"