Add x509

2020-11-25 13:53:51 -06:00
parent cfa6376157
commit b0d7948b64
30 changed files with 851 additions and 0 deletions
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2002-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package example;
+
+import java.security.KeyStore;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLHandshakeException;
+
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.ssl.SSLContexts;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.http.ResponseEntity;
+import org.springframework.http.client.ClientHttpRequestFactory;
+import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
+import org.springframework.web.client.RestTemplate;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatCode;
+
+/**
+ * Test the Hello World application.
+ *
+ * @author Michael Simons
+ */
+public class X509Tests {
+
+	private int port;
+
+	@BeforeEach
+	void setup() {
+		this.port = Integer.parseInt(System.getProperty("app.httpPort", "8443"));
+	}
+
+	@Test
+	void notCertificateThenSslHandshakeException() {
+		RestTemplate rest = new RestTemplate();
+		assertThatCode(() -> rest.getForEntity("https://localhost:8443/", String.class))
+				.hasCauseInstanceOf(SSLHandshakeException.class);
+	}
+
+	@Test
+	void certificateThenStatusOk() throws Exception {
+		ClassPathResource serverKeystore = new ClassPathResource("/certs/server.p12");
+		KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+		keyStore.load(serverKeystore.getInputStream(), "password".toCharArray());
+		// @formatter:off
+		SSLContext sslContext = SSLContexts.custom()
+				.loadKeyMaterial(keyStore, "password".toCharArray(), (aliases, socket) -> "client")
+				.loadTrustMaterial(keyStore, null)
+				.build();
+
+		SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext,
+				new String[]{"TLSv1.2", "TLSv1.1"},
+				null,
+				SSLConnectionSocketFactory.getDefaultHostnameVerifier());
+		// @formatter:on
+
+		CloseableHttpClient httpClient = HttpClients.custom().setSSLSocketFactory(socketFactory).build();
+		ClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory(httpClient);
+		RestTemplate rest = new RestTemplate(requestFactory);
+		ResponseEntity<String> responseEntity = rest.getForEntity("https://localhost:8443/me", String.class);
+		assertThat(responseEntity).extracting((result) -> result.getStatusCode().is2xxSuccessful()).isEqualTo(true);
+	}
+
+}
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package example;
+
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ComponentScan
+public class ApplicationConfiguration {
+
+}
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package example;
+
+import java.security.Principal;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * Says hello to the current user.
+ *
+ * @author Rob Winch
+ * @since 5.5
+ */
+@RestController
+public class MeController {
+
+	@GetMapping("/me")
+	public String me(Principal principal) {
+		return "Hello, " + principal.getName();
+	}
+
+}
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package example;
+
+import javax.servlet.Filter;
+
+import org.springframework.web.filter.HiddenHttpMethodFilter;
+import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
+
+public class MvcWebApplicationInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
+
+	@Override
+	protected Class<?>[] getRootConfigClasses() {
+		return null;
+	}
+
+	@Override
+	protected Class<?>[] getServletConfigClasses() {
+		return new Class[] { ApplicationConfiguration.class };
+	}
+
+	@Override
+	protected String[] getServletMappings() {
+		return new String[] { "/" };
+	}
+
+	@Override
+	protected Filter[] getServletFilters() {
+		return new Filter[] { new HiddenHttpMethodFilter() };
+	}
+
+}
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package example;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+
+import static org.springframework.security.config.Customizer.withDefaults;
+
+@EnableWebSecurity
+public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
+
+	@Override
+	// @formatter:off
+	protected void configure(HttpSecurity http) throws Exception {
+		http
+			.authorizeRequests((authorizeRequests) ->
+					authorizeRequests
+							.anyRequest().authenticated()
+			)
+			.x509(withDefaults());
+	}
+	// @formatter:on
+
+	// @formatter:off
+	@Bean
+	public UserDetailsService userDetailsService() {
+		UserDetails user = User.withDefaultPasswordEncoder()
+				.username("client")
+				.password("password")
+				.roles("USER")
+				.build();
+		UserDetails dianne = User.withDefaultPasswordEncoder()
+				.username("dianne")
+				.password("password")
+				.roles("USER")
+				.build();
+		UserDetails rod = User.withDefaultPasswordEncoder()
+				.username("rod")
+				.password("password")
+				.roles("USER", "ADMIN")
+				.build();
+		UserDetails scott = User.withDefaultPasswordEncoder()
+				.username("scott")
+				.password("password")
+				.roles("USER")
+				.build();
+		return new InMemoryUserDetailsManager(user, dianne, rod, scott);
+	}
+	// @formatter:on
+
+}
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package example;
+
+import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
+import org.springframework.security.web.session.HttpSessionEventPublisher;
+
+/**
+ * We customize {@link AbstractSecurityWebApplicationInitializer} to enable the
+ * {@link HttpSessionEventPublisher}.
+ *
+ * @author Rob Winch
+ */
+public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
+
+	@Override
+	protected boolean enableHttpSessionEventPublisher() {
+		return true;
+	}
+
+}
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package example;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
+
+@EnableWebMvc
+@Configuration
+public class WebMvcConfiguration {
+
+}
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDXTCCAkWgAwIBAgIEKA49bjANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJV
+UzELMAkGA1UECBMCSUwxEDAOBgNVBAcTB0NoaWNhZ28xDzANBgNVBAoTBnNwcmlu
+ZzERMA8GA1UECxMIc2VjdXJpdHkxDTALBgNVBAMTBHVzZXIwHhcNMjAwNzI3MTk0
+MjUyWhcNMjAxMDI1MTk0MjUyWjBfMQswCQYDVQQGEwJVUzELMAkGA1UECBMCSUwx
+EDAOBgNVBAcTB0NoaWNhZ28xDzANBgNVBAoTBnNwcmluZzERMA8GA1UECxMIc2Vj
+dXJpdHkxDTALBgNVBAMTBHVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC33N+wH+nJ5XmAOmX1JqMeqTRInJvoyOxV4x1mf4sUjbbXl0awFmUHQE8M
+WgzzcmThUrqc2z4Qk/QA8Wm7WRduFv249zqkzUrAS6/pjq7S5D23xjvFXTrhv9QI
+6orwEr4iiucY2CEyw116p20LGvh8dc4SX45HsNHrX4ubvWRL2MXEDdvnL36Ns5Pv
+ZVJfGDfNDxLoP9oInAhi8IlrGC//Sc+i232E37/xgdJuT20Fsy2P2ZILUYonUm6S
+LihzcXigC5e0dUn1qinFaJWxW61Tkm4vFbIAdlskmlAB21ZRyTfRAM5p4GJyc/LV
+zMBb5d6ETyvrtK/dC/b1QLdqb9jxAgMBAAGjITAfMB0GA1UdDgQWBBRRhhAO2eX1
+10oOKyHWbKWPItZr0TANBgkqhkiG9w0BAQsFAAOCAQEAAHiqijmO473ATu3Qc60n
+I6SwfHYa4nDMNO2zPkIA/GWb5aHtyyi8aODVUhGpU5TK+2IJ+H5eK1aRm4nC+NHm
+r8+UkWfxmi0KPboPTjU+kgPONrKe+6Wz3T9ba6lbQHNXeF0oUOB/TIpznujfhKfh
+6tJOK5A/Y4dw21hE36PO1LlY0IL4xjsZisvcgg1QvvpfBi5bbS0HxuXmK1+sGc4B
+G5oZ5pLGV39Y10PliS7CoSf1ItisgrZsfIsaZsQuyE9/NhuwT6i+E35qVNMH0Ak3
+YJgrlseA9CrQ72HJgWTORwutrbXjyA3UxE3CZ7YYaFKhCOqT+rm9blTUckzXxqL7
+sg==
+-----END CERTIFICATE-----
@@ -0,0 +1,32 @@
+Bag Attributes
+    friendlyName: user
+    localKeyID: 54 69 6D 65 20 31 35 39 35 38 37 38 39 37 32 38 39 35 
+Key Attributes: <No Attributes>
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC33N+wH+nJ5XmA
+OmX1JqMeqTRInJvoyOxV4x1mf4sUjbbXl0awFmUHQE8MWgzzcmThUrqc2z4Qk/QA
+8Wm7WRduFv249zqkzUrAS6/pjq7S5D23xjvFXTrhv9QI6orwEr4iiucY2CEyw116
+p20LGvh8dc4SX45HsNHrX4ubvWRL2MXEDdvnL36Ns5PvZVJfGDfNDxLoP9oInAhi
+8IlrGC//Sc+i232E37/xgdJuT20Fsy2P2ZILUYonUm6SLihzcXigC5e0dUn1qinF
+aJWxW61Tkm4vFbIAdlskmlAB21ZRyTfRAM5p4GJyc/LVzMBb5d6ETyvrtK/dC/b1
+QLdqb9jxAgMBAAECggEAOjSPD8eakFK3+xMBsfEQVKWGKrKBXNk2kB388bTQx6nx
+RyDZvObqBriiDav4S51cOESjVQLHDCJ6bU3/hdK3ax+WJNcHVqKy1ltfjhWgXJzq
+uOHljB5uhIbgzg3J/CRC0tacQC4znElir3CPQaPBJE169jAP77wXSGcP4Da9qJCm
+6Lb8EOMccciBowaZ9yhp7Nv7tPh4kQ/syfunjOwBQPtBhH7OFI8vQ/jmfbDfGVbR
+dwTqVbifJHjpcETagKtKxi2+UH6mXfANH172JSuA2Fya2GuMyqmz5E2EQGCaXqRe
+TOf7ZnVOBi2YR5Glj/UMyqRG2qHOXFaOO8vI/85cAQKBgQDe8PSq/fs62s10GAL5
+zJoxYSFKnkiyrNUy9tfjFVhQDJZ8CNU31JXN4YFTW5p/lNVVRRQKMEnxq1xQfq7H
+d2wIN8vf1Y2nAYSwQFqSUVRhOnfIYPQVCbh9yHjseIb6dqW/KQPuxx1/nW718G7e
+B4740hQUQNAX4V0Lzm2ZHf/jMQKBgQDTIHdREX0/D4ReW29D4eojuUJihC3lVmpa
+jOA6iH5W6OjGBofmaec1wMhcJWI7tJWzTSX7N/fziJVqsy/hcNN1yypUFMpO4UMp
+ciZwNGOq9oY3ujxZdCzZLUYQ87HUs9RN3FbYxRFVEv3Gs1HzVnEe+nBHxEEJ3x6E
+2xyNEnBhwQKBgEx99BSvLAHXjOKmUm8O6mDC6L9Ha74SWtwvoYcCjdh5WTCZfz62
+q+eF1e+Z4HqhwEiPeP697sECgJwFu0YpDWIMcuELzpxcgwBONEU7rm3lt6+CxHxr
+Z2eQ3xyThgxtpRTfp7/HhbGBfM7ZfdCkW0O4ILeKPVvUMS6Z1zTP/DohAoGBAIEI
+mKPNYpTF8QqSK2B7lFQdB7uaOUqvE/UfoHNltIF9e7Z7i1eBZjPuDQZ0OqNu7QdW
+oV32iO4ojdlWhm7sO/EEKGyXAEZRWnDcOS3edwOoA8PPaM7rN/XLu8Tki80J0zl6
+7wExADTUlJF6Sx3DuQNL4I+cHHviB47/M2Xs3Q6BAoGBANNWN4mHYe+JH4Lrfc1K
+SSAeJRGvtne3HRP/4QtKDVbQhAeU9YqKfWgY3BsHrqlF5bTYd/Otti3IeWLA0gIt
+D+bFtVWc3hDl+Tb2W3mvMoETi41qlCXaNGzSTHx283QsC/6DdxOHt1vtMwtsxJ7m
+5Hjzfx2RXONw7tC9IRzjc63f
+-----END PRIVATE KEY-----
@@ -0,0 +1,2 @@
+ curl -vvvv --cacert out/DevCA.crt --cert out/localhost.crt --key out/localhost.key https://localhost:8443/me
+
@@ -0,0 +1,12 @@
+<configuration>
+	<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+	<encoder>
+		<pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+	</encoder>
+	</appender>
+
+	<root level="WARN">
+		<appender-ref ref="STDOUT" />
+	</root>
+
+</configuration>
@@ -0,0 +1,29 @@
+<!--
+  ~ Copyright 2020 the original author or authors.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<html xmlns:th="https://www.thymeleaf.org">
+<head>
+    <title>Hello Security</title>
+</head>
+<body>
+<div>
+    <h1>Hello Security</h1>
+    <form th:action="@{/logout}" method="post">
+        <input type="submit" value="Logout"/>
+    </form>
+</div>
+</body>
+</html>
				`@@ -0,0 +1,2 @@`
				`curl -vvvv --cacert out/DevCA.crt --cert out/localhost.crt --key out/localhost.key https://localhost:8443/me`