JAVA-13856 Create new security-modules (#12622)

security-modules/apache-shiro/.gitignore

@@ -0,0 +1,4 @@
+
+/.idea/
+/target/
+/apache-shiro.iml

security-modules/apache-shiro/README.md

@@ -0,0 +1,9 @@
+## Apache Shiro
+
+This module contains articles about Apache Shiro
+
+### Relevant articles:
+
+- [Introduction to Apache Shiro](https://www.baeldung.com/apache-shiro)
+- [Permissions-Based Access Control with Apache Shiro](https://www.baeldung.com/apache-shiro-access-control)
+- [Spring Security vs Apache Shiro](https://www.baeldung.com/spring-security-vs-apache-shiro)

security-modules/apache-shiro/pom.xml

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>apache-shiro</artifactId>
+    <version>1.0-SNAPSHOT</version>
+    <name>apache-shiro</name>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>parent-boot-2</artifactId>
+        <version>0.0.1-SNAPSHOT</version>
+        <relativePath>../../parent-boot-2</relativePath>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-freemarker</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.shiro</groupId>
+            <artifactId>shiro-spring-boot-web-starter</artifactId>
+            <version>${apache-shiro-core-version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.shiro</groupId>
+            <artifactId>shiro-core</artifactId>
+            <version>${apache-shiro-core-version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>jcl-over-slf4j</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+        <!-- spring-sec -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+    </dependencies>
+
+    <properties>
+        <apache-shiro-core-version>1.5.3</apache-shiro-core-version>
+        <log4j.version>2.17.1</log4j.version>
+    </properties>
+
+</project>

security-modules/apache-shiro/src/main/java/com/baeldung/comparison/shiro/CustomRealm.java

@@ -0,0 +1,96 @@
+package com.baeldung.comparison.shiro;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.AuthenticationInfo;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.SimpleAuthenticationInfo;
+import org.apache.shiro.authc.UnknownAccountException;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.authz.AuthorizationInfo;
+import org.apache.shiro.authz.SimpleAuthorizationInfo;
+import org.apache.shiro.realm.jdbc.JdbcRealm;
+import org.apache.shiro.subject.PrincipalCollection;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class CustomRealm extends JdbcRealm {
+    
+    private Logger logger = LoggerFactory.getLogger(CustomRealm.class);
+
+    private Map<String, String> credentials = new HashMap<>();
+    private Map<String, Set<String>> roles = new HashMap<>();
+    private Map<String, Set<String>> permissions = new HashMap<>();
+
+    {
+        credentials.put("Tom", "password");
+        credentials.put("Jerry", "password");
+
+        roles.put("Jerry", new HashSet<>(Arrays.asList("ADMIN")));
+        roles.put("Tom", new HashSet<>(Arrays.asList("USER")));
+
+        permissions.put("ADMIN", new HashSet<>(Arrays.asList("READ", "WRITE")));
+        permissions.put("USER", new HashSet<>(Arrays.asList("READ")));
+    }
+
+    @Override
+    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
+
+        UsernamePasswordToken userToken = (UsernamePasswordToken) token;
+
+        if (userToken.getUsername() == null || userToken.getUsername()
+            .isEmpty() || !credentials.containsKey(userToken.getUsername())) {
+            throw new UnknownAccountException("User doesn't exist");
+        }
+
+        return new SimpleAuthenticationInfo(userToken.getUsername(), credentials.get(userToken.getUsername()), getName());
+    }
+
+    @Override
+    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
+        Set<String> roles = new HashSet<>();
+        Set<String> permissions = new HashSet<>();
+
+        for (Object user : principals) {
+            try {
+                roles.addAll(getRoleNamesForUser(null, (String) user));
+                permissions.addAll(getPermissions(null, null, roles));
+            } catch (SQLException e) {
+                logger.error(e.getMessage());
+            }
+        }
+        SimpleAuthorizationInfo authInfo = new SimpleAuthorizationInfo(roles);
+        authInfo.setStringPermissions(permissions);
+        return authInfo;
+    }
+
+    @Override
+    protected Set<String> getRoleNamesForUser(Connection conn, String username) throws SQLException {
+        if (!roles.containsKey(username)) {
+            throw new SQLException("User doesn't exist");
+        }
+        return roles.get(username);
+    }
+
+    @Override
+    protected Set<String> getPermissions(Connection conn, String username, Collection<String> roles) throws SQLException {
+        Set<String> userPermissions = new HashSet<>();
+
+        for (String role : roles) {
+            if (!permissions.containsKey(role)) {
+                throw new SQLException("Role doesn't exist");
+            }
+            userPermissions.addAll(permissions.get(role));
+        }
+        return userPermissions;
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/comparison/shiro/ShiroApplication.java

@@ -0,0 +1,33 @@
+package com.baeldung.comparison.shiro;
+
+import org.apache.shiro.realm.Realm;
+import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
+import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
+import org.springframework.context.annotation.Bean;
+
+@SpringBootApplication(exclude = SecurityAutoConfiguration.class)
+public class ShiroApplication {
+
+    public static void main(String... args) {
+        SpringApplication.run(ShiroApplication.class, args);
+    }
+
+    @Bean
+    public Realm customRealm() {
+        return new CustomRealm();
+    }
+
+    @Bean
+    public ShiroFilterChainDefinition shiroFilterChainDefinition() {
+        DefaultShiroFilterChainDefinition filter = new DefaultShiroFilterChainDefinition();
+
+        filter.addPathDefinition("/home", "authc");
+        filter.addPathDefinition("/**", "anon");
+
+        return filter;
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/comparison/shiro/controllers/ShiroController.java

@@ -0,0 +1,99 @@
+package com.baeldung.comparison.shiro.controllers;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.subject.Subject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+import com.baeldung.comparison.shiro.models.UserCredentials;
+
+@Controller
+public class ShiroController {
+    
+    private Logger logger = LoggerFactory.getLogger(ShiroController.class);
+
+    @GetMapping("/")
+    public String getIndex() {
+        return "comparison/index";
+    }
+
+    @GetMapping("/login")
+    public String showLoginPage() {
+        return "comparison/login";
+    }
+
+    @PostMapping("/login")
+    public String doLogin(HttpServletRequest req, UserCredentials credentials, RedirectAttributes attr) {
+
+        Subject subject = SecurityUtils.getSubject();
+
+        if (!subject.isAuthenticated()) {
+            UsernamePasswordToken token = new UsernamePasswordToken(credentials.getUsername(), credentials.getPassword());
+            try {
+                subject.login(token);
+            } catch (AuthenticationException ae) {
+                logger.error(ae.getMessage());
+                attr.addFlashAttribute("error", "Invalid Credentials");
+                return "redirect:/login";
+            }
+        }
+        return "redirect:/home";
+    }
+
+    @GetMapping("/home")
+    public String getMeHome(Model model) {
+
+        addUserAttributes(model);
+
+        return "comparison/home";
+    }
+
+    @GetMapping("/admin")
+    public String adminOnly(Model model) {
+        addUserAttributes(model);
+
+        Subject currentUser = SecurityUtils.getSubject();
+        if (currentUser.hasRole("ADMIN")) {
+            model.addAttribute("adminContent", "only admin can view this");
+        }
+        return "comparison/home";
+    }
+
+    @PostMapping("/logout")
+    public String logout() {
+        Subject subject = SecurityUtils.getSubject();
+        subject.logout();
+        return "redirect:/";
+    }
+
+    private void addUserAttributes(Model model) {
+        Subject currentUser = SecurityUtils.getSubject();
+        String permission = "";
+
+        if (currentUser.hasRole("ADMIN")) {
+            model.addAttribute("role", "ADMIN");
+        } else if (currentUser.hasRole("USER")) {
+            model.addAttribute("role", "USER");
+        }
+
+        if (currentUser.isPermitted("READ")) {
+            permission = permission + " READ";
+        }
+
+        if (currentUser.isPermitted("WRITE")) {
+            permission = permission + " WRITE";
+        }
+        model.addAttribute("username", currentUser.getPrincipal());
+        model.addAttribute("permission", permission);
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/comparison/shiro/models/UserCredentials.java

@@ -0,0 +1,28 @@
+package com.baeldung.comparison.shiro.models;
+
+public class UserCredentials {
+
+    private String username;
+    private String password;
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    @Override
+    public String toString() {
+        return "username = " + getUsername();
+    }
+}

security-modules/apache-shiro/src/main/java/com/baeldung/comparison/springsecurity/Application.java

@@ -0,0 +1,19 @@
+package com.baeldung.comparison.springsecurity;
+
+import org.apache.shiro.spring.boot.autoconfigure.ShiroAnnotationProcessorAutoConfiguration;
+import org.apache.shiro.spring.boot.autoconfigure.ShiroAutoConfiguration;
+import org.apache.shiro.spring.config.web.autoconfigure.ShiroWebAutoConfiguration;
+import org.apache.shiro.spring.config.web.autoconfigure.ShiroWebFilterConfiguration;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication(exclude = {ShiroAutoConfiguration.class,
+        ShiroAnnotationProcessorAutoConfiguration.class,
+        ShiroWebAutoConfiguration.class,
+        ShiroWebFilterConfiguration.class})
+public class Application {
+
+    public static void main(String[] args) {
+        SpringApplication.run(Application.class, args);
+    }
+}

security-modules/apache-shiro/src/main/java/com/baeldung/comparison/springsecurity/config/SecurityConfig.java

@@ -0,0 +1,45 @@
+package com.baeldung.comparison.springsecurity.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+@EnableWebSecurity
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http.csrf().disable().authorizeRequests(authorize -> authorize.antMatchers("/index", "/login")
+            .permitAll()
+            .antMatchers("/home", "/logout")
+            .authenticated()
+            .antMatchers("/admin/**")
+            .hasRole("ADMIN"))
+            .formLogin(formLogin -> formLogin.loginPage("/login")
+                .failureUrl("/login-error"));
+    }
+
+    @Override
+    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+        auth.inMemoryAuthentication()
+            .withUser("Jerry")
+            .password(passwordEncoder().encode("password"))
+            .authorities("READ", "WRITE")
+            .roles("ADMIN")
+            .and()
+            .withUser("Tom")
+            .password(passwordEncoder().encode("password"))
+            .authorities("READ")
+            .roles("USER");
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/comparison/springsecurity/web/SpringController.java

@@ -0,0 +1,79 @@
+package com.baeldung.comparison.springsecurity.web;
+
+import java.util.Collection;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+public class SpringController {
+
+    @GetMapping("/")
+    public String getIndex() {
+        return "comparison/index";
+    }
+
+    @GetMapping("/login")
+    public String showLoginPage() {
+        return "comparison/login";
+    }
+
+    @RequestMapping("/login-error")
+    public String loginError(Model model) {
+        model.addAttribute("error", "Invalid Credentials");
+        return "comparison/login";
+    }
+
+    @PostMapping("/login")
+    public String doLogin(HttpServletRequest req) {
+        return "redirect:/home";
+    }
+
+    @GetMapping("/home")
+    public String showHomePage(HttpServletRequest req, Model model) {
+        addUserAttributes(model);
+        return "comparison/home";
+    }
+
+    @GetMapping("/admin")
+    public String adminOnly(HttpServletRequest req, Model model) {
+        addUserAttributes(model);
+        model.addAttribute("adminContent", "only admin can view this");
+        return "comparison/home";
+    }
+
+    private void addUserAttributes(Model model) {
+        Authentication auth = SecurityContextHolder.getContext()
+            .getAuthentication();
+        if (auth != null && !auth.getClass()
+            .equals(AnonymousAuthenticationToken.class)) {
+            User user = (User) auth.getPrincipal();
+            model.addAttribute("username", user.getUsername());
+
+            Collection<GrantedAuthority> authorities = user.getAuthorities();
+
+            for (GrantedAuthority authority : authorities) {
+                if (authority.getAuthority()
+                    .contains("USER")) {
+                    model.addAttribute("role", "USER");
+                    model.addAttribute("permission", "READ");
+                } else if (authority.getAuthority()
+                    .contains("ADMIN")) {
+                    model.addAttribute("role", "ADMIN");
+                    model.addAttribute("permission", "READ WRITE");
+                }
+            }
+        }
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/intro/Main.java

@@ -0,0 +1,88 @@
+package com.baeldung.intro;
+
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.IncorrectCredentialsException;
+import org.apache.shiro.authc.LockedAccountException;
+import org.apache.shiro.authc.UnknownAccountException;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.mgt.DefaultSecurityManager;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.realm.Realm;
+import org.apache.shiro.session.Session;
+import org.apache.shiro.subject.Subject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class Main {
+
+    private static final transient Logger log = LoggerFactory.getLogger(Main.class);
+
+    public static void main(String[] args) {
+
+        Realm realm = new MyCustomRealm();
+        SecurityManager securityManager = new DefaultSecurityManager(realm);
+
+        SecurityUtils.setSecurityManager(securityManager);
+        Subject currentUser = SecurityUtils.getSubject();
+
+        if (!currentUser.isAuthenticated()) {
+          UsernamePasswordToken token 
+            = new UsernamePasswordToken("user", "password");
+          token.setRememberMe(true);
+          try {
+              currentUser.login(token);
+          } catch (UnknownAccountException uae) {
+              log.error("Username Not Found!", uae);
+          } catch (IncorrectCredentialsException ice) {
+              log.error("Invalid Credentials!", ice);
+          } catch (LockedAccountException lae) {
+              log.error("Your Account is Locked!", lae);
+          } catch (AuthenticationException ae) {
+              log.error("Unexpected Error!", ae);
+          }
+        }
+
+        log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
+
+        if (currentUser.hasRole("admin")) {
+            log.info("Welcome Admin");
+        } else if(currentUser.hasRole("editor")) {
+            log.info("Welcome, Editor!");
+        } else if(currentUser.hasRole("author")) {
+            log.info("Welcome, Author");
+        } else {
+            log.info("Welcome, Guest");
+        }
+
+        if(currentUser.isPermitted("articles:compose")) {
+            log.info("You can compose an article");
+        } else {
+            log.info("You are not permitted to compose an article!");
+        }
+
+        if(currentUser.isPermitted("articles:save")) {
+            log.info("You can save articles");
+        } else {
+            log.info("You can not save articles");
+        }
+
+        if(currentUser.isPermitted("articles:publish")) {
+            log.info("You can publish articles");
+        } else {
+            log.info("You can not publish articles");
+        }
+
+        Session session = currentUser.getSession();
+        session.setAttribute("key", "value");
+        String value = (String) session.getAttribute("key");
+        if (value.equals("value")) {
+            log.info("Retrieved the correct value! [" + value + "]");
+        }
+
+        currentUser.logout();
+
+        System.exit(0);
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/intro/MyCustomRealm.java

@@ -0,0 +1,110 @@
+package com.baeldung.intro;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.AuthenticationInfo;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.SimpleAuthenticationInfo;
+import org.apache.shiro.authc.UnknownAccountException;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.authz.AuthorizationInfo;
+import org.apache.shiro.authz.SimpleAuthorizationInfo;
+import org.apache.shiro.realm.jdbc.JdbcRealm;
+import org.apache.shiro.subject.PrincipalCollection;
+
+public class MyCustomRealm extends JdbcRealm {
+
+    private Map<String, String> credentials = new HashMap<>();
+    private Map<String, Set<String>> roles = new HashMap<>();
+    private Map<String, Set<String>> perm = new HashMap<>();
+
+    {
+      credentials.put("user", "password");
+      credentials.put("user2", "password2");
+      credentials.put("user3", "password3");
+
+      roles.put("user", new HashSet<>(Arrays.asList("admin")));
+      roles.put("user2", new HashSet<>(Arrays.asList("editor")));
+      roles.put("user3", new HashSet<>(Arrays.asList("author")));
+
+      perm.put("admin", new HashSet<>(Arrays.asList("*")));
+      perm.put("editor", new HashSet<>(Arrays.asList("articles:*")));
+      perm.put("author",
+        new HashSet<>(Arrays.asList("articles:compose",
+          "articles:save")));
+
+    }
+
+    @Override
+    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
+      throws AuthenticationException {
+
+        UsernamePasswordToken uToken = (UsernamePasswordToken) token;
+
+        if(uToken.getUsername() == null
+          || uToken.getUsername().isEmpty()
+          || !credentials.containsKey(uToken.getUsername())
+          ) {
+            throw new UnknownAccountException("username not found!");
+        }
+
+
+        return new SimpleAuthenticationInfo(
+          uToken.getUsername(), credentials.get(uToken.getUsername()),
+          getName());
+    }
+
+    @Override
+    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
+        Set<String> roleNames = new HashSet<>();
+        Set<String> permissions = new HashSet<>();
+
+        principals.forEach(p -> {
+            try {
+                Set<String> roles = getRoleNamesForUser(null, (String) p);
+                roleNames.addAll(roles);
+                permissions.addAll(getPermissions(null, null,roles));
+            } catch (SQLException e) {
+                e.printStackTrace();
+            }
+        });
+
+        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roleNames);
+        info.setStringPermissions(permissions);
+        return info;
+    }
+
+    @Override
+    protected Set<String> getRoleNamesForUser(Connection conn, String username) throws SQLException {
+        if(!roles.containsKey(username)) {
+            throw new SQLException("username not found!");
+        }
+
+       return roles.get(username);
+    }
+
+    @Override
+    protected Set<String> getPermissions(Connection conn, String username, Collection<String> roleNames) throws SQLException {
+        for (String role : roleNames) {
+            if (!perm.containsKey(role)) {
+                throw new SQLException("role not found!");
+            }
+        }
+
+        Set<String> finalSet = new HashSet<>();
+        for (String role : roleNames) {
+            finalSet.addAll(perm.get(role));
+        }
+
+        return finalSet;
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/intro/ShiroSpringApplication.java

@@ -0,0 +1,46 @@
+package com.baeldung.intro;
+
+import org.apache.shiro.realm.Realm;
+import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
+import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
+import org.springframework.context.annotation.Bean;
+
+/**
+ * Created by smatt on 21/08/2017.
+ */
+@SpringBootApplication(exclude = SecurityAutoConfiguration.class)
+public class ShiroSpringApplication {
+
+    private static final transient Logger log = LoggerFactory.getLogger(ShiroSpringApplication.class);
+
+    public static void main(String... args) {
+        SpringApplication.run(ShiroSpringApplication.class, args);
+    }
+
+
+    @Bean
+    public Realm realm() {
+        return new MyCustomRealm();
+    }
+
+
+    @Bean
+    public ShiroFilterChainDefinition filterChainDefinition() {
+        DefaultShiroFilterChainDefinition filter
+          = new DefaultShiroFilterChainDefinition();
+
+        filter.addPathDefinition("/secure", "authc");
+        filter.addPathDefinition("/**", "anon");
+
+        return filter;
+    }
+
+
+
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/intro/controllers/ShiroSpringController.java

@@ -0,0 +1,101 @@
+package com.baeldung.intro.controllers;
+
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.subject.Subject;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.ModelMap;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+import com.baeldung.intro.models.UserCredentials;
+
+import javax.servlet.http.HttpServletRequest;
+
+@Controller
+public class ShiroSpringController {
+
+    @GetMapping("/")
+    public String index() {
+       return "index";
+    }
+
+    @RequestMapping( value = "/login", method = {RequestMethod.GET, RequestMethod.POST})
+    public String login(HttpServletRequest req, UserCredentials cred, RedirectAttributes attr) {
+
+      if(req.getMethod().equals(RequestMethod.GET.toString())) {
+        return "login";
+      } else {
+        Subject subject = SecurityUtils.getSubject();
+
+        if(!subject.isAuthenticated()) {
+          UsernamePasswordToken token = new UsernamePasswordToken(
+            cred.getUsername(), cred.getPassword(), cred.isRememberMe());
+          try {
+            subject.login(token);
+          } catch (AuthenticationException ae) {
+              ae.printStackTrace();
+              attr.addFlashAttribute("error", "Invalid Credentials");
+              return "redirect:/login";
+          }
+        }
+
+        return "redirect:/secure";
+      }
+    }
+
+
+    @GetMapping("/secure")
+    public String secure(ModelMap modelMap) {
+
+        Subject currentUser = SecurityUtils.getSubject();
+        String role = "", permission = "";
+
+        if(currentUser.hasRole("admin")) {
+            role = role  + "You are an Admin";
+        }
+        else if(currentUser.hasRole("editor")) {
+            role = role + "You are an Editor";
+        }
+        else if(currentUser.hasRole("author")) {
+            role = role + "You are an Author";
+        }
+
+        if(currentUser.isPermitted("articles:compose")) {
+            permission = permission + "You can compose an article, ";
+        } else {
+            permission = permission + "You are not permitted to compose an article!, ";
+        }
+
+        if(currentUser.isPermitted("articles:save")) {
+            permission = permission + "You can save articles, ";
+        } else {
+            permission = permission + "\nYou can not save articles, ";
+        }
+
+        if(currentUser.isPermitted("articles:publish")) {
+            permission = permission  + "\nYou can publish articles";
+        } else {
+            permission = permission + "\nYou can not publish articles";
+        }
+
+        modelMap.addAttribute("username", currentUser.getPrincipal());
+        modelMap.addAttribute("permission", permission);
+        modelMap.addAttribute("role", role);
+
+        return "secure";
+    }
+
+
+    @PostMapping("/logout")
+    public String logout() {
+       Subject subject = SecurityUtils.getSubject();
+       subject.logout();
+       return "redirect:/";
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/intro/models/UserCredentials.java

@@ -0,0 +1,40 @@
+package com.baeldung.intro.models;
+
+public class UserCredentials {
+
+    private String username;
+    private String password;
+    private boolean rememberMe = false;
+
+    public UserCredentials() {}
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    public boolean isRememberMe() {
+        return rememberMe;
+    }
+
+    public void setRememberMe(boolean rememberMe) {
+        this.rememberMe = rememberMe;
+    }
+
+    @Override
+    public String toString() {
+        return "username = " + getUsername()
+                + "\nrememberMe = " + isRememberMe();
+    }
+}

security-modules/apache-shiro/src/main/java/com/baeldung/permissions/custom/Main.java

@@ -0,0 +1,69 @@
+package com.baeldung.permissions.custom;
+
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.IncorrectCredentialsException;
+import org.apache.shiro.authc.LockedAccountException;
+import org.apache.shiro.authc.UnknownAccountException;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.config.Ini;
+import org.apache.shiro.mgt.DefaultSecurityManager;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.realm.text.IniRealm;
+import org.apache.shiro.subject.Subject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class Main {
+
+    private static final transient Logger log = LoggerFactory.getLogger(Main.class);
+
+    public static void main(String[] args) {
+
+        IniRealm realm = new IniRealm();
+        Ini ini = Ini.fromResourcePath(Main.class.getResource("/com/baeldung/shiro/permissions/custom/shiro.ini").getPath());
+        realm.setIni(ini);
+        realm.setPermissionResolver(new PathPermissionResolver());
+        realm.init();
+        SecurityManager securityManager = new DefaultSecurityManager(realm);
+
+        SecurityUtils.setSecurityManager(securityManager);
+        Subject currentUser = SecurityUtils.getSubject();
+
+        if (!currentUser.isAuthenticated()) {
+          UsernamePasswordToken token = new UsernamePasswordToken("paul.reader", "password4");
+          token.setRememberMe(true);
+          try {
+              currentUser.login(token);
+          } catch (UnknownAccountException uae) {
+              log.error("Username Not Found!", uae);
+          } catch (IncorrectCredentialsException ice) {
+              log.error("Invalid Credentials!", ice);
+          } catch (LockedAccountException lae) {
+              log.error("Your Account is Locked!", lae);
+          } catch (AuthenticationException ae) {
+              log.error("Unexpected Error!", ae);
+          }
+        }
+
+        log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
+
+        if (currentUser.hasRole("admin")) {
+            log.info("Welcome Admin");
+        } else if(currentUser.hasRole("editor")) {
+            log.info("Welcome, Editor!");
+        } else if(currentUser.hasRole("author")) {
+            log.info("Welcome, Author");
+        } else {
+            log.info("Welcome, Guest");
+        }
+
+        if(currentUser.isPermitted("/articles/drafts/new-article")) {
+            log.info("You can access articles");
+        } else {
+            log.info("You cannot access articles!");
+        }
+        currentUser.logout();
+    }
+
+}

security-modules/apache-shiro/src/main/java/com/baeldung/permissions/custom/PathPermission.java

@@ -0,0 +1,22 @@
+package com.baeldung.permissions.custom;
+
+import org.apache.shiro.authz.Permission;
+
+import java.nio.file.Path;
+
+public class PathPermission implements Permission {
+
+    private final Path path;
+
+    public PathPermission(Path path) {
+        this.path = path;
+    }
+
+    @Override
+    public boolean implies(Permission p) {
+        if(p instanceof PathPermission) {
+            return ((PathPermission) p).path.startsWith(path);
+        }
+        return false;
+    }
+}

security-modules/apache-shiro/src/main/java/com/baeldung/permissions/custom/PathPermissionResolver.java

@@ -0,0 +1,13 @@
+package com.baeldung.permissions.custom;
+
+import org.apache.shiro.authz.Permission;
+import org.apache.shiro.authz.permission.PermissionResolver;
+
+import java.nio.file.Paths;
+
+public class PathPermissionResolver implements PermissionResolver {
+    @Override
+    public Permission resolvePermission(String permissionString) {
+        return new PathPermission(Paths.get(permissionString));
+    }
+}

security-modules/apache-shiro/src/main/resources/application.properties

@@ -0,0 +1,11 @@
+server.port=9000
+server.servlet-path=/
+server.context-path=/
+
+#shiro-spring-boot-config
+shiro.loginUrl = /login
+shiro.successUrl = /secure
+shiro.unauthorizedUrl = /login
+
+#freemarker
+spring.freemarker.suffix=.ftl

security-modules/apache-shiro/src/main/resources/com/baeldung/shiro/permissions/custom/shiro.ini

@@ -0,0 +1,10 @@
+[users]
+jane.admin = password, admin
+john.editor = password2, editor
+zoe.author = password3, author
+paul.reader = password4
+
+[roles]
+admin = /
+editor = /articles
+author = /articles/drafts

security-modules/apache-shiro/src/main/resources/log4j.properties

@@ -0,0 +1,12 @@
+log4j.rootLogger=INFO, stdout
+
+log4j.appender.stdout=org.apache.log4j.ConsoleAppender
+log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
+log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m %n
+
+log4j.logger.org.apache=WARN
+
+log4j.logger.org.apache.shiro=INFO
+
+log4j.logger.org.apache.shiro.util.ThreadContext=WARN
+log4j.logger.org.apache.shiro.cache.ehcache.EhCache=WARN

security-modules/apache-shiro/src/main/resources/logback.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n
+            </pattern>
+        </encoder>
+    </appender>
+
+    <root level="INFO">
+        <appender-ref ref="STDOUT" />
+    </root>
+</configuration>

security-modules/apache-shiro/src/main/resources/shiro.ini

@@ -0,0 +1,9 @@
+[users]
+user = password,admin
+user2 = password2,editor
+user3 = password3,author
+
+[roles]
+admin = *
+editor = articles:*
+author = articles:compose,articles:save

security-modules/apache-shiro/src/main/resources/templates/comparison/home.ftl

@@ -0,0 +1,19 @@
+<html>
+<head>
+    <title>Home Page</title>
+</head>
+<body style="margin-left: 30px;">
+<h1>Welcome ${username}!</h1>
+<p><strong>Role</strong>: ${role}</p>
+<p><strong>Permissions</strong></p>
+<p>${permission}</p>
+<a href="/admin">Admin only</a>
+<#if adminContent??>
+  ${adminContent}
+</#if>
+<br>
+<form role="form" action="/logout" method="POST">
+   <input type="Submit" value="Logout" />
+</form>
+</body>
+</html>

security-modules/apache-shiro/src/main/resources/templates/comparison/index.ftl

@@ -0,0 +1,10 @@
+<html>
+<head>
+    <title>Index</title>
+</head>
+<body>
+    <h1>Welcome Guest!</h1>
+    <br>
+    Go to the <a href="/home">secured page
+</body>
+</html>

security-modules/apache-shiro/src/main/resources/templates/comparison/login.ftl

@@ -0,0 +1,25 @@
+<html>
+<head>
+    <title>Login</title>
+</head>
+<body style="margin-left: 30px;">
+<h3>Login</h3>
+<br>
+<form action="/login" method="post">
+    <#if (error?length > 0)??>
+        <p style="color:darkred;">${error}</p>
+    <#else>
+    </#if>
+
+    <label for="username">Username</label>
+    <br>
+    <input type="text" name="username">
+    <br><br>
+    <label for="password">Password</label>
+    <br>
+    <input type="password" name="password">
+    <br><br>
+    <input type="submit" value="Submit">
+</form>
+</body>
+</html>

security-modules/apache-shiro/src/main/resources/templates/index.ftl

@@ -0,0 +1,10 @@
+<html>
+<head>
+    <title>Index</title>
+</head>
+<body>
+    <h1>Welcome Guest!</h1>
+    <br>
+    <a href="/login">Login</a>
+</body>
+</html>

security-modules/apache-shiro/src/main/resources/templates/login.ftl

@@ -0,0 +1,27 @@
+<html>
+<head>
+    <title>Login</title>
+</head>
+<body style="margin-left: 30px;">
+<h3>Login</h3>
+<br>
+<form action="/login" method="post">
+    <#if (error?length > 0)??>
+        <p style="color:darkred;">${error}</p>
+    <#else>
+    </#if>
+
+    <label for="username">Username</label>
+    <br>
+    <input type="text" name="username">
+    <br><br>
+    <label for="password">Password</label>
+    <br>
+    <input type="password" name="password">
+    <br><br>
+    <input type="checkbox" name="rememberMe"> Remember Me
+    <br><br>
+    <input type="submit" value="Submit">
+</form>
+</body>
+</html>

security-modules/apache-shiro/src/main/resources/templates/secure.ftl

@@ -0,0 +1,15 @@
+<html>
+<head>
+    <title>Secure</title>
+</head>
+<body style="margin-left: 30px;">
+<h1>Welcome ${username}!</h1>
+<p><strong>Role</strong>: ${role}</p>
+<p><strong>Permissions</strong></p>
+<p>${permission}</p>
+<br>
+<form role="form" action="/logout" method="POST">
+   <input type="Submit" value="Logout" />
+</form>
+</body>
+</html>

security-modules/apache-shiro/src/test/java/com/baeldung/comparison/shiro/SpringContextTest.java

@@ -0,0 +1,20 @@
+package com.baeldung.comparison.shiro;
+
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.junit.jupiter.SpringExtension;
+
+import com.baeldung.comparison.shiro.ShiroApplication;
+
+@ExtendWith(SpringExtension.class)
+@SpringBootTest(classes = { ShiroApplication.class })
+public class SpringContextTest {
+
+    @Test
+    public void whenSpringContextIsBootstrapped_thenNoExceptions() {
+
+    }
+
+}

security-modules/apache-shiro/src/test/java/com/baeldung/comparison/springsecurity/SpringContextTest.java

@@ -0,0 +1,19 @@
+package com.baeldung.comparison.springsecurity;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.junit.jupiter.SpringExtension;
+
+import com.baeldung.comparison.springsecurity.Application;
+
+@ExtendWith(SpringExtension.class)
+@SpringBootTest(classes = { Application.class })
+public class SpringContextTest {
+
+    @Test
+    public void whenSpringContextIsBootstrapped_thenNoExceptions() {
+
+    }
+
+}

security-modules/apache-shiro/src/test/resources/logback-test.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration scan="true" scanPeriod="15 seconds" debug="false">
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>[%d{ISO8601}]-[%thread] %-5level %logger - %msg%n</pattern>
+        </encoder>
+    </appender>
+
+    <root level="INFO">
+        <appender-ref ref="STDOUT" />
+    </root>
+</configuration>

security-modules/cas/README.md

@@ -0,0 +1,18 @@
+## CAS
+
+This module contains articles about the Central Authentication Service (CAS).
+
+The module consists of 2 submodules:
+1. `cas-server` - it requires JDK11 and uses the Gradle War Overlay style to ease setup and deployment. To  start the server, simply run:
+
+`./gradlew run
+  -Dorg.gradle.java.home=$JAVA11_HOME
+  -Pargs="-Dcas.standalone.configurationDirectory=/cas-server/src/main/resources/etc/cas/config"`
+
+The server starts at https://localhost:8443. `casuser`/`Mellon` are the username and password for logging in.
+
+2. `cas-secured-app` - A Maven based Springboot Application
+
+### Relevant Articles: 
+
+- [CAS SSO With Spring Security](https://www.baeldung.com/spring-security-cas-sso)

security-modules/cas/cas-secured-app/.gitignore

@@ -0,0 +1,27 @@
+target/
+!.mvn/wrapper/maven-wrapper.jar
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+
+### NetBeans ###
+nbproject/private/
+build/
+nbbuild/
+dist/
+nbdist/
+.nb-gradle/
+/.mvn/
+/mvnw
+/mvnw.cmd

security-modules/cas/cas-secured-app/README.md

@@ -0,0 +1,3 @@
+## Relevant articles:
+- [CAS SSO With Spring Security](http://www.baeldung.com/spring-security-cas-sso)
+- [Code Analysis with SonarQube](http://www.baeldung.com/sonar-qube)

security-modules/cas/cas-secured-app/pom.xml

@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>cas-secured-app</artifactId>
+    <name>cas-secured-app</name>
+    <packaging>jar</packaging>
+    <description>Demo project for CAS</description>
+
+    <parent>
+        <groupId>com.baeldung.cas</groupId>
+        <artifactId>cas</artifactId>
+        <version>0.0.1-SNAPSHOT</version>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-cas</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-freemarker</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

security-modules/cas/cas-secured-app/src/main/java/com/baeldung/cassecuredapp/CasSecuredApplication.java

@@ -0,0 +1,96 @@
+package com.baeldung.cassecuredapp;
+
+import org.jasig.cas.client.session.SingleSignOutFilter;
+import org.jasig.cas.client.session.SingleSignOutHttpSessionListener;
+import org.jasig.cas.client.validation.Cas30ServiceTicketValidator;
+import org.jasig.cas.client.validation.TicketValidator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Primary;
+import org.springframework.context.event.EventListener;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.cas.authentication.CasAuthenticationProvider;
+import org.springframework.security.cas.web.CasAuthenticationEntryPoint;
+import org.springframework.security.cas.web.CasAuthenticationFilter;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.authentication.logout.LogoutFilter;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
+
+import javax.servlet.http.HttpSessionEvent;
+
+@SpringBootApplication
+public class CasSecuredApplication {
+
+    private static final Logger logger = LoggerFactory.getLogger(CasSecuredApplication.class);
+
+    public static void main(String... args) {
+        SpringApplication.run(CasSecuredApplication.class, args);
+    }
+
+    @Bean
+    public CasAuthenticationFilter casAuthenticationFilter(
+      AuthenticationManager authenticationManager,
+      ServiceProperties serviceProperties) throws Exception {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        filter.setAuthenticationManager(authenticationManager);
+        filter.setServiceProperties(serviceProperties);
+        return filter;
+    }
+
+    @Bean
+    public ServiceProperties serviceProperties() {
+        logger.info("service properties");
+        ServiceProperties serviceProperties = new ServiceProperties();
+        serviceProperties.setService("http://cas-client:8900/login/cas");
+        serviceProperties.setSendRenew(false);
+        return serviceProperties;
+    }
+
+    @Bean
+    public TicketValidator ticketValidator() {
+        return new Cas30ServiceTicketValidator("https://localhost:8443");
+    }
+
+    @Bean
+    public CasAuthenticationProvider casAuthenticationProvider(
+      TicketValidator ticketValidator,
+      ServiceProperties serviceProperties) {
+        CasAuthenticationProvider provider = new CasAuthenticationProvider();
+        provider.setServiceProperties(serviceProperties);
+        provider.setTicketValidator(ticketValidator);
+        provider.setUserDetailsService(
+          s -> new User("test@test.com", "Mellon", true, true, true, true,
+          AuthorityUtils.createAuthorityList("ROLE_ADMIN")));
+        provider.setKey("CAS_PROVIDER_LOCALHOST_8900");
+        return provider;
+    }
+
+
+    @Bean
+    public SecurityContextLogoutHandler securityContextLogoutHandler() {
+        return new SecurityContextLogoutHandler();
+    }
+
+    @Bean
+    public LogoutFilter logoutFilter() {
+        LogoutFilter logoutFilter = new LogoutFilter("https://localhost:8443/logout", securityContextLogoutHandler());
+        logoutFilter.setFilterProcessesUrl("/logout/cas");
+        return logoutFilter;
+    }
+
+    @Bean
+    public SingleSignOutFilter singleSignOutFilter() {
+        SingleSignOutFilter singleSignOutFilter = new SingleSignOutFilter();
+        singleSignOutFilter.setLogoutCallbackPath("/exit/cas");
+        singleSignOutFilter.setIgnoreInitConfiguration(true);
+        return singleSignOutFilter;
+    }
+
+}

security-modules/cas/cas-secured-app/src/main/java/com/baeldung/cassecuredapp/config/WebSecurityConfig.java

@@ -0,0 +1,79 @@
+package com.baeldung.cassecuredapp.config;
+
+import org.jasig.cas.client.session.SingleSignOutFilter;
+import org.jasig.cas.client.validation.Cas30ServiceTicketValidator;
+import org.jasig.cas.client.validation.TicketValidator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Primary;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.cas.ServiceProperties;
+import org.springframework.security.cas.authentication.CasAuthenticationProvider;
+import org.springframework.security.cas.web.CasAuthenticationEntryPoint;
+import org.springframework.security.cas.web.CasAuthenticationFilter;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.authentication.logout.LogoutFilter;
+
+import java.util.Collections;
+
+@EnableWebSecurity
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    private Logger logger = LoggerFactory.getLogger(WebSecurityConfig.class);
+    private SingleSignOutFilter singleSignOutFilter;
+    private LogoutFilter logoutFilter;
+    private CasAuthenticationProvider casAuthenticationProvider;
+    private ServiceProperties serviceProperties;
+
+    @Autowired
+    public WebSecurityConfig(SingleSignOutFilter singleSignOutFilter, LogoutFilter logoutFilter,
+                             CasAuthenticationProvider casAuthenticationProvider,
+                             ServiceProperties serviceProperties) {
+        this.logoutFilter = logoutFilter;
+        this.singleSignOutFilter = singleSignOutFilter;
+        this.serviceProperties = serviceProperties;
+        this.casAuthenticationProvider = casAuthenticationProvider;
+    }
+
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http.authorizeRequests().antMatchers( "/secured", "/login").authenticated()
+          .and()
+          .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
+          .and()
+          .addFilterBefore(singleSignOutFilter, CasAuthenticationFilter.class)
+          .addFilterBefore(logoutFilter, LogoutFilter.class)
+          .csrf().ignoringAntMatchers("/exit/cas");
+    }
+
+    @Override
+    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+        auth.authenticationProvider(casAuthenticationProvider);
+    }
+
+    @Bean
+    @Override
+    protected AuthenticationManager authenticationManager() throws Exception {
+        return new ProviderManager(Collections.singletonList(casAuthenticationProvider));
+    }
+
+    public AuthenticationEntryPoint authenticationEntryPoint() {
+        CasAuthenticationEntryPoint entryPoint = new CasAuthenticationEntryPoint();
+        entryPoint.setLoginUrl("https://localhost:8443/login");
+        entryPoint.setServiceProperties(serviceProperties);
+        return entryPoint;
+    }
+
+
+
+}

security-modules/cas/cas-secured-app/src/main/java/com/baeldung/cassecuredapp/controllers/AuthController.java

@@ -0,0 +1,39 @@
+package com.baeldung.cassecuredapp.controllers;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
+import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import static org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices.SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY;
+
+@Controller
+public class AuthController {
+
+    private Logger logger = LoggerFactory.getLogger(AuthController.class);
+
+    @GetMapping("/login")
+    public String login() {
+        logger.info("/login called");
+        return "redirect:/secured";
+    }
+
+
+    @GetMapping("/logout")
+    public String logout(HttpServletRequest request, HttpServletResponse response, SecurityContextLogoutHandler logoutHandler) {
+        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+        CookieClearingLogoutHandler cookieClearingLogoutHandler = new CookieClearingLogoutHandler(SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY);
+        cookieClearingLogoutHandler.logout(request, response, auth);
+        logoutHandler.logout(request, response, auth);
+        return "auth/logout";
+    }
+
+}

security-modules/cas/cas-secured-app/src/main/java/com/baeldung/cassecuredapp/controllers/IndexController.java

@@ -0,0 +1,19 @@
+package com.baeldung.cassecuredapp.controllers;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+
+@Controller
+public class IndexController {
+
+    private Logger logger = LoggerFactory.getLogger(IndexController.class);
+
+    @GetMapping("/")
+    public String index() {
+        logger.info("Index controller called");
+        return "index";
+    }
+
+}

security-modules/cas/cas-secured-app/src/main/java/com/baeldung/cassecuredapp/controllers/SecuredController.java

@@ -0,0 +1,30 @@
+package com.baeldung.cassecuredapp.controllers;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.ModelMap;
+import org.springframework.web.bind.annotation.GetMapping;
+
+@Controller
+public class SecuredController {
+
+    private Logger logger = LoggerFactory.getLogger(SecuredController.class);
+
+    @GetMapping("/secured")
+    public String securedIndex(ModelMap modelMap) {
+
+        logger.info("/secured called");
+
+        Authentication auth = SecurityContextHolder.getContext()
+                .getAuthentication();
+
+        if(auth.getPrincipal() instanceof UserDetails)
+            modelMap.put("username", ((UserDetails) auth.getPrincipal()).getUsername());
+
+        return "secure/index";
+    }
+}

security-modules/cas/cas-secured-app/src/main/resources/application.properties

@@ -0,0 +1,2 @@
+server.port=8900
+spring.freemarker.suffix=.ftl

security-modules/cas/cas-secured-app/src/main/resources/logback.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n
+            </pattern>
+        </encoder>
+    </appender>
+
+    <root level="INFO">
+        <appender-ref ref="STDOUT" />
+    </root>
+</configuration>

security-modules/cas/cas-secured-app/src/main/resources/templates/auth/logout.ftl

@@ -0,0 +1,10 @@
+<html>
+<head>
+    <title>Cas Secured App - Logout</title>
+</head>
+<body>
+<h1>You have logged out of Cas Secured Spring Boot App Successfully</h1>
+<br>
+<a href="/logout/cas">Log out of all other Services</a>
+</body>
+</html>

security-modules/cas/cas-secured-app/src/main/resources/templates/index.ftl

@@ -0,0 +1,11 @@
+<html>
+<head>
+    <title>Cas Secured App - Index</title>
+</head>
+<body>
+<h1>Welcome to Cas Secured Spring Boot App</h1>
+<h2>This is a Public Page</h2>
+<br>
+<a href="/login">Login</a>
+</body>
+</html>

security-modules/cas/cas-secured-app/src/main/resources/templates/secure/index.ftl

@@ -0,0 +1,12 @@
+<html>
+<head>
+    <title>Cas Secured App - Secured</title>
+</head>
+<body>
+<h1>Welcome to Cas Secured Spring Boot App</h1>
+<h2>This is a Secured Page</h2>
+<h3>Welcome home <span style="color:cadetblue;">${username!""}</span></h3>
+<br>
+<a href="/logout">Logout</a>
+</body>
+</html>

security-modules/cas/cas-secured-app/src/test/java/com/baeldung/cassecuredapp/CasSecuredApplicationIntegrationTest.java

@@ -0,0 +1,16 @@
+package com.baeldung.cassecuredapp;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.junit4.SpringRunner;
+
+@RunWith(SpringRunner.class)
+@SpringBootTest
+public class CasSecuredApplicationIntegrationTest {
+
+	@Test
+	public void contextLoads() {
+	}
+
+}

security-modules/cas/cas-server/.gitignore

@@ -0,0 +1,21 @@
+.classpath
+!/.project
+.project
+.settings
+.history
+.vscode
+target/
+.idea/
+.DS_Store
+.idea
+overlays/
+.gradle/
+build/
+log/
+bin/
+*.war
+*.iml
+*.log
+tmp/
+./apache-tomcat
+apache-tomcat.zip

security-modules/cas/cas-server/.mergify.yml

@@ -0,0 +1,32 @@
+#
+# Licensed to Apereo under one or more contributor license
+# agreements. See the NOTICE file distributed with this work
+# for additional information regarding copyright ownership.
+# Apereo licenses this file to you under the Apache License,
+# Version 2.0 (the "License"); you may not use this file
+# except in compliance with the License.  You may obtain a
+# copy of the License at the following location:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+pull_request_rules:
+- name: automatic merge by dependabot
+  conditions:
+    - status-success=continuous-integration/travis-ci/pr
+    - status-success=WIP
+    - "#changes-requested-reviews-by=0"
+    - base=master
+    - label=dependencies
+  actions:
+    merge:
+      method: merge
+      strict: true
+    delete_head_branch:

security-modules/cas/cas-server/.travis.yml

@@ -0,0 +1,62 @@
+language: java
+sudo: required
+dist: trusty
+services:
+  - docker
+branches:
+  only:
+    - master
+before_cache:
+  - rm -rf $HOME/.gradle/caches/5.*/
+  - rm -rf $HOME/.gradle/caches/4.*/
+  - rm -fr $HOME/.gradle/caches/*/plugin-resolution/
+  - find ~/.gradle/caches/ -name "*.lock" -type f -delete
+cache:
+  bundler: false
+  cargo: false
+  directories:
+    - $HOME/.m2
+    - $HOME/.npm/
+    - $HOME/.gradle/caches/
+    - $HOME/.gradle/wrapper/
+env:
+  global:
+    - JAVA_OPTS="-Xms512m -Xmx4048m -Xss128m -XX:ReservedCodeCacheSize=512m -XX:+UseG1GC -Xverify:none -server"
+    - GRADLE_OPTS="-Xms512m -Xmx1024m -Xss128m -XX:ReservedCodeCacheSize=512m -XX:+UseG1GC -Xverify:none -server"
+jdk:
+- openjdk11
+before_install:
+- echo -e "Configuring Gradle wrapper...\n"
+- mkdir -p ~/.gradle && echo "org.gradle.daemon=false" >> ~/.gradle/gradle.properties
+- chmod -R 777 ./gradlew
+- chmod -R 777 *.sh
+install: true
+stages:
+  - build
+  - validate
+  - docker
+jobs:
+  include:
+    - stage: build
+      script: ./gradlew clean build --stacktrace --no-daemon --refresh-dependencies -Dorg.gradle.internal.http.socketTimeout=600000 -Dorg.gradle.internal.http.connectionTimeout=600000
+      name: "Build CAS"
+      ############################################
+    - stage: validate
+      script: ./gradlew downloadShell
+      name: "Download CAS Shell"
+    - stage: validate
+      script: ./gradlew listTemplateViews
+      name: "List CAS Template Views"
+    - stage: validate
+      script: ./gradlew explodeWar
+      name: "Unzip CAS Web Application"
+      ############################################
+    - stage: docker
+      script: ./gradlew build jibDockerBuild --stacktrace --no-daemon --refresh-dependencies
+      name: "Build Docker Image via Jib"
+    - stage: docker
+      script: docker-compose build
+      name: "Build Docker Image via Docker Compose"
+    - stage: docker
+      script: ./docker-build.sh
+      name: "Build Docker Image"

security-modules/cas/cas-server/Dockerfile

@@ -0,0 +1,40 @@
+FROM adoptopenjdk/openjdk11:alpine-slim AS overlay
+
+RUN mkdir -p cas-overlay
+COPY ./src cas-overlay/src/
+COPY ./gradle/ cas-overlay/gradle/
+COPY ./gradlew ./settings.gradle ./build.gradle ./gradle.properties /cas-overlay/
+
+RUN mkdir -p ~/.gradle \
+    && echo "org.gradle.daemon=false" >> ~/.gradle/gradle.properties \
+    && echo "org.gradle.configureondemand=true" >> ~/.gradle/gradle.properties \
+    && cd cas-overlay \
+    && chmod 750 ./gradlew \
+    && ./gradlew --version;
+
+RUN cd cas-overlay \
+    && ./gradlew clean build --parallel;
+
+FROM adoptopenjdk/openjdk11:alpine-jre AS cas
+
+LABEL "Organization"="Apereo"
+LABEL "Description"="Apereo CAS"
+
+RUN cd / \
+    && mkdir -p /etc/cas/config \
+    && mkdir -p /etc/cas/services \
+    && mkdir -p /etc/cas/saml \
+    && mkdir -p cas-overlay;
+
+COPY etc/cas/ /etc/cas/
+COPY etc/cas/config/ /etc/cas/config/
+COPY etc/cas/services/ /etc/cas/services/
+COPY etc/cas/saml/ /etc/cas/saml/
+COPY --from=overlay cas-overlay/build/libs/cas.war cas-overlay/
+
+EXPOSE 8080 8443
+
+ENV PATH $PATH:$JAVA_HOME/bin:.
+
+WORKDIR cas-overlay
+ENTRYPOINT ["java", "-server", "-noverify", "-Xmx2048M", "-jar", "cas.war"]

security-modules/cas/cas-server/LICENSE.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

security-modules/cas/cas-server/build.gradle

@@ -0,0 +1,106 @@
+buildscript {
+    repositories {
+        mavenLocal()
+        mavenCentral()
+        jcenter()
+        maven { url "https://repo.spring.io/libs-milestone" }
+        maven { url "https://repo.spring.io/libs-snapshot" }
+        maven { url "https://plugins.gradle.org/m2/" }
+    }
+    dependencies {
+        classpath "de.undercouch:gradle-download-task:${project.gradleDownloadTaskVersion}"
+        classpath "org.springframework.boot:spring-boot-gradle-plugin:${project.springBootVersion}"
+        classpath "gradle.plugin.com.google.cloud.tools:jib-gradle-plugin:${project.jibVersion}"
+        classpath "io.freefair.gradle:maven-plugin:${project.gradleMavenPluginVersion}"
+    }
+}
+
+repositories {
+    mavenLocal()
+    mavenCentral()
+    jcenter()
+    maven { url "https://oss.sonatype.org/content/repositories/snapshots" }
+    maven { url "https://build.shibboleth.net/nexus/content/repositories/releases/" }
+    maven { url "https://repo.spring.io/milestone/" }
+    maven { url "https://repo.spring.io/snapshot/" }
+    maven { url "https://oss.jfrog.org/artifactory/oss-snapshot-local" }
+}
+
+def casServerVersion = project.'cas.version'
+def casWebApplicationBinaryName = "cas.war"
+
+project.ext."casServerVersion" = casServerVersion
+project.ext."casWebApplicationBinaryName" = casWebApplicationBinaryName
+
+apply plugin: "io.freefair.war-overlay"
+apply from: rootProject.file("gradle/tasks.gradle")
+
+apply plugin: "war"
+apply plugin: "eclipse"
+apply plugin: "idea"
+
+apply from: rootProject.file("gradle/springboot.gradle")
+apply from: rootProject.file("gradle/dockerjib.gradle")
+
+dependencies {
+    // Other CAS dependencies/modules may be listed here...
+    compile "org.apereo.cas:cas-server-support-json-service-registry:${casServerVersion}"
+    compile "org.apereo.cas:cas-server-support-jdbc:${casServerVersion}"
+}
+
+tasks.findByName("jibDockerBuild")
+    .dependsOn(copyWebAppIntoJib, copyConfigIntoJib)
+    .finalizedBy(deleteWebAppFromJib)
+
+tasks.findByName("jib")
+    .dependsOn(copyWebAppIntoJib, copyConfigIntoJib)
+    .finalizedBy(deleteWebAppFromJib)
+    
+configurations.all {
+    resolutionStrategy {
+        cacheChangingModulesFor 0, "seconds"
+        cacheDynamicVersionsFor 0, "seconds"
+
+        preferProjectModules()
+
+        def failIfConflict = project.hasProperty("failOnVersionConflict") && Boolean.valueOf(project.getProperty("failOnVersionConflict"))
+        if (failIfConflict) {
+            failOnVersionConflict()
+        }
+    }
+}
+
+eclipse {
+    classpath {
+       downloadSources = true
+       downloadJavadoc = true
+    }
+}
+
+idea {
+    module {
+        downloadJavadoc = true
+        downloadSources = true
+    }
+}
+
+bootWar {
+    entryCompression = ZipEntryCompression.STORED
+    overlays {
+        // https://docs.freefair.io/gradle-plugins/current/reference/#_io_freefair_war_overlay
+        // Note: The "excludes" property is only for files in the war dependency.
+        // If a jar is excluded from the war, it could be brought back into the final war as a dependency
+        // of non-war dependencies. Those should be excluded via normal gradle dependency exclusions.
+        cas {
+            from "org.apereo.cas:cas-server-webapp${project.appServer}:${casServerVersion}@war"
+            provided = false
+            //excludes = ["WEB-INF/lib/somejar-1.0*"]
+        }
+    }
+}
+
+
+wrapper {
+    distributionType = Wrapper.DistributionType.BIN
+    gradleVersion = "${project.gradleVersion}"
+}

security-modules/cas/cas-server/docker-build.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+image_tag=(`cat gradle.properties | grep "cas.version" | cut -d= -f2`)
+
+echo "Building CAS docker image tagged as [$image_tag]"
+# read -p "Press [Enter] to continue..." any_key;
+
+docker build --tag="org.apereo.cas/cas:$image_tag" . \
+  && echo "Built CAS image successfully tagged as org.apereo.cas/cas:$image_tag" \
+  && docker images "org.apereo.cas/cas:$image_tag"

security-modules/cas/cas-server/docker-compose.yml

@@ -0,0 +1,7 @@
+version: '3'
+services:
+  cas:
+    build: .
+    ports:
+     - "8443:8443"
+     - "8080:8080"

security-modules/cas/cas-server/docker-push.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+read -p "Docker username: " docker_user
+read -s -p "Docker password: " docker_psw
+
+echo "$docker_psw" | docker login --username "$docker_user" --password-stdin
+
+image_tag=(`cat gradle.properties | grep "cas.version" | cut -d= -f2`)
+
+echo "Pushing CAS docker image tagged as $image_tag to org.apereo.cas/cas..."
+docker push org.apereo.cas/cas:"$image_tag" \
+	&& echo "Pushed org.apereo.cas/cas:$image_tag successfully.";

security-modules/cas/cas-server/docker-run.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+docker stop cas > /dev/null 2>&1
+docker rm cas > /dev/null 2>&1
+image_tag=(`cat gradle.properties | grep "cas.version" | cut -d= -f2`)
+docker run -d -p 8080:8080 -p 8443:8443 --name="cas" org.apereo.cas/cas:"${image_tag}"
+docker logs -f cas

security-modules/cas/cas-server/etc/cas/config/cas.properties

@@ -0,0 +1,6 @@
+cas.server.name=https://cas.example.org:8443
+cas.server.prefix=${cas.server.name}/cas
+
+logging.config: file:/etc/cas/config/log4j2.xml
+
+# cas.authn.accept.users=

security-modules/cas/cas-server/etc/cas/config/log4j2.xml

@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!-- Specify the refresh internal in seconds. -->
+<Configuration monitorInterval="5" packages="org.apereo.cas.logging">
+    <Properties>
+        <Property name="baseDir">/var/log</Property>
+
+        <Property name="cas.log.level">info</Property>
+        <Property name="spring.webflow.log.level">warn</Property>
+        <Property name="spring.security.log.level">info</Property>
+        <Property name="spring.cloud.log.level">warn</Property>
+        <Property name="spring.boot.admin.log.level">debug</Property>
+        <Property name="spring.web.log.level">warn</Property>
+        <Property name="spring.boot.log.level">warn</Property>
+        <Property name="ldap.log.level">warn</Property>
+        <Property name="pac4j.log.level">warn</Property>
+        <Property name="opensaml.log.level">warn</Property>
+        <Property name="hazelcast.log.level">warn</Property>
+    </Properties>
+    <Appenders>
+        <Console name="console" target="SYSTEM_OUT">
+            <PatternLayout pattern="%highlight{%d %p [%c] - &lt;%m&gt;}%n"/>
+        </Console>
+        <RollingFile name="file" fileName="${baseDir}/cas.log" append="true"
+                     filePattern="${baseDir}/cas-%d{yyyy-MM-dd-HH}-%i.log">
+            <PatternLayout pattern="%d %p [%c] - &lt;%m&gt;%n"/>
+            <Policies>
+                <OnStartupTriggeringPolicy />
+                <SizeBasedTriggeringPolicy size="10 MB"/>
+                <TimeBasedTriggeringPolicy />
+            </Policies>
+        </RollingFile>
+        <RollingFile name="auditlogfile" fileName="${baseDir}/cas_audit.log" append="true"
+                     filePattern="${baseDir}/cas_audit-%d{yyyy-MM-dd-HH}-%i.log">
+            <PatternLayout pattern="%d %p [%c] - %m%n"/>
+            <Policies>
+                <OnStartupTriggeringPolicy />
+                <SizeBasedTriggeringPolicy size="10 MB"/>
+                <TimeBasedTriggeringPolicy />
+            </Policies>
+        </RollingFile>
+
+        <CasAppender name="casAudit">
+            <AppenderRef ref="auditlogfile" />
+        </CasAppender>
+        <CasAppender name="casFile">
+            <AppenderRef ref="file" />
+        </CasAppender>
+        <CasAppender name="casConsole">
+            <AppenderRef ref="console" />
+        </CasAppender>
+    </Appenders>
+    <Loggers>
+        <!-- If adding a Logger with level set higher than warn, make category as selective as possible -->
+        <!-- Loggers inherit appenders from Root Logger unless additivity is false -->
+        <AsyncLogger name="org.apereo" level="${sys:cas.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.apereo.services.persondir" level="${sys:cas.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.apereo.cas.web.flow" level="${sys:cas.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.apereo.spring" level="${sys:cas.log.level}" includeLocation="true"/>
+
+        <AsyncLogger name="org.apache" level="warn" />
+        <AsyncLogger name="org.apache.http" level="error" />
+
+        <AsyncLogger name="org.springframework.boot" level="${sys:spring.boot.log.level" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.boot.context.embedded" level="info" includeLocation="true" />
+        <AsyncLogger name="org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration"
+        level="${sys:spring.security.log.level}" includeLocation="true" />
+        <AsyncLogger name="org.springframework.boot.autoconfigure.security" level="${sys:spring.security.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.boot.devtools" level="off" includeLocation="true"/>
+
+        <AsyncLogger name="org.springframework" level="warn" includeLocation="true" />
+        <AsyncLogger name="org.springframework.webflow" level="${sys:spring.webflow.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.aop" level="warn" includeLocation="true" />
+        <AsyncLogger name="org.springframework.web" level="warn" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.session" level="warn" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.scheduling" level="info" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.cloud.vault" level="warn" includeLocation="true" />
+        <AsyncLogger name="org.springframework.web.client" level="warn" includeLocation="true" />
+        <AsyncLogger name="org.springframework.security" level="${sys:spring.security.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.cloud" level="${sys:spring.cloud.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.amqp" level="error" />
+        <AsyncLogger name="org.springframework.integration" level="warn" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.messaging" level="warn" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.web" level="${sys:spring.web.log.level}" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.orm.jpa" level="warn" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.scheduling" level="warn" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.context.annotation" level="off" includeLocation="true"/>
+        <AsyncLogger name="org.springframework.web.socket" level="warn" includeLocation="true"/>
+
+        <AsyncLogger name="org.thymeleaf" level="warn" includeLocation="true"/>
+
+        <AsyncLogger name="org.pac4j" level="${sys:pac4j.log.level}" includeLocation="true"/>
+
+        <AsyncLogger name="org.opensaml" level="${sys:opensaml.log.level}" includeLocation="true"/>
+        <AsyncLogger name="PROTOCOL_MESSAGE" level="${sys:opensaml.log.level}" includeLocation="true" />
+
+        <AsyncLogger name="net.sf.ehcache" level="warn" includeLocation="true"/>
+        <AsyncLogger name="com.couchbase" level="warn" includeLocation="true"/>
+        <AsyncLogger name="de.codecentric" level="${sys:spring.boot.admin.log.level}" includeLocation="true"/>
+        <AsyncLogger name="net.jradius" level="warn" includeLocation="true" />
+        <AsyncLogger name="org.openid4java" level="warn" includeLocation="true" />
+        <AsyncLogger name="org.ldaptive" level="${sys:ldap.log.level}" includeLocation="true"/>
+        <AsyncLogger name="com.hazelcast" level="${sys:hazelcast.log.level}" includeLocation="true"/>
+
+        <!-- Log audit to all root appenders, and also to audit log (additivity is not false) -->
+        <AsyncLogger name="org.apereo.inspektr.audit.support" level="info" includeLocation="true" >
+            <AppenderRef ref="casAudit"/>
+        </AsyncLogger>
+
+        <!-- All Loggers inherit appenders specified here, unless additivity="false" on the Logger -->
+        <AsyncRoot level="warn">
+            <AppenderRef ref="casFile"/>
+            <!-- 
+                 For deployment to an application server running as service, 
+                 delete the casConsole appender below
+            -->
+            <AppenderRef ref="casConsole"/>
+        </AsyncRoot>
+    </Loggers>
+</Configuration>

security-modules/cas/cas-server/etc/cas/saml/.gitkeep

@@ -0,0 +1 @@
+This directory is references in the Dockerfile so it needs to be here. 

security-modules/cas/cas-server/gradle.properties

@@ -0,0 +1,28 @@
+# Versions
+cas.version=6.1.5
+springBootVersion=2.2.0.RELEASE
+
+# Use -jetty, -undertow to other containers
+# Or blank if you want to deploy to an external container
+appServer=-tomcat
+executable=false
+
+gradleVersion=5.6.3
+tomcatVersion=9.0.30
+
+group=org.apereo.cas
+sourceCompatibility=11
+targetCompatibility=11
+
+jibVersion=1.7.0
+
+# Location of the downloaded CAS shell JAR
+shellDir=build/libs
+ivyVersion=2.4.0
+gradleDownloadTaskVersion=3.4.3
+gradleMavenPluginVersion=3.8.4
+
+# use without "-slim" in tag name if you want tools like jstack, adds about 100MB to image size
+# (https://hub.docker.com/r/adoptopenjdk/openjdk11/tags/)
+baseDockerImage=adoptopenjdk/openjdk11:alpine-jre
+allowInsecureRegistries=false

security-modules/cas/cas-server/gradle/dockerjib.gradle

@@ -0,0 +1,52 @@
+apply plugin: "com.google.cloud.tools.jib"
+
+jib {
+    from {
+        image = project.baseDockerImage
+    }
+    to {
+        image = "${project.group}/${project.name}"
+        /**
+         ecr-login: Amazon Elastic Container Registry (ECR)
+         gcr: Google Container Registry (GCR)
+         osxkeychain: Docker Hub
+         */
+        credHelper = "osxkeychain"
+        /**
+        auth {
+            username = "*******"
+            password = "*******"
+        }
+        tags = [casServerVersion]
+        */
+    }
+    container {
+        useCurrentTimestamp = true
+        entrypoint = ['docker/entrypoint.sh']
+        ports = ['80', '443', '8080', '8443']
+        labels = [version:casServerVersion, name:project.name, group:project.group]
+    }
+    extraDirectories {
+        paths = 'src/main/jib'
+        permissions = [
+            '/docker/entrypoint.sh': '755'
+        ]
+    }
+    allowInsecureRegistries = project.allowInsecureRegistries
+}
+
+task copyWebAppIntoJib(type: Copy, group: "Docker", description: "Copy the web application into Docker image") {
+    dependsOn build
+    from "build/libs/${casWebApplicationBinaryName}"
+    into "src/main/jib/docker/cas/war"
+}
+
+task copyConfigIntoJib(type: Copy, group: "Docker", description: "Copy the CAS configuration into Docker image") {
+    dependsOn build
+    from "etc/cas"
+    into "src/main/jib/docker/cas"
+}
+
+task deleteWebAppFromJib(type: Delete, group: "Docker", description: "Explodes the CAS web application archive") {
+    delete "src/main/jib/docker/cas"
+}

security-modules/cas/cas-server/gradle/springboot.gradle

@@ -0,0 +1,24 @@
+apply plugin: "org.springframework.boot"
+
+bootRun.enabled = false
+bootRun.onlyIf { return false }
+tasks.remove(tasks['bootRun'])
+
+springBoot {
+    mainClassName = "org.apereo.cas.web.CasWebApplication"
+}
+
+bootWar {
+    doFirst {
+        def executable = project.hasProperty("executable") && Boolean.valueOf(project.getProperty("executable"))
+        if (executable) {
+            logger.info "Including launch script for executable WAR artifact"
+            launchScript()
+        } else {
+            logger.info "WAR artifact is not marked as an executable"
+        }
+        archiveName "${casWebApplicationBinaryName}"
+        baseName "cas"
+        excludeDevtools = true
+    }
+}

security-modules/cas/cas-server/gradle/tasks.gradle

@@ -0,0 +1,258 @@
+import org.apache.ivy.util.url.*
+import org.apache.tools.ant.taskdefs.condition.Os
+import org.gradle.api.tasks.Copy
+
+import java.nio.file.*
+import org.gradle.internal.logging.text.StyledTextOutputFactory;
+import static org.gradle.internal.logging.text.StyledTextOutput.Style;
+
+buildscript {
+    repositories {
+        mavenLocal()
+        mavenCentral()
+        jcenter()
+    }
+    dependencies {
+        classpath "org.apache.ivy:ivy:${project.ivyVersion}"
+    }
+}
+
+apply plugin: "de.undercouch.download"
+
+def tomcatDirectory = "${buildDir}/apache-tomcat-${tomcatVersion}"
+project.ext."tomcatDirectory" = tomcatDirectory
+
+def explodedDir="${buildDir}/cas"
+def explodedResourcesDir="${buildDir}/cas-resources"
+def resourceJarName = "cas-server-webapp-resources"
+
+task copyCasConfiguration(type: Copy, group: "build", description: "Copy the CAS configuration from this project to /etc/cas/config") {
+    from "etc/cas/config"
+    into new File('/etc/cas/config').absolutePath
+    doFirst {
+        new File('/etc/cas/config').mkdirs()
+    }
+}
+
+task explodeWarOnly(type: Copy, group: "build", description: "Explodes the CAS web application archive") {
+    dependsOn 'build'
+    from zipTree("build/libs/${casWebApplicationBinaryName}")
+    into explodedDir
+}
+
+task explodeWar(type: Copy, group: "build", description: "Explodes the CAS archive and resources jar from the CAS web application archive") {
+    dependsOn explodeWarOnly
+    from zipTree("${explodedDir}/WEB-INF/lib/${resourceJarName}-${casServerVersion}.jar")
+    into explodedResourcesDir
+}
+
+task run(group: "build", description: "Run the CAS web application in embedded container mode") {
+    dependsOn 'build'
+    doLast {
+        def casRunArgs = new ArrayList<>(Arrays.asList("-server -noverify -Xmx2048M -XX:+TieredCompilation -XX:TieredStopAtLevel=1".split(" ")))
+        if (project.hasProperty('args')) {
+            casRunArgs.addAll(project.args.split('\\s+'))
+        }
+        javaexec {
+            main = "-jar"
+            jvmArgs = casRunArgs
+            args = ["build/libs/${casWebApplicationBinaryName}"]
+            logger.info "Started ${commandLine}"
+        }
+    }
+}
+
+task setExecutable(group: "build", description: "Configure the project to run in executable mode") {
+    doFirst {
+        project.setProperty("executable", "true")
+        logger.info "Configuring the project as executable"
+    }
+}
+
+task executable(type:Exec, group: "build", description: "Run the CAS web application in standalone executable mode") {
+    dependsOn setExecutable, 'build'
+    doFirst {
+        workingDir "."
+        if (!Os.isFamily(Os.FAMILY_WINDOWS)) {
+            commandLine "chmod", "+x", bootWar.archivePath
+        }
+        logger.info "Running ${bootWar.archivePath}"
+        commandLine bootWar.archivePath
+    }
+}
+
+task debug(group: "build", description: "Debug the CAS web application in embedded mode on port 5005") {
+    dependsOn 'build'
+    doLast {
+        logger.info "Debugging process is started in a suspended state, listening on port 5005."
+        def casArgs = Arrays.asList("-Xmx2048M".split(" "))
+        javaexec {
+            main = "-jar"
+            jvmArgs = casArgs
+            debug = true
+            args = ["build/libs/${casWebApplicationBinaryName}"]
+            logger.info "Started ${commandLine}"
+        }
+    }
+}
+
+task downloadShell(group: "shell", description: "Download CAS shell jar from snapshot or release maven repo") {
+    doFirst {
+        mkdir "${project.shellDir}"
+    }
+    doLast {
+        def downloadFile
+        if (isRunningCasServerSnapshot(casServerVersion)) {
+            def snapshotDir = "https://oss.sonatype.org/content/repositories/snapshots/org/apereo/cas/cas-server-support-shell/${casServerVersion}/"
+            def files = new ApacheURLLister().listFiles(new URL(snapshotDir))
+            files = files.sort{it.path}
+            files.each {
+                if (it.path.endsWith(".jar")) {
+                    downloadFile = it
+                }
+            }
+        } else {
+            downloadFile = "https://repo1.maven.org/maven2/org/apereo/cas/cas-server-support-shell/${casServerVersion}/cas-server-support-shell-${casServerVersion}.jar"
+        }
+        logger.info "Downloading file: ${downloadFile}"
+        download {
+            src downloadFile
+            dest new File("${project.shellDir}", "cas-server-support-shell-${casServerVersion}.jar")
+            overwrite false
+        }
+    }
+}
+
+task runShell(group: "shell",  description: "Run the CAS shell") {
+    dependsOn downloadShell
+    doLast {
+        println "Run the following command to launch the shell:\n\tjava -jar ${project.shellDir}/cas-server-support-shell-${casServerVersion}.jar"
+    }
+}
+
+task debugShell(group: "shell", description: "Run the CAS shell with debug options, wait for debugger on port 5005") {
+    dependsOn downloadShell
+    doLast {
+        println """
+        Run the following command to launch the shell:\n\t
+        java -Xrunjdwp:transport=dt_socket,address=5000,server=y,suspend=y -jar ${project.shellDir}/cas-server-support-shell-${casServerVersion}.jar
+        """
+    }
+}
+
+task showConfiguration(group: "build", description: "Show configurations for each dependency, etc") {
+    doLast() {
+        def cfg = project.hasProperty("configuration") ? project.property("configuration") : "compile"
+        configurations.getByName(cfg).each { println it }
+    }
+}
+
+task allDependenciesInsight(group: "build", type: DependencyInsightReportTask, description: "Produce insight information for all dependencies") {}
+
+task allDependencies(group: "build", type: DependencyReportTask, description: "Display a graph of all project dependencies") {}
+
+task casVersion (group: "build", description: "Display the current CAS version") {
+    doFirst {
+        def verbose = project.hasProperty("verbose") && Boolean.valueOf(project.getProperty("verbose"))
+        if (verbose) {
+            def out = services.get(StyledTextOutputFactory).create("CAS")
+            println "******************************************************************"
+            out.withStyle(Style.Info).println "Apereo CAS $casServerVersion"
+            out.withStyle(Style.Description).println "Enterprise Single SignOn for all earthlings and beyond"
+            out.withStyle(Style.SuccessHeader).println "- GitHub: "
+            out.withStyle(Style.Success).println "https://github.com/apereo/cas"
+            out.withStyle(Style.SuccessHeader).println "- Docs: "
+            out.withStyle(Style.Success).println "https://apereo.github.io/cas"
+            out.withStyle(Style.SuccessHeader).println "- Blog: "
+            out.withStyle(Style.Success).println "https://apereo.github.io"
+            println "******************************************************************"
+        } else {
+            println casServerVersion
+        }
+    }
+}
+
+task createKeystore(group: "build", description: "Create CAS keystore") {
+    doFirst {
+        mkdir "/etc/cas"
+
+        def keystorePath = "/etc/cas/thekeystore"
+
+        def dn = "CN=cas.example.org,OU=Example,OU=Org,C=US"
+        if (project.hasProperty("certificateDn")) {
+            dn = project.getProperty("certificateDn")
+        }
+        def subjectAltName = "dns:example.org,dns:localhost,ip:127.0.0.1"
+        if (project.hasProperty("certificateSubAltName")) {
+            subjectAltName = project.getProperty("certificateSubAltName")
+        }
+        // this will fail if thekeystore exists and has cert with cas alias already (so delete if you want to recreate)
+        logger.info "Generating keystore for CAS with DN ${dn}"
+        exec {
+            workingDir "."
+            commandLine "keytool", "-genkeypair", "-alias", "cas",
+                    "-keyalg", "RSA",
+                    "-keypass", "changeit", "-storepass", "changeit",
+                    "-keystore", keystorePath,
+                    "-dname", dn, "-ext", "SAN=${subjectAltName}"
+        }
+        logger.info "Exporting cert from keystore..."
+        exec {
+            workingDir "."
+            commandLine "keytool", "-exportcert", "-alias", "cas",
+                    "-storepass", "changeit", "-keystore", keystorePath,
+                    "-file", "/etc/cas/cas.cer"
+        }
+        logger.info "Import /etc/cas/cas.cer into your Java truststore (JAVA_HOME/lib/security/cacerts)"
+    }
+}
+
+task listTemplateViews (group: "build", description: "List all CAS views") {
+    dependsOn explodeWar
+
+    doFirst {
+        fileTree(explodedResourcesDir).matching {
+            include "**/*.html"
+        }
+        .collect { it.name }
+        .toSorted()
+        .each { println it }
+    }
+}
+
+task getResource(group: "build", description: "Fetch a CAS resource and move it into the overlay") {
+    dependsOn explodeWar
+
+    doFirst {
+        def resourceName = project.getProperty("resourceName")
+
+        def results = fileTree(explodedResourcesDir).matching {
+            include "**/${resourceName}.*"
+        }
+        if (results.isEmpty()) {
+            println "No resources could be found matching ${resourceName}"
+            return
+        }
+        if (results.size() > 1) {
+            println "Multiple resources found matching ${resourceName}: ${results}"
+            return
+        }
+
+        def fromFile = explodedResourcesDir
+        def resourcesDir = "src/main/resources"
+        mkdir resourcesDir
+
+        def resourceFile = results[0].canonicalPath
+        def toResourceFile = resourceFile.replace(fromFile, resourcesDir)
+
+        def parent = file(toResourceFile).getParent()
+        mkdir parent
+
+        Files.copy(Paths.get(resourceFile), Paths.get(toResourceFile), StandardCopyOption.REPLACE_EXISTING)
+        println "Copied file ${resourceFile} to ${toResourceFile}"
+    }
+}
+
+def isRunningCasServerSnapshot(casServerVersion) {
+    return "${casServerVersion}".contains("-SNAPSHOT")
+}

security-modules/cas/cas-server/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,5 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-5.6.3-bin.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

security-modules/cas/cas-server/gradlew

@@ -0,0 +1,188 @@
+#!/usr/bin/env sh
+
+#
+# Copyright 2015 the original author or authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn () {
+    echo "$*"
+}
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=$((i+1))
+    done
+    case $i in
+        (0) set -- ;;
+        (1) set -- "$args0" ;;
+        (2) set -- "$args0" "$args1" ;;
+        (3) set -- "$args0" "$args1" "$args2" ;;
+        (4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save () {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=$(save "$@")
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+# by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong
+if [ "$(uname)" = "Darwin" ] && [ "$HOME" = "$PWD" ]; then
+  cd "$(dirname "$0")"
+fi
+
+exec "$JAVACMD" "$@"

security-modules/cas/cas-server/gradlew.bat

@@ -0,0 +1,100 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%" == "" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%" == "" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto init
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto init
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:init
+@rem Get command-line arguments, handling Windows variants
+
+if not "%OS%" == "Windows_NT" goto win9xME_args
+
+:win9xME_args
+@rem Slurp the command line arguments.
+set CMD_LINE_ARGS=
+set _SKIP=2
+
+:win9xME_args_slurp
+if "x%~1" == "x" goto execute
+
+set CMD_LINE_ARGS=%*
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
+
+:end
+@rem End local scope for the variables with windows NT shell
+if "%ERRORLEVEL%"=="0" goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
+exit /b 1
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

security-modules/cas/cas-server/settings.gradle

@@ -0,0 +1 @@
+rootProject.name='cas'

security-modules/cas/cas-server/src/main/jib/docker/entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+#echo -e "\nChecking java..."
+#java -version
+
+#echo -e "\nCreating CAS configuration directories..."
+mkdir -p /etc/cas/config
+mkdir -p /etc/cas/services
+
+#echo "Listing provided CAS docker artifacts..."
+#ls -R docker/cas
+
+#echo -e "\nMoving CAS configuration artifacts..."
+mv docker/cas/thekeystore /etc/cas 2>/dev/null
+mv docker/cas/config/*.* /etc/cas/config 2>/dev/null
+mv docker/cas/services/*.* /etc/cas/services 2>/dev/null
+
+#echo -e "\nListing CAS configuration under /etc/cas..."
+#ls -R /etc/cas
+
+echo -e "\nRunning CAS..."
+exec java -Xms512m -Xmx2048M -XX:+TieredCompilation -XX:TieredStopAtLevel=1 -jar docker/cas/war/cas.war

security-modules/cas/cas-server/src/main/resources/application.properties

@@ -0,0 +1,4 @@
+server.port=8443
+spring.main.allow-bean-definition-overriding=true
+server.ssl.key-store=classpath:/etc/cas/thekeystore
+server.ssl.key-store-password=changeit

security-modules/cas/cas-server/src/main/resources/create_test_db_and_users_tbl.sql

@@ -0,0 +1,16 @@
+-- Dumping database structure for test
+CREATE DATABASE IF NOT EXISTS `test` /*!40100 DEFAULT CHARACTER SET latin1 */;
+USE `test`;
+
+-- Dumping structure for table test.users
+CREATE TABLE IF NOT EXISTS `users` (
+    `id` int(11) NOT NULL AUTO_INCREMENT,
+    `email` varchar(50) DEFAULT NULL,
+    `password` text DEFAULT NULL,
+    PRIMARY KEY (`id`)
+    ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=latin1;
+
+/*!40000 ALTER TABLE `users` DISABLE KEYS */;
+INSERT INTO `users` (`id`, `email`, `password`) VALUES
+    (1, 'test@test.com', 'Mellon');
+/*!40000 ALTER TABLE `users` ENABLE KEYS */;

security-modules/cas/cas-server/src/main/resources/etc/cas/config/cas.properties

@@ -0,0 +1,15 @@
+cas.serviceRegistry.initFromJson=true
+cas.serviceRegistry.json.location=classpath:/etc/cas/services
+
+
+cas.authn.accept.users=
+
+cas.authn.jdbc.query[0].sql=SELECT * FROM users WHERE email = ?
+cas.authn.jdbc.query[0].url=jdbc:mysql://127.0.0.1:3306/test?useUnicode=true&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=UTC
+cas.authn.jdbc.query[0].dialect=org.hibernate.dialect.MySQLDialect
+cas.authn.jdbc.query[0].user=root
+cas.authn.jdbc.query[0].password=smattroot
+cas.authn.jdbc.query[0].ddlAuto=none
+cas.authn.jdbc.query[0].driverClass=com.mysql.cj.jdbc.Driver
+cas.authn.jdbc.query[0].fieldPassword=password
+cas.authn.jdbc.query[0].passwordEncoder.type=NONE

security-modules/cas/cas-server/src/main/resources/etc/cas/services/casSecuredApp-8900.json

@@ -0,0 +1,8 @@
+{
+  "@class" : "org.apereo.cas.services.RegexRegisteredService",
+  "serviceId" : "http://cas-client:8900/login/cas",
+  "name" : "casSecuredApp",
+  "id" : 8900,
+  "logoutType" : "BACK_CHANNEL",
+  "logoutUrl" : "http://cas-client:8900/exit/cas"
+}

security-modules/cas/pom.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns="http://maven.apache.org/POM/4.0.0"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.baeldung.cas</groupId>
+    <artifactId>cas</artifactId>
+    <name>cas</name>
+    <packaging>pom</packaging>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>parent-boot-2</artifactId>
+        <version>0.0.1-SNAPSHOT</version>
+        <relativePath>../../parent-boot-2</relativePath>
+    </parent>
+
+    <modules>
+        <module>cas-secured-app</module>
+    </modules>
+
+</project>

security-modules/cloud-foundry-uaa/README.md

@@ -0,0 +1,7 @@
+## Cloud Foundry UAA
+
+This module contains articles about Cloud Foundry UAA
+
+### Relevant Articles:
+
+- [A Quick Guide To Using Cloud Foundry UAA](https://www.baeldung.com/cloud-foundry-uaa)

security-modules/cloud-foundry-uaa/cf-uaa-config/uaa.yml

@@ -0,0 +1,68 @@
+issuer:
+  uri: http://localhost:8080/uaa
+
+spring_profiles: default,hsqldb
+  
+encryption:
+  active_key_label: CHANGE-THIS-KEY
+  encryption_keys:
+    - label: CHANGE-THIS-KEY
+      passphrase: CHANGEME
+
+login:
+  serviceProviderKey: |
+    -----BEGIN RSA PRIVATE KEY-----
+    MIICXQIBAAKBgQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5
+    L39WqS9u0hnA+O7MCA/KlrAR4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vA
+    fpOwznoD66DDCnQVpbCjtDYWX+x6imxn8HCYxhMol6ZnTbSsFW6VZjFMjQIDAQAB
+    AoGAVOj2Yvuigi6wJD99AO2fgF64sYCm/BKkX3dFEw0vxTPIh58kiRP554Xt5ges
+    7ZCqL9QpqrChUikO4kJ+nB8Uq2AvaZHbpCEUmbip06IlgdA440o0r0CPo1mgNxGu
+    lhiWRN43Lruzfh9qKPhleg2dvyFGQxy5Gk6KW/t8IS4x4r0CQQD/dceBA+Ndj3Xp
+    ubHfxqNz4GTOxndc/AXAowPGpge2zpgIc7f50t8OHhG6XhsfJ0wyQEEvodDhZPYX
+    kKBnXNHzAkEAyCA76vAwuxqAd3MObhiebniAU3SnPf2u4fdL1EOm92dyFs1JxyyL
+    gu/DsjPjx6tRtn4YAalxCzmAMXFSb1qHfwJBAM3qx3z0gGKbUEWtPHcP7BNsrnWK
+    vw6By7VC8bk/ffpaP2yYspS66Le9fzbFwoDzMVVUO/dELVZyBnhqSRHoXQcCQQCe
+    A2WL8S5o7Vn19rC0GVgu3ZJlUrwiZEVLQdlrticFPXaFrn3Md82ICww3jmURaKHS
+    N+l4lnMda79eSp3OMmq9AkA0p79BvYsLshUJJnvbk76pCjR28PK4dV1gSDUEqQMB
+    qy45ptdwJLqLJCeNoR0JUcDNIRhOCuOPND7pcMtX6hI/
+    -----END RSA PRIVATE KEY-----
+  serviceProviderKeyPassword: password
+  serviceProviderCertificate: |
+    -----BEGIN CERTIFICATE-----
+    MIIDSTCCArKgAwIBAgIBADANBgkqhkiG9w0BAQQFADB8MQswCQYDVQQGEwJhdzEO
+    MAwGA1UECBMFYXJ1YmExDjAMBgNVBAoTBWFydWJhMQ4wDAYDVQQHEwVhcnViYTEO
+    MAwGA1UECxMFYXJ1YmExDjAMBgNVBAMTBWFydWJhMR0wGwYJKoZIhvcNAQkBFg5h
+    cnViYUBhcnViYS5hcjAeFw0xNTExMjAyMjI2MjdaFw0xNjExMTkyMjI2MjdaMHwx
+    CzAJBgNVBAYTAmF3MQ4wDAYDVQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAM
+    BgNVBAcTBWFydWJhMQ4wDAYDVQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAb
+    BgkqhkiG9w0BCQEWDmFydWJhQGFydWJhLmFyMIGfMA0GCSqGSIb3DQEBAQUAA4GN
+    ADCBiQKBgQDHtC5gUXxBKpEqZTLkNvFwNGnNIkggNOwOQVNbpO0WVHIivig5L39W
+    qS9u0hnA+O7MCA/KlrAR4bXaeVVhwfUPYBKIpaaTWFQR5cTR1UFZJL/OF9vAfpOw
+    znoD66DDCnQVpbCjtDYWX+x6imxn8HCYxhMol6ZnTbSsFW6VZjFMjQIDAQABo4Ha
+    MIHXMB0GA1UdDgQWBBTx0lDzjH/iOBnOSQaSEWQLx1syGDCBpwYDVR0jBIGfMIGc
+    gBTx0lDzjH/iOBnOSQaSEWQLx1syGKGBgKR+MHwxCzAJBgNVBAYTAmF3MQ4wDAYD
+    VQQIEwVhcnViYTEOMAwGA1UEChMFYXJ1YmExDjAMBgNVBAcTBWFydWJhMQ4wDAYD
+    VQQLEwVhcnViYTEOMAwGA1UEAxMFYXJ1YmExHTAbBgkqhkiG9w0BCQEWDmFydWJh
+    QGFydWJhLmFyggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAYvBJ
+    0HOZbbHClXmGUjGs+GS+xC1FO/am2suCSYqNB9dyMXfOWiJ1+TLJk+o/YZt8vuxC
+    KdcZYgl4l/L6PxJ982SRhc83ZW2dkAZI4M0/Ud3oePe84k8jm3A7EvH5wi5hvCkK
+    RpuRBwn3Ei+jCRouxTbzKPsuCVB+1sNyxMTXzf0=
+    -----END CERTIFICATE-----
+
+#The secret that an external login server will use to authenticate to the uaa using the id `login`
+LOGIN_SECRET: loginsecret
+
+jwt:
+  token:
+    signing-key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      MIIEpAIBAAKCAQEAqUeygEfDGxI6c1VDQ6xIyUSLrP6iz1y97iHFbtXSxXaArL4a
+      ...
+      v6Mtt5LcRAAVP7pemunTdju4h8Q/noKYlVDVL30uLYUfKBL4UKfOBw==
+      -----END RSA PRIVATE KEY-----
+    verification-key: |
+      -----BEGIN PUBLIC KEY-----
+      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqUeygEfDGxI6c1VDQ6xI
+      ...
+      AwIDAQAB
+      -----END PUBLIC KEY-----

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-client/pom.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.example</groupId>
+    <artifactId>cf-uaa-oauth2-client</artifactId>
+    <name>cf-uaa-oauth2-client</name>
+    <description>Demo project for Spring Boot</description>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>cloud-foundry-uaa</artifactId>
+        <version>0.0.1-SNAPSHOT</version>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-client</artifactId>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-client/src/main/java/com/baeldung/cfuaa/oauth2/client/CFUAAOAuth2ClientApplication.java

@@ -0,0 +1,13 @@
+package com.baeldung.cfuaa.oauth2.client;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class CFUAAOAuth2ClientApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(CFUAAOAuth2ClientApplication.class, args);
+	}
+
+}

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-client/src/main/java/com/baeldung/cfuaa/oauth2/client/CFUAAOAuth2ClientController.java

@@ -0,0 +1,80 @@
+package com.baeldung.cfuaa.oauth2.client;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.core.OAuth2AccessToken;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.client.HttpClientErrorException;
+import org.springframework.web.client.RestTemplate;
+
+@RestController
+public class CFUAAOAuth2ClientController {
+
+    @Value("${resource.server.url}")
+    private String remoteResourceServer;
+
+    private RestTemplate restTemplate;
+
+    private OAuth2AuthorizedClientService authorizedClientService;
+
+    public CFUAAOAuth2ClientController(OAuth2AuthorizedClientService authorizedClientService) {
+        this.authorizedClientService = authorizedClientService;
+        this.restTemplate = new RestTemplate();
+    }
+
+    @RequestMapping("/")
+    public String index(OAuth2AuthenticationToken authenticationToken) {
+        OAuth2AuthorizedClient oAuth2AuthorizedClient = this.authorizedClientService.loadAuthorizedClient(authenticationToken.getAuthorizedClientRegistrationId(), authenticationToken.getName());
+        OAuth2AccessToken oAuth2AccessToken = oAuth2AuthorizedClient.getAccessToken();
+
+        String response = "Hello, " + authenticationToken.getPrincipal().getName();
+        response += "</br></br>";
+        response += "Here is your accees token :</br>" + oAuth2AccessToken.getTokenValue();
+        response += "</br>";
+        response += "</br>You can use it to call these Resource Server APIs:";
+        response += "</br></br>";
+        response += "<a href='/read'>Call Resource Server Read API</a>";
+        response += "</br>";
+        response += "<a href='/write'>Call Resource Server Write API</a>";
+        return response;
+    }
+
+    @RequestMapping("/read")
+    public String read(OAuth2AuthenticationToken authenticationToken) {
+        String url = remoteResourceServer + "/read";
+        return callResourceServer(authenticationToken, url);
+    }
+
+    @RequestMapping("/write")
+    public String write(OAuth2AuthenticationToken authenticationToken) {
+        String url = remoteResourceServer + "/write";
+        return callResourceServer(authenticationToken, url);
+    }
+
+    private String callResourceServer(OAuth2AuthenticationToken authenticationToken, String url) {
+        OAuth2AuthorizedClient oAuth2AuthorizedClient = this.authorizedClientService.loadAuthorizedClient(authenticationToken.getAuthorizedClientRegistrationId(), authenticationToken.getName());
+        OAuth2AccessToken oAuth2AccessToken = oAuth2AuthorizedClient.getAccessToken();
+
+        HttpHeaders headers = new HttpHeaders();
+        headers.add("Authorization", "Bearer " + oAuth2AccessToken.getTokenValue());
+
+        HttpEntity<String> entity = new HttpEntity<>("parameters", headers);
+        ResponseEntity<String> responseEntity = null;
+
+        String response = null;
+        try {
+            responseEntity = restTemplate.exchange(url, HttpMethod.GET, entity, String.class);
+            response = responseEntity.getBody();
+        } catch (HttpClientErrorException e) {
+            response = e.getMessage();
+        }
+        return response;
+    }
+}

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-client/src/main/resources/application.properties

@@ -0,0 +1,11 @@
+server.port=8081
+
+resource.server.url=http://localhost:8082
+
+spring.security.oauth2.client.registration.uaa.client-name=Web App Client
+spring.security.oauth2.client.registration.uaa.client-id=webappclient
+spring.security.oauth2.client.registration.uaa.client-secret=webappclientsecret
+spring.security.oauth2.client.registration.uaa.scope=resource.read,resource.write,openid,profile
+
+spring.security.oauth2.client.provider.uaa.issuer-uri=http://localhost:8080/uaa/oauth/token
+

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-client/src/main/resources/templates/index.html

@@ -0,0 +1 @@
+tintin

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-resource-server/pom.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.baeldung.cfuaa</groupId>
+    <artifactId>cf-uaa-oauth2-resource-server</artifactId>
+    <name>cf-uaa-oauth2-resource-server</name>
+    <description>Demo project for Spring Boot</description>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>cloud-foundry-uaa</artifactId>
+        <version>0.0.1-SNAPSHOT</version>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-resource-server/src/main/java/com/baeldung/cfuaa/oauth2/resourceserver/CFUAAOAuth2ResourceServerApplication.java

@@ -0,0 +1,13 @@
+package com.baeldung.cfuaa.oauth2.resourceserver;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class CFUAAOAuth2ResourceServerApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(CFUAAOAuth2ResourceServerApplication.class, args);
+	}
+
+}

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-resource-server/src/main/java/com/baeldung/cfuaa/oauth2/resourceserver/CFUAAOAuth2ResourceServerRestController.java

@@ -0,0 +1,28 @@
+package com.baeldung.cfuaa.oauth2.resourceserver;
+
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.security.Principal;
+
+@RestController
+public class CFUAAOAuth2ResourceServerRestController {
+
+    @GetMapping("/")
+    public String index(@AuthenticationPrincipal Jwt jwt) {
+        return String.format("Hello, %s!", jwt.getSubject());
+    }
+
+    @GetMapping("/read")
+    public String read(JwtAuthenticationToken jwtAuthenticationToken) {
+        return "Hello read: " + jwtAuthenticationToken.getTokenAttributes();
+    }
+
+    @GetMapping("/write")
+    public String write(Principal principal) {
+        return "Hello write: " + principal.getName();
+    }
+}

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-resource-server/src/main/java/com/baeldung/cfuaa/oauth2/resourceserver/CFUAAOAuth2ResourceServerSecurityConfiguration.java

@@ -0,0 +1,21 @@
+package com.baeldung.cfuaa.oauth2.resourceserver;
+
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@EnableWebSecurity
+public class CFUAAOAuth2ResourceServerSecurityConfiguration extends WebSecurityConfigurerAdapter {
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		http
+			.authorizeRequests()
+                .antMatchers("/read/**").hasAuthority("SCOPE_resource.read")
+                .antMatchers("/write/**").hasAuthority("SCOPE_resource.write")
+                .anyRequest().authenticated()
+				.and()
+			.oauth2ResourceServer()
+				.jwt();
+	}
+}

security-modules/cloud-foundry-uaa/cf-uaa-oauth2-resource-server/src/main/resources/application.properties

@@ -0,0 +1,3 @@
+server.port=8082
+
+spring.security.oauth2.resourceserver.jwt.issuer-uri=http://localhost:8080/uaa/oauth/token

security-modules/cloud-foundry-uaa/pom.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>cloud-foundry-uaa</artifactId>
+    <name>cloud-foundry-uaa</name>
+    <packaging>pom</packaging>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>parent-boot-2</artifactId>
+        <version>0.0.1-SNAPSHOT</version>
+        <relativePath>../../parent-boot-2</relativePath>
+    </parent>
+
+    <modules>
+        <module>cf-uaa-oauth2-client</module>
+        <module>cf-uaa-oauth2-resource-server</module>
+    </modules>
+
+</project>

security-modules/java-ee-8-security-api/README.md

@@ -0,0 +1,7 @@
+## Java EE 8 Security API
+
+This module contains articles about the Security API in Java EE 8.
+
+### Relevant articles
+ 
+ - [Jakarta EE 8 Security API](https://www.baeldung.com/java-ee-8-security)

security-modules/java-ee-8-security-api/app-auth-basic-store-db/pom.xml

@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>app-auth-basic-store-db</artifactId>
+    <name>app-auth-basic-store-db</name>
+    <packaging>war</packaging>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>java-ee-8-security-api</artifactId>
+        <version>1.0-SNAPSHOT</version>
+    </parent>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>net.wasdev.wlp.maven.plugins</groupId>
+                <artifactId>liberty-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>install-server</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>install-server</goal>
+                            <goal>create-server</goal>
+                            <goal>install-feature</goal>
+                        </goals>
+                    </execution>
+                    <execution>
+                        <id>install-apps</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>install-apps</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>copy</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>copy</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <artifactItems>
+                        <artifactItem>
+                            <groupId>com.h2database</groupId>
+                            <artifactId>h2</artifactId>
+                            <version>${h2.version}</version>
+                            <type>jar</type>
+                            <outputDirectory>
+                                ${project.build.directory}/liberty/wlp/usr/servers/defaultServer/lib/global
+                            </outputDirectory>
+                        </artifactItem>
+                    </artifactItems>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

security-modules/java-ee-8-security-api/app-auth-basic-store-db/src/main/java/com/baeldung/javaee/security/AdminServlet.java

@@ -0,0 +1,22 @@
+package com.baeldung.javaee.security;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.HttpConstraint;
+import javax.servlet.annotation.ServletSecurity;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+@WebServlet("/admin")
+@ServletSecurity(value = @HttpConstraint(rolesAllowed = {"admin_role"}))
+public class AdminServlet extends HttpServlet {
+
+    @Override
+    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        response.getWriter().append("User :" + request.getUserPrincipal().getName() + "\n");
+        response.getWriter().append("User in Role user_role :" + request.isUserInRole("user_role") + "\n");
+        response.getWriter().append("User in Role admin_role :" + request.isUserInRole("admin_role"));
+    }
+}

security-modules/java-ee-8-security-api/app-auth-basic-store-db/src/main/java/com/baeldung/javaee/security/AppConfig.java

@@ -0,0 +1,16 @@
+package com.baeldung.javaee.security;
+
+import javax.enterprise.context.ApplicationScoped;
+import javax.security.enterprise.authentication.mechanism.http.BasicAuthenticationMechanismDefinition;
+import javax.security.enterprise.authentication.mechanism.http.CustomFormAuthenticationMechanismDefinition;
+import javax.security.enterprise.identitystore.DatabaseIdentityStoreDefinition;
+
+@BasicAuthenticationMechanismDefinition(realmName = "defaultRealm")
+@DatabaseIdentityStoreDefinition(
+        dataSourceLookup = "java:comp/env/jdbc/securityDS",
+        callerQuery = "select password from users where username = ?",
+        groupsQuery = "select GROUPNAME from groups where username = ?"
+)
+@ApplicationScoped
+public class AppConfig {
+}

security-modules/java-ee-8-security-api/app-auth-basic-store-db/src/main/java/com/baeldung/javaee/security/DatabaseSetupServlet.java

@@ -0,0 +1,59 @@
+package com.baeldung.javaee.security;
+
+import javax.annotation.Resource;
+import javax.annotation.sql.DataSourceDefinition;
+import javax.inject.Inject;
+import javax.security.enterprise.identitystore.Pbkdf2PasswordHash;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.sql.DataSource;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
+
+@DataSourceDefinition(
+        name = "java:comp/env/jdbc/securityDS",
+        className = "org.h2.jdbcx.JdbcDataSource",
+        url = "jdbc:h2:~/securityTest;MODE=Oracle"
+)
+@WebServlet(value = "/init", loadOnStartup = 0)
+public class DatabaseSetupServlet extends HttpServlet {
+
+    @Resource(lookup = "java:comp/env/jdbc/securityDS")
+    private DataSource dataSource;
+
+    @Inject
+    private Pbkdf2PasswordHash passwordHash;
+
+    @Override
+    public void init() throws ServletException {
+        super.init();
+        initdb();
+    }
+
+    private void initdb() {
+        executeUpdate(dataSource, "DROP TABLE IF EXISTS USERS");
+        executeUpdate(dataSource, "DROP TABLE IF EXISTS GROUPS");
+
+        executeUpdate(dataSource, "CREATE TABLE IF NOT EXISTS USERS(username VARCHAR(64) PRIMARY KEY, password VARCHAR(255))");
+        executeUpdate(dataSource, "CREATE TABLE IF NOT EXISTS GROUPS(username VARCHAR(64), GROUPNAME VARCHAR(64))");
+
+        executeUpdate(dataSource, "INSERT INTO USERS VALUES('admin', '" + passwordHash.generate("passadmin".toCharArray()) + "')");
+        executeUpdate(dataSource, "INSERT INTO USERS VALUES('user', '" + passwordHash.generate("passuser".toCharArray()) + "')");
+
+        executeUpdate(dataSource, "INSERT INTO GROUPS VALUES('admin', 'admin_role')");
+        executeUpdate(dataSource, "INSERT INTO GROUPS VALUES('admin', 'user_role')");
+        executeUpdate(dataSource, "INSERT INTO GROUPS VALUES('user', 'user_role')");
+    }
+
+    private void executeUpdate(DataSource dataSource, String query) {
+        try (Connection connection = dataSource.getConnection()) {
+            try (PreparedStatement statement = connection.prepareStatement(query)) {
+                statement.executeUpdate();
+            }
+        } catch (SQLException e) {
+            throw new IllegalStateException(e);
+        }
+    }
+}

security-modules/java-ee-8-security-api/app-auth-basic-store-db/src/main/java/com/baeldung/javaee/security/UserServlet.java

@@ -0,0 +1,25 @@
+package com.baeldung.javaee.security;
+
+import javax.annotation.security.DeclareRoles;
+import javax.inject.Inject;
+import javax.security.enterprise.SecurityContext;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.HttpConstraint;
+import javax.servlet.annotation.ServletSecurity;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+
+@WebServlet("/user")
+@ServletSecurity(value = @HttpConstraint(rolesAllowed = {"user_role"}))
+public class UserServlet extends HttpServlet {
+    @Override
+    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        response.getWriter().append("User :" + request.getUserPrincipal().getName() + "\n");
+        response.getWriter().append("User in Role user_role :" + request.isUserInRole("user_role") + "\n");
+        response.getWriter().append("User in Role admin_role :" + request.isUserInRole("admin_role"));
+    }
+}

security-modules/java-ee-8-security-api/app-auth-basic-store-db/src/main/liberty/config/server.xml

@@ -0,0 +1,9 @@
+<server description="OpenLiberty MicroProfile server">
+
+    <featureManager>
+        <feature>webProfile-8.0</feature>
+    </featureManager>
+
+    <httpEndpoint httpPort="${default.http.port}" httpsPort="${default.https.port}"
+                  id="defaultHttpEndpoint" host="*"/>
+</server>

security-modules/java-ee-8-security-api/app-auth-basic-store-db/src/main/resources/logback.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n
+            </pattern>
+        </encoder>
+    </appender>
+
+    <root level="INFO">
+        <appender-ref ref="STDOUT" />
+    </root>
+</configuration>

security-modules/java-ee-8-security-api/app-auth-custom-form-store-custom/pom.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>app-auth-custom-form-store-custom</artifactId>
+    <name>app-auth-custom-form-store-custom</name>
+    <packaging>war</packaging>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>java-ee-8-security-api</artifactId>
+        <version>1.0-SNAPSHOT</version>
+    </parent>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>net.wasdev.wlp.maven.plugins</groupId>
+                <artifactId>liberty-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>install-server</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>install-server</goal>
+                            <goal>create-server</goal>
+                            <goal>install-feature</goal>
+                        </goals>
+                    </execution>
+                    <execution>
+                        <id>install-apps</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>install-apps</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

security-modules/java-ee-8-security-api/app-auth-custom-form-store-custom/src/main/java/com/baeldung/javaee/security/AppConfig.java

@@ -0,0 +1,17 @@
+package com.baeldung.javaee.security;
+
+import javax.enterprise.context.ApplicationScoped;
+import javax.faces.annotation.FacesConfig;
+import javax.security.enterprise.authentication.mechanism.http.CustomFormAuthenticationMechanismDefinition;
+import javax.security.enterprise.authentication.mechanism.http.LoginToContinue;
+
+
+@CustomFormAuthenticationMechanismDefinition(
+        loginToContinue = @LoginToContinue(
+                loginPage = "/login.xhtml",
+                errorPage = "/login-error.html"
+        )
+)
+@ApplicationScoped
+public class AppConfig {
+}