[BAEL-9552] - Create spring-security-modules folder

2019-12-13 13:04:59 +02:00
parent f9f1534394
commit d90a0a4fbb
712 changed files with 1140 additions and 1141 deletions
@@ -0,0 +1,50 @@
+package com.baeldung.app;
+
+import javax.servlet.Filter;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.autoconfigure.domain.EntityScan;
+import org.springframework.boot.web.servlet.support.SpringBootServletInitializer;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+import org.springframework.web.filter.DelegatingFilterProxy;
+import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
+
+@SpringBootApplication
+@EnableJpaRepositories("com.baeldung.repository")
+@ComponentScan("com.baeldung")
+@EntityScan("com.baeldung.entity")
+public class App extends SpringBootServletInitializer {
+    public static void main(String[] args) {
+        SpringApplication.run(App.class, args);
+    }
+    
+    public static class ApplicationInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
+
+        @Override
+        protected javax.servlet.Filter[] getServletFilters() {
+            DelegatingFilterProxy delegateFilterProxy = new DelegatingFilterProxy();
+            delegateFilterProxy.setTargetBeanName("loggingFilter");
+            return new Filter[] { delegateFilterProxy };
+        }
+
+        @Override
+        protected Class<?>[] getRootConfigClasses() {
+            // TODO Auto-generated method stub
+            return null;
+        }
+
+        @Override
+        protected Class<?>[] getServletConfigClasses() {
+            // TODO Auto-generated method stub
+            return null;
+        }
+
+        @Override
+        protected String[] getServletMappings() {
+            // TODO Auto-generated method stub
+            return null;
+        }
+    }
+}
@@ -0,0 +1,36 @@
+package com.baeldung.auditing;
+
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.security.AbstractAuthorizationAuditListener;
+import org.springframework.security.access.event.AbstractAuthorizationEvent;
+import org.springframework.security.access.event.AuthorizationFailureEvent;
+import org.springframework.security.web.FilterInvocation;
+import org.springframework.stereotype.Component;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@Component
+public class ExposeAttemptedPathAuthorizationAuditListener extends AbstractAuthorizationAuditListener {
+
+    public static final String AUTHORIZATION_FAILURE = "AUTHORIZATION_FAILURE";
+
+    @Override
+    public void onApplicationEvent(AbstractAuthorizationEvent event) {
+        if (event instanceof AuthorizationFailureEvent) {
+            onAuthorizationFailureEvent((AuthorizationFailureEvent) event);
+        }
+    }
+
+    private void onAuthorizationFailureEvent(AuthorizationFailureEvent event) {
+        Map<String, Object> data = new HashMap<>();
+        data.put("type", event.getAccessDeniedException().getClass().getName());
+        data.put("message", event.getAccessDeniedException().getMessage());
+        data.put("requestUrl", ((FilterInvocation)event.getSource()).getRequestUrl() );
+        if (event.getAuthentication().getDetails() != null) {
+            data.put("details", event.getAuthentication().getDetails());
+        }
+        publish(new AuditEvent(event.getAuthentication().getName(), AUTHORIZATION_FAILURE,
+                               data));
+    }
+}
@@ -0,0 +1,25 @@
+package com.baeldung.auditing;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.audit.listener.AuditApplicationEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.security.web.authentication.WebAuthenticationDetails;
+import org.springframework.stereotype.Component;
+
+@Component
+public class LoginAttemptsLogger {
+    private static final Logger LOGGER = LoggerFactory.getLogger(LoginAttemptsLogger.class);
+
+    @EventListener
+    public void auditEventHappened(AuditApplicationEvent auditApplicationEvent) {
+        AuditEvent auditEvent = auditApplicationEvent.getAuditEvent();
+        LOGGER.info("Principal " + auditEvent.getPrincipal() + " - " + auditEvent.getType());
+
+        WebAuthenticationDetails details = (WebAuthenticationDetails) auditEvent.getData().get("details");
+        LOGGER.info("  Remote IP address: " + details.getRemoteAddress());
+        LOGGER.info("  Session Id: " + details.getSessionId());
+        LOGGER.info("  Request URL: " + auditEvent.getData().get("requestUrl"));
+    }
+}
@@ -0,0 +1,24 @@
+package com.baeldung.config;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.CommandLineRunner;
+import org.springframework.stereotype.Component;
+
+import com.baeldung.entity.Task;
+import com.baeldung.repository.TaskRepository;
+
+@Component
+public class DatabaseLoader implements CommandLineRunner {
+
+    @Autowired
+    private TaskRepository taskRepository;
+
+    @Override
+    public void run(String... strings) throws Exception {
+        this.taskRepository.save(new Task("Send a fax", "pam"));
+        this.taskRepository.save(new Task("Print a document", "pam"));
+        this.taskRepository.save(new Task("Answer the phone", "pam"));
+        this.taskRepository.save(new Task("Call a client", "jim"));
+        this.taskRepository.save(new Task("Organize a meeting", "michael"));
+    }
+}
@@ -0,0 +1,36 @@
+package com.baeldung.config;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+@Configuration
+@EnableWebSecurity
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http.authorizeRequests().antMatchers("/css/**", "/js/**", "/loggedout").permitAll().anyRequest().authenticated().and().httpBasic().and().logout().disable().csrf().disable();
+    }
+
+    @Autowired
+    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
+        auth.inMemoryAuthentication()
+            .withUser("jim").password(passwordEncoder().encode("jim")).roles("USER", "ACTUATOR")
+            .and().withUser("pam").password(passwordEncoder().encode("pam")).roles("USER")
+            .and().withUser("michael").password(passwordEncoder().encode("michael")).roles("MANAGER");
+    }
+    
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}
@@ -0,0 +1,33 @@
+package com.baeldung.controller;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import com.baeldung.entity.Task;
+import com.baeldung.service.TaskService;
+
+@Controller
+@RequestMapping("api/tasks")
+public class TaskController {
+
+    @Autowired
+    private TaskService taskService;
+
+    @RequestMapping(method = RequestMethod.GET)
+    public ResponseEntity<Iterable<Task>> findAllTasks() {
+        Iterable<Task> tasks = taskService.findAll();
+
+        return ResponseEntity.ok().body(tasks);
+    }
+
+    @RequestMapping(method = RequestMethod.POST, consumes = "application/json")
+    public ResponseEntity<Iterable<Task>> addTasks(@RequestBody Iterable<Task> newTasks) {
+        Iterable<Task> tasks = taskService.save(newTasks);
+
+        return ResponseEntity.ok().body(tasks);
+    }
+}
@@ -0,0 +1,46 @@
+package com.baeldung.entity;
+
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.Id;
+
+@Entity
+public class Task {
+    private @Id @GeneratedValue Long id;
+    private String description;
+
+    private String assignee;
+
+    public Task() {
+    }
+
+    public Task(String description, String assignee) {
+        this.description = description;
+        this.assignee = assignee;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getAssignee() {
+        return assignee;
+    }
+
+    public void setAssignee(String assignee) {
+        this.assignee = assignee;
+    }
+
+}
@@ -0,0 +1,38 @@
+package com.baeldung.filter;
+
+import java.io.IOException;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Component;
+
+@Component("loggingFilter")
+public class CustomFilter implements Filter {
+    
+    private static Logger LOGGER = LoggerFactory.getLogger(CustomFilter.class);
+
+    @Override
+    public void init(FilterConfig config) throws ServletException {
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, 
+            FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest req = (HttpServletRequest) request;
+        LOGGER.info("Request Info : " + req);
+        chain.doFilter(request, response);
+    }
+
+    @Override
+    public void destroy() {
+        // cleanup code, if necessary
+    }
+}
@@ -0,0 +1,14 @@
+package com.baeldung.methodsecurity.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+@PreAuthorize("hasRole('VIEWER')")
+public @interface IsViewer {
+}
@@ -0,0 +1,11 @@
+package com.baeldung.methodsecurity.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
+
+@Configuration
+@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
+public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
+
+}
@@ -0,0 +1,30 @@
+package com.baeldung.methodsecurity.entity;
+
+import java.util.Collection;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+
+@SuppressWarnings("serial")
+public class CustomUser extends User {
+
+    private String nickName;
+
+    public CustomUser(String username, String password, Collection<? extends GrantedAuthority> authorities) {
+        super(username, password, authorities);
+    }
+
+    public CustomUser(String username, String password, Collection<? extends GrantedAuthority> authorities, String nickName) {
+        super(username, password, authorities);
+        this.nickName = nickName;
+    }
+
+    public String getNickName() {
+        return nickName;
+    }
+
+    public void setNickName(String nickName) {
+        this.nickName = nickName;
+    }
+
+}
@@ -0,0 +1,58 @@
+package com.baeldung.methodsecurity.repository;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+
+import com.baeldung.methodsecurity.entity.CustomUser;
+
+@Service
+public class UserRoleRepository {
+
+    static Map<String, CustomUser> DB_BASED_USER_MAPPING;
+
+    static {
+        DB_BASED_USER_MAPPING = new LinkedHashMap<>();
+        DB_BASED_USER_MAPPING.put("jane", new CustomUser("jane", "1234", getGrantedAuthorities("ROLE_USER", "ROLE_VIEWER"), "jane"));
+        DB_BASED_USER_MAPPING.put("john", new CustomUser("john", "1234", getGrantedAuthorities("ROLE_EDITOR", "ROLE_ADMIN"), "jane"));
+        DB_BASED_USER_MAPPING.put("jack", new CustomUser("jack", "1234", getGrantedAuthorities("ROLE_USER", "ROLE_REVIEWER"), "jane"));
+    }
+
+    private static List<GrantedAuthority> getGrantedAuthorities(String... roles) {
+        ArrayList<GrantedAuthority> authorities = new ArrayList<>();
+        for (String role : roles) {
+            authorities.add(new SimpleGrantedAuthority(role));
+        }
+        return authorities;
+    }
+
+    public CustomUser loadUserByUserName(String username) {
+        if (DB_BASED_USER_MAPPING.containsKey(username)) {
+            return DB_BASED_USER_MAPPING.get(username);
+        }
+        throw new UsernameNotFoundException("User " + username + " cannot be found");
+    }
+
+    public boolean isValidUsername(String username) {
+        return DB_BASED_USER_MAPPING.containsKey(username);
+    }
+
+    public boolean isValidRole(String roleName) {
+        return roleName.startsWith("ROLE_");
+    }
+
+    public List<String> getAllUsernames() {
+        List<String> usernames = new ArrayList<>();
+        usernames.add("jane");
+        usernames.add("john");
+        usernames.add("jack");
+        return usernames;
+    }
+
+}
@@ -0,0 +1,20 @@
+package com.baeldung.methodsecurity.service;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.stereotype.Service;
+
+import com.baeldung.methodsecurity.repository.UserRoleRepository;
+
+@Service("userDetailService")
+public class CustomUserDetailsService implements UserDetailsService {
+   
+    @Autowired
+    UserRoleRepository userRoleRepo;
+    
+    @Override
+    public UserDetails loadUserByUsername(String username) {
+        return userRoleRepo.loadUserByUserName(username);
+    }
+}
@@ -0,0 +1,18 @@
+package com.baeldung.methodsecurity.service;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Service;
+
+@Service
+@PreAuthorize("hasRole('ROLE_ADMIN')")
+public class SystemService {
+    
+    public String getSystemYear(){
+        return "2017";
+    }
+    
+    public String getSystemDate(){
+        return "31-12-2017";
+    }
+    
+}
@@ -0,0 +1,109 @@
+package com.baeldung.methodsecurity.service;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import javax.annotation.security.RolesAllowed;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.access.prepost.PostAuthorize;
+import org.springframework.security.access.prepost.PostFilter;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.access.prepost.PreFilter;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Service;
+
+import com.baeldung.methodsecurity.annotation.IsViewer;
+import com.baeldung.methodsecurity.entity.CustomUser;
+import com.baeldung.methodsecurity.repository.UserRoleRepository;
+
+@Service
+public class UserRoleService {
+
+    @Autowired
+    UserRoleRepository userRoleRepository;
+
+    @Secured("ROLE_VIEWER")
+    public String getUsername() {
+        SecurityContext securityContext = SecurityContextHolder.getContext();
+        return securityContext.getAuthentication().getName();
+    }
+
+    @Secured({ "ROLE_VIEWER", "ROLE_EDITOR" })
+    public boolean isValidUsername(String username) {
+        return userRoleRepository.isValidUsername(username);
+    }
+
+    @RolesAllowed("ROLE_VIEWER")
+    public String getUsername2() {
+        SecurityContext securityContext = SecurityContextHolder.getContext();
+        return securityContext.getAuthentication().getName();
+    }
+
+    @RolesAllowed({ "ROLE_VIEWER", "ROLE_EDITOR" })
+    public boolean isValidUsername2(String username) {
+        return userRoleRepository.isValidUsername(username);
+    }
+
+    @PreAuthorize("hasRole('ROLE_VIEWER')")
+    public String getUsernameInUpperCase() {
+        return getUsername().toUpperCase();
+    }
+
+    @PreAuthorize("hasAuthority('SYS_ADMIN')")
+    public String getUsernameLC() {
+        return getUsername().toLowerCase();
+    }
+
+    @PreAuthorize("hasRole('ROLE_VIEWER') or hasRole('ROLE_EDITOR')")
+    public boolean isValidUsername3(String username) {
+        return userRoleRepository.isValidUsername(username);
+    }
+
+    @PreAuthorize("#username == authentication.principal.username")
+    public String getMyRoles(String username) {
+        SecurityContext securityContext = SecurityContextHolder.getContext();
+        return securityContext.getAuthentication().getAuthorities().stream().map(auth -> auth.getAuthority()).collect(Collectors.joining(","));
+    }
+
+    @PostAuthorize("#username == authentication.principal.username")
+    public String getMyRoles2(String username) {
+        SecurityContext securityContext = SecurityContextHolder.getContext();
+        return securityContext.getAuthentication().getAuthorities().stream().map(auth -> auth.getAuthority()).collect(Collectors.joining(","));
+    }
+
+    @PostAuthorize("returnObject.username == authentication.principal.nickName")
+    public CustomUser loadUserDetail(String username) {
+        return userRoleRepository.loadUserByUserName(username);
+    }
+
+    @PreFilter("filterObject != authentication.principal.username")
+    public String joinUsernames(List<String> usernames) {
+        return usernames.stream().collect(Collectors.joining(";"));
+    }
+
+    @PreFilter(value = "filterObject != authentication.principal.username", filterTarget = "usernames")
+    public String joinUsernamesAndRoles(List<String> usernames, List<String> roles) {
+        return usernames.stream().collect(Collectors.joining(";")) + ":" + roles.stream().collect(Collectors.joining(";"));
+    }
+
+    @PostFilter("filterObject != authentication.principal.username")
+    public List<String> getAllUsernamesExceptCurrent() {
+        return userRoleRepository.getAllUsernames();
+    }
+
+    @IsViewer
+    public String getUsername4() {
+        SecurityContext securityContext = SecurityContextHolder.getContext();
+        return securityContext.getAuthentication().getName();
+    }
+
+    @PreAuthorize("#username == authentication.principal.username")
+    @PostAuthorize("returnObject.username == authentication.principal.nickName")
+    public CustomUser securedLoadUserDetail(String username) {
+        return userRoleRepository.loadUserByUserName(username);
+    }
+
+}
@@ -0,0 +1,9 @@
+package com.baeldung.repository;
+
+import org.springframework.data.repository.CrudRepository;
+
+import com.baeldung.entity.Task;
+
+public interface TaskRepository extends CrudRepository<Task, Long> {
+
+}
@@ -0,0 +1,27 @@
+package com.baeldung.service;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PostFilter;
+import org.springframework.security.access.prepost.PreFilter;
+import org.springframework.stereotype.Service;
+
+import com.baeldung.entity.Task;
+import com.baeldung.repository.TaskRepository;
+
+@Service
+public class TaskService {
+
+    @Autowired
+    private TaskRepository taskRepository;
+
+    @PostFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
+    public Iterable<Task> findAll() {
+        return taskRepository.findAll();
+    }
+
+    @PreFilter("hasRole('MANAGER') or filterObject.assignee == authentication.name")
+    public Iterable<Task> save(Iterable<Task> entities) {
+        return taskRepository.saveAll(entities);
+    }
+
+}
@@ -0,0 +1 @@
+spring.main.allow-bean-definition-overriding=true
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n
+            </pattern>
+        </encoder>
+    </appender>
+
+    <root level="INFO">
+        <appender-ref ref="STDOUT" />
+    </root>
+</configuration>
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
+         version="3.1">
+
+	<filter>
+		<filter-name>loggingFilter</filter-name>
+		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
+	</filter>
+
+	<filter-mapping>
+		<filter-name>loggingFilter</filter-name>
+		<url-pattern>/*</url-pattern>
+	</filter-mapping>
+
+</web-app>
				`@@ -0,0 +1 @@`
				`spring.main.allow-bean-definition-overriding=true`