@Override public ConditionOutcome getMatchOutcome(ConditionContext context, AnnotatedTypeMetadata metadata) { String[] enablers = context.getBeanFactory() .getBeanNamesForAnnotation(EnableOAuth2Sso.class); ConditionMessage.Builder message = ConditionMessage .forCondition("@EnableOAuth2Sso Condition"); for (String name : enablers) { if (context.getBeanFactory().isTypeMatch(name, WebSecurityConfigurerAdapter.class)) { return ConditionOutcome.match(message .found("@EnableOAuth2Sso annotation on WebSecurityConfigurerAdapter") .items(name)); } } return ConditionOutcome.noMatch(message.didNotFind( "@EnableOAuth2Sso annotation " + "on any WebSecurityConfigurerAdapter") .atAll()); }
@Bean public WebSecurityConfigurerAdapter securityConfigBean(){ return new WebSecurityConfigurerAdapter() { @Override protected void configure(HttpSecurity http) throws Exception { // We need this to prevent the browser from popping up a dialog on a 401 http .httpBasic() .and() .authorizeRequests() .antMatchers(HttpMethod.GET, "/posts/**").permitAll() .antMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN") .anyRequest().authenticated() .and() .csrf().disable(); } }; }
@Bean WebSecurityConfigurerAdapter webSecurityConfigurerAdapter() { return new WebSecurityConfigurerAdapter() { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable() // enables HTTP GET for /logout, not recommended in prod .authorizeRequests() .antMatchers("/b/**").hasAnyAuthority("USER") // hasRole(ADMIN) == hasAuthority(ROLE_ADMIN) .antMatchers("/books/**").hasRole("ADMIN") .anyRequest().authenticated() .and().formLogin() .and().logout().permitAll(); } }; }
@Bean public WebSecurityConfigurerAdapter applicationSecurity() { return new WebSecurityConfigurerAdapter() { @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().anyRequest().permitAll().and().csrf().disable(); //oops? } // // @Override // protected void configure(AuthenticationManagerBuilder auth) throws Exception { // auth.inMemoryAuthentication().withUser("admin").password("admin") // .roles("ADMIN", "USER").and().withUser("user").password("user") // .roles("USER"); // } }; }
@Override public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException { if (this.configType.isAssignableFrom(bean.getClass()) && bean instanceof WebSecurityConfigurerAdapter) { ProxyFactory factory = new ProxyFactory(); factory.setTarget(bean); factory.addAdvice(new SsoSecurityAdapter(this.applicationContext)); bean = factory.getProxy(); } return bean; }
@Override public Object invoke(MethodInvocation invocation) throws Throwable { if (invocation.getMethod().getName().equals("init")) { Method method = ReflectionUtils .findMethod(WebSecurityConfigurerAdapter.class, "getHttp"); ReflectionUtils.makeAccessible(method); HttpSecurity http = (HttpSecurity) ReflectionUtils.invokeMethod(method, invocation.getThis()); this.configurer.configure(http); } return invocation.proceed(); }
/** * Checks whether beans are registered after auto configuration class has been registered */ @Test public void registerJwtAutoConfiguration() { this.context.register(SecurityProperties.class); this.context.register(JwtAutoConfiguration.class); this.context.refresh(); //assert this.context.getBean(TokenProvider.class); this.context.getBean(PasswordEncoder.class); this.context.getBean(UserDetailsService.class); this.context.getBean(SecurityEvaluationContextExtension.class); this.context.getBean(WebSecurityConfigurerAdapter.class); }
/** * Expects not to have {@link WebSecurityConfigurerAdapter} in context if property is set to false */ @Test(expected = NoSuchBeanDefinitionException.class) public void propertyAutoSecurityDisabled() { this.context.register(SecurityProperties.class); this.context.register(JwtAutoConfiguration.class); EnvironmentTestUtils.addEnvironment(this.context, "com.github.cobrijani.jwt.enabled:false"); this.context.refresh(); //assert this.context.getBean(WebSecurityConfigurerAdapter.class); }
@Override public ConditionOutcome getMatchOutcome(ConditionContext context, AnnotatedTypeMetadata metadata) { String[] enablers = context.getBeanFactory() .getBeanNamesForAnnotation(EnableOAuth2Sso.class); for (String name : enablers) { if (context.getBeanFactory().isTypeMatch(name, WebSecurityConfigurerAdapter.class)) { return ConditionOutcome.match( "found @EnableOAuth2Sso on a WebSecurityConfigurerAdapter"); } } return ConditionOutcome.noMatch( "found no @EnableOAuth2Sso on a WebSecurityConfigurerAdapter"); }
@Override public ConditionOutcome getMatchOutcome(ConditionContext context, AnnotatedTypeMetadata metadata) { String[] enablers = context.getBeanFactory() .getBeanNamesForAnnotation(EnableOAuth2Sso.class); for (String name : enablers) { if (context.getBeanFactory().isTypeMatch(name, WebSecurityConfigurerAdapter.class)) { return ConditionOutcome.noMatch( "found @EnableOAuth2Sso on a WebSecurityConfigurerAdapter"); } } return ConditionOutcome .match("found no @EnableOAuth2Sso on a WebSecurityConfigurerAdapter"); }
@SuppressWarnings("unchecked") @Override protected <T extends WebSecurityConfigurerAdapter> Class<T> getSpringSecurityConfigClass(IServerContext context) { if (context.equals(PServerContext.WORKLIST)) { return (Class<T>) SecurityConfigs.CASAnalise.class; } else if (context.equals(PServerContext.REQUIREMENT)) { return (Class<T>) SecurityConfigs.CASPeticionamento.class; } else if (context.equals(PServerContext.ADMINISTRATION)) { return (Class<T>) SecurityConfigs.AdministrationSecurity.class; } return null; }
public void init(ServletContext ctx, AnnotationConfigWebApplicationContext applicationContext, String springMVCServletMapping, IServerContext[] serverContexts) { addRestSecurity(applicationContext); addSpringSecurityFilter(ctx, applicationContext, springMVCServletMapping); for (IServerContext context : serverContexts) { logger.info(SINGULAR_SECURITY, "Securing (Spring Security) context:", context.getContextPath()); Class<WebSecurityConfigurerAdapter> config = getSpringSecurityConfigClass(context); if (config != null) { applicationContext.register(config); addLogoutFilter(ctx, applicationContext, springMVCServletMapping, context); } } }
@Bean public WebSecurityConfigurerAdapter webSecurityConfigure(){ return new WebSecurityConfigurerAdapter() { @Override protected void configure(HttpSecurity http) throws Exception { // @formatter:off http .authorizeRequests() .antMatchers("/api/signup", "/api/users/username-check") .permitAll() .and() .authorizeRequests() .regexMatchers(HttpMethod.GET, "^/api/users/[\\d]*(\\/)?$").authenticated() .regexMatchers(HttpMethod.GET, "^/api/users(\\/)?(\\?.+)?$").hasRole("ADMIN") .regexMatchers(HttpMethod.DELETE, "^/api/users/[\\d]*(\\/)?$").hasRole("ADMIN") .regexMatchers(HttpMethod.POST, "^/api/users(\\/)?$").hasRole("ADMIN") .and() .authorizeRequests() .antMatchers("/api/**").authenticated() .and() .authorizeRequests() .anyRequest().permitAll() .and() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .httpBasic() .and() .csrf() .disable(); // @formatter:on } }; }
@Override public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException { if (this.configType.isAssignableFrom(bean.getClass()) && bean instanceof WebSecurityConfigurerAdapter) { ProxyFactory factory = new ProxyFactory(); factory.setTarget(bean); factory.addAdvice(new SsoSecurityAdapter(this.beanFactory)); bean = factory.getProxy(); } return bean; }
@Bean public WebSecurityConfigurerAdapter secureConfigurer() { return new WebSecurityConfigurerAdapterImpl(); }
@Bean public WebSecurityConfigurerAdapter h2ConsoleSecurityConfigurer() { return new H2ConsoleSecurityConfigurer(); }
@Override protected <T extends WebSecurityConfigurerAdapter> Class<T> getSpringSecurityConfigClass(IServerContext context) { return (Class<T>) StudioSecurity.class; }
/** * Disable csrf * Allows anonymous request * * @return */ @Bean @Autowired WebSecurityConfigurerAdapter webSecurityConfigurerAdapter() { return new WebSecurityConfigurerAdapterImpl(); }
protected abstract <T extends WebSecurityConfigurerAdapter> Class<T> getSpringSecurityConfigClass(IServerContext context);
