secure - spring-security-oauth2 maven

Spring security oauth2 y configuración de inicio de sesión de formulario

Question

Mi proyecto consiste en exponer dos partes diferentes, un panel de administración JSF y un servicio RESTfull. Estoy tratando de configurar la seguridad de Spring para usar diferentes métodos de autenticación dependiendo de la URL que navegue el usuario.

Los requisitos son

• Los usuarios que navegan a la página JSF obtienen una pantalla de inicio de sesión donde se autentican mediante la autenticación de formulario.
• Los usuarios que navegan al servicio REST utilizan la autenticación implícita OAuth2 con autenticación básica para la concesión de token.

Las configuraciones separadas funcionan por sí mismas, el problema es cuando trato de combinar ambas en una configuración, en ese caso, parece que el proveedor de REST se interpone y autentica cada solicitud, incluso si las solicitudes van a la URL del administrador se documenta a partir de pedidos de seguridad de primavera).

Mis configuraciones de muestra son como se muestra:

• Para el formulario de inicio de sesión (JSF)

  @Override
  @Order(1)
  protected void configure(HttpSecurity http) throws Exception {
  http
          .csrf().disable()
          .authorizeRequests()
          .antMatchers("/resources/**").permitAll()
          .antMatchers("/templates/**").permitAll()
          .antMatchers("/401.html").permitAll()
          .antMatchers("/404.html").permitAll()
          .antMatchers("/500.html").permitAll()
          .antMatchers("/api/**").permitAll()
          .antMatchers("/ui/admin.xhtml").hasAnyAuthority("admin", "ADMIN")
          .antMatchers("/thymeleaf").hasAnyAuthority("admin", "ADMIN")
          //.anyRequest().authenticated()
          .and()
          .formLogin()
          .loginPage("/login")
          .defaultSuccessUrl("/ui/index.xhtml")
          .failureUrl("/login?error=1")
          .permitAll()
          .and()
          .logout()
          .permitAll()
          .and()
          .rememberMe()
          .and().exceptionHandling().accessDeniedPage("/error/403");

• Configuración de seguridad OAuth2 (REST)

  @EnableResourceServer
  @Order(2)
  public class RestSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Inject
      private UserRepository userRepository;
  
      @Inject
      private PasswordEncoder passwordEncoder;
  
      @Bean
      ApplicationListener<AbstractAuthorizationEvent> loggerBean() {
          return new AuthenticationLoggerListener();
      }
  
      @Bean
      AccessDeniedHandler accessDeniedHandler() {
          return new AccessDeniedExceptionHandler();
      }
  
      @Bean
      AuthenticationEntryPoint entryPointBean() {
          return new UnauthorizedEntryPoint();
      }
  
      /*Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring()
                  .antMatchers(
                          "/resources/**"
                          , "/templates/**"
                          , "/login"
                          , "/logout"
                          , "/ui/**"
                          , "/401.html"
                          , "/404.html"
                          , "/500.html"
                  );
      }*/
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
          if (contentNegotiationStrategy == null) {
              contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
          }
          MediaTypeRequestMatcher preferredMatcher = new MediaTypeRequestMatcher(contentNegotiationStrategy,
                  MediaType.APPLICATION_FORM_URLENCODED,
                  MediaType.APPLICATION_JSON,
                  MediaType.MULTIPART_FORM_DATA);
  
          http.authorizeRequests()
                  .antMatchers("/ui/**").permitAll()
                  .and()
                  .anonymous().disable()
                  .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and().httpBasic()
                  .and()
                  .exceptionHandling()
                  .accessDeniedHandler(accessDeniedHandler()) // handle access denied in general (for example comming from @PreAuthorization
                  .authenticationEntryPoint(entryPointBean()) // handle authentication exceptions for unauthorized calls.
                  .defaultAuthenticationEntryPointFor(entryPointBean(), preferredMatcher)
                  .and()
                  .authorizeRequests()
                  .antMatchers("/api/**").fullyAuthenticated();
  
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(new UserDetailsService() {
              @Override
              public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
                  User user = userRepository.findOneByUsername(s);
  
                  if (null == user) {
                      // leave that to be handled by log listener
                      throw new UsernameNotFoundException("The user with email " + s + " was not found");
                  }
  
                  return (UserDetails) user;
              }
          }).passwordEncoder(passwordEncoder);
      }
  
  
      @Configuration
      @EnableAuthorizationServer
      protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  
  
  
          @Autowired
          private AuthenticationManager authenticationManager;
  
  
          @Bean
          public JwtAccessTokenConverter accessTokenConverter() {
              return new JwtAccessTokenConverter();
          }
  
          @Override
          public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
              oauthServer.tokenKeyAccess("isAnonymous() || hasAuthority(''ROLE_TRUSTED_CLIENT'')").checkTokenAccess("hasAuthority(''ROLE_TRUSTED_CLIENT'')");
          }
  
          @Override
          public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
              endpoints.authenticationManager(authenticationManager).accessTokenConverter(accessTokenConverter());
          }
  
  
          @Override
          public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
              clients.inMemory()
                      .withClient("xxx")
                      .resourceIds(xxx)
                      .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                      .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                      .scopes("read", "write", "trust", "update")
                      .accessTokenValiditySeconds(xxx)
                      .refreshTokenValiditySeconds(xxx)
                      .secret("xxx")
  
          }
      }
  }

Estas configuraciones existen en diferentes clases y el orden se establece manualmente.

¿Alguien tiene alguna solución a este problema?

Mejor,

Answer 1

Intenté adaptar tu configuración de seguridad. Desafortunadamente, no puedo validar esta configuración debido a que falta la aplicación de referencia.

Puede que esto te ayude:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserRepository userRepository;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(new UserDetailsService() {
            @Override
            public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
                User user = userRepository.findOneByUsername(s);

                if (null == user) {
                    throw new UsernameNotFoundException("The user with email " + s + " was not found");
                }

                return (UserDetails) user;
            }
        }).passwordEncoder(passwordEncoder);
    }

    @Override
    public void configure(WebSecurity webSecurity) throws Exception {
        webSecurity
                .ignoring()
                .antMatchers("/resources/**"
                        , "/templates/**"
                        , "/login"
                        , "/logout"
                        , "/ui/**"
                        , "/401.html"
                        , "/404.html"
                        , "/500.html");
    }

    @Configuration
    @EnableAuthorizationServer
    public static class OAuth2Configuration extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;

        @Bean
        public JwtAccessTokenConverter accessTokenConverter() {
            return new JwtAccessTokenConverter();
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.tokenKeyAccess("isAnonymous() || hasAuthority(''ROLE_TRUSTED_CLIENT'')").checkTokenAccess("hasAuthority(''ROLE_TRUSTED_CLIENT'')");
        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.authenticationManager(authenticationManager).accessTokenConverter(accessTokenConverter());
        }


        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                    .withClient("xxx")
                    .resourceIds("xxx")
                    .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                    .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                    .scopes("read", "write", "trust", "update")
                    .accessTokenValiditySeconds(xxx)
                    .refreshTokenValiditySeconds(xxx)
                    .secret("xxx");

        }
    }

    @Configuration
    @Order(1)
    public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Override
        public void configure(HttpSecurity http) throws Exception {
            http
                    .csrf().disable()
                    .authorizeRequests()
                    .antMatchers("/ui/admin.xhtml").hasAnyAuthority("admin", "ADMIN")
                    .antMatchers("/thymeleaf").hasAnyAuthority("admin", "ADMIN")
                    .and()
                    .formLogin()
                    .loginPage("/login")
                    .defaultSuccessUrl("/ui/index.xhtml")
                    .failureUrl("/login?error=1")
                    .permitAll()
                    .and()
                    .logout()
                    .permitAll()
                    .and()
                    .rememberMe()
                    .and().exceptionHandling().accessDeniedPage("/error/403");
        }
    }

    @Order(2)
    @Configuration
    @EnableResourceServer
    public static class CustomResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter {

        @Bean
        ApplicationListener<AbstractAuthorizationEvent> loggerBean() {
            return new AuthenticationLoggerListener();
        }

        @Bean
        AccessDeniedHandler accessDeniedHandler() {
            return new AccessDeniedExceptionHandler();
        }

        @Bean
        AuthenticationEntryPoint entryPointBean() {
            return new UnauthorizedEntryPoint();
        }

        @Override
        public void configure(HttpSecurity http) throws Exception {
            ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
            if (contentNegotiationStrategy == null) {
                contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
            }
            MediaTypeRequestMatcher preferredMatcher = new MediaTypeRequestMatcher(contentNegotiationStrategy,
                    MediaType.APPLICATION_FORM_URLENCODED,
                    MediaType.APPLICATION_JSON,
                    MediaType.MULTIPART_FORM_DATA);

            http.authorizeRequests()
                    .and()
                    .anonymous().disable()
                    .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and().httpBasic()
                    .and()
                    .exceptionHandling()
                    .accessDeniedHandler(accessDeniedHandler()) // handle access denied in general (for example comming from @PreAuthorization
                    .authenticationEntryPoint(entryPointBean()) // handle authentication exceptions for unauthorized calls.
                    .defaultAuthenticationEntryPointFor(entryPointBean(), preferredMatcher)
                    .and()
                    .authorizeRequests()
                    .antMatchers("/api/**").fullyAuthenticated();
        }
    }
}