secure - spring-security-oauth2 maven

Spring security oauth2 y configuración de inicio de sesión de formulario

Question

Mi proyecto consiste en exponer dos partes diferentes, un panel de administración JSF y un servicio RESTfull. Estoy tratando de configurar la seguridad de Spring para usar diferentes métodos de autenticación dependiendo de la URL que navegue el usuario.

Los requisitos son

• Los usuarios que navegan a la página JSF obtienen una pantalla de inicio de sesión donde se autentican mediante la autenticación de formulario.
• Los usuarios que navegan al servicio REST utilizan la autenticación implícita OAuth2 con autenticación básica para la concesión de token.

Las configuraciones separadas funcionan por sí mismas, el problema es cuando trato de combinar ambas en una configuración, en ese caso, parece que el proveedor de REST se interpone y autentica cada solicitud, incluso si las solicitudes van a la URL del administrador se documenta a partir de pedidos de seguridad de primavera).

Mis configuraciones de muestra son como se muestra:

• Para el formulario de inicio de sesión (JSF)

  @Override
  @Order(1)
  protected void configure(HttpSecurity http) throws Exception {
  http
  .csrf().disable()
  .authorizeRequests()
  .antMatchers("/resources/**").permitAll()
  .antMatchers("/templates/**").permitAll()
  .antMatchers("/401.html").permitAll()
  .antMatchers("/404.html").permitAll()
  .antMatchers("/500.html").permitAll()
  .antMatchers("/api/**").permitAll()
  .antMatchers("/ui/admin.xhtml").hasAnyAuthority("admin", "ADMIN")
  .antMatchers("/thymeleaf").hasAnyAuthority("admin", "ADMIN")
  //.anyRequest().authenticated()
  .and()
  .formLogin()
  .loginPage("/login")
  .defaultSuccessUrl("/ui/index.xhtml")
  .failureUrl("/login?error=1")
  .permitAll()
  .and()
  .logout()
  .permitAll()
  .and()
  .rememberMe()
  .and().exceptionHandling().accessDeniedPage("/error/403");

• Configuración de seguridad OAuth2 (REST)

  @EnableResourceServer
  @Order(2)
  public class RestSecurityConfig extends WebSecurityConfigurerAdapter {
  @Inject
  private UserRepository userRepository;
  @Inject
  private PasswordEncoder passwordEncoder;
  @Bean
  ApplicationListener<AbstractAuthorizationEvent> loggerBean() {
  return new AuthenticationLoggerListener();
  }
  @Bean
  AccessDeniedHandler accessDeniedHandler() {
  return new AccessDeniedExceptionHandler();
  }
  @Bean
  AuthenticationEntryPoint entryPointBean() {
  return new UnauthorizedEntryPoint();
  }
  /*Override
  public void configure(WebSecurity web) throws Exception {
  web.ignoring()
  .antMatchers(
  "/resources/**"
  , "/templates/**"
  , "/login"
  , "/logout"
  , "/ui/**"
  , "/401.html"
  , "/404.html"
  , "/500.html"
  );
  }*/
  @Override
  protected void configure(HttpSecurity http) throws Exception {
  ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
  if (contentNegotiationStrategy == null) {
  contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
  }
  MediaTypeRequestMatcher preferredMatcher = new MediaTypeRequestMatcher(contentNegotiationStrategy,
  MediaType.APPLICATION_FORM_URLENCODED,
  MediaType.APPLICATION_JSON,
  MediaType.MULTIPART_FORM_DATA);
  http.authorizeRequests()
  .antMatchers("/ui/**").permitAll()
  .and()
  .anonymous().disable()
  .sessionManagement()
  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  .and().httpBasic()
  .and()
  .exceptionHandling()
  .accessDeniedHandler(accessDeniedHandler()) // handle access denied in general (for example comming from @PreAuthorization
  .authenticationEntryPoint(entryPointBean()) // handle authentication exceptions for unauthorized calls.
  .defaultAuthenticationEntryPointFor(entryPointBean(), preferredMatcher)
  .and()
  .authorizeRequests()
  .antMatchers("/api/**").fullyAuthenticated();
  }
  @Override
  @Bean
  public AuthenticationManager authenticationManagerBean() throws Exception {
  return super.authenticationManagerBean();
  }
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  auth.userDetailsService(new UserDetailsService() {
  @Override
  public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
  User user = userRepository.findOneByUsername(s);
  if (null == user) {
  // leave that to be handled by log listener
  throw new UsernameNotFoundException("The user with email " + s + " was not found");
  }
  return (UserDetails) user;
  }
  }).passwordEncoder(passwordEncoder);
  }
  @Configuration
  @EnableAuthorizationServer
  protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  @Autowired
  private AuthenticationManager authenticationManager;
  @Bean
  public JwtAccessTokenConverter accessTokenConverter() {
  return new JwtAccessTokenConverter();
  }
  @Override
  public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
  oauthServer.tokenKeyAccess("isAnonymous() || hasAuthority(''ROLE_TRUSTED_CLIENT'')").checkTokenAccess("hasAuthority(''ROLE_TRUSTED_CLIENT'')");
  }
  @Override
  public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  endpoints.authenticationManager(authenticationManager).accessTokenConverter(accessTokenConverter());
  }
  @Override
  public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  clients.inMemory()
  .withClient("xxx")
  .resourceIds(xxx)
  .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
  .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
  .scopes("read", "write", "trust", "update")
  .accessTokenValiditySeconds(xxx)
  .refreshTokenValiditySeconds(xxx)
  .secret("xxx")
  }
  }
  }

Estas configuraciones existen en diferentes clases y el orden se establece manualmente.

¿Alguien tiene alguna solución a este problema?

Mejor,

Answer 1

Intenté adaptar tu configuración de seguridad. Desafortunadamente, no puedo validar esta configuración debido a que falta la aplicación de referencia.

Puede que esto te ayude:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserRepository userRepository;
@Autowired
private PasswordEncoder passwordEncoder;
@Autowired
protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(new UserDetailsService() {
@Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
User user = userRepository.findOneByUsername(s);
if (null == user) {
throw new UsernameNotFoundException("The user with email " + s + " was not found");
}
return (UserDetails) user;
}
}).passwordEncoder(passwordEncoder);
}
@Override
public void configure(WebSecurity webSecurity) throws Exception {
webSecurity
.ignoring()
.antMatchers("/resources/**"
, "/templates/**"
, "/login"
, "/logout"
, "/ui/**"
, "/401.html"
, "/404.html"
, "/500.html");
}
@Configuration
@EnableAuthorizationServer
public static class OAuth2Configuration extends AuthorizationServerConfigurerAdapter {
@Autowired
private AuthenticationManager authenticationManager;
@Bean
public JwtAccessTokenConverter accessTokenConverter() {
return new JwtAccessTokenConverter();
}
@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer.tokenKeyAccess("isAnonymous() || hasAuthority(''ROLE_TRUSTED_CLIENT'')").checkTokenAccess("hasAuthority(''ROLE_TRUSTED_CLIENT'')");
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.authenticationManager(authenticationManager).accessTokenConverter(accessTokenConverter());
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("xxx")
.resourceIds("xxx")
.authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
.authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
.scopes("read", "write", "trust", "update")
.accessTokenValiditySeconds(xxx)
.refreshTokenValiditySeconds(xxx)
.secret("xxx");
}
}
@Configuration
@Order(1)
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
public void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/ui/admin.xhtml").hasAnyAuthority("admin", "ADMIN")
.antMatchers("/thymeleaf").hasAnyAuthority("admin", "ADMIN")
.and()
.formLogin()
.loginPage("/login")
.defaultSuccessUrl("/ui/index.xhtml")
.failureUrl("/login?error=1")
.permitAll()
.and()
.logout()
.permitAll()
.and()
.rememberMe()
.and().exceptionHandling().accessDeniedPage("/error/403");
}
}
@Order(2)
@Configuration
@EnableResourceServer
public static class CustomResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter {
@Bean
ApplicationListener<AbstractAuthorizationEvent> loggerBean() {
return new AuthenticationLoggerListener();
}
@Bean
AccessDeniedHandler accessDeniedHandler() {
return new AccessDeniedExceptionHandler();
}
@Bean
AuthenticationEntryPoint entryPointBean() {
return new UnauthorizedEntryPoint();
}
@Override
public void configure(HttpSecurity http) throws Exception {
ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
if (contentNegotiationStrategy == null) {
contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
}
MediaTypeRequestMatcher preferredMatcher = new MediaTypeRequestMatcher(contentNegotiationStrategy,
MediaType.APPLICATION_FORM_URLENCODED,
MediaType.APPLICATION_JSON,
MediaType.MULTIPART_FORM_DATA);
http.authorizeRequests()
.and()
.anonymous().disable()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and().httpBasic()
.and()
.exceptionHandling()
.accessDeniedHandler(accessDeniedHandler()) // handle access denied in general (for example comming from @PreAuthorization
.authenticationEntryPoint(entryPointBean()) // handle authentication exceptions for unauthorized calls.
.defaultAuthenticationEntryPointFor(entryPointBean(), preferredMatcher)
.and()
.authorizeRequests()
.antMatchers("/api/**").fullyAuthenticated();
}
}
}