Fix for SO-2598

Change-Id: I26a8251bd878d95ae3ede8d27bf9f42a6692e338
Issue-ID: SO-2598
Signed-off-by: waqas.ikram <waqas.ikram@est.tech>

5 files changed, 131 insertions, 98 deletions

diff --git a/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java b/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java
new file mode 100644
index 0000000000..c778dde9af
--- /dev/null
+++ b/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java
@@ -0,0 +1,68 @@
+/*-
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2020 Nordix Foundation.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * 
+ * SPDX-License-Identifier: Apache-2.0
+ * ============LICENSE_END=========================================================
+ */
+package org.onap.so.security;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Profile;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
+import org.springframework.util.StringUtils;
+
+/**
+ * @author Waqas Ikram (waqas.ikram@est.tech)
+ *
+ */
+@EnableWebSecurity
+@Configuration
+@Order(1)
+@Profile({"basic"})
+public class SoBasicWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
+
+    @Autowired
+    private SoUserCredentialConfiguration soUserCredentialConfiguration;
+
+    @Override
+    protected void configure(final HttpSecurity http) throws Exception {
+        http.csrf().disable().authorizeRequests().antMatchers("/manage/health", "/manage/info").permitAll()
+                .antMatchers("/**")
+                .hasAnyRole(StringUtils.collectionToDelimitedString(soUserCredentialConfiguration.getRoles(), ","))
+                .and().httpBasic();
+    }
+
+    @Override
+    public void configure(final WebSecurity web) throws Exception {
+        super.configure(web);
+        final StrictHttpFirewall firewall = new MSOSpringFirewall();
+        web.httpFirewall(firewall);
+    }
+
+    @Override
+    protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
+        auth.userDetailsService(soUserCredentialConfiguration.userDetailsService())
+                .passwordEncoder(soUserCredentialConfiguration.passwordEncoder());
+    }
+
+}
diff --git a/common/src/main/java/org/onap/so/security/SoCadiFilter.java b/common/src/main/java/org/onap/so/security/SoCadiFilter.java
index 9849db380f..2763d6ee15 100644
--- a/common/src/main/java/org/onap/so/security/SoCadiFilter.java
+++ b/common/src/main/java/org/onap/so/security/SoCadiFilter.java
@@ -38,9 +38,6 @@ public class SoCadiFilter extends CadiFilter {
 
     protected final Logger logger = LoggerFactory.getLogger(SoCadiFilter.class);
 
-    private static String AFT_ENVIRONMENT_VAR = "AFT_ENVIRONMENT";
-    private static String AAF_API_VERSION = "aaf_api_version";
-
     @Value("${mso.config.cadi.cadiLoglevel:#{null}}")
     private String cadiLoglevel;
 
diff --git a/common/src/main/java/org/onap/so/security/SoNoAuthWebSecurityConfigurerAdapter.java b/common/src/main/java/org/onap/so/security/SoNoAuthWebSecurityConfigurerAdapter.java
new file mode 100644
index 0000000000..b3e4842bbd
--- /dev/null
+++ b/common/src/main/java/org/onap/so/security/SoNoAuthWebSecurityConfigurerAdapter.java
@@ -0,0 +1,45 @@
+/*-
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2020 Nordix Foundation.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * 
+ * SPDX-License-Identifier: Apache-2.0
+ * ============LICENSE_END=========================================================
+ */
+package org.onap.so.security;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Profile;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
+
+/**
+ * @author Waqas Ikram (waqas.ikram@est.tech)
+ *
+ */
+@EnableWebSecurity
+@Configuration
+@Order(2)
+@Profile({"aaf", "test"})
+public class SoNoAuthWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
+    @Override
+    public void configure(final WebSecurity web) throws Exception {
+        web.ignoring().antMatchers("/**");
+        final StrictHttpFirewall firewall = new MSOSpringFirewall();
+        web.httpFirewall(firewall);
+    }
+}
diff --git a/common/src/main/java/org/onap/so/security/WebSecurityConfig.java b/common/src/main/java/org/onap/so/security/SoUserCredentialConfiguration.java
index 2eafc6c9cd..ee680511b9 100644
--- a/common/src/main/java/org/onap/so/security/WebSecurityConfig.java
+++ b/common/src/main/java/org/onap/so/security/SoUserCredentialConfiguration.java
@@ -1,8 +1,6 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP - SO
- * ================================================================================
- * Copyright (C) 2017 - 2018 AT&T Intellectual Property. All rights reserved.
+ *  Copyright (C) 2020 Nordix Foundation.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,9 +13,10 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
+ * 
+ * SPDX-License-Identifier: Apache-2.0
  * ============LICENSE_END=========================================================
  */
-
 package org.onap.so.security;
 
 import java.util.ArrayList;
@@ -25,17 +24,20 @@ import java.util.List;
 import javax.annotation.PostConstruct;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Bean;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.stereotype.Component;
 
-
+/**
+ * @author Waqas Ikram (waqas.ikram@est.tech)
+ *
+ */
+@Component
 @ConfigurationProperties(prefix = "spring.security")
-public class WebSecurityConfig {
+public class SoUserCredentialConfiguration {
 
-    private List<UserCredentials> credentials;
-    private List<String> roles = new ArrayList<>();
+    private List<UserCredentials> credentials = new ArrayList<>();
+    private final List<String> roles = new ArrayList<>();
 
     public List<String> getRoles() {
         return roles;
@@ -43,10 +45,8 @@ public class WebSecurityConfig {
 
     @PostConstruct
     private void addRoles() {
-        if (credentials != null) {
-            for (int i = 0; i < credentials.size(); i++) {
-                roles.add(credentials.get(i).getRole());
-            }
+        for (int i = 0; i < credentials.size(); i++) {
+            roles.add(credentials.get(i).getRole());
         }
     }
 
@@ -54,8 +54,10 @@ public class WebSecurityConfig {
         return credentials;
     }
 
-    public void setUsercredentials(List<UserCredentials> usercredentials) {
-        this.credentials = usercredentials;
+    public void setUsercredentials(final List<UserCredentials> usercredentials) {
+        if (usercredentials != null) {
+            this.credentials = usercredentials;
+        }
     }
 
     @Bean
diff --git a/common/src/main/java/org/onap/so/security/WebSecurityConfigImpl.java b/common/src/main/java/org/onap/so/security/WebSecurityConfigImpl.java
deleted file mode 100644
index c84c7e8603..0000000000
--- a/common/src/main/java/org/onap/so/security/WebSecurityConfigImpl.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*-
- * ============LICENSE_START=======================================================
- * ONAP - SO
- * ================================================================================
- * Copyright (C) 2017 - 2018 AT&T Intellectual Property. All rights reserved.
- * ================================================================================
- * Modifications Copyright (c) 2019 Samsung
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *      http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============LICENSE_END=========================================================
- */
-
-package org.onap.so.security;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Profile;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.builders.WebSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.web.firewall.StrictHttpFirewall;
-import org.springframework.util.StringUtils;
-
-@EnableWebSecurity
-@Configuration()
-public class WebSecurityConfigImpl extends WebSecurityConfig {
-
-    @Profile({"basic"})
-    @Bean
-    public WebSecurityConfigurerAdapter basicAuth() {
-        return new WebSecurityConfigurerAdapter() {
-            @Override
-            protected void configure(HttpSecurity http) throws Exception {
-                http.csrf().disable().authorizeRequests().antMatchers("/manage/health", "/manage/info").permitAll()
-                        .antMatchers("/**").hasAnyRole(StringUtils.collectionToDelimitedString(getRoles(), ",")).and()
-                        .httpBasic();
-            }
-
-            @Override
-            public void configure(WebSecurity web) throws Exception {
-                super.configure(web);
-                StrictHttpFirewall firewall = new MSOSpringFirewall();
-                web.httpFirewall(firewall);
-            }
-
-            @Override
-            protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-                auth.userDetailsService(WebSecurityConfigImpl.this.userDetailsService())
-                        .passwordEncoder(WebSecurityConfigImpl.this.passwordEncoder());
-            }
-        };
-    }
-
-    @Profile({"aaf", "test"})
-    @Bean
-    public WebSecurityConfigurerAdapter noAuth() {
-        return new WebSecurityConfigurerAdapter() {
-            @Override
-            public void configure(WebSecurity web) throws Exception {
-                web.ignoring().antMatchers("/**");
-                StrictHttpFirewall firewall = new MSOSpringFirewall();
-                web.httpFirewall(firewall);
-            }
-        };
-    }
-
-}