From b6b577995677cc637fb829abd4cb76434af41775 Mon Sep 17 00:00:00 2001 From: "waqas.ikram" Date: Thu, 16 Jan 2020 15:04:08 +0000 Subject: Fix for SO-2598 Change-Id: I26a8251bd878d95ae3ede8d27bf9f42a6692e338 Issue-ID: SO-2598 Signed-off-by: waqas.ikram --- .../SoBasicWebSecurityConfigurerAdapter.java | 68 +++++++++++++++++++ .../java/org/onap/so/security/SoCadiFilter.java | 3 - .../SoNoAuthWebSecurityConfigurerAdapter.java | 45 ++++++++++++ .../so/security/SoUserCredentialConfiguration.java | 72 ++++++++++++++++++++ .../org/onap/so/security/WebSecurityConfig.java | 70 ------------------- .../onap/so/security/WebSecurityConfigImpl.java | 79 ---------------------- 6 files changed, 185 insertions(+), 152 deletions(-) create mode 100644 common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java create mode 100644 common/src/main/java/org/onap/so/security/SoNoAuthWebSecurityConfigurerAdapter.java create mode 100644 common/src/main/java/org/onap/so/security/SoUserCredentialConfiguration.java delete mode 100644 common/src/main/java/org/onap/so/security/WebSecurityConfig.java delete mode 100644 common/src/main/java/org/onap/so/security/WebSecurityConfigImpl.java (limited to 'common/src/main/java/org') diff --git a/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java b/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java new file mode 100644 index 0000000000..c778dde9af --- /dev/null +++ b/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java @@ -0,0 +1,68 @@ +/*- + * ============LICENSE_START======================================================= + * Copyright (C) 2020 Nordix Foundation. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + * ============LICENSE_END========================================================= + */ +package org.onap.so.security; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Profile; +import org.springframework.core.annotation.Order; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.builders.WebSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.web.firewall.StrictHttpFirewall; +import org.springframework.util.StringUtils; + +/** + * @author Waqas Ikram (waqas.ikram@est.tech) + * + */ +@EnableWebSecurity +@Configuration +@Order(1) +@Profile({"basic"}) +public class SoBasicWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { + + @Autowired + private SoUserCredentialConfiguration soUserCredentialConfiguration; + + @Override + protected void configure(final HttpSecurity http) throws Exception { + http.csrf().disable().authorizeRequests().antMatchers("/manage/health", "/manage/info").permitAll() + .antMatchers("/**") + .hasAnyRole(StringUtils.collectionToDelimitedString(soUserCredentialConfiguration.getRoles(), ",")) + .and().httpBasic(); + } + + @Override + public void configure(final WebSecurity web) throws Exception { + super.configure(web); + final StrictHttpFirewall firewall = new MSOSpringFirewall(); + web.httpFirewall(firewall); + } + + @Override + protected void configure(final AuthenticationManagerBuilder auth) throws Exception { + auth.userDetailsService(soUserCredentialConfiguration.userDetailsService()) + .passwordEncoder(soUserCredentialConfiguration.passwordEncoder()); + } + +} diff --git a/common/src/main/java/org/onap/so/security/SoCadiFilter.java b/common/src/main/java/org/onap/so/security/SoCadiFilter.java index 9849db380f..2763d6ee15 100644 --- a/common/src/main/java/org/onap/so/security/SoCadiFilter.java +++ b/common/src/main/java/org/onap/so/security/SoCadiFilter.java @@ -38,9 +38,6 @@ public class SoCadiFilter extends CadiFilter { protected final Logger logger = LoggerFactory.getLogger(SoCadiFilter.class); - private static String AFT_ENVIRONMENT_VAR = "AFT_ENVIRONMENT"; - private static String AAF_API_VERSION = "aaf_api_version"; - @Value("${mso.config.cadi.cadiLoglevel:#{null}}") private String cadiLoglevel; diff --git a/common/src/main/java/org/onap/so/security/SoNoAuthWebSecurityConfigurerAdapter.java b/common/src/main/java/org/onap/so/security/SoNoAuthWebSecurityConfigurerAdapter.java new file mode 100644 index 0000000000..b3e4842bbd --- /dev/null +++ b/common/src/main/java/org/onap/so/security/SoNoAuthWebSecurityConfigurerAdapter.java @@ -0,0 +1,45 @@ +/*- + * ============LICENSE_START======================================================= + * Copyright (C) 2020 Nordix Foundation. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + * ============LICENSE_END========================================================= + */ +package org.onap.so.security; + +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Profile; +import org.springframework.core.annotation.Order; +import org.springframework.security.config.annotation.web.builders.WebSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.web.firewall.StrictHttpFirewall; + +/** + * @author Waqas Ikram (waqas.ikram@est.tech) + * + */ +@EnableWebSecurity +@Configuration +@Order(2) +@Profile({"aaf", "test"}) +public class SoNoAuthWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { + @Override + public void configure(final WebSecurity web) throws Exception { + web.ignoring().antMatchers("/**"); + final StrictHttpFirewall firewall = new MSOSpringFirewall(); + web.httpFirewall(firewall); + } +} diff --git a/common/src/main/java/org/onap/so/security/SoUserCredentialConfiguration.java b/common/src/main/java/org/onap/so/security/SoUserCredentialConfiguration.java new file mode 100644 index 0000000000..ee680511b9 --- /dev/null +++ b/common/src/main/java/org/onap/so/security/SoUserCredentialConfiguration.java @@ -0,0 +1,72 @@ +/*- + * ============LICENSE_START======================================================= + * Copyright (C) 2020 Nordix Foundation. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + * ============LICENSE_END========================================================= + */ +package org.onap.so.security; + +import java.util.ArrayList; +import java.util.List; +import javax.annotation.PostConstruct; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.context.annotation.Bean; +import org.springframework.security.core.userdetails.UserDetailsService; +import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; +import org.springframework.stereotype.Component; + +/** + * @author Waqas Ikram (waqas.ikram@est.tech) + * + */ +@Component +@ConfigurationProperties(prefix = "spring.security") +public class SoUserCredentialConfiguration { + + private List credentials = new ArrayList<>(); + private final List roles = new ArrayList<>(); + + public List getRoles() { + return roles; + } + + @PostConstruct + private void addRoles() { + for (int i = 0; i < credentials.size(); i++) { + roles.add(credentials.get(i).getRole()); + } + } + + public List getUsercredentials() { + return credentials; + } + + public void setUsercredentials(final List usercredentials) { + if (usercredentials != null) { + this.credentials = usercredentials; + } + } + + @Bean + public UserDetailsService userDetailsService() { + return new UserDetailsServiceImpl(); + } + + @Bean + public BCryptPasswordEncoder passwordEncoder() { + return new BCryptPasswordEncoder(); + } +} diff --git a/common/src/main/java/org/onap/so/security/WebSecurityConfig.java b/common/src/main/java/org/onap/so/security/WebSecurityConfig.java deleted file mode 100644 index 2eafc6c9cd..0000000000 --- a/common/src/main/java/org/onap/so/security/WebSecurityConfig.java +++ /dev/null @@ -1,70 +0,0 @@ -/*- - * ============LICENSE_START======================================================= - * ONAP - SO - * ================================================================================ - * Copyright (C) 2017 - 2018 AT&T Intellectual Property. All rights reserved. - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END========================================================= - */ - -package org.onap.so.security; - -import java.util.ArrayList; -import java.util.List; -import javax.annotation.PostConstruct; -import org.springframework.boot.context.properties.ConfigurationProperties; -import org.springframework.context.annotation.Bean; -import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; -import org.springframework.security.core.userdetails.UserDetailsService; -import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; - - -@ConfigurationProperties(prefix = "spring.security") -public class WebSecurityConfig { - - private List credentials; - private List roles = new ArrayList<>(); - - public List getRoles() { - return roles; - } - - @PostConstruct - private void addRoles() { - if (credentials != null) { - for (int i = 0; i < credentials.size(); i++) { - roles.add(credentials.get(i).getRole()); - } - } - } - - public List getUsercredentials() { - return credentials; - } - - public void setUsercredentials(List usercredentials) { - this.credentials = usercredentials; - } - - @Bean - public UserDetailsService userDetailsService() { - return new UserDetailsServiceImpl(); - } - - @Bean - public BCryptPasswordEncoder passwordEncoder() { - return new BCryptPasswordEncoder(); - } -} diff --git a/common/src/main/java/org/onap/so/security/WebSecurityConfigImpl.java b/common/src/main/java/org/onap/so/security/WebSecurityConfigImpl.java deleted file mode 100644 index c84c7e8603..0000000000 --- a/common/src/main/java/org/onap/so/security/WebSecurityConfigImpl.java +++ /dev/null @@ -1,79 +0,0 @@ -/*- - * ============LICENSE_START======================================================= - * ONAP - SO - * ================================================================================ - * Copyright (C) 2017 - 2018 AT&T Intellectual Property. All rights reserved. - * ================================================================================ - * Modifications Copyright (c) 2019 Samsung - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END========================================================= - */ - -package org.onap.so.security; - -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.context.annotation.Profile; -import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; -import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.builders.WebSecurity; -import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; -import org.springframework.security.web.firewall.StrictHttpFirewall; -import org.springframework.util.StringUtils; - -@EnableWebSecurity -@Configuration() -public class WebSecurityConfigImpl extends WebSecurityConfig { - - @Profile({"basic"}) - @Bean - public WebSecurityConfigurerAdapter basicAuth() { - return new WebSecurityConfigurerAdapter() { - @Override - protected void configure(HttpSecurity http) throws Exception { - http.csrf().disable().authorizeRequests().antMatchers("/manage/health", "/manage/info").permitAll() - .antMatchers("/**").hasAnyRole(StringUtils.collectionToDelimitedString(getRoles(), ",")).and() - .httpBasic(); - } - - @Override - public void configure(WebSecurity web) throws Exception { - super.configure(web); - StrictHttpFirewall firewall = new MSOSpringFirewall(); - web.httpFirewall(firewall); - } - - @Override - protected void configure(AuthenticationManagerBuilder auth) throws Exception { - auth.userDetailsService(WebSecurityConfigImpl.this.userDetailsService()) - .passwordEncoder(WebSecurityConfigImpl.this.passwordEncoder()); - } - }; - } - - @Profile({"aaf", "test"}) - @Bean - public WebSecurityConfigurerAdapter noAuth() { - return new WebSecurityConfigurerAdapter() { - @Override - public void configure(WebSecurity web) throws Exception { - web.ignoring().antMatchers("/**"); - StrictHttpFirewall firewall = new MSOSpringFirewall(); - web.httpFirewall(firewall); - } - }; - } - -} -- cgit 1.2.3-korg