diff --git a/pom.xml b/pom.xml index 34e20d8..1e0d749 100644 --- a/pom.xml +++ b/pom.xml @@ -10,28 +10,14 @@ 1.0.0-SNAPSHOT - - - - 7.13.0 - - - - 7.13.0 - - - - - 2.2.6.RELEASE - + 7.15.0 + 2.5.4 1.8 1.8 1.8 - UTF-8 false - 2.2.4 - + 3.8.0 @@ -51,7 +37,7 @@ pom - com.microsoft.azure + com.azure.spring azure-spring-boot-bom ${azure.version} pom @@ -61,75 +47,26 @@ - - - - - - org.camunda.bpm.springboot - camunda-bpm-spring-boot-starter-webapp - ${camunda.spring-boot.version} - - - - - - - - - - - - - - - - com.sun.xml.bind - jaxb-impl - 2.2.3 + org.camunda.bpm.springboot + camunda-bpm-spring-boot-starter-webapp - org.postgresql - postgresql - 42.2.12 + org.glassfish.jaxb + jaxb-runtime - - - - org.springframework.boot - spring-boot-starter-security - ${spring-boot.version} + org.postgresql + postgresql org.springframework.boot - spring-boot-starter-data-jpa - - - - - - org.springframework.security - spring-security-oauth2-client + spring-boot-starter-oauth2-client - org.springframework.security - spring-security-oauth2-jose + com.azure.spring + azure-spring-boot-starter-active-directory - - - - - com.microsoft.azure - azure-active-directory-spring-boot-starter - - - com.microsoft.azure - azure-spring-boot - ${azure.version} - - @@ -151,5 +88,4 @@ - diff --git a/src/main/java/com/camunda/example/oauth2/config/WebAppSecurityConfig.java b/src/main/java/com/camunda/example/oauth2/config/WebAppSecurityConfig.java index 2c0663e..d80e751 100644 --- a/src/main/java/com/camunda/example/oauth2/config/WebAppSecurityConfig.java +++ b/src/main/java/com/camunda/example/oauth2/config/WebAppSecurityConfig.java @@ -1,57 +1,47 @@ package com.camunda.example.oauth2.config; -import com.camunda.example.oauth2.filter.CamundaAuthenticationFilter; +import com.azure.spring.aad.webapp.AADWebSecurityConfigurerAdapter; import com.camunda.example.oauth2.filter.WebAppAuthenticationProvider; +import org.camunda.bpm.webapp.impl.security.auth.ContainerBasedAuthenticationFilter; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.boot.autoconfigure.security.SecurityProperties; import org.springframework.boot.web.servlet.FilterRegistrationBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.annotation.Order; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; -import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest; -import org.springframework.security.oauth2.client.userinfo.OAuth2UserService; -import org.springframework.security.oauth2.core.oidc.user.OidcUser; -import java.util.Collections; +import static java.util.Collections.singletonMap; +import static org.camunda.bpm.engine.rest.security.auth.ProcessEngineAuthenticationFilter.AUTHENTICATION_PROVIDER_PARAM; +import static org.springframework.boot.autoconfigure.security.SecurityProperties.BASIC_AUTH_ORDER; @Configuration @EnableWebSecurity(debug = true) -@Order(SecurityProperties.BASIC_AUTH_ORDER - 15) -public class WebAppSecurityConfig extends WebSecurityConfigurerAdapter { +@Order(BASIC_AUTH_ORDER - 15) +public class WebAppSecurityConfig extends AADWebSecurityConfigurerAdapter { private final Logger logger = LoggerFactory.getLogger(WebAppSecurityConfig.class.getName()); - @Autowired - private OAuth2UserService oidcUserService; - @Override protected void configure(HttpSecurity http) throws Exception { + super.configure(http); + http.csrf().disable(); http.authorizeRequests().antMatchers("/app/admin/**", "/app/cockpit/**", "/app/tasklist/**").authenticated() .and() - .authorizeRequests().antMatchers("/**").permitAll() - .and() - .oauth2Login() - .userInfoEndpoint() - .oidcUserService(oidcUserService); + .authorizeRequests().antMatchers("/**").permitAll(); - http.csrf().disable(); } @Bean - @Order(SecurityProperties.BASIC_AUTH_ORDER - 15) - public FilterRegistrationBean containerBasedAuthenticationFilter() { + @Order(BASIC_AUTH_ORDER - 15) + public FilterRegistrationBean containerBasedAuthenticationFilter() { logger.info("++++++++ WebAppSecurityConfig.containerBasedAuthenticationFilter()...."); - FilterRegistrationBean filterRegistration - = new FilterRegistrationBean<>(); - filterRegistration.setFilter(new CamundaAuthenticationFilter()); - filterRegistration.setInitParameters(Collections.singletonMap("authentication-provider", WebAppAuthenticationProvider.class.getName())); + FilterRegistrationBean filterRegistration = new FilterRegistrationBean<>(); + filterRegistration.setFilter(new ContainerBasedAuthenticationFilter()); + filterRegistration.setInitParameters(singletonMap(AUTHENTICATION_PROVIDER_PARAM, WebAppAuthenticationProvider.class.getName())); filterRegistration.setOrder(101); // make sure the filter is registered after the Spring Security Filter Chain filterRegistration.addUrlPatterns("/*"); return filterRegistration; diff --git a/src/main/java/com/camunda/example/oauth2/filter/CamundaAuthenticationFilter.java b/src/main/java/com/camunda/example/oauth2/filter/CamundaAuthenticationFilter.java deleted file mode 100644 index 1f25026..0000000 --- a/src/main/java/com/camunda/example/oauth2/filter/CamundaAuthenticationFilter.java +++ /dev/null @@ -1,31 +0,0 @@ -package com.camunda.example.oauth2.filter; - -import org.camunda.bpm.webapp.impl.security.auth.ContainerBasedAuthenticationFilter; -import org.camunda.bpm.webapp.impl.util.ServletContextUtil; - -import javax.servlet.ServletContext; -import javax.servlet.http.HttpServletRequest; - -public class CamundaAuthenticationFilter extends ContainerBasedAuthenticationFilter { - - @Override - protected String getRequestUri(HttpServletRequest request) { - String requestURI = request.getRequestURI(); - String contextPath = request.getContextPath(); - - int contextPathLength = contextPath.length(); - if (contextPathLength > 0) { - requestURI = requestURI.substring(contextPathLength); - } - - ServletContext servletContext = request.getServletContext(); - String applicationPath = ServletContextUtil.getAppPath(servletContext); - int applicationPathLength = applicationPath.length(); - - if (applicationPathLength > 0 && applicationPathLength < requestURI.length()) { - requestURI = requestURI.substring(applicationPathLength); - } - - return requestURI; - } -} diff --git a/src/main/java/com/camunda/example/oauth2/filter/WebAppAuthenticationProvider.java b/src/main/java/com/camunda/example/oauth2/filter/WebAppAuthenticationProvider.java index fad2afb..14f1721 100644 --- a/src/main/java/com/camunda/example/oauth2/filter/WebAppAuthenticationProvider.java +++ b/src/main/java/com/camunda/example/oauth2/filter/WebAppAuthenticationProvider.java @@ -12,6 +12,9 @@ import java.util.List; import java.util.stream.Collectors; +import static org.camunda.bpm.engine.rest.security.auth.AuthenticationResult.successful; +import static org.camunda.bpm.engine.rest.security.auth.AuthenticationResult.unsuccessful; + public class WebAppAuthenticationProvider extends ContainerBasedAuthenticationProvider { private final Logger logger = LoggerFactory.getLogger(WebAppAuthenticationProvider.class.getName()); @@ -25,17 +28,17 @@ public AuthenticationResult extractAuthenticatedUser(HttpServletRequest request, if (authentication == null) { logger.debug("++ authentication == null...return unsuccessful."); - return AuthenticationResult.unsuccessful(); + return unsuccessful(); } logger.debug("++ authentication IS NOT NULL"); String name = authentication.getName(); if (name == null || name.isEmpty()) { - return AuthenticationResult.unsuccessful(); + return unsuccessful(); } logger.debug("++ name = " + name); - AuthenticationResult authenticationResult = new AuthenticationResult(name, true); + AuthenticationResult authenticationResult = successful(name); authenticationResult.setGroups(getUserGroups(authentication)); return authenticationResult; @@ -51,10 +54,10 @@ private List getUserGroups(Authentication authentication) { .map(res -> res.substring(5)) // Strip "ROLE_" .collect(Collectors.toList()); - logger.debug("++ groupIds = " + groupIds.toString()); + logger.debug("++ groupIds = " + groupIds); return groupIds; } -} \ No newline at end of file +}