com.oneops.proxy.security

Class WebSecurityConfig

java.lang.Object

org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

com.oneops.proxy.security.WebSecurityConfig

All Implemented Interfaces:

org.springframework.security.config.annotation.SecurityConfigurer<javax.servlet.Filter,org.springframework.security.config.annotation.web.builders.WebSecurity>, org.springframework.security.config.annotation.web.WebSecurityConfigurer<org.springframework.security.config.annotation.web.builders.WebSecurity>

@EnableWebSecurity
 @Order(value=2147483640)
public class WebSecurityConfig
extends org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

Web security configurer for the application.

Author:

Suresh

Constructor Summary

Constructors

Constructor and Description

WebSecurityConfig(LoginAuthProvider loginAuthProvider, TokenAuthProvider tokenAuthProvider, org.springframework.security.web.authentication.AuthenticationSuccessHandler successHandler, org.springframework.security.web.authentication.AuthenticationFailureHandler failureHandler, RestAuthEntryPoint authEntryPoint, JwtTokenService jwtTokenService, com.fasterxml.jackson.databind.ObjectMapper objectMapper, OneOpsConfig oneOpsConfig, String mgmtContext, String mgmtUser, String mgmtPasswd)

Method Summary

Modifier and Type	Method and Description
org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder	bCryptPasswordEncoder()
protected void	configure(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder auth) The method configures 3 authentication providers, namely
protected void	configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http) Configures two filters namely, login and auth filters in the same order.
void	configure(org.springframework.security.config.annotation.web.builders.WebSecurity web)
org.springframework.web.cors.CorsConfigurationSource	corsConfigurationSource() Cross-Origin Resource Sharing (CORS) configuration for all the cross-domain REST API calls.

Methods inherited from class org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

authenticationManager, authenticationManagerBean, getApplicationContext, getHttp, init, setApplicationContext, setAuthenticationConfiguration, setContentNegotationStrategy, setObjectPostProcessor, setTrustResolver, userDetailsService, userDetailsServiceBean

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

WebSecurityConfig

public WebSecurityConfig(LoginAuthProvider loginAuthProvider,
                         TokenAuthProvider tokenAuthProvider,
                         org.springframework.security.web.authentication.AuthenticationSuccessHandler successHandler,
                         org.springframework.security.web.authentication.AuthenticationFailureHandler failureHandler,
                         RestAuthEntryPoint authEntryPoint,
                         JwtTokenService jwtTokenService,
                         com.fasterxml.jackson.databind.ObjectMapper objectMapper,
                         OneOpsConfig oneOpsConfig,
                         @Value(value="${management.context-path}")
                         String mgmtContext,
                         @Value(value="${management.user}")
                         String mgmtUser,
                         @Value(value="${management.password}")
                         String mgmtPasswd)

Method Detail

bCryptPasswordEncoder

@Bean
 @Lazy
public org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder bCryptPasswordEncoder()

configure

protected void configure(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder auth)
                  throws Exception

The method configures 3 authentication providers, namely

1. LoginAuthProvider - Only for login requests 2. TokenAuthProvider - For all requests except management endpoints 3. InMemoryAuthentication - For management endpoints and user/password auth fallback.

Overrides:

configure in class org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

Throws:

Exception

configure

protected void configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
                  throws Exception

Configures two filters namely, login and auth filters in the same order. LoginProcessingFilter is for all the login (/auth/token) requests and TokenAuthProcessingFilter is for other requests to check the presence of JWT in header.

Overrides:

configure in class org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

Parameters:

http - http security

Throws:

Exception - throws if any error configuring Web security.

configure

public void configure(org.springframework.security.config.annotation.web.builders.WebSecurity web)
               throws Exception

Specified by:

configure in interface org.springframework.security.config.annotation.SecurityConfigurer<javax.servlet.Filter,org.springframework.security.config.annotation.web.builders.WebSecurity>

Overrides:

configure in class org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

Throws:

Exception

corsConfigurationSource

@Bean
public org.springframework.web.cors.CorsConfigurationSource corsConfigurationSource()

Cross-Origin Resource Sharing (CORS) configuration for all the cross-domain REST API calls. Its' applied to all request paths (/**).

Returns:

cors filter bean