Spring 3 - Security: How to rebuild authManager () usage?

35 views Asked by At

I try to go from Spring-Boot 2.7 to 3.1 - its regarding Security.

What I have under old version 2.

public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
    @Override
    protected void configure (HttpSecurity http) throws Exception
    {   
        http.cors ().and ()
            .csrf ().disable ()
            .authorizeRequests ()       
            .antMatchers ("/web/test").permitAll ()             
            .antMatchers ("/web/**").hasAnyRole ("USER")
            .anyRequest ().authenticated ()             
            .and ()
            .addFilter (new SecurityAuthenticationFilter (authenticationManager ()))
            .addFilter (new SecurityAuthorizationFilter (authenticationManager ()))      
            .sessionManagement ()
            .sessionCreationPolicy (SessionCreationPolicy.STATELESS);
    }

What I already have for version 3.

@Bean
public SecurityFilterChain securityFilterChain (HttpSecurity http) throws Exception
{
    http
        .cors (Customizer.withDefaults ())
         .csrf (AbstractHttpConfigurer::disable)
        .authorizeHttpRequests ((requests) -> requests
            .requestMatchers ("/web/test").permitAll ()
            .requestMatchers ("/web/**").hasRole ("USER")
            .anyRequest ().authenticated ()           
        )
        //.addFilter (new SecurityAuthenticationFilter (authenticationManager ()))
        
        .sessionManagement (httpSecuritySessionManagementConfigurer -> 
            httpSecuritySessionManagementConfigurer.sessionCreationPolicy (SessionCreationPolicy.STATELESS))

        ;

    return http.build();

But here I struggle with authenticationManager () of former WebSecurtyConfigurationAdapter - for my 2 custom filters.

They are

public class SecurityAuthorizationFilter extends BasicAuthenticationFilter
{
    public SecurityAuthorizationFilter (AuthenticationManager authenticationManager)
    {
        super (authenticationManager);
    }

    @Override
    protected void doFilterInternal (HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException 
    {
        UsernamePasswordAuthenticationToken upa = getAuthentication (request);
        if (upa == null)
        {
            filterChain.doFilter (request, response);
        }
        else
        {
            SecurityContextHolder.getContext ().setAuthentication (upa);
            filterChain.doFilter (request, response);
        }
    }

    @SuppressWarnings ("unchecked")
    private UsernamePasswordAuthenticationToken getAuthentication (HttpServletRequest request)
    {
        String token = request.getHeader (SecurityConstants.TOKEN_HEADER);
        
        if (token != null && token.startsWith (SecurityConstants.TOKEN_PREFIX) == true)
        {
            byte [] signingKey = SecurityConstants.JWT_SECRET.getBytes ();
            token = token.replace (SecurityConstants.TOKEN_PREFIX, "");
            
            Jws <Claims> claim = Jwts.parserBuilder ().setSigningKey (signingKey).build ().parseClaimsJws (token);
            String usr = claim.getBody ().getSubject ();
            
            List <LinkedHashMap <?, ?>> cs = claim.getBody ().get ("roles", List.class);
            List <SimpleGrantedAuthority> claims  = new ArrayList <SimpleGrantedAuthority> ();
            for (int i = 0; i < cs.size (); i ++)
            {
                claims.add (new SimpleGrantedAuthority (cs.get (i).get ("authority"). toString ()));
            }
            
            if (usr.length () > 0) 
            {
                return new UsernamePasswordAuthenticationToken (usr, null, claims);
            }
        }
        
        return null;
    }
}

and

public class SecurityAuthenticationFilter extends UsernamePasswordAuthenticationFilter 
{
    private final AuthenticationManager authenticationManager;
    
    
    
    public SecurityAuthenticationFilter (AuthenticationManager authenticationManager)
    {
        this.authenticationManager = authenticationManager;
        setFilterProcessesUrl (SecurityConstants.AUTH_LOGIN_URL);
    }

    @Override
    public Authentication attemptAuthentication (HttpServletRequest request, HttpServletResponse response)
    {
        String usr = request.getParameter ("username");
        String pwd = request.getParameter ("password");
        UsernamePasswordAuthenticationToken upat = new UsernamePasswordAuthenticationToken (usr, pwd); 
        return authenticationManager.authenticate (upat);
    }

    @Override
    protected void successfulAuthentication (HttpServletRequest request, HttpServletResponse response, FilterChain filterChain, Authentication authentication) throws java.io.IOException, ServletException
    {
        UserDetails user = ((UserDetails) authentication.getPrincipal ());
      
        @SuppressWarnings ("unchecked")
        Collection <GrantedAuthority> roles = (Collection <GrantedAuthority>) user.getAuthorities ();   
        String token = Jwts.builder ()
            .signWith (Keys.hmacShaKeyFor (SecurityConstants.JWT_SECRET.getBytes ()), SignatureAlgorithm.HS512)
            .setHeaderParam ("typ", SecurityConstants.TOKEN_TYPE)
            .setIssuer (SecurityConstants.TOKEN_ISSUER)
            .setAudience (SecurityConstants.TOKEN_AUDIENCE)
            .setSubject (user.getUsername ())
            .setExpiration (new java.util.Date (System.currentTimeMillis () + 60 * 60 * 24 * 1000))     // 24h lifetime of token          
            .claim ("roles", roles)
            .compact ();

        response.addHeader (SecurityConstants.TOKEN_HEADER, SecurityConstants.TOKEN_PREFIX + token);
    }
}

Question

How can I integration my 2 filters in Spring3 security?? authManager () is not available there.

0

There are 0 answers