diff --git a/settings.gradle b/settings.gradle index 8da34c5..abfbb04 100644 --- a/settings.gradle +++ b/settings.gradle @@ -33,6 +33,7 @@ include 'spring-security-kerberos-web' include 'spring-security-kerberos-samples:sec-client-rest-template' include 'spring-security-kerberos-samples:sec-server-client-auth' include 'spring-security-kerberos-samples:sec-server-spnego-form-auth' +include 'spring-security-kerberos-samples:sec-server-win-auth' include 'spring-security-kerberos-docs' rootProject.children.each { project -> diff --git a/spring-security-kerberos-samples/sec-server-win-auth/sec-server-win-auth.gradle b/spring-security-kerberos-samples/sec-server-win-auth/sec-server-win-auth.gradle new file mode 100644 index 0000000..adec533 --- /dev/null +++ b/spring-security-kerberos-samples/sec-server-win-auth/sec-server-win-auth.gradle @@ -0,0 +1,24 @@ +plugins { + id 'org.springframework.security.kerberos.sample' + id 'org.springframework.boot' + id 'io.spring.dependency-management' +} + +description = 'Security Server Win Auth Sample' + +dependencies { + management platform(project(":spring-security-kerberos-management")) + implementation project(':spring-security-kerberos-core') + implementation project(':spring-security-kerberos-web') + implementation project(':spring-security-kerberos-client') + implementation 'org.springframework.security:spring-security-ldap' + implementation 'org.springframework.security:spring-security-config' + implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity6' + implementation 'org.springframework.boot:spring-boot-starter' + implementation 'org.springframework.boot:spring-boot-starter-web' + implementation 'org.springframework.boot:spring-boot-starter-thymeleaf' + testImplementation 'org.springframework:spring-test' + testImplementation 'org.junit.jupiter:junit-jupiter' + testImplementation 'org.mockito:mockito-junit-jupiter' + testImplementation 'org.assertj:assertj-core' +} diff --git a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/ActiveDirectoryLdapAuthoritiesPopulator.java b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/ActiveDirectoryLdapAuthoritiesPopulator.java index eefa6eb..c1e022a 100644 --- a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/ActiveDirectoryLdapAuthoritiesPopulator.java +++ b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/ActiveDirectoryLdapAuthoritiesPopulator.java @@ -1,3 +1,18 @@ +/* + * Copyright 2023 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ package demo.app; import org.springframework.ldap.core.DirContextOperations; diff --git a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/Application.java b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/Application.java index d2b66db..5ce441b 100644 --- a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/Application.java +++ b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/Application.java @@ -1,16 +1,27 @@ +/* + * Copyright 2023 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ package demo.app; import org.springframework.boot.SpringApplication; -import org.springframework.boot.autoconfigure.EnableAutoConfiguration; import org.springframework.boot.autoconfigure.SpringBootApplication; -import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration; @SpringBootApplication -@EnableAutoConfiguration(exclude = SecurityAutoConfiguration.class) public class Application { public static void main(String[] args) throws Throwable { SpringApplication.run(Application.class, args); } - } diff --git a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/MvcConfig.java b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/MvcConfig.java index cb578b3..2f66516 100644 --- a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/MvcConfig.java +++ b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/MvcConfig.java @@ -1,11 +1,26 @@ +/* + * Copyright 2023 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ package demo.app; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.ViewControllerRegistry; -import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; @Configuration -public class MvcConfig extends WebMvcConfigurerAdapter { +public class MvcConfig implements WebMvcConfigurer { @Override public void addViewControllers(ViewControllerRegistry registry) { @@ -14,5 +29,4 @@ public class MvcConfig extends WebMvcConfigurerAdapter { registry.addViewController("/hello").setViewName("hello"); registry.addViewController("/login").setViewName("login"); } - } diff --git a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/WebSecurityConfig.java b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/WebSecurityConfig.java index 240209b..7df0d82 100644 --- a/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/WebSecurityConfig.java +++ b/spring-security-kerberos-samples/sec-server-win-auth/src/main/java/demo/app/WebSecurityConfig.java @@ -1,3 +1,18 @@ +/* + * Copyright 2023 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ package demo.app; import org.springframework.beans.factory.annotation.Value; @@ -5,10 +20,9 @@ import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.io.FileSystemResource; import org.springframework.security.authentication.AuthenticationManager; -import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.authentication.ProviderManager; import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; -import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider; import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator; import org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig; @@ -19,11 +33,12 @@ import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAu import org.springframework.security.ldap.search.FilterBasedLdapUserSearch; import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper; import org.springframework.security.ldap.userdetails.LdapUserDetailsService; +import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.www.BasicAuthenticationFilter; @Configuration -@EnableWebMvcSecurity -public class WebSecurityConfig extends WebSecurityConfigurerAdapter { +@EnableWebSecurity +public class WebSecurityConfig { @Value("${app.ad-domain}") private String adDomain; @@ -43,32 +58,33 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Value("${app.ldap-search-filter}") private String ldapSearchFilter; - @Override - protected void configure(HttpSecurity http) throws Exception { + @Bean + public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { + KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider = kerberosServiceAuthenticationProvider(); + ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = activeDirectoryLdapAuthenticationProvider(); + ProviderManager providerManager = new ProviderManager(kerberosServiceAuthenticationProvider, + activeDirectoryLdapAuthenticationProvider); + http + .authorizeHttpRequests((authz) -> authz + .requestMatchers("/", "/home").permitAll() + .anyRequest().authenticated() + ) .exceptionHandling() .authenticationEntryPoint(spnegoEntryPoint()) .and() - .authorizeRequests() - .antMatchers("/", "/home").permitAll() - .anyRequest().authenticated() - .and() .formLogin() .loginPage("/login").permitAll() .and() .logout() .permitAll() .and() - .addFilterBefore( - spnegoAuthenticationProcessingFilter(authenticationManagerBean()), - BasicAuthenticationFilter.class); - } - - @Override - protected void configure(AuthenticationManagerBuilder auth) throws Exception { - auth .authenticationProvider(activeDirectoryLdapAuthenticationProvider()) - .authenticationProvider(kerberosServiceAuthenticationProvider()); + .authenticationProvider(kerberosServiceAuthenticationProvider()) + .addFilterBefore(spnegoAuthenticationProcessingFilter(providerManager), + BasicAuthenticationFilter.class); + + return http.build(); } @Bean @@ -89,7 +105,6 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { return filter; } - @Bean public KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider() throws Exception { KerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider(); provider.setTicketValidator(sunJaasKerberosTicketValidator()); @@ -132,10 +147,4 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { service.setUserDetailsMapper(new LdapUserDetailsMapper()); return service; } - - @Bean - @Override - public AuthenticationManager authenticationManagerBean() throws Exception { - return super.authenticationManagerBean(); - } } diff --git a/spring-security-kerberos-samples/sec-server-win-auth/src/main/resources/logback.xml b/spring-security-kerberos-samples/sec-server-win-auth/src/main/resources/logback.xml deleted file mode 100644 index 0215b09..0000000 --- a/spring-security-kerberos-samples/sec-server-win-auth/src/main/resources/logback.xml +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - -