Spring/spring-security-kerberos
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Migrate client examples

Browse Source 
- Build both sec-client-rest-template and sec-server-client-auth
- Migrate HttpClient 4.x to 5.x
- Relates #165
This commit is contained in:
Janne Valkealahti
2023-03-28 08:37:19 +01:00
parent cb41f1a280
commit df0ec59ae4
13 changed files with 186 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
settings.gradle
View File

@@ -30,6 +30,8 @@ include 'spring-security-kerberos-bom'
include 'spring-security-kerberos-core'
include 'spring-security-kerberos-client'
include 'spring-security-kerberos-web'
include 'spring-security-kerberos-samples:sec-client-rest-template'
include 'spring-security-kerberos-samples:sec-server-client-auth'
include 'spring-security-kerberos-samples:sec-server-spnego-form-auth'
include 'spring-security-kerberos-docs'

1
spring-security-kerberos-client/spring-security-kerberos-client.gradle
View File

@@ -9,6 +9,7 @@ dependencies {
implementation project(':spring-security-kerberos-core')
implementation project(':spring-security-kerberos-web')
// api('org.apache.httpcomponents:httpclient')
api('org.springframework:spring-web')
api('org.apache.httpcomponents.client5:httpclient5')
optional 'org.springframework.security:spring-security-ldap'
// api('org.springframework.security:spring-security-web')

38
spring-security-kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2015 the original author or authors.
* Copyright 2015-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -36,27 +36,20 @@ import javax.security.auth.login.Configuration;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import org.apache.hc.client5.http.SystemDefaultDnsResolver;
import org.apache.hc.client5.http.auth.AuthSchemeFactory;
import org.apache.hc.client5.http.auth.AuthScope;
import org.apache.hc.client5.http.auth.Credentials;
import org.apache.hc.client5.http.auth.KerberosConfig;
import org.apache.hc.client5.http.auth.StandardAuthScheme;
import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
import org.apache.hc.client5.http.impl.auth.SPNegoSchemeFactory;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
import org.apache.hc.core5.http.config.Lookup;
import org.apache.hc.core5.http.config.RegistryBuilder;
// import org.apache.http.auth.AuthSchemeProvider;
// import org.apache.http.auth.AuthScope;
// import org.apache.http.auth.Credentials;
// import org.apache.http.client.HttpClient;
// import org.apache.http.client.config.AuthSchemes;
// import org.apache.http.config.Lookup;
// import org.apache.http.config.RegistryBuilder;
// import org.apache.http.impl.auth.SPNegoSchemeFactory;
// import org.apache.http.impl.client.BasicCredentialsProvider;
// import org.apache.http.impl.client.CloseableHttpClient;
// import org.apache.http.impl.client.HttpClientBuilder;
import org.springframework.http.HttpMethod;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.util.StringUtils;
@@ -207,9 +200,16 @@ public class KerberosRestTemplate extends RestTemplate {
*/
private static HttpClient buildHttpClient() {
HttpClientBuilder builder = HttpClientBuilder.create();
// Lookup<AuthSchemeProvider> authSchemeRegistry = RegistryBuilder.<AuthSchemeProvider> create()
// .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true)).build();
Lookup<AuthSchemeFactory> authSchemeRegistry = null;
Lookup<AuthSchemeFactory> authSchemeRegistry = RegistryBuilder.<AuthSchemeFactory>create()
.register(StandardAuthScheme.SPNEGO, new SPNegoSchemeFactory(
KerberosConfig.custom()
.setStripPort(KerberosConfig.Option.ENABLE)
.setUseCanonicalHostname(KerberosConfig.Option.DISABLE)
.build(),
SystemDefaultDnsResolver.INSTANCE))
.build();
builder.setDefaultAuthSchemeRegistry(authSchemeRegistry);
BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
credentialsProvider.setCredentials(new AuthScope(null, -1), credentials);
@@ -234,7 +234,7 @@ public class KerberosRestTemplate extends RestTemplate {
}
@Override
protected final <T> T doExecute(final URI url, final HttpMethod method, final RequestCallback requestCallback,
protected final <T> T doExecute(final URI url, final String uriTemplate, final HttpMethod method, final RequestCallback requestCallback,
final ResponseExtractor<T> responseExtractor) throws RestClientException {
try {
@@ -245,7 +245,7 @@ public class KerberosRestTemplate extends RestTemplate {
@Override
public T run() {
return KerberosRestTemplate.this.doExecuteSubject(url, method, requestCallback, responseExtractor);
return KerberosRestTemplate.this.doExecuteSubject(url, uriTemplate, method, requestCallback, responseExtractor);
}
});
@@ -254,9 +254,9 @@ public class KerberosRestTemplate extends RestTemplate {
}
}
private <T> T doExecuteSubject(URI url, HttpMethod method, RequestCallback requestCallback,
private <T> T doExecuteSubject(URI url, String uriTemplate, HttpMethod method, RequestCallback requestCallback,
ResponseExtractor<T> responseExtractor) throws RestClientException {
return super.doExecute(url, method, requestCallback, responseExtractor);
return super.doExecute(url, uriTemplate, method, requestCallback, responseExtractor);
}
private static class ClientLoginConfig extends Configuration {

17
spring-security-kerberos-samples/sec-client-rest-template/sec-client-rest-template.gradle Normal file
View File

@@ -0,0 +1,17 @@
plugins {
id 'org.springframework.security.kerberos.sample'
id 'org.springframework.boot'
id 'io.spring.dependency-management'
}
description = 'Security Client RestTemplate Sample'
dependencies {
management platform(project(":spring-security-kerberos-management"))
implementation project(':spring-security-kerberos-client')
implementation 'org.springframework.boot:spring-boot-starter'
testImplementation 'org.springframework:spring-test'
testImplementation 'org.junit.jupiter:junit-jupiter'
testImplementation 'org.mockito:mockito-junit-jupiter'
testImplementation 'org.assertj:assertj-core'
}

21
spring-security-kerberos-samples/sec-client-rest-template/src/main/java/demo/app/Application.java
View File

@@ -1,10 +1,26 @@
/*
* Copyright 2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package demo.app;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.WebApplicationType;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.boot.builder.SpringApplicationBuilder;
import org.springframework.security.kerberos.client.KerberosRestTemplate;
@@ -30,7 +46,6 @@ public class Application implements CommandLineRunner {
}
public static void main(String[] args) throws Throwable {
new SpringApplicationBuilder(Application.class).web(false).run(args);
new SpringApplicationBuilder(Application.class).web(WebApplicationType.NONE).run(args);
}
}

4
spring-security-kerberos-samples/sec-client-rest-template/src/main/resources/application.yml
View File

@@ -1,4 +1,4 @@
app:
user-principal: user2@EXAMPLE.ORG
user-principal: user2@KERBOS.COM
keytab-location: /tmp/user2.keytab
access-url: http://neo.example.org:8080/hello
access-url: http://cypher.localdomain:8080/hello

22
spring-security-kerberos-samples/sec-server-client-auth/sec-server-client-auth.gradle Normal file
View File

@@ -0,0 +1,22 @@
plugins {
id 'org.springframework.security.kerberos.sample'
id 'org.springframework.boot'
id 'io.spring.dependency-management'
}
description = 'Security Server Client Auth Sample'
dependencies {
management platform(project(":spring-security-kerberos-management"))
implementation project(':spring-security-kerberos-core')
implementation project(':spring-security-kerberos-web')
implementation 'org.springframework.security:spring-security-config'
implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity6'
implementation 'org.springframework.boot:spring-boot-starter'
implementation 'org.springframework.boot:spring-boot-starter-web'
implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
testImplementation 'org.springframework:spring-test'
testImplementation 'org.junit.jupiter:junit-jupiter'
testImplementation 'org.mockito:mockito-junit-jupiter'
testImplementation 'org.assertj:assertj-core'
}

19
spring-security-kerberos-samples/sec-server-client-auth/src/main/java/demo/app/Application.java
View File

@@ -1,16 +1,27 @@
/*
* Copyright 2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package demo.app;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration;
@SpringBootApplication
@EnableAutoConfiguration(exclude = SecurityAutoConfiguration.class)
public class Application {
public static void main(String[] args) throws Throwable {
SpringApplication.run(Application.class, args);
}
}

30
spring-security-kerberos-samples/sec-server-client-auth/src/main/java/demo/app/DummyUserDetailsService.java Normal file
View File

@@ -0,0 +1,30 @@
/*
* Copyright 2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package demo.app;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
public class DummyUserDetailsService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
return new User(username, "{noop}notUsed", true, true, true, true, AuthorityUtils.createAuthorityList("ROLE_USER"));
}
}

20
spring-security-kerberos-samples/sec-server-client-auth/src/main/java/demo/app/MvcConfig.java
View File

@@ -1,11 +1,26 @@
/*
* Copyright 2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package demo.app;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class MvcConfig extends WebMvcConfigurerAdapter {
public class MvcConfig implements WebMvcConfigurer {
@Override
public void addViewControllers(ViewControllerRegistry registry) {
@@ -14,5 +29,4 @@ public class MvcConfig extends WebMvcConfigurerAdapter {
registry.addViewController("/hello").setViewName("hello");
registry.addViewController("/login").setViewName("login");
}
}

45
spring-security-kerberos-samples/sec-server-client-auth/src/main/java/demo/app/WebSecurityConfig.java
View File

@@ -1,38 +1,47 @@
/*
* Copyright 2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package demo.app;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
import org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient;
import demo.DummyUserDetailsService;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@EnableWebSecurity
public class WebSecurityConfig {
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/", "/home").permitAll()
.authorizeHttpRequests((authz) -> authz
.requestMatchers("/", "/home").permitAll()
.anyRequest().authenticated()
.and()
)
.formLogin()
.loginPage("/login").permitAll()
.and()
.logout()
.permitAll();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.permitAll()
.and()
.authenticationProvider(kerberosAuthenticationProvider());
return http.build();
}
@Bean

26
spring-security-kerberos-samples/sec-server-spnego-form-auth/src/main/java/demo/app/WebSecurityConfig.java
View File

@@ -20,6 +20,7 @@ import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.FileSystemResource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider;
@@ -42,13 +43,17 @@ public class WebSecurityConfig {
private String keytabLocation;
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
AuthenticationManager authenticationManager = http.getSharedObject(AuthenticationManager.class);
http
.authorizeHttpRequests((authz) -> authz
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
KerberosAuthenticationProvider kerberosAuthenticationProvider = kerberosAuthenticationProvider();
KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider = kerberosServiceAuthenticationProvider();
ProviderManager providerManager = new ProviderManager(kerberosAuthenticationProvider,
kerberosServiceAuthenticationProvider);
http
.authorizeHttpRequests((authz) -> authz
.requestMatchers("/", "/home").permitAll()
.anyRequest().authenticated()
)
.anyRequest().authenticated()
)
.exceptionHandling()
.authenticationEntryPoint(spnegoEntryPoint())
.and()
@@ -60,11 +65,10 @@ public class WebSecurityConfig {
.and()
.authenticationProvider(kerberosAuthenticationProvider())
.authenticationProvider(kerberosServiceAuthenticationProvider())
.addFilterBefore(spnegoAuthenticationProcessingFilter(authenticationManager),
BasicAuthenticationFilter.class)
;
return http.build();
}
.addFilterBefore(spnegoAuthenticationProcessingFilter(providerManager),
BasicAuthenticationFilter.class);
return http.build();
}
@Bean
public KerberosAuthenticationProvider kerberosAuthenticationProvider() {

2
spring-security-kerberos-samples/sec-server-spnego-form-auth/src/main/resources/application.yml
View File

@@ -1,7 +1,7 @@
server:
port: 8080
app:
service-principal: HTTP/cypher.localdomain@KERBOS.ORG
service-principal: HTTP/cypher.localdomain@KERBOS.COM
keytab-location: /tmp/tomcat.keytab
logging:
level: