|
1 | 1 | package com.provectus.kafka.ui.config.auth; |
2 | 2 |
|
3 | | -import lombok.AllArgsConstructor; |
| 3 | +import com.provectus.kafka.ui.config.auth.logout.OAuthLogoutSuccessHandler; |
| 4 | +import com.provectus.kafka.ui.service.rbac.AccessControlService; |
| 5 | +import com.provectus.kafka.ui.service.rbac.extractor.ProviderAuthorityExtractor; |
| 6 | +import java.util.ArrayList; |
| 7 | +import java.util.List; |
| 8 | +import java.util.Map; |
| 9 | +import java.util.Optional; |
| 10 | +import lombok.RequiredArgsConstructor; |
4 | 11 | import lombok.extern.log4j.Log4j2; |
| 12 | +import org.jetbrains.annotations.Nullable; |
5 | 13 | import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; |
6 | | -import org.springframework.context.ApplicationContext; |
| 14 | +import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties; |
| 15 | +import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesRegistrationAdapter; |
| 16 | +import org.springframework.boot.context.properties.EnableConfigurationProperties; |
7 | 17 | import org.springframework.context.annotation.Bean; |
8 | 18 | import org.springframework.context.annotation.Configuration; |
| 19 | +import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity; |
9 | 20 | import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; |
10 | 21 | import org.springframework.security.config.web.server.ServerHttpSecurity; |
| 22 | +import org.springframework.security.oauth2.client.oidc.userinfo.OidcReactiveOAuth2UserService; |
| 23 | +import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest; |
| 24 | +import org.springframework.security.oauth2.client.oidc.web.server.logout.OidcClientInitiatedServerLogoutSuccessHandler; |
| 25 | +import org.springframework.security.oauth2.client.registration.ClientRegistration; |
| 26 | +import org.springframework.security.oauth2.client.registration.InMemoryReactiveClientRegistrationRepository; |
| 27 | +import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository; |
| 28 | +import org.springframework.security.oauth2.client.userinfo.DefaultReactiveOAuth2UserService; |
| 29 | +import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest; |
| 30 | +import org.springframework.security.oauth2.client.userinfo.ReactiveOAuth2UserService; |
| 31 | +import org.springframework.security.oauth2.core.oidc.user.OidcUser; |
| 32 | +import org.springframework.security.oauth2.core.user.OAuth2User; |
11 | 33 | import org.springframework.security.web.server.SecurityWebFilterChain; |
12 | | -import org.springframework.util.ClassUtils; |
| 34 | +import org.springframework.security.web.server.authentication.logout.ServerLogoutSuccessHandler; |
| 35 | +import reactor.core.publisher.Mono; |
13 | 36 |
|
14 | 37 | @Configuration |
15 | | -@EnableWebFluxSecurity |
16 | 38 | @ConditionalOnProperty(value = "auth.type", havingValue = "OAUTH2") |
17 | | -@AllArgsConstructor |
| 39 | +@EnableConfigurationProperties(OAuthProperties.class) |
| 40 | +@EnableWebFluxSecurity |
| 41 | +@EnableReactiveMethodSecurity |
| 42 | +@RequiredArgsConstructor |
18 | 43 | @Log4j2 |
19 | 44 | public class OAuthSecurityConfig extends AbstractAuthSecurityConfig { |
20 | 45 |
|
21 | | - public static final String REACTIVE_CLIENT_REGISTRATION_REPOSITORY_CLASSNAME = |
22 | | - "org.springframework.security.oauth2.client.registration." |
23 | | - + "ReactiveClientRegistrationRepository"; |
24 | | - |
25 | | - private static final boolean IS_OAUTH2_PRESENT = ClassUtils.isPresent( |
26 | | - REACTIVE_CLIENT_REGISTRATION_REPOSITORY_CLASSNAME, |
27 | | - OAuthSecurityConfig.class.getClassLoader() |
28 | | - ); |
29 | | - |
30 | | - private final ApplicationContext context; |
| 46 | + private final OAuthProperties properties; |
31 | 47 |
|
32 | 48 | @Bean |
33 | | - public SecurityWebFilterChain configure(ServerHttpSecurity http) { |
| 49 | + public SecurityWebFilterChain configure(ServerHttpSecurity http, OAuthLogoutSuccessHandler logoutHandler) { |
34 | 50 | log.info("Configuring OAUTH2 authentication."); |
35 | | - http.authorizeExchange() |
| 51 | + |
| 52 | + return http.authorizeExchange() |
36 | 53 | .pathMatchers(AUTH_WHITELIST) |
37 | 54 | .permitAll() |
38 | 55 | .anyExchange() |
39 | | - .authenticated(); |
| 56 | + .authenticated() |
| 57 | + |
| 58 | + .and() |
| 59 | + .oauth2Login() |
| 60 | + |
| 61 | + .and() |
| 62 | + .logout() |
| 63 | + .logoutSuccessHandler(logoutHandler) |
| 64 | + |
| 65 | + .and() |
| 66 | + .csrf().disable() |
| 67 | + .build(); |
| 68 | + } |
| 69 | + |
| 70 | + @Bean |
| 71 | + public ReactiveOAuth2UserService<OidcUserRequest, OidcUser> customOidcUserService(AccessControlService acs) { |
| 72 | + final OidcReactiveOAuth2UserService delegate = new OidcReactiveOAuth2UserService(); |
| 73 | + return request -> delegate.loadUser(request) |
| 74 | + .flatMap(user -> { |
| 75 | + String providerId = request.getClientRegistration().getRegistrationId(); |
| 76 | + final var extractor = getExtractor(providerId, acs); |
| 77 | + if (extractor == null) { |
| 78 | + return Mono.just(user); |
| 79 | + } |
40 | 80 |
|
41 | | - if (IS_OAUTH2_PRESENT && OAuth2ClasspathGuard.shouldConfigure(this.context)) { |
42 | | - OAuth2ClasspathGuard.configure(http); |
43 | | - } |
| 81 | + return extractor.extract(acs, user, Map.of("request", request)) |
| 82 | + .map(groups -> new RbacOidcUser(user, groups)); |
| 83 | + }); |
| 84 | + } |
| 85 | + |
| 86 | + @Bean |
| 87 | + public ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> customOauth2UserService(AccessControlService acs) { |
| 88 | + final DefaultReactiveOAuth2UserService delegate = new DefaultReactiveOAuth2UserService(); |
| 89 | + return request -> delegate.loadUser(request) |
| 90 | + .flatMap(user -> { |
| 91 | + String providerId = request.getClientRegistration().getRegistrationId(); |
| 92 | + final var extractor = getExtractor(providerId, acs); |
| 93 | + if (extractor == null) { |
| 94 | + return Mono.just(user); |
| 95 | + } |
44 | 96 |
|
45 | | - return http.csrf().disable().build(); |
| 97 | + return extractor.extract(acs, user, Map.of("request", request)) |
| 98 | + .map(groups -> new RbacOAuth2User(user, groups)); |
| 99 | + }); |
46 | 100 | } |
47 | 101 |
|
48 | | - private static class OAuth2ClasspathGuard { |
49 | | - static void configure(ServerHttpSecurity http) { |
50 | | - http |
51 | | - .oauth2Login() |
52 | | - .and() |
53 | | - .oauth2Client(); |
54 | | - } |
55 | | - |
56 | | - static boolean shouldConfigure(ApplicationContext context) { |
57 | | - ClassLoader loader = context.getClassLoader(); |
58 | | - Class<?> reactiveClientRegistrationRepositoryClass = |
59 | | - ClassUtils.resolveClassName(REACTIVE_CLIENT_REGISTRATION_REPOSITORY_CLASSNAME, loader); |
60 | | - return context.getBeanNamesForType(reactiveClientRegistrationRepositoryClass).length == 1; |
61 | | - } |
| 102 | + @Bean |
| 103 | + public InMemoryReactiveClientRegistrationRepository clientRegistrationRepository() { |
| 104 | + final OAuth2ClientProperties props = OAuthPropertiesConverter.convertProperties(properties); |
| 105 | + final List<ClientRegistration> registrations = |
| 106 | + new ArrayList<>(OAuth2ClientPropertiesRegistrationAdapter.getClientRegistrations(props).values()); |
| 107 | + return new InMemoryReactiveClientRegistrationRepository(registrations); |
62 | 108 | } |
63 | 109 |
|
| 110 | + @Bean |
| 111 | + public ServerLogoutSuccessHandler defaultOidcLogoutHandler(final ReactiveClientRegistrationRepository repository) { |
| 112 | + return new OidcClientInitiatedServerLogoutSuccessHandler(repository); |
| 113 | + } |
| 114 | + |
| 115 | + @Nullable |
| 116 | + private ProviderAuthorityExtractor getExtractor(final String providerId, AccessControlService acs) { |
| 117 | + final String provider = getProviderByProviderId(providerId); |
| 118 | + Optional<ProviderAuthorityExtractor> extractor = acs.getExtractors() |
| 119 | + .stream() |
| 120 | + .filter(e -> e.isApplicable(provider)) |
| 121 | + .findFirst(); |
| 122 | + |
| 123 | + return extractor.orElse(null); |
| 124 | + } |
| 125 | + |
| 126 | + private String getProviderByProviderId(final String providerId) { |
| 127 | + return properties.getClient().get(providerId).getProvider(); |
| 128 | + } |
64 | 129 |
|
65 | 130 | } |
66 | 131 |
|
0 commit comments