|
| 1 | +package org.example.magiclink; |
| 2 | + |
| 3 | +import java.time.Duration; |
| 4 | + |
| 5 | +import org.springframework.context.annotation.Bean; |
| 6 | +import org.springframework.context.annotation.Configuration; |
| 7 | +import org.springframework.context.annotation.Profile; |
| 8 | +import org.springframework.http.HttpMethod; |
| 9 | +import org.springframework.security.config.Customizer; |
| 10 | +import org.springframework.security.config.annotation.SecurityConfigurerAdapter; |
| 11 | +import org.springframework.security.config.annotation.web.HttpSecurityBuilder; |
| 12 | +import org.springframework.security.config.annotation.web.builders.HttpSecurity; |
| 13 | +import org.springframework.security.config.annotation.web.configurers.MfaConfigurer; |
| 14 | +import org.springframework.security.web.DefaultSecurityFilterChain; |
| 15 | +import org.springframework.security.web.SecurityFilterChain; |
| 16 | +import org.springframework.security.web.authentication.AuthenticationFilter; |
| 17 | +import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; |
| 18 | +import org.springframework.security.web.context.HttpSessionSecurityContextRepository; |
| 19 | +import org.springframework.stereotype.Controller; |
| 20 | +import org.springframework.web.bind.annotation.GetMapping; |
| 21 | + |
| 22 | +import static org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher.pathPattern; |
| 23 | + |
| 24 | +@Profile("elevated-security") |
| 25 | +@Configuration(proxyBeanMethods = false) |
| 26 | +public class ElevatedSecurityPageSecurityConfig { |
| 27 | + |
| 28 | + @Controller |
| 29 | + @Profile("elevated-security") |
| 30 | + static class LoginController { |
| 31 | + @GetMapping("/login/form") |
| 32 | + public String login() { |
| 33 | + return "login"; |
| 34 | + } |
| 35 | + |
| 36 | + @GetMapping("/login/ott") |
| 37 | + public String ott() { |
| 38 | + return "ott"; |
| 39 | + } |
| 40 | + } |
| 41 | + |
| 42 | + @Bean |
| 43 | + public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { |
| 44 | + // @formatter:off |
| 45 | + http |
| 46 | + .authorizeHttpRequests((authz) -> authz |
| 47 | + .requestMatchers("/profile").hasAuthority("profile:read") |
| 48 | + .anyRequest().authenticated() |
| 49 | + ) |
| 50 | + .formLogin((form) -> form |
| 51 | + .loginPage("/login/form").permitAll() |
| 52 | + .factor((f) -> f.grants(Duration.ofMinutes(1), "profile:read")) |
| 53 | + ) |
| 54 | + .oneTimeTokenLogin((ott) -> ott |
| 55 | + .loginPage("/login/ott").permitAll() |
| 56 | + .factor(Customizer.withDefaults()) |
| 57 | + ); |
| 58 | + |
| 59 | + // @formatter:on |
| 60 | + return http.build(); |
| 61 | + } |
| 62 | + |
| 63 | +} |
0 commit comments