Remove redundant AuthTokenDTO and use WebEidAuthToken directly

Author: aarmam

README.md

@@ -239,11 +239,11 @@ Authentication consists of calling the `validate()` method of the authentication
 
 When using [Spring Security](https://spring.io/guides/topicals/spring-security-architecture) with standard cookie-based authentication,
 
-- implement a custom authentication provider that uses the authentication token validator for authentication as shown [here](example/blob/main/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java),
+- implement a custom authentication provider that uses the authentication token validator for authentication as shown [here](example/blob/main/src/main/java/eu/webeid/example/security/WebEidAuthenticationProvider.java),
 - implement an AJAX authentication processing filter that extracts the authentication token and passes it to the authentication manager as shown [here](example/blob/main/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java),
 - configure the authentication provider and authentication processing filter in the application configuration as shown [here](example/blob/main/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java).
 
-The gist of the validation is [in the `authenticate()` method](example/blob/main/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java#L74-L76) of the authentication provider:
+The gist of the validation is [in the `authenticate()` method](example/blob/main/src/main/java/eu/webeid/example/security/WebEidAuthenticationProvider.java#L74-L76) of the authentication provider:
 
 ```java
 try {

example/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java

@@ -22,8 +22,8 @@
 
 package eu.webeid.example.config;
 
-import eu.webeid.example.security.AuthTokenDTOAuthenticationProvider;
 import eu.webeid.example.security.WebEidAjaxLoginProcessingFilter;
+import eu.webeid.example.security.WebEidAuthenticationProvider;
 import eu.webeid.example.security.WebEidChallengeNonceFilter;
 import eu.webeid.example.security.WebEidMobileAuthInitFilter;
 import eu.webeid.example.security.ui.WebEidLoginPageGeneratingFilter;
@@ -47,7 +47,7 @@ public class ApplicationConfiguration {
     @Bean
     public SecurityFilterChain filterChain(
         HttpSecurity http,
-        AuthTokenDTOAuthenticationProvider authTokenDTOAuthenticationProvider,
+        WebEidAuthenticationProvider webEidAuthenticationProvider,
         AuthenticationConfiguration authConfig,
         ChallengeNonceGenerator challengeNonceGenerator
     ) throws Exception {
@@ -57,7 +57,7 @@ public SecurityFilterChain filterChain(
                 .requestMatchers("/").permitAll()
                 .anyRequest().authenticated()
             )
-            .authenticationProvider(authTokenDTOAuthenticationProvider)
+            .authenticationProvider(webEidAuthenticationProvider)
             .addFilterBefore(new WebEidMobileAuthInitFilter("/auth/mobile/init", "/auth/mobile/login", challengeNonceGenerator), UsernamePasswordAuthenticationFilter.class)
             .addFilterBefore(new WebEidChallengeNonceFilter("/auth/challenge", challengeNonceGenerator), UsernamePasswordAuthenticationFilter.class)
             .addFilterBefore(new WebEidLoginPageGeneratingFilter("/auth/mobile/login", "/auth/login"), UsernamePasswordAuthenticationFilter.class)

example/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java

@@ -26,7 +26,7 @@
 import com.fasterxml.jackson.databind.ObjectReader;
 import eu.webeid.example.security.ajax.AjaxAuthenticationFailureHandler;
 import eu.webeid.example.security.ajax.AjaxAuthenticationSuccessHandler;
-import eu.webeid.example.security.dto.AuthTokenDTO;
+import eu.webeid.security.authtoken.WebEidAuthToken;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
@@ -52,7 +52,7 @@
 
 public class WebEidAjaxLoginProcessingFilter extends AbstractAuthenticationProcessingFilter {
     private static final Logger LOG = LoggerFactory.getLogger(WebEidAjaxLoginProcessingFilter.class);
-    private final ObjectReader OBJECT_READER = new ObjectMapper().readerFor(AuthTokenDTO.class);
+    private final ObjectReader OBJECT_READER = new ObjectMapper().readerFor(WebEidAuthToken.class);
     private final SecurityContextRepository securityContextRepository;
 
     public WebEidAjaxLoginProcessingFilter(
@@ -77,9 +77,9 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
         }
 
         LOG.info("attemptAuthentication(): Reading request body");
-        final AuthTokenDTO authTokenDTO = OBJECT_READER.readValue(request.getReader());
+        final WebEidAuthToken webEidAuthToken = OBJECT_READER.readValue(request.getReader());
         LOG.info("attemptAuthentication(): Creating token");
-        final PreAuthenticatedAuthenticationToken token = new PreAuthenticatedAuthenticationToken(null, authTokenDTO);
+        final PreAuthenticatedAuthenticationToken token = new PreAuthenticatedAuthenticationToken(null, webEidAuthToken);
         LOG.info("attemptAuthentication(): Calling authentication manager");
         return getAuthenticationManager().authenticate(token);
     }

…/AuthTokenDTOAuthenticationProvider.java …curity/WebEidAuthenticationProvider.javaexample/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java renamed to example/src/main/java/eu/webeid/example/security/WebEidAuthenticationProvider.java example/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java renamed to example/src/main/java/eu/webeid/example/security/WebEidAuthenticationProvider.java

@@ -22,7 +22,6 @@
 
 package eu.webeid.example.security;
 
-import eu.webeid.example.security.dto.AuthTokenDTO;
 import eu.webeid.security.authtoken.WebEidAuthToken;
 import eu.webeid.security.challenge.ChallengeNonceStore;
 import eu.webeid.security.exceptions.AuthTokenException;
@@ -47,16 +46,16 @@
  * Parses JWT from token string inside AuthTokenDTO and attempts authentication.
  */
 @Component
-public class AuthTokenDTOAuthenticationProvider implements AuthenticationProvider {
+public class WebEidAuthenticationProvider implements AuthenticationProvider {
     public static final String ROLE_USER = "ROLE_USER";
     private static final GrantedAuthority USER_ROLE = new SimpleGrantedAuthority(ROLE_USER);
 
-    private static final Logger LOG = LoggerFactory.getLogger(AuthTokenDTOAuthenticationProvider.class);
+    private static final Logger LOG = LoggerFactory.getLogger(WebEidAuthenticationProvider.class);
 
     private final AuthTokenValidator tokenValidator;
     private final ChallengeNonceStore challengeNonceStore;
 
-    public AuthTokenDTOAuthenticationProvider(AuthTokenValidator tokenValidator, ChallengeNonceStore challengeNonceStore) {
+    public WebEidAuthenticationProvider(AuthTokenValidator tokenValidator, ChallengeNonceStore challengeNonceStore) {
         this.tokenValidator = tokenValidator;
         this.challengeNonceStore = challengeNonceStore;
     }
@@ -66,7 +65,7 @@ public Authentication authenticate(Authentication auth) throws AuthenticationExc
         LOG.info("authenticate(): {}", auth);
 
         final PreAuthenticatedAuthenticationToken authentication = (PreAuthenticatedAuthenticationToken) auth;
-        final WebEidAuthToken authToken = ((AuthTokenDTO) authentication.getCredentials()).getToken();
+        final WebEidAuthToken authToken = (WebEidAuthToken) authentication.getCredentials();
 
         final List<GrantedAuthority> authorities = Collections.singletonList(USER_ROLE);
 

example/src/main/java/eu/webeid/example/security/dto/AuthTokenDTO.java

@@ -79,7 +79,7 @@ public final class WebEidLoginPageGeneratingFilter extends OncePerRequestFilter
               "Content-Type": "application/json",
               "%s": "%s"
             },
-            body: JSON.stringify({ "auth-token": authToken }),
+            body: JSON.stringify(authToken),
             credentials: "include"
           })
           .then(r => {

example/src/main/java/eu/webeid/example/security/ui/WebEidLoginPageGeneratingFilter.java

@@ -56,7 +56,7 @@
 import java.security.cert.X509Certificate;
 import java.util.Objects;
 
-import static eu.webeid.example.security.AuthTokenDTOAuthenticationProvider.ROLE_USER;
+import static eu.webeid.example.security.WebEidAuthenticationProvider.ROLE_USER;
 
 @Service
 @Secured(ROLE_USER)

example/src/main/java/eu/webeid/example/service/SigningService.java

@@ -32,7 +32,7 @@
 import java.security.Principal;
 import java.util.Objects;
 
-import static eu.webeid.example.security.AuthTokenDTOAuthenticationProvider.ROLE_USER;
+import static eu.webeid.example.security.WebEidAuthenticationProvider.ROLE_USER;
 
 @Controller
 @Secured(ROLE_USER)

example/src/main/java/eu/webeid/example/web/WelcomeController.java

@@ -43,7 +43,7 @@
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.CertificateException;
 
-import static eu.webeid.example.security.AuthTokenDTOAuthenticationProvider.ROLE_USER;
+import static eu.webeid.example.security.WebEidAuthenticationProvider.ROLE_USER;
 
 @RestController
 @RequestMapping("sign")

example/src/main/java/eu/webeid/example/web/rest/SigningController.java

@@ -450,7 +450,7 @@ <h4 class="accordion-header" id="headingDocumentationMobile">
                     "Content-Type": "application/json",
                     [csrfHeaderName]: csrfToken
                 },
-                body: `{"auth-token": ${JSON.stringify(authToken)}}`
+                body: JSON.stringify(authToken)
             });
             await checkHttpError(authTokenResponse);
             const authTokenResult = await authTokenResponse.json();