Disable client editing through MitreID API endpoint (#703)

GET endpoint still enabled because it's used by whitelist page
indigo-iam · Jan 29, 2024 · e1cbdb4 · e1cbdb4
1 parent a97a1a0
commit e1cbdb4
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/MitreSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/MitreSecurityConfig.java
@@ -22,6 +22,7 @@
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@@ -56,7 +57,11 @@ public static class MitreApisEndpointAuthorizationConfig extends WebSecurityConf
     public void configure(final HttpSecurity http) throws Exception {
 
       // @formatter:off
-      http.antMatcher("/api/**")
+     http.authorizeRequests()
+       .antMatchers(HttpMethod.POST, "/api/clients").denyAll()
+       .antMatchers(HttpMethod.PUT, "/api/clients/**").denyAll()
+       .antMatchers(HttpMethod.DELETE, "/api/clients/**").denyAll();
+     http.antMatcher("/api/**")
           .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
           .exceptionHandling()
             .authenticationEntryPoint(authenticationEntryPoint)