diff --git a/pom.xml b/pom.xml index 2cc886a..0baf8ea 100644 --- a/pom.xml +++ b/pom.xml @@ -7,12 +7,11 @@ war - - 3.0.7.RELEASE - 3.1.4.RELEASE + 4.0.0.RELEASE + 3.2.0.RELEASE 1.17.1 1.7.5 - 2.5 + 3.1.0 4.2.2.Final 3.1 2.2.9 @@ -50,6 +49,11 @@ 1.6 + + org.apache.tomcat.maven + tomcat7-maven-plugin + 2.2 + @@ -57,6 +61,19 @@ scm:git:https://github.com/philipsorst/angular-rest-springsecurity.git + + + + + org.springframework + spring-framework-bom + ${spring.version} + pom + import + + + + @@ -158,13 +175,13 @@ spring-security-config ${spring.security.version} - - - javax.servlet - servlet-api - ${javax.servlet-api.version} - provided - + + + javax.servlet + javax.servlet-api + ${javax.servlet-api.version} + provided + org.springframework diff --git a/src/main/java/net/dontdrinkandroot/example/angularrestspringsecurity/rest/resources/UserResource.java b/src/main/java/net/dontdrinkandroot/example/angularrestspringsecurity/rest/resources/UserResource.java index 872a985..f0a829d 100644 --- a/src/main/java/net/dontdrinkandroot/example/angularrestspringsecurity/rest/resources/UserResource.java +++ b/src/main/java/net/dontdrinkandroot/example/angularrestspringsecurity/rest/resources/UserResource.java @@ -1,19 +1,8 @@ package net.dontdrinkandroot.example.angularrestspringsecurity.rest.resources; -import java.util.HashMap; -import java.util.Map; - -import javax.ws.rs.FormParam; -import javax.ws.rs.POST; -import javax.ws.rs.Path; -import javax.ws.rs.Produces; -import javax.ws.rs.core.MediaType; - import net.dontdrinkandroot.example.angularrestspringsecurity.rest.TokenUtils; import net.dontdrinkandroot.example.angularrestspringsecurity.transfer.UserTransfer; - import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; @@ -23,6 +12,14 @@ import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.stereotype.Component; +import javax.ws.rs.FormParam; +import javax.ws.rs.POST; +import javax.ws.rs.Path; +import javax.ws.rs.Produces; +import javax.ws.rs.core.MediaType; +import java.util.HashMap; +import java.util.Map; + @Component @Path("/user") @@ -32,7 +29,6 @@ public class UserResource { private UserDetailsService userService; @Autowired - @Qualifier("authenticationManager") private AuthenticationManager authManager; diff --git a/src/main/java/net/dontdrinkandroot/example/angularrestspringsecurity/security/WebSecurityConfig.java b/src/main/java/net/dontdrinkandroot/example/angularrestspringsecurity/security/WebSecurityConfig.java new file mode 100644 index 0000000..de063ad --- /dev/null +++ b/src/main/java/net/dontdrinkandroot/example/angularrestspringsecurity/security/WebSecurityConfig.java @@ -0,0 +1,52 @@ +package net.dontdrinkandroot.example.angularrestspringsecurity.security; + +import net.dontdrinkandroot.example.angularrestspringsecurity.dao.user.UserDao; +import net.dontdrinkandroot.example.angularrestspringsecurity.rest.AuthenticationTokenProcessingFilter; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.ImportResource; +import org.springframework.http.HttpMethod; +import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.config.http.SessionCreationPolicy; +import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; + +@Configuration +@EnableWebSecurity +@ImportResource("classpath:/context.xml") +public class WebSecurityConfig extends WebSecurityConfigurerAdapter { + @Override + protected void configure(HttpSecurity http) throws Exception { + // disable CSRF and Basic Authentication + http.csrf().disable().httpBasic().disable(); + + http.authorizeRequests() + .antMatchers("/rest/user/authenticate").permitAll() + .antMatchers(HttpMethod.GET, "/rest/news/**").hasRole("user") + .antMatchers(HttpMethod.PUT, "/rest/news/**").hasRole("admin") + .antMatchers(HttpMethod.POST, "/rest/news/**").hasRole("admin") + .antMatchers(HttpMethod.DELETE, "/rest/news/**").hasRole("admin"); + + // customization for REST Token AUTH + http.addFilterBefore(new AuthenticationTokenProcessingFilter(userDao), UsernamePasswordAuthenticationFilter.class) + .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); + } + + @Autowired + private UserDao userDao; + + @Override + protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception { + authManagerBuilder.userDetailsService(userDao).passwordEncoder(new SaltedSHA256PasswordEncoder("secret")); + } + + @Bean + @Override + public AuthenticationManager authenticationManagerBean() throws Exception { + return super.authenticationManagerBean(); + } +} \ No newline at end of file diff --git a/src/main/resources/context.xml b/src/main/resources/context.xml index c0fca8c..730651c 100644 --- a/src/main/resources/context.xml +++ b/src/main/resources/context.xml @@ -8,16 +8,16 @@ xmlns:security="http://www.springframework.org/schema/security" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd - http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd - http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd - http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd - http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd - http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> + http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd + http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee.xsd + http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd + http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd + http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> @@ -42,13 +42,13 @@ - + - + - + @@ -58,46 +58,21 @@ - + - + - - - + - - - - - - - - - - - - - - - - - - - - - + + \ No newline at end of file diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml index eeb6cc6..0221135 100644 --- a/src/main/webapp/WEB-INF/web.xml +++ b/src/main/webapp/WEB-INF/web.xml @@ -1,24 +1,31 @@ - + angular-rest-springsecurity - - - - contextConfigLocation - - classpath:/context.xml - - + + + + + contextClass + + org.springframework.web.context.support.AnnotationConfigWebApplicationContext + + + + + contextConfigLocation + net.dontdrinkandroot.example.angularrestspringsecurity.security.WebSecurityConfig + + org.springframework.web.context.ContextLoaderListener - + @@ -39,9 +46,9 @@ RestService /rest/* - + springSecurityFilterChain @@ -51,5 +58,5 @@ springSecurityFilterChain /* - + \ No newline at end of file