From ef77b0c4113e1b2eb37958a3200471dcd13b120a Mon Sep 17 00:00:00 2001
From: Adrian Gonzalez <adr_gonzalez@yahoo.fr>
Date: Tue, 13 Sep 2016 16:34:42 +0200
Subject: [PATCH] [FEDIZ-173] Cors support for js OIDC Implicit Flow

Provide OOB support for Cors request on all
endpoints used by javascript clients.
---
 services/oidc/pom.xml                                 |  5 +++++
 .../src/main/webapp/WEB-INF/applicationContext.xml    | 11 +++++++++++
 2 files changed, 16 insertions(+)

diff --git a/services/oidc/pom.xml b/services/oidc/pom.xml
index ad3b5153a..aede1ddd0 100644
--- a/services/oidc/pom.xml
+++ b/services/oidc/pom.xml
@@ -57,6 +57,11 @@
             <artifactId>cxf-rt-rs-extension-providers</artifactId>
             <version>${cxf.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-rs-security-cors</artifactId>
+            <version>${cxf.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-web</artifactId>
diff --git a/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml b/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml
index c893dd48c..fad2fb134 100644
--- a/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml
+++ b/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml
@@ -95,6 +95,7 @@
            <ref bean="oidcKeysService"/>
         </jaxrs:serviceBeans>
         <jaxrs:providers>
+            <ref bean="corsFilter"/>
             <bean class="org.apache.cxf.rs.security.jose.jaxrs.JsonWebKeysProvider"/>
         </jaxrs:providers>
         <jaxrs:properties>
@@ -119,6 +120,7 @@
            <ref bean="userInfoService"/>
         </jaxrs:serviceBeans>
         <jaxrs:providers>
+            <ref bean="corsFilter"/>
             <bean class="org.apache.cxf.jaxrs.provider.json.JsonMapObjectProvider"/>
             <ref bean="oauth2TokenValidationFilter"/>
         </jaxrs:providers>
@@ -178,6 +180,15 @@
         <property name="signWithClientSecret" value="true"/>
       -->
     </bean>
+
+    <!-- Cors filter for endpoints used by implicit flow (by js clients) -->
+    <bean id="corsFilter" class="org.apache.cxf.rs.security.cors.CrossOriginResourceSharingFilter">
+        <property name="allowHeaders">
+            <list>
+                <value>Authorization</value>
+            </list>
+        </property>
+    </bean>
     <bean id="refreshTokenHandler" class="org.apache.cxf.rs.security.oauth2.grants.refresh.RefreshTokenGrantHandler">
         <property name="dataProvider" ref="oauthProvider"/>
     </bean>