Skip to content

Fixing Spring Security 7 deprecations #445

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilgrosso merged 1 commit into from
Apr 24, 2023
Merged

Fixing Spring Security 7 deprecations #445

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,10 @@
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
Expand All @@ -38,13 +40,13 @@ public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
EndpointRequest.EndpointRequestMatcher actuatorEndpoints = EndpointRequest.toAnyEndpoint();

http.csrf().disable().
authorizeHttpRequests().
http.authorizeHttpRequests(customizer -> customizer.
requestMatchers(new NegatedRequestMatcher(actuatorEndpoints)).permitAll().
requestMatchers(actuatorEndpoints).authenticated().
and().
httpBasic();
requestMatchers(actuatorEndpoints).authenticated());

http.httpBasic(Customizer.withDefaults());
http.csrf(AbstractHttpConfigurer::disable);

return http.build();
}

Expand Down
14 changes: 8 additions & 6 deletions client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,10 @@
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
Expand All @@ -38,13 +40,13 @@ public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
EndpointRequest.EndpointRequestMatcher actuatorEndpoints = EndpointRequest.toAnyEndpoint();

http.csrf().disable().
authorizeHttpRequests().
http.authorizeHttpRequests(customizer -> customizer.
requestMatchers(new NegatedRequestMatcher(actuatorEndpoints)).permitAll().
requestMatchers(actuatorEndpoints).authenticated().
and().
httpBasic();
requestMatchers(actuatorEndpoints).authenticated());

http.httpBasic(Customizer.withDefaults());
http.csrf(AbstractHttpConfigurer::disable);

return http.build();
}

Expand Down
36 changes: 18 additions & 18 deletions core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,13 @@
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.security.web.access.intercept.AuthorizationFilter;
import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.security.web.context.NullSecurityContextRepository;
import org.springframework.security.web.firewall.DefaultHttpFirewall;
import org.springframework.security.web.firewall.HttpFirewall;

Expand All @@ -76,6 +75,7 @@ public WebSecurityCustomizer webSecurityCustomizer(final HttpFirewall allowUrlEn
public SecurityFilterChain filterChain(
final HttpSecurity http,
final UsernamePasswordAuthenticationProvider usernamePasswordAuthenticationProvider,
final AccessDeniedHandler accessDeniedHandler,
final AuthDataAccessor authDataAccessor,
final DefaultCredentialChecker defaultCredentialChecker,
final SecurityProperties securityProperties) throws Exception {
Expand All @@ -84,6 +84,7 @@ public SecurityFilterChain filterChain(
parentAuthenticationManager(null).
authenticationProvider(usernamePasswordAuthenticationProvider).
build();
http.authenticationManager(authenticationManager);

SyncopeAuthenticationDetailsSource authenticationDetailsSource =
new SyncopeAuthenticationDetailsSource();
Expand All @@ -96,35 +97,34 @@ public SecurityFilterChain filterChain(
securityProperties.getAnonymousUser(),
AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS"));
anonymousAuthenticationFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
http.anonymous(customizer -> customizer.
authenticationProvider(anonymousAuthenticationProvider).
authenticationFilter(anonymousAuthenticationFilter));

SyncopeBasicAuthenticationEntryPoint basicAuthenticationEntryPoint =
new SyncopeBasicAuthenticationEntryPoint();
basicAuthenticationEntryPoint.setRealmName("Apache Syncope authentication");
http.httpBasic(customizer -> customizer.
authenticationEntryPoint(basicAuthenticationEntryPoint).
authenticationDetailsSource(authenticationDetailsSource));

JWTAuthenticationFilter jwtAuthenticationFilter = new JWTAuthenticationFilter(
authenticationManager,
basicAuthenticationEntryPoint,
authenticationDetailsSource,
authDataAccessor,
defaultCredentialChecker);
http.addFilterBefore(jwtAuthenticationFilter, BasicAuthenticationFilter.class);

MustChangePasswordFilter mustChangePasswordFilter = new MustChangePasswordFilter();

http.authenticationManager(authenticationManager).
authorizeHttpRequests().
requestMatchers("/**").permitAll().and().
sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().
securityContext().securityContextRepository(new NullSecurityContextRepository()).and().
anonymous().
authenticationProvider(anonymousAuthenticationProvider).
authenticationFilter(anonymousAuthenticationFilter).and().
httpBasic().authenticationEntryPoint(basicAuthenticationEntryPoint).
authenticationDetailsSource(authenticationDetailsSource).and().
exceptionHandling().accessDeniedHandler(accessDeniedHandler()).and().
addFilterBefore(jwtAuthenticationFilter, BasicAuthenticationFilter.class).
addFilterBefore(mustChangePasswordFilter, AuthorizationFilter.class).
headers().disable().
csrf().disable();
http.addFilterBefore(mustChangePasswordFilter, AuthorizationFilter.class);

http.authorizeHttpRequests(customizer -> customizer.requestMatchers("/**").permitAll());
http.securityContext(AbstractHttpConfigurer::disable);
http.sessionManagement(AbstractHttpConfigurer::disable);
http.headers(AbstractHttpConfigurer::disable);
http.csrf(AbstractHttpConfigurer::disable);
http.exceptionHandling(customizer -> customizer.accessDeniedHandler(accessDeniedHandler));

return http.build();
}
Expand Down
44 changes: 28 additions & 16 deletions sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@
import org.springframework.core.io.FileUrlResource;
import org.springframework.core.io.support.ResourcePatternResolver;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
Expand Down Expand Up @@ -88,21 +89,30 @@ public class SecurityConfig {
public SecurityWebFilterChain saml2SecurityFilterChain(final ServerHttpSecurity http) {
ServerWebExchangeMatcher metadataMatcher =
ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, SAML2MetadataEndpoint.METADATA_URL);
return http.securityMatcher(metadataMatcher).
authorizeExchange().anyExchange().permitAll().
and().csrf().requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(metadataMatcher)).
and().build();
http.securityMatcher(metadataMatcher);

http.authorizeExchange(customizer -> customizer.anyExchange().permitAll());

http.csrf(customizer -> customizer.
requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(metadataMatcher)));

return http.build();
}

@Bean
@Order(1)
public SecurityWebFilterChain actuatorSecurityFilterChain(final ServerHttpSecurity http) {
ServerWebExchangeMatcher actuatorMatcher = EndpointRequest.toAnyEndpoint();
return http.securityMatcher(actuatorMatcher).
authorizeExchange().anyExchange().authenticated().
and().httpBasic().
and().csrf().requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(actuatorMatcher)).
and().build();
http.securityMatcher(actuatorMatcher);

http.authorizeExchange(customizer -> customizer.anyExchange().authenticated());

http.httpBasic(Customizer.withDefaults());

http.csrf(customizer -> customizer.
requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(actuatorMatcher)));

return http.build();
}

@Bean
Expand Down Expand Up @@ -298,21 +308,22 @@ public SecurityWebFilterChain routesSecurityFilterChain(
final CsrfRouteMatcher csrfRouteMatcher,
final ConfigurableApplicationContext ctx) {

ServerHttpSecurity.AuthorizeExchangeSpec builder = http.authorizeExchange().
http.authorizeExchange(customizer -> customizer.
matchers(publicRouteMatcher).permitAll().
anyExchange().authenticated();
anyExchange().authenticated());

switch (props.getAmType()) {
case OIDC, OAUTH2 -> {
OAuth2SecurityConfigUtils.forLogin(http, props.getAmType(), ctx);
OAuth2SecurityConfigUtils.forLogout(builder, props.getAmType(), cacheManager, logoutRouteMatcher, ctx);
http.oauth2ResourceServer().jwt().jwtDecoder(ctx.getBean(ReactiveJwtDecoder.class));
OAuth2SecurityConfigUtils.forLogout(http, props.getAmType(), cacheManager, logoutRouteMatcher, ctx);
http.oauth2ResourceServer(customizer -> customizer.jwt(
c -> c.jwtDecoder(ctx.getBean(ReactiveJwtDecoder.class))));
}

case SAML2 ->
saml2Client.ifAvailable(client -> {
SAML2SecurityConfigUtils.forLogin(http, client, publicRouteMatcher);
SAML2SecurityConfigUtils.forLogout(builder, client, cacheManager, logoutRouteMatcher, ctx);
SAML2SecurityConfigUtils.forLogout(http, client, cacheManager, logoutRouteMatcher, ctx);
});

case CAS -> {
Expand All @@ -322,7 +333,7 @@ public SecurityWebFilterChain routesSecurityFilterChain(
props.getCas().getServerPrefix(),
publicRouteMatcher);
CASSecurityConfigUtils.forLogout(
builder,
http,
cacheManager,
props.getCas().getServerPrefix(),
logoutRouteMatcher,
Expand All @@ -333,6 +344,7 @@ public SecurityWebFilterChain routesSecurityFilterChain(
}
}

return builder.and().csrf().requireCsrfProtectionMatcher(csrfRouteMatcher).and().build();
http.csrf(customizer -> customizer.requireCsrfProtectionMatcher(csrfRouteMatcher));
return http.build();
}
}
4 changes: 2 additions & 2 deletions sra/src/main/java/org/apache/syncope/sra/security/cas/CASSecurityConfigUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ public static void forLogin(
}

public static void forLogout(
final ServerHttpSecurity.AuthorizeExchangeSpec builder,
final ServerHttpSecurity http,
final CacheManager cacheManager,
final String casServerUrlPrefix,
final LogoutRouteMatcher logoutRouteMatcher,
Expand All @@ -87,7 +87,7 @@ public static void forLogout(
LOG.error("While creating instance of {}", CASServerLogoutSuccessHandler.class.getName(), e);
}

builder.and().addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
http.addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
}

private CASSecurityConfigUtils() {
Expand Down
8 changes: 5 additions & 3 deletions sra/src/main/java/org/apache/syncope/sra/security/oauth2/OAuth2SecurityConfigUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,11 +107,12 @@ public static void forLogin(
htmlMatcher.setIgnoredMediaTypes(Set.of(MediaType.ALL));
ServerAuthenticationEntryPoint entrypoint =
new RedirectServerAuthenticationEntryPoint("/oauth2/authorization/" + amType.name());
http.exceptionHandling().authenticationEntryPoint(new DelegateEntry(htmlMatcher, entrypoint).getEntryPoint());
http.exceptionHandling(customizer -> customizer.authenticationEntryPoint(
new DelegateEntry(htmlMatcher, entrypoint).getEntryPoint()));
}

public static void forLogout(
final ServerHttpSecurity.AuthorizeExchangeSpec builder,
final ServerHttpSecurity http,
final SRAProperties.AMType amType,
final CacheManager cacheManager,
final LogoutRouteMatcher logoutRouteMatcher,
Expand All @@ -134,7 +135,8 @@ public static void forLogout(
}
}

builder.and().logout().disable().addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
http.logout(customizer -> customizer.disable());
http.addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
}

private OAuth2SecurityConfigUtils() {
Expand Down
6 changes: 3 additions & 3 deletions sra/src/main/java/org/apache/syncope/sra/security/saml2/SAML2SecurityConfigUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ public static void forLogin(
}

public static void forLogout(
final ServerHttpSecurity.AuthorizeExchangeSpec builder,
final ServerHttpSecurity http,
final SAML2Client saml2Client,
final CacheManager cacheManager,
final LogoutRouteMatcher logoutRouteMatcher,
Expand All @@ -85,12 +85,12 @@ public static void forLogout(

SAML2LogoutResponseWebFilter logoutResponseWebFilter =
new SAML2LogoutResponseWebFilter(saml2Client, logoutSuccessHandler);
builder.and().addFilterAt(logoutResponseWebFilter, SecurityWebFiltersOrder.LOGOUT);
http.addFilterAt(logoutResponseWebFilter, SecurityWebFiltersOrder.LOGOUT);
} catch (ClassNotFoundException e) {
LOG.error("While creating instance of {}", SAML2ServerLogoutSuccessHandler.class.getName(), e);
}

builder.and().addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
http.addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
}

private SAML2SecurityConfigUtils() {
Expand Down