Skip to content

Commit b4987f1

Browse files
author
dimMaryanto@win10
committed
update application project
1 parent c71f97c commit b4987f1

File tree

6 files changed

+95
-86
lines changed

6 files changed

+95
-86
lines changed

‎README.md‎

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,31 @@
1-
# Security Oauth2 with LDAP
1+
# Spring Security - Oauth2 SSO example
22

3-
## Request token
3+
Belajar Web Security dengan fitur single sign on (SSO)
44

5-
```bash
6-
curl -X POST \
7-
'http://localhost:8080/oauth/token?grant_type=password&username=user&password=password&client_id=mandiri_mits' \
8-
-H 'Authorization: Basic bWFuZGlyaV9taXRzOjEyMzQ1Ng=='
9-
```
5+
- Fitur Grant type Authorization code
6+
7+
- request code : [klick disini](http://localhost:8080/oauth/authorize?grant_type=authorization_code&client_id=client-code&client_secret=123456&redirectUrl=http://localhost:8080/&response_type=code)
8+
9+
```bash
10+
http://localhost:8080/oauth/authorize?grant_type=authorization_code&client_id=client-code&client_secret=123456&redirectUrl=http://localhost:8080/&response_type=code
11+
```
12+
13+
- request token :
14+
15+
```bash
16+
curl -X POST \
17+
http://localhost:8080/oauth/token \
18+
-H 'Authorization: Basic Y2xpZW50LWNvZGU6MTIzNDU2' \
19+
-H 'Cache-Control: no-cache' \
20+
-H 'Content-Type: application/x-www-form-urlencoded' \
21+
-d 'grant_type=authorization_code&code=1HQ2Gh'
22+
```
23+
24+
- Fitur Grant type Password
25+
26+
```bash
27+
curl -X POST \
28+
'http://localhost:8080/oauth/token?grant_type=password&client_id=client-code&username=user&password=password' \
29+
-H 'Authorization: Basic Y2xpZW50LWNvZGU6MTIzNDU2' \
30+
-H 'Postman-Token: f2b78553-073a-46c7-8a3e-dca6ccdc1fef'
31+
```

‎pom.xml‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,6 @@
2525
</properties>
2626

2727
<dependencies>
28-
<dependency>
29-
<groupId>org.springframework.boot</groupId>
30-
<artifactId>spring-boot-starter-data-ldap</artifactId>
31-
</dependency>
3228
<dependency>
3329
<groupId>org.springframework.boot</groupId>
3430
<artifactId>spring-boot-starter-security</artifactId>
@@ -37,10 +33,6 @@
3733
<groupId>org.springframework.security.oauth</groupId>
3834
<artifactId>spring-security-oauth2</artifactId>
3935
</dependency>
40-
<dependency>
41-
<groupId>org.springframework.security</groupId>
42-
<artifactId>spring-security-jwt</artifactId>
43-
</dependency>
4436
<dependency>
4537
<groupId>net.sourceforge.collections</groupId>
4638
<artifactId>collections-generic</artifactId>

‎src/main/java/com/maryanto/dimas/example/configurations/OauthResourceServerConfiguration.java‎ renamed to ‎src/main/java/com/maryanto/dimas/example/config/OauthAuthorizationServer.java‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
package com.maryanto.dimas.example.configurations;
1+
package com.maryanto.dimas.example.config;
22

33
import org.springframework.beans.factory.annotation.Autowired;
4-
import org.springframework.beans.factory.annotation.Value;
54
import org.springframework.context.annotation.Configuration;
65
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
76
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
@@ -11,22 +10,17 @@
1110

1211
@EnableResourceServer
1312
@Configuration
14-
public class OauthResourceServerConfiguration extends ResourceServerConfigurerAdapter {
15-
13+
public class OauthAuthorizationServer extends ResourceServerConfigurerAdapter {
1614

1715
@Autowired
1816
private OAuth2AccessDeniedHandler handler;
1917

2018
@Autowired
2119
private TokenStore tokenStore;
2220

23-
@Value("${oauth2.resource_id}")
24-
private String RESOURCE_ID;
25-
2621
@Override
2722
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
28-
// super.configure(resources);
29-
resources.resourceId(RESOURCE_ID)
23+
resources.resourceId("client-code")
3024
.tokenStore(tokenStore)
3125
.accessDeniedHandler(handler)
3226
.stateless(false);

‎src/main/java/com/maryanto/dimas/example/configurations/OauthServerConfiguration.java‎ renamed to ‎src/main/java/com/maryanto/dimas/example/config/OauthResourceServer.java‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
1-
package com.maryanto.dimas.example.configurations;
1+
package com.maryanto.dimas.example.config;
22

33
import org.springframework.beans.factory.annotation.Autowired;
44
import org.springframework.beans.factory.annotation.Qualifier;
5-
import org.springframework.beans.factory.annotation.Value;
65
import org.springframework.context.annotation.Bean;
76
import org.springframework.context.annotation.Configuration;
87
import org.springframework.security.authentication.AuthenticationManager;
@@ -16,14 +15,7 @@
1615

1716
@Configuration
1817
@EnableAuthorizationServer
19-
public class OauthServerConfiguration extends AuthorizationServerConfigurerAdapter {
20-
21-
@Value("${oauth2.resource_id}")
22-
private String RESOURCE_ID;
23-
@Value("${oauth2.client_id}")
24-
private String CLIENT_ID;
25-
@Value("${oauth2.client_secret}")
26-
private String CLIENT_SECRET;
18+
public class OauthResourceServer extends AuthorizationServerConfigurerAdapter {
2719

2820
@Autowired
2921
private TokenStore tokenStore;
@@ -37,7 +29,6 @@ public OAuth2AccessDeniedHandler oauthAccessDeniedHandler() {
3729
return new OAuth2AccessDeniedHandler();
3830
}
3931

40-
4132
@Override
4233
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
4334
oauthServer.checkTokenAccess("permitAll()");
@@ -46,12 +37,13 @@ public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws
4637
@Override
4738
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
4839
clients.inMemory()
49-
.withClient(CLIENT_ID)
50-
.secret(CLIENT_SECRET)
40+
.withClient("client-code")
41+
.resourceIds("resource-example")
42+
.secret("123456")
5143
.scopes("read", "write", "trust")
5244
.authorizedGrantTypes("password", "authorization_code", "refresh_token")
53-
.authorities("CLIENT_APP")
54-
.resourceIds(RESOURCE_ID)
45+
.authorities("module-users-management")
46+
.redirectUris("http://localhost:8080/")
5547
.autoApprove(true);
5648
}
5749

‎src/main/java/com/maryanto/dimas/example/configurations/WebSecurityConfiguration.java‎ renamed to ‎src/main/java/com/maryanto/dimas/example/config/WebSecurityConfiguration.java‎

Lines changed: 56 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,97 @@
1-
package com.maryanto.dimas.example.configurations;
1+
package com.maryanto.dimas.example.config;
22

3-
import com.google.common.collect.ImmutableList;
43
import org.springframework.beans.factory.annotation.Autowired;
5-
import org.springframework.boot.autoconfigure.security.SecurityProperties;
64
import org.springframework.boot.web.servlet.FilterRegistrationBean;
75
import org.springframework.context.annotation.Bean;
86
import org.springframework.context.annotation.Configuration;
97
import org.springframework.core.annotation.Order;
108
import org.springframework.security.authentication.AuthenticationManager;
11-
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
129
import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
1310
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
1411
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
1512
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
1613
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
1714
import org.springframework.security.config.http.SessionCreationPolicy;
15+
import org.springframework.security.core.userdetails.User;
16+
import org.springframework.security.core.userdetails.UserDetails;
17+
import org.springframework.security.core.userdetails.UserDetailsService;
1818
import org.springframework.security.oauth2.provider.ClientDetailsService;
1919
import org.springframework.security.oauth2.provider.approval.ApprovalStore;
2020
import org.springframework.security.oauth2.provider.approval.TokenApprovalStore;
2121
import org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler;
2222
import org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory;
2323
import org.springframework.security.oauth2.provider.token.TokenStore;
2424
import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
25+
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
26+
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
2527
import org.springframework.web.cors.CorsConfiguration;
26-
import org.springframework.web.cors.CorsConfigurationSource;
2728
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
2829
import org.springframework.web.filter.CorsFilter;
2930

3031
@Configuration
3132
@EnableWebSecurity
3233
@EnableGlobalMethodSecurity(securedEnabled = true)
3334
@EnableGlobalAuthentication
34-
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
35-
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
36-
35+
public class WebSecurityConfiguration {
3736

3837
@Autowired
3938
private ClientDetailsService clientDetailsService;
4039

4140
@Bean
42-
@Override
43-
public AuthenticationManager authenticationManagerBean() throws Exception {
44-
return super.authenticationManagerBean();
41+
public UserDetailsService userDetailsService() {
42+
InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
43+
UserDetails user = User.withUsername("user").password("password").roles("USER").build();
44+
UserDetails admin = User.withUsername("admin").password("password").roles("USER", "ADMIN").build();
45+
manager.createUser(user);
46+
manager.createUser(admin);
47+
return manager;
4548
}
4649

47-
@Override
48-
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
49-
// super.configure(auth);
50-
auth.inMemoryAuthentication()
51-
.withUser("user").password("password").roles("USER").and()
52-
.withUser("admin").password("password").roles("ADMIN", "USER");
50+
@Configuration
51+
@Order(1)
52+
public static class ApiAuthenticationServer extends WebSecurityConfigurerAdapter {
53+
54+
@Bean
55+
@Override
56+
public AuthenticationManager authenticationManagerBean() throws Exception {
57+
return super.authenticationManagerBean();
58+
}
59+
60+
@Override
61+
protected void configure(HttpSecurity http) throws Exception {
62+
// super.configure(http);
63+
http.cors().disable()
64+
.csrf().disable();
65+
http.antMatcher("/api/**")
66+
.authorizeRequests()
67+
.antMatchers("/oauth/**", "/login").permitAll()
68+
.anyRequest().authenticated()
69+
.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
70+
}
71+
5372
}
5473

55-
@Override
56-
protected void configure(HttpSecurity http) throws Exception {
74+
@Configuration
75+
public static class WebFormAuthenticationServer extends WebSecurityConfigurerAdapter {
76+
77+
@Bean
78+
@Override
79+
public AuthenticationManager authenticationManagerBean() throws Exception {
80+
return super.authenticationManagerBean();
81+
}
82+
83+
@Override
84+
protected void configure(HttpSecurity http) throws Exception {
5785
// super.configure(http);
58-
http
59-
.csrf().disable()
60-
.cors().disable()
61-
.authorizeRequests()
62-
.antMatchers("/oauth/**").permitAll()
63-
.anyRequest().authenticated()
64-
.and().httpBasic()
65-
.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
86+
http.cors().disable()
87+
.csrf().disable();
88+
http.authorizeRequests()
89+
.antMatchers("/oauth/**").permitAll()
90+
.anyRequest().authenticated()
91+
.and().formLogin().permitAll()
92+
.and().httpBasic();
93+
}
94+
6695
}
6796

6897

@@ -99,21 +128,6 @@ public FilterRegistrationBean corsFilter() {
99128
return bean;
100129
}
101130

102-
103-
@Bean
104-
public CorsConfigurationSource corsConfigurationSource() {
105-
final CorsConfiguration configuration = new CorsConfiguration();
106-
configuration.setAllowedMethods(ImmutableList.of("HEAD",
107-
"GET", "POST", "PUT", "DELETE", "PATCH"));
108-
configuration.setAllowedOrigins(ImmutableList.of("*"));
109-
configuration.setAllowCredentials(true);
110-
configuration.setAllowedHeaders(ImmutableList.of("Authorization", "Cache-Control", "Content-Type"));
111-
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
112-
source.registerCorsConfiguration("/**", configuration);
113-
return source;
114-
}
115-
116-
117131
@Bean
118132
public TokenStore tokenStore() {
119133
return new InMemoryTokenStore();

‎src/main/resources/application.properties‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +0,0 @@
1-
# oauth
2-
oauth2.client_id=mandiri_mits
3-
oauth2.client_secret=123456
4-
oauth2.resource_id=MANDIRI_RESOURCE
5-
oauth2.check_token.uri=http://localhost:8080/oauth/check_token

0 commit comments

Comments
 (0)