초기소스
This commit is contained in:
jazz
@@ -0,0 +1,224 @@
|
||||
/*
|
||||
* Copyright 2020-2022 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package com.wb.domainserver.security.config;
|
||||
|
||||
import com.wb.domainserver.domain.sopmal.oauth.service.CustomOAuth2UserService;
|
||||
import com.wb.domainserver.exception.response.CustomOauthFailureException;
|
||||
import com.wb.domainserver.realm.RealmResolver;
|
||||
import com.wb.domainserver.realm.filter.RealmFilter;
|
||||
import com.wb.domainserver.response.CustomAuthenticationSuccessHandler;
|
||||
import com.wb.domainserver.security.authentication.CustomAccessDeniedEntryPoint;
|
||||
import com.wb.domainserver.security.authentication.CustomAuthenticationEntryPoint;
|
||||
import com.wb.domainserver.security.authorization.WnbtAuthorizationManager;
|
||||
import com.wb.domainserver.security.filter.CustomXssFilter;
|
||||
import com.wb.domainserver.security.filter.JwtAuthenticationFilter;
|
||||
import com.wb.domainserver.security.handler.CustomLogoutSuccessHandler;
|
||||
import com.wb.domainserver.security.user.SecurityUserDetailService;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
import org.springframework.aop.Advisor;
|
||||
import org.springframework.aop.support.JdkRegexpMethodPointcut;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.context.annotation.Role;
|
||||
import org.springframework.core.annotation.Order;
|
||||
import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
|
||||
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.security.web.authentication.logout.LogoutFilter;
|
||||
import org.springframework.security.web.header.HeaderWriterFilter;
|
||||
import org.springframework.security.web.savedrequest.RequestCacheAwareFilter;
|
||||
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
import static org.springframework.beans.factory.config.BeanDefinition.ROLE_INFRASTRUCTURE;
|
||||
|
||||
@EnableWebSecurity(debug = true)
|
||||
@Configuration
|
||||
//@EnableMethodSecurity
|
||||
public class ResourceServerConfig {
|
||||
private static final Logger logger = LoggerFactory.getLogger(ResourceServerConfig.class);
|
||||
|
||||
@Autowired
|
||||
private RealmResolver realmResolver;
|
||||
|
||||
@Autowired
|
||||
private SecurityUserDetailService userDetailService;
|
||||
|
||||
@Autowired
|
||||
private CustomAuthenticationEntryPoint authenticationEntryPoint;
|
||||
|
||||
@Autowired
|
||||
private CustomAccessDeniedEntryPoint accessDeniedEntryPoint;
|
||||
|
||||
@Autowired
|
||||
private CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;
|
||||
|
||||
@Autowired
|
||||
private CustomOAuth2UserService customOAuth2UserService;
|
||||
|
||||
@Bean
|
||||
@Role(ROLE_INFRASTRUCTURE)
|
||||
public Advisor authorizationManagerBeforeMethodInterception(WnbtAuthorizationManager<?> authorizationManager) {
|
||||
JdkRegexpMethodPointcut pattern = new JdkRegexpMethodPointcut();
|
||||
pattern.setPattern("com.wb.domainserver.*.controller.*");
|
||||
return new AuthorizationManagerBeforeMethodInterceptor(pattern, authorizationManager);
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(1)
|
||||
SecurityFilterChain sopmalSecurityFilterChain(HttpSecurity http, SecurityPathProperties securityProperties) throws Exception {
|
||||
|
||||
RequestMatcher logoutRequestMatcher = new OrRequestMatcher(
|
||||
new AntPathRequestMatcher("/sopmal/logout")
|
||||
);
|
||||
|
||||
//사용자 권한
|
||||
List<RequestMatcher> anonymousPath = securityProperties.getSolmal().getAnonmymous().stream()
|
||||
.map(AntPathRequestMatcher::new)
|
||||
.collect(Collectors.toList());
|
||||
|
||||
List<RequestMatcher> authPath = securityProperties.getSolmal().getAuthenticated().stream()
|
||||
.map(AntPathRequestMatcher::new)
|
||||
.collect(Collectors.toList());
|
||||
|
||||
List<RequestMatcher> resourcePath = securityProperties.getCommon().getResources().stream()
|
||||
.map(AntPathRequestMatcher::new)
|
||||
.collect(Collectors.toList());
|
||||
|
||||
OrRequestMatcher anonymoushMatchers = new OrRequestMatcher(anonymousPath);
|
||||
OrRequestMatcher authMatchers = new OrRequestMatcher(authPath);
|
||||
OrRequestMatcher resourceMatchers = new OrRequestMatcher(resourcePath);
|
||||
|
||||
return http
|
||||
.csrf(AbstractHttpConfigurer::disable)
|
||||
.securityMatcher("/sopmal/**", "/oauth2/**", "/login/oauth2/**")
|
||||
.authorizeHttpRequests(authorize ->
|
||||
authorize
|
||||
.requestMatchers(authMatchers).authenticated()
|
||||
.requestMatchers(anonymoushMatchers).anonymous()
|
||||
.requestMatchers(resourceMatchers).permitAll()
|
||||
.requestMatchers(
|
||||
new AntPathRequestMatcher("/oauth2/**"),
|
||||
new AntPathRequestMatcher("/login/oauth2/**")
|
||||
).permitAll()
|
||||
.anyRequest().permitAll()
|
||||
)
|
||||
.oauth2Login(oauth2 -> oauth2 //sns oauth
|
||||
.loginPage("/sopmal/login")
|
||||
.successHandler(customAuthenticationSuccessHandler) //인증성공시 로그인 혹은 연동처리
|
||||
.userInfoEndpoint(userInfo -> userInfo //인증처리
|
||||
.userService(customOAuth2UserService)
|
||||
)
|
||||
.failureHandler(new CustomOauthFailureException()) //인증 실패시
|
||||
)
|
||||
.addFilterAfter(new CustomXssFilter(), RequestCacheAwareFilter.class)
|
||||
.addFilterBefore(new JwtAuthenticationFilter(userDetailService), LogoutFilter.class)
|
||||
.addFilterAfter(new RealmFilter(realmResolver), HeaderWriterFilter.class)
|
||||
.exceptionHandling(exceptions -> exceptions
|
||||
.authenticationEntryPoint(authenticationEntryPoint)
|
||||
.accessDeniedHandler(accessDeniedEntryPoint)
|
||||
).logout(logout
|
||||
-> logout.logoutRequestMatcher(logoutRequestMatcher)
|
||||
.deleteCookies("JSESSIONID")
|
||||
.logoutSuccessHandler(new CustomLogoutSuccessHandler())
|
||||
)
|
||||
|
||||
.build();
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(2)
|
||||
SecurityFilterChain adminSecurityFilterChain(HttpSecurity http, SecurityPathProperties securityProperties) throws Exception {
|
||||
|
||||
// 설정된 로그아웃 URL
|
||||
RequestMatcher logoutRequestMatcher = new OrRequestMatcher(
|
||||
new AntPathRequestMatcher("/mngr/logout"),
|
||||
new AntPathRequestMatcher("/admin/logout"),
|
||||
new AntPathRequestMatcher("/crm/logout")
|
||||
);
|
||||
|
||||
|
||||
List<RequestMatcher> anonmyPath = securityProperties.getAdmin().getAnonmymous().stream()
|
||||
.map(AntPathRequestMatcher::new)
|
||||
.collect(Collectors.toList());
|
||||
List<RequestMatcher> authPath = securityProperties.getAdmin().getAuthenticated().stream()
|
||||
.map(AntPathRequestMatcher::new)
|
||||
.collect(Collectors.toList());
|
||||
List<RequestMatcher> resourcePath = securityProperties.getCommon().getResources().stream()
|
||||
.map(AntPathRequestMatcher::new)
|
||||
.collect(Collectors.toList());
|
||||
|
||||
OrRequestMatcher authMatchers = new OrRequestMatcher(authPath);
|
||||
OrRequestMatcher resourceMatchers = new OrRequestMatcher(resourcePath);
|
||||
|
||||
return http
|
||||
.csrf(AbstractHttpConfigurer::disable)
|
||||
.securityMatcher("/mngr/**","/mngr","/admin/**","/admin","/admin/**","/crm/**","/itrnt/**", logoutRequestMatcher.toString()) //"/*/mq/**", "/api/batch/schedulerloader/**", 제외
|
||||
.authorizeHttpRequests(authorize ->
|
||||
authorize
|
||||
// .requestMatchers(AntPathRequestMatcher.antMatcher("/*/mq/**")).anonymous() //ERP 호출 허용을 위해
|
||||
// .requestMatchers(AntPathRequestMatcher.antMatcher("/api/batch/schedulerloader/**")).anonymous() //batch 스케줄 동적기동
|
||||
.requestMatchers(AntPathRequestMatcher.antMatcher("/admin")).permitAll()
|
||||
.requestMatchers(AntPathRequestMatcher.antMatcher("/mngr")).permitAll()
|
||||
.requestMatchers(AntPathRequestMatcher.antMatcher("/mngr/login/**")).permitAll()
|
||||
.requestMatchers(AntPathRequestMatcher.antMatcher("/admin/login/**")).permitAll()
|
||||
.requestMatchers(AntPathRequestMatcher.antMatcher("/mngr/tokens/**")).anonymous()
|
||||
.requestMatchers(AntPathRequestMatcher.antMatcher("/admin/tokens/**")).anonymous()
|
||||
.requestMatchers(resourceMatchers).permitAll()
|
||||
.requestMatchers(authMatchers).authenticated()
|
||||
.anyRequest().permitAll()
|
||||
)
|
||||
.addFilterBefore(new JwtAuthenticationFilter(userDetailService), LogoutFilter.class)
|
||||
.addFilterAfter(new RealmFilter(realmResolver), HeaderWriterFilter.class)
|
||||
.exceptionHandling(exceptions -> exceptions
|
||||
.authenticationEntryPoint(authenticationEntryPoint)
|
||||
.accessDeniedHandler(accessDeniedEntryPoint)
|
||||
).logout(logout
|
||||
-> logout.logoutRequestMatcher(logoutRequestMatcher)
|
||||
.deleteCookies("JSESSIONID")
|
||||
.logoutSuccessHandler(new CustomLogoutSuccessHandler())
|
||||
)
|
||||
|
||||
.build();
|
||||
}
|
||||
|
||||
//
|
||||
// private String customBearerTokenResolver(HttpServletRequest request) {
|
||||
// String authorization = request.getHeader("Authorization");
|
||||
// if (StringUtils.hasText(authorization) && authorization.startsWith("Bearer ")) {
|
||||
// return authorization.substring(7);
|
||||
// }
|
||||
// return null;
|
||||
// }
|
||||
//
|
||||
// private String determineIssuerUri(String token) {
|
||||
// return String.format(issuerUri+"/%s", RealmContextHolder.getRealm());
|
||||
// }
|
||||
|
||||
@Bean
|
||||
public BCryptPasswordEncoder bCryptPasswordEncoder() {
|
||||
return new BCryptPasswordEncoder();
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user