fix : batch에서 BO호출할 수 있도록 security 수정

src/main/java/com/wb/domainserver/security/config/RealmFilterConfig.java

@@ -1,26 +0,0 @@
-package com.wb.domainserver.security.config;
-
-import com.wb.domainserver.realm.RealmResolver;
-import com.wb.domainserver.realm.filter.RealmFilter;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.servlet.FilterRegistrationBean;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.core.Ordered;
-
-@Configuration
-public class RealmFilterConfig {
-
-    @Autowired
-    RealmResolver realmResolver;
-
-    @Bean
-    public FilterRegistrationBean<RealmFilter> realmFilter() {
-        FilterRegistrationBean<RealmFilter> registrationBean = new FilterRegistrationBean<>();
-        registrationBean.setFilter(new RealmFilter(realmResolver));
-        registrationBean.addUrlPatterns("/*");
-        registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE);
-        return registrationBean;
-    }
-
-}

src/main/java/com/wb/domainserver/security/config/ResourceServerConfig.java

@@ -15,6 +15,7 @@
  */
 package com.wb.domainserver.security.config;
 
+import com.wb.domainserver.common.prop.PropertyService;
 import com.wb.domainserver.domain.sopmal.oauth.service.CustomOAuth2UserService;
 import com.wb.domainserver.exception.response.CustomOauthFailureException;
 import com.wb.domainserver.realm.RealmResolver;
@@ -23,6 +24,7 @@ import com.wb.domainserver.response.CustomAuthenticationSuccessHandler;
 import com.wb.domainserver.security.authentication.CustomAccessDeniedEntryPoint;
 import com.wb.domainserver.security.authentication.CustomAuthenticationEntryPoint;
 import com.wb.domainserver.security.authorization.WnbtAuthorizationManager;
+import com.wb.domainserver.security.filter.BatchFilter;
 import com.wb.domainserver.security.filter.CustomXssFilter;
 import com.wb.domainserver.security.filter.JwtAuthenticationFilter;
 import com.wb.domainserver.security.handler.CustomLogoutSuccessHandler;
@@ -55,7 +57,7 @@ import java.util.stream.Collectors;
 
 import static org.springframework.beans.factory.config.BeanDefinition.ROLE_INFRASTRUCTURE;
 
-@EnableWebSecurity(debug = false)
+@EnableWebSecurity(debug = true)
 @Configuration
 //@EnableMethodSecurity
 public class ResourceServerConfig {
@@ -113,7 +115,7 @@ public class ResourceServerConfig {
         OrRequestMatcher resourceMatchers = new OrRequestMatcher(resourcePath);
 
         return http
-                .securityMatcher("/sopmal/**", "/oauth2/**", "/login/oauth2/**","/file/*")
+                .securityMatcher("/*", "/sopmal/**", "/oauth2/**", "/login/oauth2/**","/file/*")           ///gcone/** #배치호출처리
                 .headers((headers)->headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin))
                 .csrf(AbstractHttpConfigurer::disable)
                 .authorizeHttpRequests(authorize ->
@@ -205,6 +207,26 @@ public class ResourceServerConfig {
                 .build();
     }
 
+    @Bean
+    @Order(3)
+    SecurityFilterChain batchSecurityFilterChain(HttpSecurity http, SecurityPathProperties securityProperties) throws Exception {
+
+        List<RequestMatcher> uriList = securityProperties.getBatch().getUri().stream()
+                .map(AntPathRequestMatcher::new)
+                .collect(Collectors.toList());
+        OrRequestMatcher uri = new OrRequestMatcher(uriList);
+
+        return http
+                .securityMatcher(uri)
+                .headers((headers)->headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin))
+                .csrf(AbstractHttpConfigurer::disable)
+                .addFilterBefore(new BatchFilter(securityProperties), RequestCacheAwareFilter.class)        /*batch 호출된 주소 확인 후 주소가 아니면 제외*/
+                .exceptionHandling(exceptions -> exceptions
+                        .accessDeniedHandler(accessDeniedEntryPoint)
+                )
+                .build();
+    }
+
 //
 //	private String customBearerTokenResolver(HttpServletRequest request) {
 //		String authorization = request.getHeader("Authorization");

src/main/java/com/wb/domainserver/security/config/SecurityPathProperties.java

@@ -19,6 +19,8 @@ public class SecurityPathProperties {
     private Solmal solmal;
     private Admin admin;
     private Common common;
+    private Batch batch;
+
 
     @Getter
     @Setter
@@ -39,5 +41,12 @@ public class SecurityPathProperties {
     public static class Common {
         private List<String> resources;
     }
+
+    @Getter
+    @Setter
+    public static class Batch {
+        private List<String> accessip;
+        private List<String> uri;
+    }
 }
 

src/main/java/com/wb/domainserver/security/filter/BatchFilter.java

@@ -0,0 +1,51 @@
+package com.wb.domainserver.security.filter;
+
+import com.wb.domainserver.common.prop.PropertyService;
+import com.wb.domainserver.exception.WnbtRestException;
+import com.wb.domainserver.security.config.SecurityPathProperties;
+import com.wb.domainserver.security.filter.wrapper.XssServletWrapper;
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.util.ContentCachingResponseWrapper;
+
+import java.io.IOException;
+import java.util.Arrays;
+
+@Slf4j
+public class BatchFilter implements Filter {
+
+    SecurityPathProperties securityProperties;
+
+    public BatchFilter(SecurityPathProperties securityProperties) {
+        this.securityProperties = securityProperties;
+    }
+
+    /*
+    * batch서버에서 호출 되었는지 확인하는 필터
+    * */
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest httpRequest = (HttpServletRequest) request;
+
+        String ip = httpRequest.getHeader("X-Forwarded-For");
+        if (ip == null || ip.isEmpty()) {
+            ip = httpRequest.getRemoteAddr();
+        }
+        // 여러 프록시를 거친 경우, 콤마로 구분된 여러 IP가 있을 수 있어 첫 번째 IP만 가져오거나 처리 필요 [4, 7].
+        if (ip != null && ip.contains(",")) {
+            ip = ip.split(",")[0];
+        }
+
+        Object[] whiteIp = securityProperties.getBatch().getAccessip().toArray();
+
+        /* 대상 ip가 아닌경우 처리불가*/
+        if(!Arrays.asList(whiteIp).contains(ip)){
+            throw new IOException("접근이 허용되지 않은 IP입니다.");
+        }
+
+        chain.doFilter(request, response);
+    }
+}