-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Backend initial app with authorization server configuration and OpenA…
…PI generator (#243) * H2 DB or Postgresql TestContainer available for local development * added springdoc * logging URL in log message * Minimal Members service for Authorization server * Auth server keys generator + example key * Authorization server with google login github doesn't work well because there is not OIDC (only OAuth2) * API server security configuration * added springdoc configuration * Spring security chains configuration - API (application/json) is secured using KLabis OAuth2 JWT token - login form has social login using Google - springdoc is not secured - authorization server * swagger-ui from app shows static openapi yaml from project root folder * OpenAPI updates (cleanup) * OpenAPI generator for server * Fixed in API specs * Added backend compiled files to ignore list
- Loading branch information
Showing
29 changed files
with
1,238 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,10 @@ | |
|
|
||
| # jetbrains | ||
| .idea/ | ||
| **/*.iml | ||
|
|
||
| # vscode | ||
| .vscode/ | ||
|
|
||
| # backend excludes | ||
| backend/target/** | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # Klabis backend | ||
|
|
||
| ## Spusteni na localhost | ||
| Aplikace ma nakonfigurovane prostredi pomoci [TestContainers](https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#features.testcontainers.at-development-time). Pro spusteni je potreba mit nainstalovany docker. Spusteni je pak mozne pomoci prikazu | ||
| ```shell | ||
| mvn spring-boot:test-run | ||
| ``` | ||
| Alternativne lze aplikaci spolecne s TestContainers spustit pomoci java main tridy `club.klabis.KlabisAppWithTestContainers` | ||
|
|
||
| # DevOps | ||
|
|
||
| ## Autorizacni server | ||
|
|
||
| ### Vygenerovani noveho klice pro JWT tokeny | ||
| `club.klabis.config.authserver.generatejwtkeys.JKWKeyGenerator` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| ### OIDC metadata | ||
| GET {{host}}/.well-known/openid-configuration | ||
|
|
||
| ### OIDC UserInfo | ||
| GET {{host}}/oidc/userinfo | ||
| Authorization: Bearer {{$auth.token("test")}} | ||
|
|
||
| ### OAuth2 token introspection - ID token | ||
| POST {{host}}/oauth2/introspect | ||
| Authorization: Basic test test | ||
| Content-Type: application/x-www-form-urlencoded | ||
|
|
||
| token={{$auth.idToken("test")}} | ||
|
|
||
| ### OAuth2 token introspection - access token | ||
| POST {{host}}/oauth2/introspect | ||
| Authorization: Basic test test | ||
| Content-Type: application/x-www-form-urlencoded | ||
|
|
||
| token={{$auth.token("test")}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
32 changes: 32 additions & 0 deletions
32
backend/src/main/java/club/klabis/adapters/api/ApiSecurityConfiguration.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| package club.klabis.adapters.api; | ||
|
|
||
| import club.klabis.config.authserver.AuthorizationServerConfiguration; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.core.annotation.Order; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.security.config.Customizer; | ||
| import org.springframework.security.config.annotation.web.builders.HttpSecurity; | ||
| import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; | ||
| import org.springframework.security.web.SecurityFilterChain; | ||
| import org.springframework.security.web.util.matcher.MediaTypeRequestMatcher; | ||
| import org.springframework.security.web.util.matcher.NegatedRequestMatcher; | ||
| import org.springframework.security.web.util.matcher.RequestMatcher; | ||
|
|
||
| @EnableWebSecurity | ||
| @Configuration(proxyBeanMethods = false) | ||
| public class ApiSecurityConfiguration { | ||
|
|
||
| public static RequestMatcher API_ENDPOINTS_MATCHER = new MediaTypeRequestMatcher(MediaType.APPLICATION_JSON); | ||
|
|
||
| @Bean | ||
| @Order(AuthorizationServerConfiguration.AFTER_AUTH_SERVER_SECURITY_ORDER) | ||
| public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http) throws Exception { | ||
| return http | ||
| .securityMatcher(API_ENDPOINTS_MATCHER) | ||
| .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated()) | ||
| .oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults())) | ||
| .build(); | ||
| } | ||
|
|
||
| } |
18 changes: 18 additions & 0 deletions
18
backend/src/main/java/club/klabis/adapters/api/TestController.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| package club.klabis.adapters.api; | ||
|
|
||
| import net.minidev.json.JSONObject; | ||
| import org.springframework.http.MediaType; | ||
| import org.springframework.security.core.Authentication; | ||
| import org.springframework.web.bind.annotation.GetMapping; | ||
| import org.springframework.web.bind.annotation.RestController; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| @RestController | ||
| public class TestController { | ||
|
|
||
| @GetMapping(value = "/api/test", produces = MediaType.APPLICATION_JSON_VALUE) | ||
| public JSONObject getResponse(Authentication principal) { | ||
| return new JSONObject(Map.of("message", "Hello %s!".formatted(principal.getName()))); } | ||
|
|
||
| } |
76 changes: 76 additions & 0 deletions
76
backend/src/main/java/club/klabis/config/authserver/AuthorizationServerConfiguration.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| package club.klabis.config.authserver; | ||
|
|
||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.core.Ordered; | ||
| import org.springframework.core.annotation.Order; | ||
| import org.springframework.security.authentication.dao.DaoAuthenticationProvider; | ||
| import org.springframework.security.config.Customizer; | ||
| import org.springframework.security.config.annotation.web.builders.HttpSecurity; | ||
| import org.springframework.security.core.userdetails.UserDetailsService; | ||
| import org.springframework.security.crypto.factory.PasswordEncoderFactories; | ||
| import org.springframework.security.crypto.password.PasswordEncoder; | ||
| import org.springframework.security.oauth2.server.authorization.InMemoryOAuth2AuthorizationService; | ||
| import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService; | ||
| import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration; | ||
| import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer; | ||
| import org.springframework.security.web.SecurityFilterChain; | ||
| import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; | ||
|
|
||
| @Configuration | ||
| public class AuthorizationServerConfiguration { | ||
|
|
||
| public static final int AUTH_SERVER_SECURITY_ORDER = Ordered.HIGHEST_PRECEDENCE + 5; | ||
| public static final int apAUTH_SERVER_LOGIN_PAGE = Ordered.LOWEST_PRECEDENCE - 5; | ||
| public static final int BEFORE_AUTH_SERVER_SECURITY_ORDER = AUTH_SERVER_SECURITY_ORDER - 2; | ||
| public static final int AFTER_AUTH_SERVER_SECURITY_ORDER = AUTH_SERVER_SECURITY_ORDER + 2; | ||
|
|
||
| @Bean | ||
| @Order(AUTH_SERVER_SECURITY_ORDER) | ||
| public SecurityFilterChain authorizationSecurityFilterChain( | ||
| HttpSecurity http, | ||
| DaoAuthenticationProvider daoAuthenticationProvider | ||
| ) throws Exception { | ||
| OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http); | ||
|
|
||
| http.getConfigurer(OAuth2AuthorizationServerConfigurer.class) | ||
| .tokenEndpoint(tokenEndpoint -> | ||
| tokenEndpoint | ||
| .authenticationProvider(daoAuthenticationProvider) | ||
| ) | ||
| .oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0 | ||
|
|
||
| // OAuth2 resource server to authenticate OIDC userInfo and/or client registration endpoints | ||
| http.oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults())); | ||
|
|
||
| http.exceptionHandling( | ||
| exceptions -> | ||
| exceptions.authenticationEntryPoint( | ||
| new LoginUrlAuthenticationEntryPoint("/login") | ||
| ) | ||
| ); | ||
|
|
||
| return http.build(); | ||
| } | ||
|
|
||
| @Bean | ||
| public OAuth2AuthorizationService authorizationService() { | ||
| // TODO: replace with DB | ||
| return new InMemoryOAuth2AuthorizationService(); | ||
| } | ||
|
|
||
| @Bean | ||
| public PasswordEncoder passwordEncoder() { | ||
| return PasswordEncoderFactories.createDelegatingPasswordEncoder(); | ||
| } | ||
|
|
||
| @Bean | ||
| public DaoAuthenticationProvider daoAuthenticationProvider( | ||
| PasswordEncoder passwordEncoder, UserDetailsService userDetailsService | ||
| ) { | ||
| DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider(); | ||
| daoAuthenticationProvider.setUserDetailsService(userDetailsService); | ||
| daoAuthenticationProvider.setPasswordEncoder(passwordEncoder); | ||
| return daoAuthenticationProvider; | ||
| } | ||
| } |
Oops, something went wrong.