You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2023/04/24 12:56:49 UTC
[syncope] branch master updated: Fixing Spring Security 7 deprecations (#445)
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git
The following commit(s) were added to refs/heads/master by this push:
new 3aa5ceb33c Fixing Spring Security 7 deprecations (#445)
3aa5ceb33c is described below
commit 3aa5ceb33c7909acae5191f80c975c1768f445fb
Author: Francesco Chicchiriccò <il...@users.noreply.github.com>
AuthorDate: Mon Apr 24 14:56:42 2023 +0200
Fixing Spring Security 7 deprecations (#445)
---
.../syncope/client/console/SecurityConfig.java | 14 ++++---
.../syncope/client/enduser/SecurityConfig.java | 14 ++++---
.../core/spring/security/WebSecurityContext.java | 36 +++++++++---------
.../org/apache/syncope/sra/SecurityConfig.java | 44 ++++++++++++++--------
.../sra/security/cas/CASSecurityConfigUtils.java | 4 +-
.../security/oauth2/OAuth2SecurityConfigUtils.java | 8 ++--
.../security/saml2/SAML2SecurityConfigUtils.java | 6 +--
7 files changed, 72 insertions(+), 54 deletions(-)
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java
index d8c3e59d9d..73850f5888 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java
@@ -22,8 +22,10 @@ import org.apache.syncope.common.lib.types.IdRepoEntitlement;
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
@@ -38,13 +40,13 @@ public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
EndpointRequest.EndpointRequestMatcher actuatorEndpoints = EndpointRequest.toAnyEndpoint();
-
- http.csrf().disable().
- authorizeHttpRequests().
+ http.authorizeHttpRequests(customizer -> customizer.
requestMatchers(new NegatedRequestMatcher(actuatorEndpoints)).permitAll().
- requestMatchers(actuatorEndpoints).authenticated().
- and().
- httpBasic();
+ requestMatchers(actuatorEndpoints).authenticated());
+
+ http.httpBasic(Customizer.withDefaults());
+ http.csrf(AbstractHttpConfigurer::disable);
+
return http.build();
}
diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SecurityConfig.java b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SecurityConfig.java
index ee0cda3680..327ced58c9 100644
--- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SecurityConfig.java
+++ b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SecurityConfig.java
@@ -22,8 +22,10 @@ import org.apache.syncope.common.lib.types.IdRepoEntitlement;
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
@@ -38,13 +40,13 @@ public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
EndpointRequest.EndpointRequestMatcher actuatorEndpoints = EndpointRequest.toAnyEndpoint();
-
- http.csrf().disable().
- authorizeHttpRequests().
+ http.authorizeHttpRequests(customizer -> customizer.
requestMatchers(new NegatedRequestMatcher(actuatorEndpoints)).permitAll().
- requestMatchers(actuatorEndpoints).authenticated().
- and().
- httpBasic();
+ requestMatchers(actuatorEndpoints).authenticated());
+
+ http.httpBasic(Customizer.withDefaults());
+ http.csrf(AbstractHttpConfigurer::disable);
+
return http.build();
}
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java
index 71693cd944..df004da7ef 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java
@@ -42,14 +42,13 @@ import org.springframework.security.config.annotation.method.configuration.Enabl
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
-import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.security.web.access.intercept.AuthorizationFilter;
import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
-import org.springframework.security.web.context.NullSecurityContextRepository;
import org.springframework.security.web.firewall.DefaultHttpFirewall;
import org.springframework.security.web.firewall.HttpFirewall;
@@ -76,6 +75,7 @@ public class WebSecurityContext {
public SecurityFilterChain filterChain(
final HttpSecurity http,
final UsernamePasswordAuthenticationProvider usernamePasswordAuthenticationProvider,
+ final AccessDeniedHandler accessDeniedHandler,
final AuthDataAccessor authDataAccessor,
final DefaultCredentialChecker defaultCredentialChecker,
final SecurityProperties securityProperties) throws Exception {
@@ -84,6 +84,7 @@ public class WebSecurityContext {
parentAuthenticationManager(null).
authenticationProvider(usernamePasswordAuthenticationProvider).
build();
+ http.authenticationManager(authenticationManager);
SyncopeAuthenticationDetailsSource authenticationDetailsSource =
new SyncopeAuthenticationDetailsSource();
@@ -96,10 +97,16 @@ public class WebSecurityContext {
securityProperties.getAnonymousUser(),
AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS"));
anonymousAuthenticationFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+ http.anonymous(customizer -> customizer.
+ authenticationProvider(anonymousAuthenticationProvider).
+ authenticationFilter(anonymousAuthenticationFilter));
SyncopeBasicAuthenticationEntryPoint basicAuthenticationEntryPoint =
new SyncopeBasicAuthenticationEntryPoint();
basicAuthenticationEntryPoint.setRealmName("Apache Syncope authentication");
+ http.httpBasic(customizer -> customizer.
+ authenticationEntryPoint(basicAuthenticationEntryPoint).
+ authenticationDetailsSource(authenticationDetailsSource));
JWTAuthenticationFilter jwtAuthenticationFilter = new JWTAuthenticationFilter(
authenticationManager,
@@ -107,24 +114,17 @@ public class WebSecurityContext {
authenticationDetailsSource,
authDataAccessor,
defaultCredentialChecker);
+ http.addFilterBefore(jwtAuthenticationFilter, BasicAuthenticationFilter.class);
MustChangePasswordFilter mustChangePasswordFilter = new MustChangePasswordFilter();
-
- http.authenticationManager(authenticationManager).
- authorizeHttpRequests().
- requestMatchers("/**").permitAll().and().
- sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().
- securityContext().securityContextRepository(new NullSecurityContextRepository()).and().
- anonymous().
- authenticationProvider(anonymousAuthenticationProvider).
- authenticationFilter(anonymousAuthenticationFilter).and().
- httpBasic().authenticationEntryPoint(basicAuthenticationEntryPoint).
- authenticationDetailsSource(authenticationDetailsSource).and().
- exceptionHandling().accessDeniedHandler(accessDeniedHandler()).and().
- addFilterBefore(jwtAuthenticationFilter, BasicAuthenticationFilter.class).
- addFilterBefore(mustChangePasswordFilter, AuthorizationFilter.class).
- headers().disable().
- csrf().disable();
+ http.addFilterBefore(mustChangePasswordFilter, AuthorizationFilter.class);
+
+ http.authorizeHttpRequests(customizer -> customizer.requestMatchers("/**").permitAll());
+ http.securityContext(AbstractHttpConfigurer::disable);
+ http.sessionManagement(AbstractHttpConfigurer::disable);
+ http.headers(AbstractHttpConfigurer::disable);
+ http.csrf(AbstractHttpConfigurer::disable);
+ http.exceptionHandling(customizer -> customizer.accessDeniedHandler(accessDeniedHandler));
return http.build();
}
diff --git a/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java b/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java
index 878ed14660..3590bcc0cd 100644
--- a/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java
+++ b/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java
@@ -54,6 +54,7 @@ import org.springframework.core.convert.converter.Converter;
import org.springframework.core.io.FileUrlResource;
import org.springframework.core.io.support.ResourcePatternResolver;
import org.springframework.http.HttpMethod;
+import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
@@ -88,21 +89,30 @@ public class SecurityConfig {
public SecurityWebFilterChain saml2SecurityFilterChain(final ServerHttpSecurity http) {
ServerWebExchangeMatcher metadataMatcher =
ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, SAML2MetadataEndpoint.METADATA_URL);
- return http.securityMatcher(metadataMatcher).
- authorizeExchange().anyExchange().permitAll().
- and().csrf().requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(metadataMatcher)).
- and().build();
+ http.securityMatcher(metadataMatcher);
+
+ http.authorizeExchange(customizer -> customizer.anyExchange().permitAll());
+
+ http.csrf(customizer -> customizer.
+ requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(metadataMatcher)));
+
+ return http.build();
}
@Bean
@Order(1)
public SecurityWebFilterChain actuatorSecurityFilterChain(final ServerHttpSecurity http) {
ServerWebExchangeMatcher actuatorMatcher = EndpointRequest.toAnyEndpoint();
- return http.securityMatcher(actuatorMatcher).
- authorizeExchange().anyExchange().authenticated().
- and().httpBasic().
- and().csrf().requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(actuatorMatcher)).
- and().build();
+ http.securityMatcher(actuatorMatcher);
+
+ http.authorizeExchange(customizer -> customizer.anyExchange().authenticated());
+
+ http.httpBasic(Customizer.withDefaults());
+
+ http.csrf(customizer -> customizer.
+ requireCsrfProtectionMatcher(new NegatedServerWebExchangeMatcher(actuatorMatcher)));
+
+ return http.build();
}
@Bean
@@ -298,21 +308,22 @@ public class SecurityConfig {
final CsrfRouteMatcher csrfRouteMatcher,
final ConfigurableApplicationContext ctx) {
- ServerHttpSecurity.AuthorizeExchangeSpec builder = http.authorizeExchange().
+ http.authorizeExchange(customizer -> customizer.
matchers(publicRouteMatcher).permitAll().
- anyExchange().authenticated();
+ anyExchange().authenticated());
switch (props.getAmType()) {
case OIDC, OAUTH2 -> {
OAuth2SecurityConfigUtils.forLogin(http, props.getAmType(), ctx);
- OAuth2SecurityConfigUtils.forLogout(builder, props.getAmType(), cacheManager, logoutRouteMatcher, ctx);
- http.oauth2ResourceServer().jwt().jwtDecoder(ctx.getBean(ReactiveJwtDecoder.class));
+ OAuth2SecurityConfigUtils.forLogout(http, props.getAmType(), cacheManager, logoutRouteMatcher, ctx);
+ http.oauth2ResourceServer(customizer -> customizer.jwt(
+ c -> c.jwtDecoder(ctx.getBean(ReactiveJwtDecoder.class))));
}
case SAML2 ->
saml2Client.ifAvailable(client -> {
SAML2SecurityConfigUtils.forLogin(http, client, publicRouteMatcher);
- SAML2SecurityConfigUtils.forLogout(builder, client, cacheManager, logoutRouteMatcher, ctx);
+ SAML2SecurityConfigUtils.forLogout(http, client, cacheManager, logoutRouteMatcher, ctx);
});
case CAS -> {
@@ -322,7 +333,7 @@ public class SecurityConfig {
props.getCas().getServerPrefix(),
publicRouteMatcher);
CASSecurityConfigUtils.forLogout(
- builder,
+ http,
cacheManager,
props.getCas().getServerPrefix(),
logoutRouteMatcher,
@@ -333,6 +344,7 @@ public class SecurityConfig {
}
}
- return builder.and().csrf().requireCsrfProtectionMatcher(csrfRouteMatcher).and().build();
+ http.csrf(customizer -> customizer.requireCsrfProtectionMatcher(csrfRouteMatcher));
+ return http.build();
}
}
diff --git a/sra/src/main/java/org/apache/syncope/sra/security/cas/CASSecurityConfigUtils.java b/sra/src/main/java/org/apache/syncope/sra/security/cas/CASSecurityConfigUtils.java
index 6a47876435..7d47e60c44 100644
--- a/sra/src/main/java/org/apache/syncope/sra/security/cas/CASSecurityConfigUtils.java
+++ b/sra/src/main/java/org/apache/syncope/sra/security/cas/CASSecurityConfigUtils.java
@@ -67,7 +67,7 @@ public final class CASSecurityConfigUtils {
}
public static void forLogout(
- final ServerHttpSecurity.AuthorizeExchangeSpec builder,
+ final ServerHttpSecurity http,
final CacheManager cacheManager,
final String casServerUrlPrefix,
final LogoutRouteMatcher logoutRouteMatcher,
@@ -87,7 +87,7 @@ public final class CASSecurityConfigUtils {
LOG.error("While creating instance of {}", CASServerLogoutSuccessHandler.class.getName(), e);
}
- builder.and().addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
+ http.addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
}
private CASSecurityConfigUtils() {
diff --git a/sra/src/main/java/org/apache/syncope/sra/security/oauth2/OAuth2SecurityConfigUtils.java b/sra/src/main/java/org/apache/syncope/sra/security/oauth2/OAuth2SecurityConfigUtils.java
index 8a9c78890a..d31d8a9edd 100644
--- a/sra/src/main/java/org/apache/syncope/sra/security/oauth2/OAuth2SecurityConfigUtils.java
+++ b/sra/src/main/java/org/apache/syncope/sra/security/oauth2/OAuth2SecurityConfigUtils.java
@@ -107,11 +107,12 @@ public final class OAuth2SecurityConfigUtils {
htmlMatcher.setIgnoredMediaTypes(Set.of(MediaType.ALL));
ServerAuthenticationEntryPoint entrypoint =
new RedirectServerAuthenticationEntryPoint("/oauth2/authorization/" + amType.name());
- http.exceptionHandling().authenticationEntryPoint(new DelegateEntry(htmlMatcher, entrypoint).getEntryPoint());
+ http.exceptionHandling(customizer -> customizer.authenticationEntryPoint(
+ new DelegateEntry(htmlMatcher, entrypoint).getEntryPoint()));
}
public static void forLogout(
- final ServerHttpSecurity.AuthorizeExchangeSpec builder,
+ final ServerHttpSecurity http,
final SRAProperties.AMType amType,
final CacheManager cacheManager,
final LogoutRouteMatcher logoutRouteMatcher,
@@ -134,7 +135,8 @@ public final class OAuth2SecurityConfigUtils {
}
}
- builder.and().logout().disable().addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
+ http.logout(customizer -> customizer.disable());
+ http.addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
}
private OAuth2SecurityConfigUtils() {
diff --git a/sra/src/main/java/org/apache/syncope/sra/security/saml2/SAML2SecurityConfigUtils.java b/sra/src/main/java/org/apache/syncope/sra/security/saml2/SAML2SecurityConfigUtils.java
index 21b8923e8d..95e2074467 100644
--- a/sra/src/main/java/org/apache/syncope/sra/security/saml2/SAML2SecurityConfigUtils.java
+++ b/sra/src/main/java/org/apache/syncope/sra/security/saml2/SAML2SecurityConfigUtils.java
@@ -66,7 +66,7 @@ public final class SAML2SecurityConfigUtils {
}
public static void forLogout(
- final ServerHttpSecurity.AuthorizeExchangeSpec builder,
+ final ServerHttpSecurity http,
final SAML2Client saml2Client,
final CacheManager cacheManager,
final LogoutRouteMatcher logoutRouteMatcher,
@@ -85,12 +85,12 @@ public final class SAML2SecurityConfigUtils {
SAML2LogoutResponseWebFilter logoutResponseWebFilter =
new SAML2LogoutResponseWebFilter(saml2Client, logoutSuccessHandler);
- builder.and().addFilterAt(logoutResponseWebFilter, SecurityWebFiltersOrder.LOGOUT);
+ http.addFilterAt(logoutResponseWebFilter, SecurityWebFiltersOrder.LOGOUT);
} catch (ClassNotFoundException e) {
LOG.error("While creating instance of {}", SAML2ServerLogoutSuccessHandler.class.getName(), e);
}
- builder.and().addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
+ http.addFilterAt(logoutWebFilter, SecurityWebFiltersOrder.LOGOUT);
}
private SAML2SecurityConfigUtils() {