I try to go from Spring-Boot 2.7 to 3.1 - its regarding Security.
What I have under old version 2.
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
@Override
protected void configure (HttpSecurity http) throws Exception
{
http.cors ().and ()
.csrf ().disable ()
.authorizeRequests ()
.antMatchers ("/web/test").permitAll ()
.antMatchers ("/web/**").hasAnyRole ("USER")
.anyRequest ().authenticated ()
.and ()
.addFilter (new SecurityAuthenticationFilter (authenticationManager ()))
.addFilter (new SecurityAuthorizationFilter (authenticationManager ()))
.sessionManagement ()
.sessionCreationPolicy (SessionCreationPolicy.STATELESS);
}
What I already have for version 3.
@Bean
public SecurityFilterChain securityFilterChain (HttpSecurity http) throws Exception
{
http
.cors (Customizer.withDefaults ())
.csrf (AbstractHttpConfigurer::disable)
.authorizeHttpRequests ((requests) -> requests
.requestMatchers ("/web/test").permitAll ()
.requestMatchers ("/web/**").hasRole ("USER")
.anyRequest ().authenticated ()
)
//.addFilter (new SecurityAuthenticationFilter (authenticationManager ()))
.sessionManagement (httpSecuritySessionManagementConfigurer ->
httpSecuritySessionManagementConfigurer.sessionCreationPolicy (SessionCreationPolicy.STATELESS))
;
return http.build();
But here I struggle with authenticationManager () of former WebSecurtyConfigurationAdapter - for my 2 custom filters.
They are
public class SecurityAuthorizationFilter extends BasicAuthenticationFilter
{
public SecurityAuthorizationFilter (AuthenticationManager authenticationManager)
{
super (authenticationManager);
}
@Override
protected void doFilterInternal (HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException
{
UsernamePasswordAuthenticationToken upa = getAuthentication (request);
if (upa == null)
{
filterChain.doFilter (request, response);
}
else
{
SecurityContextHolder.getContext ().setAuthentication (upa);
filterChain.doFilter (request, response);
}
}
@SuppressWarnings ("unchecked")
private UsernamePasswordAuthenticationToken getAuthentication (HttpServletRequest request)
{
String token = request.getHeader (SecurityConstants.TOKEN_HEADER);
if (token != null && token.startsWith (SecurityConstants.TOKEN_PREFIX) == true)
{
byte [] signingKey = SecurityConstants.JWT_SECRET.getBytes ();
token = token.replace (SecurityConstants.TOKEN_PREFIX, "");
Jws <Claims> claim = Jwts.parserBuilder ().setSigningKey (signingKey).build ().parseClaimsJws (token);
String usr = claim.getBody ().getSubject ();
List <LinkedHashMap <?, ?>> cs = claim.getBody ().get ("roles", List.class);
List <SimpleGrantedAuthority> claims = new ArrayList <SimpleGrantedAuthority> ();
for (int i = 0; i < cs.size (); i ++)
{
claims.add (new SimpleGrantedAuthority (cs.get (i).get ("authority"). toString ()));
}
if (usr.length () > 0)
{
return new UsernamePasswordAuthenticationToken (usr, null, claims);
}
}
return null;
}
}
and
public class SecurityAuthenticationFilter extends UsernamePasswordAuthenticationFilter
{
private final AuthenticationManager authenticationManager;
public SecurityAuthenticationFilter (AuthenticationManager authenticationManager)
{
this.authenticationManager = authenticationManager;
setFilterProcessesUrl (SecurityConstants.AUTH_LOGIN_URL);
}
@Override
public Authentication attemptAuthentication (HttpServletRequest request, HttpServletResponse response)
{
String usr = request.getParameter ("username");
String pwd = request.getParameter ("password");
UsernamePasswordAuthenticationToken upat = new UsernamePasswordAuthenticationToken (usr, pwd);
return authenticationManager.authenticate (upat);
}
@Override
protected void successfulAuthentication (HttpServletRequest request, HttpServletResponse response, FilterChain filterChain, Authentication authentication) throws java.io.IOException, ServletException
{
UserDetails user = ((UserDetails) authentication.getPrincipal ());
@SuppressWarnings ("unchecked")
Collection <GrantedAuthority> roles = (Collection <GrantedAuthority>) user.getAuthorities ();
String token = Jwts.builder ()
.signWith (Keys.hmacShaKeyFor (SecurityConstants.JWT_SECRET.getBytes ()), SignatureAlgorithm.HS512)
.setHeaderParam ("typ", SecurityConstants.TOKEN_TYPE)
.setIssuer (SecurityConstants.TOKEN_ISSUER)
.setAudience (SecurityConstants.TOKEN_AUDIENCE)
.setSubject (user.getUsername ())
.setExpiration (new java.util.Date (System.currentTimeMillis () + 60 * 60 * 24 * 1000)) // 24h lifetime of token
.claim ("roles", roles)
.compact ();
response.addHeader (SecurityConstants.TOKEN_HEADER, SecurityConstants.TOKEN_PREFIX + token);
}
}
Question
How can I integration my 2 filters in Spring3 security?? authManager () is not available there.