Revise user controller to answer real data

[portal/ric-dashboard.git] / webapp-backend / src / main / java / org / oransc / ric / portal / dashboard / config / WebSecurityConfiguration.java

diff --git a/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java b/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java
index 4e24356..33458ba 100644 (file)
--- a/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java
+++ b/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java
@@ -2,7 +2,7 @@
  * ========================LICENSE_START=================================
  * O-RAN-SC
  * %%
- * Copyright (C) 2019 AT&T Intellectual Property and Nokia
+ * Copyright (C) 2019 AT&T Intellectual Property
  * %%
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,23 +23,20 @@ import java.io.IOException;
 import java.lang.invoke.MethodHandles;
 import java.lang.reflect.InvocationTargetException;
 
-import org.onap.portalsdk.core.onboarding.crossapi.PortalRestAPIProxy;
 import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
-import org.oransc.ric.portal.dashboard.DashboardConstants;
-import org.oransc.ric.portal.dashboard.LoginServlet;
-import org.oransc.ric.portal.dashboard.controller.AcXappController;
+import org.oransc.ric.portal.dashboard.DashboardUserManager;
+import org.oransc.ric.portal.dashboard.controller.A1MediatorController;
 import org.oransc.ric.portal.dashboard.controller.AdminController;
 import org.oransc.ric.portal.dashboard.controller.AnrXappController;
 import org.oransc.ric.portal.dashboard.controller.AppManagerController;
 import org.oransc.ric.portal.dashboard.controller.E2ManagerController;
 import org.oransc.ric.portal.dashboard.controller.SimpleErrorController;
-import org.oransc.ric.portal.dashboard.portalapi.DashboardUserManager;
 import org.oransc.ric.portal.dashboard.portalapi.PortalAuthManager;
 import org.oransc.ric.portal.dashboard.portalapi.PortalAuthenticationFilter;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.web.servlet.ServletRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Profile;
@@ -61,8 +58,8 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
 
        // Although constructor arguments are recommended over field injection,
        // this results in fewer lines of code.
-       @Value("${userfile}")
-       private String userFilePath;
+       @Value("${portalapi.security}")
+       private Boolean portalapiSecurity;
        @Value("${portalapi.appname}")
        private String appName;
        @Value("${portalapi.username}")
@@ -74,10 +71,14 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
        @Value("${portalapi.usercookie}")
        private String userCookie;
 
+       @Autowired
+       DashboardUserManager userManager;
+
        protected void configure(HttpSecurity http) throws Exception {
                logger.debug("configure: portalapi.username {}", userName);
                // A chain of ".and()" always baffles me
                http.authorizeRequests().anyRequest().authenticated();
+               http.headers().frameOptions().disable();
                http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
                http.addFilterBefore(portalAuthenticationFilterBean(), BasicAuthenticationFilter.class);
        }
@@ -92,7 +93,7 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
                        "/swagger-ui.html", //
                        "/webjars/**", //
                        PortalApiConstants.API_PREFIX + "/**", //
-                       AcXappController.CONTROLLER_PATH + "/" + AcXappController.VERSION_METHOD, //
+                       A1MediatorController.CONTROLLER_PATH + "/" + A1MediatorController.VERSION_METHOD, //
                        AdminController.CONTROLLER_PATH + "/" + AdminController.HEALTH_METHOD, //
                        AdminController.CONTROLLER_PATH + "/" + AdminController.VERSION_METHOD, //
                        AnrXappController.CONTROLLER_PATH + "/" + AnrXappController.HEALTH_ALIVE_METHOD, //
@@ -103,9 +104,7 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
                        AppManagerController.CONTROLLER_PATH + "/" + AppManagerController.VERSION_METHOD, //
                        E2ManagerController.CONTROLLER_PATH + "/" + E2ManagerController.HEALTH_METHOD, //
                        E2ManagerController.CONTROLLER_PATH + "/" + E2ManagerController.VERSION_METHOD, //
-                       SimpleErrorController.ERROR_PATH, //
-                       DashboardConstants.LOGIN_PAGE //
-       };
+                       SimpleErrorController.ERROR_PATH };
 
        @Override
        public void configure(WebSecurity web) throws Exception {
@@ -120,11 +119,6 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
                return new PortalAuthManager(appName, userName, password, decryptor, userCookie);
        }
 
-       @Bean
-       public DashboardUserManager dashboardUserManagerBean() throws IOException {
-               return new DashboardUserManager(userFilePath);
-       }
-
        /*
         * If this is annotated with @Bean, it is created automatically AND REGISTERED,
         * and Spring processes annotations in the source of the class. However, the
@@ -137,41 +131,9 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
        public PortalAuthenticationFilter portalAuthenticationFilterBean()
                        throws ClassNotFoundException, InstantiationException, IllegalAccessException, IOException,
                        IllegalArgumentException, InvocationTargetException, NoSuchMethodException, SecurityException {
-               PortalAuthenticationFilter portalAuthenticationFilter = new PortalAuthenticationFilter(portalAuthManagerBean(),
-                               dashboardUserManagerBean());
+               PortalAuthenticationFilter portalAuthenticationFilter = new PortalAuthenticationFilter(portalapiSecurity,
+                               portalAuthManagerBean(), this.userManager);
                return portalAuthenticationFilter;
        }
 
-       /**
-        * Instantiates the EPSDK-FW servlet. Needed because this app is not configured
-        * to scan the EPSDK-FW packages; there's also a chance that Spring-Boot does
-        * not automatically process @WebServlet annotations.
-        * 
-        * @return Servlet registration bean for the Portal Rest API proxy servlet.
-        */
-       @Bean
-       public ServletRegistrationBean<PortalRestAPIProxy> portalApiProxyServletBean() {
-               PortalRestAPIProxy servlet = new PortalRestAPIProxy();
-               final ServletRegistrationBean<PortalRestAPIProxy> servletBean = new ServletRegistrationBean<>(servlet,
-                               PortalApiConstants.API_PREFIX + "/*");
-               servletBean.setName("PortalRestApiProxyServlet");
-               return servletBean;
-       }
-
-       /**
-        * Instantiates a trivial login servlet that serves a basic page with a link to
-        * authenticate at Portal. The login filter redirects to this page instead of
-        * Portal.
-        * 
-        * @return Servlet registration bean for the Dashboard login servlet.
-        */
-       @Bean
-       public ServletRegistrationBean<LoginServlet> loginServletBean() {
-               LoginServlet servlet = new LoginServlet();
-               final ServletRegistrationBean<LoginServlet> servletBean = new ServletRegistrationBean<>(servlet,
-                               DashboardConstants.LOGIN_PAGE);
-               servletBean.setName("LoginServlet");
-               return servletBean;
-       }
-
 }