X-Git-Url: https://gerrit.o-ran-sc.org/r/gitweb?a=blobdiff_plain;f=webapp-backend%2Fsrc%2Fmain%2Fjava%2Forg%2Foransc%2Fric%2Fportal%2Fdashboard%2Fconfig%2FWebSecurityConfiguration.java;h=f1438d7ee704e004616ff2b68a06b99a33de8ee4;hb=a82f827644fa87b576d9de3f77cb1b78d25d356d;hp=4e1ddb41a18e5a782a8784fde860cf12cd976da5;hpb=749749f288de7ef42e3d1507c7f07a4453a774b4;p=portal%2Fric-dashboard.git diff --git a/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java b/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java index 4e1ddb41..f1438d7e 100644 --- a/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java +++ b/webapp-backend/src/main/java/org/oransc/ric/portal/dashboard/config/WebSecurityConfiguration.java @@ -2,7 +2,7 @@ * ========================LICENSE_START================================= * O-RAN-SC * %% - * Copyright (C) 2019 AT&T Intellectual Property and Nokia + * Copyright (C) 2019 AT&T Intellectual Property * %% * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -19,27 +19,23 @@ */ package org.oransc.ric.portal.dashboard.config; -import java.io.IOException; import java.lang.invoke.MethodHandles; import java.lang.reflect.InvocationTargetException; -import org.onap.portalsdk.core.onboarding.crossapi.PortalRestAPIProxy; import org.onap.portalsdk.core.onboarding.util.PortalApiConstants; import org.oransc.ric.portal.dashboard.DashboardConstants; -import org.oransc.ric.portal.dashboard.LoginServlet; +import org.oransc.ric.portal.dashboard.DashboardUserManager; import org.oransc.ric.portal.dashboard.controller.A1MediatorController; import org.oransc.ric.portal.dashboard.controller.AdminController; -import org.oransc.ric.portal.dashboard.controller.AnrXappController; import org.oransc.ric.portal.dashboard.controller.AppManagerController; import org.oransc.ric.portal.dashboard.controller.E2ManagerController; import org.oransc.ric.portal.dashboard.controller.SimpleErrorController; -import org.oransc.ric.portal.dashboard.portalapi.DashboardUserManager; import org.oransc.ric.portal.dashboard.portalapi.PortalAuthManager; import org.oransc.ric.portal.dashboard.portalapi.PortalAuthenticationFilter; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; -import org.springframework.boot.web.servlet.ServletRegistrationBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Profile; @@ -61,8 +57,8 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { // Although constructor arguments are recommended over field injection, // this results in fewer lines of code. - @Value("${userfile}") - private String userFilePath; + @Value("${portalapi.security}") + private Boolean portalapiSecurity; @Value("${portalapi.appname}") private String appName; @Value("${portalapi.username}") @@ -74,8 +70,12 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { @Value("${portalapi.usercookie}") private String userCookie; + @Autowired + DashboardUserManager userManager; + + @Override protected void configure(HttpSecurity http) throws Exception { - logger.debug("configure: portalapi.username {}", userName); + logger.debug("configure: portalapi.appName {}", appName); // A chain of ".and()" always baffles me http.authorizeRequests().anyRequest().authenticated(); http.headers().frameOptions().disable(); @@ -84,29 +84,27 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { } /** - * Resource paths that do not require authentication, especially including + * Resource paths that do not require authentication, including * Swagger-generated documentation. */ - public static final String[] OPEN_PATHS = { // + protected static final String[] OPEN_PATHS = { // "/v2/api-docs", // "/swagger-resources/**", // "/swagger-ui.html", // "/webjars/**", // PortalApiConstants.API_PREFIX + "/**", // - A1MediatorController.CONTROLLER_PATH + "/" + A1MediatorController.VERSION_METHOD, // + A1MediatorController.CONTROLLER_PATH + "/" + DashboardConstants.VERSION_METHOD, // AdminController.CONTROLLER_PATH + "/" + AdminController.HEALTH_METHOD, // AdminController.CONTROLLER_PATH + "/" + AdminController.VERSION_METHOD, // - AnrXappController.CONTROLLER_PATH + "/" + AnrXappController.HEALTH_ALIVE_METHOD, // - AnrXappController.CONTROLLER_PATH + "/" + AnrXappController.HEALTH_READY_METHOD, // - AnrXappController.CONTROLLER_PATH + "/" + AnrXappController.VERSION_METHOD, // - AppManagerController.CONTROLLER_PATH + "/" + AppManagerController.HEALTH_ALIVE_METHOD, // - AppManagerController.CONTROLLER_PATH + "/" + AppManagerController.HEALTH_READY_METHOD, // - AppManagerController.CONTROLLER_PATH + "/" + AppManagerController.VERSION_METHOD, // - E2ManagerController.CONTROLLER_PATH + "/" + E2ManagerController.HEALTH_METHOD, // - E2ManagerController.CONTROLLER_PATH + "/" + E2ManagerController.VERSION_METHOD, // - SimpleErrorController.ERROR_PATH, // - DashboardConstants.LOGIN_PAGE // - }; + AppManagerController.CONTROLLER_PATH + "/" + DashboardConstants.RIC_INSTANCE_KEY + "/*/" + + AppManagerController.HEALTH_ALIVE_METHOD, // + AppManagerController.CONTROLLER_PATH + "/" + DashboardConstants.RIC_INSTANCE_KEY + "/*/" + + AppManagerController.HEALTH_READY_METHOD, // + AppManagerController.CONTROLLER_PATH + "/" + DashboardConstants.VERSION_METHOD, // + E2ManagerController.CONTROLLER_PATH + "/" + DashboardConstants.RIC_INSTANCE_KEY + "/*/" + + E2ManagerController.HEALTH_METHOD, // + E2ManagerController.CONTROLLER_PATH + "/" + DashboardConstants.VERSION_METHOD, // + SimpleErrorController.ERROR_PATH }; @Override public void configure(WebSecurity web) throws Exception { @@ -115,17 +113,12 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { } @Bean - public PortalAuthManager portalAuthManagerBean() - throws IOException, ClassNotFoundException, InstantiationException, IllegalAccessException, - IllegalArgumentException, InvocationTargetException, NoSuchMethodException, SecurityException { + public PortalAuthManager portalAuthManagerBean() throws ClassNotFoundException, IllegalAccessException, + InstantiationException, InvocationTargetException, NoSuchMethodException { + logger.debug("portalAuthManagerBean"); return new PortalAuthManager(appName, userName, password, decryptor, userCookie); } - @Bean - public DashboardUserManager dashboardUserManagerBean() throws IOException { - return new DashboardUserManager(userFilePath); - } - /* * If this is annotated with @Bean, it is created automatically AND REGISTERED, * and Spring processes annotations in the source of the class. However, the @@ -135,44 +128,10 @@ public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { * bypass this filter, which seems to me means the filter participates * correctly. */ - public PortalAuthenticationFilter portalAuthenticationFilterBean() - throws ClassNotFoundException, InstantiationException, IllegalAccessException, IOException, - IllegalArgumentException, InvocationTargetException, NoSuchMethodException, SecurityException { - PortalAuthenticationFilter portalAuthenticationFilter = new PortalAuthenticationFilter(portalAuthManagerBean(), - dashboardUserManagerBean()); - return portalAuthenticationFilter; - } - - /** - * Instantiates the EPSDK-FW servlet. Needed because this app is not configured - * to scan the EPSDK-FW packages; there's also a chance that Spring-Boot does - * not automatically process @WebServlet annotations. - * - * @return Servlet registration bean for the Portal Rest API proxy servlet. - */ - @Bean - public ServletRegistrationBean portalApiProxyServletBean() { - PortalRestAPIProxy servlet = new PortalRestAPIProxy(); - final ServletRegistrationBean servletBean = new ServletRegistrationBean<>(servlet, - PortalApiConstants.API_PREFIX + "/*"); - servletBean.setName("PortalRestApiProxyServlet"); - return servletBean; - } - - /** - * Instantiates a trivial login servlet that serves a basic page with a link to - * authenticate at Portal. The login filter redirects to this page instead of - * Portal. - * - * @return Servlet registration bean for the Dashboard login servlet. - */ - @Bean - public ServletRegistrationBean loginServletBean() { - LoginServlet servlet = new LoginServlet(); - final ServletRegistrationBean servletBean = new ServletRegistrationBean<>(servlet, - DashboardConstants.LOGIN_PAGE); - servletBean.setName("LoginServlet"); - return servletBean; + public PortalAuthenticationFilter portalAuthenticationFilterBean() throws ClassNotFoundException, + IllegalAccessException, InstantiationException, InvocationTargetException, NoSuchMethodException { + logger.debug("portalAuthenticationFilterBean"); + return new PortalAuthenticationFilter(portalapiSecurity, portalAuthManagerBean(), this.userManager); } }