rel #6118 switching from xml to java based web security configuration

diff --git a/cdmlib-remote-webapp/src/main/webapp/WEB-INF/applicationContext.xml b/cdmlib-remote-webapp/src/main/webapp/WEB-INF/applicationContext.xml
index 36b0e701438ef57406e49c76e9b33bb220f22518..7193dd938dab7d415e249ac7b6abf5b3afe2219b 100644 (file)
--- a/cdmlib-remote-webapp/src/main/webapp/WEB-INF/applicationContext.xml
+++ b/cdmlib-remote-webapp/src/main/webapp/WEB-INF/applicationContext.xml
@@ -13,6 +13,8 @@
     bootstrapping of this web application see: 
     http://dev.e-taxonomy.eu/trac/wiki/cdmlib-remote-webappConfigurationAndBootstrapping
   -->
+  
+  <context:annotation-config />
 
   <!-- include default application context and customization -->
   <import resource="classpath:/eu/etaxonomy/cdm/defaultApplicationContext.xml" />
@@ -21,8 +23,7 @@
   </bean>
   <context:component-scan base-package="eu/etaxonomy/cdm/ext" />
 
-  <!-- <import resource="classpath:/eu/etaxonomy/cdm/remote.xml"/> -->
-  <import resource="classpath:/eu/etaxonomy/cdm/remote-security.xml" />
+  <import resource="classpath:/eu/etaxonomy/cdm/remote.xml"/>
   <context:component-scan base-package="eu/etaxonomy/cdm/io">
     <context:exclude-filter type="regex"
       expression="eu\.etaxonomy\.cdm\.io\.pesi.*" />
@@ -54,8 +55,10 @@
 
   <!-- CONFIGURE WEB APPLICATION HERE -->
   <import resource="datasources/configurable.xml" />
+  
+  <!-- bootstrap the WebSecurityConfiguration -->
+  <bean class="eu.etaxonomy.cdm.remote.config.MultiWebSecurityConfiguration"></bean>
 
-  <context:annotation-config />
   <bean class="eu.etaxonomy.cdm.remote.config.LoggingConfigurer">
   </bean>
 

diff --git a/cdmlib-remote/src/main/java/eu/etaxonomy/cdm/remote/config/MultiWebSecurityConfiguration.java b/cdmlib-remote/src/main/java/eu/etaxonomy/cdm/remote/config/MultiWebSecurityConfiguration.java
new file mode 100644 (file)
index 0000000..d77e366
--- /dev/null
+++ b/cdmlib-remote/src/main/java/eu/etaxonomy/cdm/remote/config/MultiWebSecurityConfiguration.java
@@ -0,0 +1,70 @@
+/**
+ * Copyright (C) 2016 EDIT
+ * European Distributed Institute of Taxonomy
+ * http://www.e-taxonomy.eu
+ *
+ * The contents of this file are subject to the Mozilla Public License Version 1.1
+ * See LICENSE.TXT at the top of this package for the full license terms.
+ */
+package eu.etaxonomy.cdm.remote.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+/**
+ * @author a.kohlbecker
+ * @date Oct 6, 2016
+ *
+ */
+@EnableWebSecurity
+public class MultiWebSecurityConfiguration {
+
+    /**
+     * Check for full authentication for remoting services
+     * @author a.kohlbecker
+     * @date Oct 6, 2016
+     *
+     */
+    @Configuration
+    @Order(1)
+    public static class RemotingWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
+        @Override
+        protected void configure(HttpSecurity http) throws Exception {
+              // @formatter:off
+                 http
+             .anonymous().disable()
+             .antMatcher("/remoting/**")
+                 .authorizeRequests().anyRequest().fullyAuthenticated()
+                 .and()
+             .csrf().disable()
+             .httpBasic();
+             // @formatter:on
+        }
+    }
+
+    /**
+     * Allow anonymous authentication for all other services
+     * @author a.kohlbecker
+     * @date Oct 6, 2016
+     *
+     */
+    @Configuration
+    public static class DefaultWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
+        @Override
+        protected void configure(HttpSecurity http) throws Exception {
+              // @formatter:off
+                 http
+             .anonymous().and()
+             .antMatcher("/**").authorizeRequests().anyRequest().hasAnyRole("ANONYMOUS", "USER", "ADMIN")
+                .and()
+             .csrf()
+             .disable()
+             .httpBasic();
+             // @formatter:on
+        }
+    }
+
+}

diff --git a/cdmlib-remote/src/main/resources/eu/etaxonomy/cdm/remote-security.xml b/cdmlib-remote/src/main/resources/eu/etaxonomy/cdm/remote-security.xml
deleted file mode 100644 (file)
index 1b22749..0000000
--- a/cdmlib-remote/src/main/resources/eu/etaxonomy/cdm/remote-security.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
-  xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd
-               http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
-
-  <import resource="remote.xml" />
-
-  <!-- Pattern to intercept URL requests -->
-
-  <security:http auto-config="true" authentication-manager-ref="authenticationManager" use-expressions="true">
-    <!-- check for full authentication for remoting services -->
-    <!-- (from http://docs.spring.io/spring-security/site/docs/3.0.x/reference/springsecurity-single.html#el-access) -->
-    <security:intercept-url pattern="/remoting/**" access="isFullyAuthenticated()" />
-    <security:http-basic />
-    <security:csrf disabled="true"/>
-  </security:http>
-</beans>

diff --git a/cdmlib-remote/src/main/resources/eu/etaxonomy/cdm/remote.xml b/cdmlib-remote/src/main/resources/eu/etaxonomy/cdm/remote.xml
index 81de67ed6b856a5bfc01ce6bb0d0511858d95361..8d642692e83eb0d0951928a789af1a8f86a8954a 100644 (file)
--- a/cdmlib-remote/src/main/resources/eu/etaxonomy/cdm/remote.xml
+++ b/cdmlib-remote/src/main/resources/eu/etaxonomy/cdm/remote.xml
@@ -9,7 +9,6 @@
     http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.5.xsd
     ">
 
-
   <bean id="marshaller" name="marshaller" class="org.springframework.oxm.jaxb.Jaxb2Marshaller">
     <property name="classesToBeBound">
       <list>