CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

FINERACT-724 fix oauth authentication, replace DefaultPasswordEncoderFactories with standard spring security PasswordEncoderFactories

Browse Source
This commit is contained in:
ibondarenko
2019-11-22 18:28:10 +02:00
parent 1e0e6ca3e7
commit 347108b382
7 changed files with 34 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/domain/DefaultPasswordEncoderFactories.java
-54
View File
@@ -1,54 +0,0 @@
/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.fineract.infrastructure.core.domain;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.DelegatingPasswordEncoder;
import org.springframework.security.crypto.password.Md4PasswordEncoder;
import org.springframework.security.crypto.password.MessageDigestPasswordEncoder;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.crypto.password.Pbkdf2PasswordEncoder;
import org.springframework.security.crypto.scrypt.SCryptPasswordEncoder;
import java.util.HashMap;
import java.util.Map;
public class DefaultPasswordEncoderFactories {
@SuppressWarnings("deprecation")
public static PasswordEncoder createDelegatingPasswordEncoder() {
String encodingId = "bcrypt";
Map<String, PasswordEncoder> encoders = new HashMap<>();
encoders.put(encodingId, new BCryptPasswordEncoder());
encoders.put("ldap", new org.springframework.security.crypto.password.LdapShaPasswordEncoder());
encoders.put("MD4", new Md4PasswordEncoder());
encoders.put("MD5", new MessageDigestPasswordEncoder("MD5"));
encoders.put("noop", NoOpPasswordEncoder.getInstance());
encoders.put("pbkdf2", new Pbkdf2PasswordEncoder());
encoders.put("scrypt", new SCryptPasswordEncoder());
encoders.put("SHA-1", new MessageDigestPasswordEncoder("SHA-1"));
encoders.put("SHA-256", new MessageDigestPasswordEncoder("SHA-256"));
DelegatingPasswordEncoder delegatingPasswordEncoder = new DelegatingPasswordEncoder(encodingId, encoders);
delegatingPasswordEncoder.setDefaultPasswordEncoderForMatches(new MessageDigestPasswordEncoder("SHA-256"));
return delegatingPasswordEncoder;
}
}
fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/security/ApplicationSecurityConfiguration.java
-33
View File
@@ -1,33 +0,0 @@
/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.fineract.infrastructure.core.security;
import org.apache.fineract.infrastructure.core.domain.DefaultPasswordEncoderFactories;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;
@Configuration
public class ApplicationSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Bean
public PasswordEncoder passwordEncoder() {
return DefaultPasswordEncoderFactories.createDelegatingPasswordEncoder();
}
}
fineract-provider/src/main/java/org/apache/fineract/organisation/office/domain/Office.java
+3 -2
View File
@@ -18,6 +18,7 @@
*/
package org.apache.fineract.organisation.office.domain;
import java.io.Serializable;
import java.util.Date;
import java.util.LinkedHashMap;
import java.util.LinkedList;
@@ -45,7 +46,7 @@ import org.joda.time.LocalDate;
@Entity
@Table(name = "m_office", uniqueConstraints = { @UniqueConstraint(columnNames = { "name" }, name = "name_org"),
@UniqueConstraint(columnNames = { "external_id" }, name = "externalid_org") })
public class Office extends AbstractPersistableCustom<Long> {
public class Office extends AbstractPersistableCustom<Long> implements Serializable {
@OneToMany(fetch = FetchType.LAZY)
@JoinColumn(name = "parent_id")
@@ -246,4 +247,4 @@ public class Office extends AbstractPersistableCustom<Long> {
public void loadLazyCollections() {
this.children.size() ;
}
}
}
fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/Permission.java
+4 -2
View File
@@ -24,9 +24,11 @@ import javax.persistence.Table;
import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
import java.io.Serializable;
@Entity
@Table(name = "m_permission")
public class Permission extends AbstractPersistableCustom<Long> {
public class Permission extends AbstractPersistableCustom<Long> implements Serializable {
@Column(name = "grouping", nullable = false, length = 45)
private String grouping;
@@ -81,4 +83,4 @@ public class Permission extends AbstractPersistableCustom<Long> {
return !isUpdatedValueSame;
}
}
}
fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/Role.java
+3 -2
View File
@@ -18,6 +18,7 @@
*/
package org.apache.fineract.useradministration.domain;
import java.io.Serializable;
import java.util.Collection;
import java.util.HashSet;
import java.util.LinkedHashMap;
@@ -39,7 +40,7 @@ import org.apache.fineract.useradministration.data.RoleData;
@Entity
@Table(name = "m_role", uniqueConstraints = { @UniqueConstraint(columnNames = { "name" }, name = "unq_name") })
public class Role extends AbstractPersistableCustom<Long> {
public class Role extends AbstractPersistableCustom<Long> implements Serializable {
@Column(name = "name", unique = true, nullable = false, length = 100)
private String name;
@@ -148,4 +149,4 @@ public class Role extends AbstractPersistableCustom<Long> {
public Boolean isEnabled() {
return this.disabled;
}
}
}
fineract-provider/src/main/resources/META-INF/spring/securityContext.xml
+22 -31
View File
@@ -63,22 +63,22 @@
<custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />
<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
</http>
<beans:bean id="basicAuthenticationEntryPoint"
class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
<beans:property name="realmName" value="Fineract Platform API" />
</beans:bean>
<beans:bean id="passwordEncoder" class="org.apache.fineract.infrastructure.core.domain.DefaultPasswordEncoderFactories"
factory-method="createDelegatingPasswordEncoder">
</beans:bean>
<beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
factory-method="createDelegatingPasswordEncoder">
</beans:bean>
<beans:bean id="customAuthenticationProvider"
class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<beans:property name="userDetailsService" ref="userDetailsService" />
<beans:property name="passwordEncoder" ref="passwordEncoder" />
</beans:bean>
<authentication-manager alias="authenticationManager"
erase-credentials="false">
<authentication-provider ref="customAuthenticationProvider" />
@@ -114,7 +114,7 @@
<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<http pattern="/api/oauth/token" create-session="stateless"
entry-point-ref="oauthAuthenticationEntryPoint" use-expressions="true"
authentication-manager-ref="clientAuthenticationManager">
@@ -124,7 +124,7 @@
<intercept-url pattern="/api/oauth/token" method="POST"
access="isFullyAuthenticated()" requires-channel="https" />
<anonymous enabled="false" />
<custom-filter ref="tenantIdentifierProcessingFilter"
position="FIRST" />
<custom-filter ref="clientCredentialsTokenEndpointFilter"
@@ -132,7 +132,7 @@
<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<beans:bean id="passwordEncoder" class="org.apache.fineract.infrastructure.core.domain.DefaultPasswordEncoderFactories"
<beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
factory-method="createDelegatingPasswordEncoder">
</beans:bean>
@@ -140,18 +140,16 @@
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<beans:property name="realmName" value="Fineract Platform API" />
</beans:bean>
<beans:bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<beans:bean id="clientCredentialsTokenEndpointFilter"
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
<beans:constructor-arg value="/api/oauth/token" />
<beans:property name="authenticationManager" ref="clientAuthenticationManager" />
</beans:bean>
<beans:bean id="accessDecisionManager"
class="org.springframework.security.access.vote.UnanimousBased">
<beans:constructor-arg>
@@ -168,22 +166,17 @@
</beans:list>
</beans:constructor-arg>
</beans:bean>
<authentication-manager id="clientAuthenticationManager">
<authentication-manager id="clientAuthenticationManager" erase-credentials="false">
<authentication-provider user-service-ref="clientDetailsUserService" />
<authentication-provider ref="customAuthenticationProvider" />
</authentication-manager>
<authentication-manager alias="authenticationManager"
erase-credentials="false">
<authentication-provider ref="customAuthenticationProvider" />
</authentication-manager>
<beans:bean id="clientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<beans:constructor-arg ref="clientDetailsService" />
</beans:bean>
<beans:bean id="customAuthenticationProvider"
class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<beans:property name="userDetailsService" ref="userDetailsService" />
@@ -195,12 +188,11 @@
<beans:constructor-arg ref="routingDataSource" />
</beans:bean>
<beans:bean id="tokenStore"
class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
<beans:constructor-arg ref="routingDataSource" />
</beans:bean>
<beans:bean id="tokenServices"
class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
<beans:property name="tokenStore" ref="tokenStore" />
@@ -211,19 +203,19 @@
<beans:property name="accessTokenValiditySeconds"
value="3600" />
</beans:bean>
<beans:bean id="userApprovalHandler"
class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
<beans:property name="tokenStore" ref="tokenStore" />
<beans:property name="clientDetailsService" ref="clientDetailsService" />
<beans:property name="requestFactory" ref="oAuth2RequestFactory" />
</beans:bean>
<beans:bean id="oAuth2RequestFactory"
class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
<beans:constructor-arg ref="clientDetailsService" />
</beans:bean>
<oauth:authorization-server
client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"
user-approval-handler-ref="userApprovalHandler" token-endpoint-url="/api/oauth/token"
@@ -231,9 +223,8 @@
<oauth:refresh-token />
<oauth:password />
</oauth:authorization-server>
<oauth:resource-server id="resourceServerFilter"
<oauth:resource-server id="resourceServerFilter" stateless="false"
token-services-ref="tokenServices" />
</beans:beans>
</beans:beans>
fineract-provider/src/main/resources/sql/migrations/core_db/V353__migrate_passwords_to_ss_5.sql
+2 -1
View File
@@ -17,4 +17,5 @@
-- under the License.
--
UPDATE m_appuser SET password = CONCAT('{', id, '}', password) WHERE password NOT LIKE '{%';
UPDATE m_appuser SET password = CONCAT('{SHA-256}{', id, '}', password) WHERE password NOT LIKE '{%';
UPDATE oauth_client_details SET client_secret = CONCAT('{SHA-256}', SHA2(client_secret, 256)) WHERE client_secret NOT LIKE '{%';