FINERACT-724 fix oauth authentication, replace DefaultPasswordEncoderFactories with standard spring security PasswordEncoderFactories

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/domain/DefaultPasswordEncoderFactories.java

@@ -1,54 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.fineract.infrastructure.core.domain;
-
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.DelegatingPasswordEncoder;
-import org.springframework.security.crypto.password.Md4PasswordEncoder;
-import org.springframework.security.crypto.password.MessageDigestPasswordEncoder;
-import org.springframework.security.crypto.password.NoOpPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder;
-import org.springframework.security.crypto.password.Pbkdf2PasswordEncoder;
-import org.springframework.security.crypto.scrypt.SCryptPasswordEncoder;
-
-import java.util.HashMap;
-import java.util.Map;
-
-
-public class DefaultPasswordEncoderFactories {
-
-    @SuppressWarnings("deprecation")
-    public static PasswordEncoder createDelegatingPasswordEncoder() {
-        String encodingId = "bcrypt";
-        Map<String, PasswordEncoder> encoders = new HashMap<>();
-        encoders.put(encodingId, new BCryptPasswordEncoder());
-        encoders.put("ldap", new org.springframework.security.crypto.password.LdapShaPasswordEncoder());
-        encoders.put("MD4", new Md4PasswordEncoder());
-        encoders.put("MD5", new MessageDigestPasswordEncoder("MD5"));
-        encoders.put("noop", NoOpPasswordEncoder.getInstance());
-        encoders.put("pbkdf2", new Pbkdf2PasswordEncoder());
-        encoders.put("scrypt", new SCryptPasswordEncoder());
-        encoders.put("SHA-1", new MessageDigestPasswordEncoder("SHA-1"));
-        encoders.put("SHA-256", new MessageDigestPasswordEncoder("SHA-256"));
-
-        DelegatingPasswordEncoder delegatingPasswordEncoder = new DelegatingPasswordEncoder(encodingId, encoders);
-        delegatingPasswordEncoder.setDefaultPasswordEncoderForMatches(new MessageDigestPasswordEncoder("SHA-256"));
-        return delegatingPasswordEncoder;
-    }
-}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/security/ApplicationSecurityConfiguration.java

@@ -1,33 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.fineract.infrastructure.core.security;
-
-import org.apache.fineract.infrastructure.core.domain.DefaultPasswordEncoderFactories;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.crypto.password.PasswordEncoder;
-
-@Configuration
-public class ApplicationSecurityConfiguration  extends WebSecurityConfigurerAdapter {
-    @Bean
-    public PasswordEncoder passwordEncoder() {
-        return DefaultPasswordEncoderFactories.createDelegatingPasswordEncoder();
-    }
-}

fineract-provider/src/main/java/org/apache/fineract/organisation/office/domain/Office.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.organisation.office.domain;
 
+import java.io.Serializable;
 import java.util.Date;
 import java.util.LinkedHashMap;
 import java.util.LinkedList;
@@ -45,7 +46,7 @@ import org.joda.time.LocalDate;
 @Entity
 @Table(name = "m_office", uniqueConstraints = { @UniqueConstraint(columnNames = { "name" }, name = "name_org"),
         @UniqueConstraint(columnNames = { "external_id" }, name = "externalid_org") })
-public class Office extends AbstractPersistableCustom<Long> {
+public class Office extends AbstractPersistableCustom<Long> implements Serializable {
 
     @OneToMany(fetch = FetchType.LAZY)
     @JoinColumn(name = "parent_id")
@@ -246,4 +247,4 @@ public class Office extends AbstractPersistableCustom<Long> {
     public void loadLazyCollections() {
         this.children.size() ;
     }
-}
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/Permission.java

@@ -24,9 +24,11 @@ import javax.persistence.Table;
 
 import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
 
+import java.io.Serializable;
+
 @Entity
 @Table(name = "m_permission")
-public class Permission extends AbstractPersistableCustom<Long> {
+public class Permission extends AbstractPersistableCustom<Long> implements Serializable {
 
     @Column(name = "grouping", nullable = false, length = 45)
     private String grouping;
@@ -81,4 +83,4 @@ public class Permission extends AbstractPersistableCustom<Long> {
 
         return !isUpdatedValueSame;
     }
-}
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/Role.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.useradministration.domain;
 
+import java.io.Serializable;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
@@ -39,7 +40,7 @@ import org.apache.fineract.useradministration.data.RoleData;
 
 @Entity
 @Table(name = "m_role", uniqueConstraints = { @UniqueConstraint(columnNames = { "name" }, name = "unq_name") })
-public class Role extends AbstractPersistableCustom<Long> {
+public class Role extends AbstractPersistableCustom<Long> implements Serializable {
 
     @Column(name = "name", unique = true, nullable = false, length = 100)
     private String name;
@@ -148,4 +149,4 @@ public class Role extends AbstractPersistableCustom<Long> {
     public Boolean isEnabled() {
         return this.disabled;
     }
-}
+}

fineract-provider/src/main/resources/META-INF/spring/securityContext.xml

@@ -63,22 +63,22 @@
 			<custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />
 			<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
 		</http>
-	
+
 		<beans:bean id="basicAuthenticationEntryPoint"
 			class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
 			<beans:property name="realmName" value="Fineract Platform API" />
 		</beans:bean>
 
-		<beans:bean id="passwordEncoder" class="org.apache.fineract.infrastructure.core.domain.DefaultPasswordEncoderFactories"
+        <beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
-					factory-method="createDelegatingPasswordEncoder">
+                    factory-method="createDelegatingPasswordEncoder">
-		</beans:bean>
+        </beans:bean>
 
 		<beans:bean id="customAuthenticationProvider"
 			class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
 			<beans:property name="userDetailsService" ref="userDetailsService" />
 			<beans:property name="passwordEncoder" ref="passwordEncoder" />
 		</beans:bean>
-	
+
 		<authentication-manager alias="authenticationManager"
 			erase-credentials="false">
 			<authentication-provider ref="customAuthenticationProvider" />
@@ -114,7 +114,7 @@
 			<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
 			<access-denied-handler ref="oauthAccessDeniedHandler" />
 		</http>
-	
+
 		<http pattern="/api/oauth/token" create-session="stateless"
 			entry-point-ref="oauthAuthenticationEntryPoint" use-expressions="true"
 			authentication-manager-ref="clientAuthenticationManager">
@@ -124,7 +124,7 @@
 			<intercept-url pattern="/api/oauth/token" method="POST"
 				access="isFullyAuthenticated()" requires-channel="https" />
 			<anonymous enabled="false" />
-	
+
 			<custom-filter ref="tenantIdentifierProcessingFilter"
 				position="FIRST" />
 			<custom-filter ref="clientCredentialsTokenEndpointFilter"
@@ -132,7 +132,7 @@
 			<access-denied-handler ref="oauthAccessDeniedHandler" />
 		</http>
 
-        <beans:bean id="passwordEncoder" class="org.apache.fineract.infrastructure.core.domain.DefaultPasswordEncoderFactories"
+        <beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
                     factory-method="createDelegatingPasswordEncoder">
         </beans:bean>
 
@@ -140,18 +140,16 @@
 			class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
 			<beans:property name="realmName" value="Fineract Platform API" />
 		</beans:bean>
-	
+
 		<beans:bean id="oauthAccessDeniedHandler"
 			class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
-	
+
-	
 		<beans:bean id="clientCredentialsTokenEndpointFilter"
 			class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
 			<beans:constructor-arg value="/api/oauth/token" />
 			<beans:property name="authenticationManager" ref="clientAuthenticationManager" />
-	
 		</beans:bean>
-	
+
 		<beans:bean id="accessDecisionManager"
 			class="org.springframework.security.access.vote.UnanimousBased">
 			<beans:constructor-arg>
@@ -168,22 +166,17 @@
 				</beans:list>
 			</beans:constructor-arg>
 		</beans:bean>
-	
+
-	
+		<authentication-manager id="clientAuthenticationManager" erase-credentials="false">
-		<authentication-manager id="clientAuthenticationManager">
 			<authentication-provider user-service-ref="clientDetailsUserService" />
+            <authentication-provider ref="customAuthenticationProvider" />
 		</authentication-manager>
-	
+
-		<authentication-manager alias="authenticationManager"
-			erase-credentials="false">
-			<authentication-provider ref="customAuthenticationProvider" />
-		</authentication-manager>
-	
 		<beans:bean id="clientDetailsUserService"
 			class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
 			<beans:constructor-arg ref="clientDetailsService" />
 		</beans:bean>
-	
+
 		<beans:bean id="customAuthenticationProvider"
 			class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
 			<beans:property name="userDetailsService" ref="userDetailsService" />
@@ -195,12 +188,11 @@
 			<beans:constructor-arg ref="routingDataSource" />
 		</beans:bean>
 	
-	
 		<beans:bean id="tokenStore"
 			class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
 			<beans:constructor-arg ref="routingDataSource" />
 		</beans:bean>
-	
+
 		<beans:bean id="tokenServices"
 			class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
 			<beans:property name="tokenStore" ref="tokenStore" />
@@ -211,19 +203,19 @@
 			<beans:property name="accessTokenValiditySeconds"
 				value="3600" />
 		</beans:bean>
-	
+
 		<beans:bean id="userApprovalHandler"
 			class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
 			<beans:property name="tokenStore" ref="tokenStore" />
 			<beans:property name="clientDetailsService" ref="clientDetailsService" />
 			<beans:property name="requestFactory" ref="oAuth2RequestFactory" />
 		</beans:bean>
-	
+
 		<beans:bean id="oAuth2RequestFactory"
 			class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
 			<beans:constructor-arg ref="clientDetailsService" />
 		</beans:bean>
-	
+
 		<oauth:authorization-server
 			client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"
 			user-approval-handler-ref="userApprovalHandler" token-endpoint-url="/api/oauth/token"
@@ -231,9 +223,8 @@
 			<oauth:refresh-token />
 			<oauth:password />
 		</oauth:authorization-server>
-	
+
-		<oauth:resource-server id="resourceServerFilter"
+		<oauth:resource-server id="resourceServerFilter" stateless="false"
 			token-services-ref="tokenServices" />
 	</beans:beans>
 </beans:beans>
-

fineract-provider/src/main/resources/sql/migrations/core_db/V353__migrate_passwords_to_ss_5.sql

@@ -17,4 +17,5 @@
 -- under the License.
 --
 
-UPDATE m_appuser SET password = CONCAT('{', id, '}', password) WHERE password NOT LIKE '{%';
+UPDATE m_appuser SET password = CONCAT('{SHA-256}{', id, '}', password) WHERE password NOT LIKE '{%';
+UPDATE oauth_client_details SET client_secret = CONCAT('{SHA-256}', SHA2(client_secret, 256)) WHERE client_secret NOT LIKE '{%';