implementation of FINERACT-724 (Upgrade Spring Boot, Spring and Spring Security to their latest stable version)

fineract-provider/src/main/resources/META-INF/spring/appContext.xml

@@ -24,17 +24,17 @@
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
 	xmlns:jpa="http://www.springframework.org/schema/data/jpa" xmlns:sec="http://www.springframework.org/schema/security"
 	xmlns:tx="http://www.springframework.org/schema/tx" xmlns:cache="http://www.springframework.org/schema/cache"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
 		http://www.springframework.org/schema/data/jpa http://www.springframework.org/schema/data/jpa/spring-jpa.xsd
-		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
-		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
-		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
+		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
 		http://www.springframework.org/schema/cache http://www.springframework.org/schema/cache/spring-cache.xsd">
 
 	<sec:global-method-security
 		pre-post-annotations="enabled" />
 
-	<tx:annotation-driven />
+<!--	<tx:annotation-driven />-->
 
 	<context:component-scan
 		base-package="org.apache.fineract.accounting.*,
@@ -43,8 +43,9 @@
 										  org.apache.fineract.commands.service.*,
 										  org.apache.fineract.commands.*,
 										  org.apache.fineract.audit.*,
-										 org.apache.fineract.infrastructure.creditbureau.*,
+										  org.apache.fineract.infrastructure.creditbureau.*,
 										  org.apache.fineract.infrastructure.*,
+										  org.apache.fineract.infrastructure.core.security*,
 										  org.apache.fineract.scheduledjobs.*,
 										  org.apache.fineract.organisation.*,
 										  org.apache.fineract.interoperation.*,

fineract-provider/src/main/resources/META-INF/spring/infrastructure.xml

@@ -34,7 +34,7 @@
 		<property name="dataSource" ref="routingDataSource" />
 		<property name="persistenceUnitName" value="jpa-pu" />
 		<property name="jpaVendorAdapter">
-		   <bean class="org.springframework.orm.jpa.vendor.OpenJpaVendorAdapter"/>
+			<bean class="org.apache.fineract.infrastructure.openjpa.OpenJpaVendorAdapter"/>
 		</property>
 	</bean>
 
@@ -45,6 +45,6 @@
 	<!-- Create instance of transaction template for programmatic transaction manipulation -->
 	<bean id="txTemplate" class="org.springframework.transaction.support.TransactionTemplate">
 		<property name="transactionManager" ref="transactionManager"></property>
-	</bean>	
+	</bean>
 
-</beans>
+</beans>

fineract-provider/src/main/resources/META-INF/spring/securityContext.xml

@@ -25,15 +25,16 @@
 	xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
 	xsi:schemaLocation="
    http://www.springframework.org/schema/beans
-   http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
+   http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security/oauth2
    http://www.springframework.org/schema/security/spring-security-oauth2.xsd
    http://www.springframework.org/schema/security
-   http://www.springframework.org/schema/security/spring-security-3.2.xsd">
+   http://www.springframework.org/schema/security/spring-security.xsd">
 
-	<beans:beans profile="basicauth"> 
+	<beans:beans profile="basicauth">
 		<http create-session="stateless" use-expressions="true" pattern="/api/**"
 			entry-point-ref="basicAuthenticationEntryPoint">
+			<csrf disabled="true"/>
 			<intercept-url pattern="/api/*/authentication" access="permitAll"
 				method="POST" requires-channel="https" />
 			<intercept-url pattern="/api/*/self/authentication" access="permitAll"
@@ -59,8 +60,7 @@
 			<intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
 				method="HEAD" requires-channel="https" />
 	
-			<custom-filter after="SECURITY_CONTEXT_FILTER"
-				ref="basicAuthenticationProcessingFilter" />
+			<custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />
 			<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
 		</http>
 	
@@ -68,22 +68,15 @@
 			class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
 			<beans:property name="realmName" value="Fineract Platform API" />
 		</beans:bean>
-	
-		<beans:bean id="passwordEncoder"
-			class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
-			<beans:constructor-arg value="256" />
+
+		<beans:bean id="passwordEncoder" class="org.apache.fineract.infrastructure.core.domain.DefaultPasswordEncoderFactories"
+					factory-method="createDelegatingPasswordEncoder">
 		</beans:bean>
-	
-		<beans:bean id="saltSource"
-			class="org.springframework.security.authentication.dao.ReflectionSaltSource">
-			<beans:property name="userPropertyToUse" value="id" />
-		</beans:bean>
-	
+
 		<beans:bean id="customAuthenticationProvider"
 			class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
 			<beans:property name="userDetailsService" ref="userDetailsService" />
 			<beans:property name="passwordEncoder" ref="passwordEncoder" />
-			<beans:property name="saltSource" ref="saltSource" />
 		</beans:bean>
 	
 		<authentication-manager alias="authenticationManager"
@@ -95,6 +88,7 @@
 		<http create-session="stateless" use-expressions="true" pattern="/api/v1/**"
 			entry-point-ref="oauthAuthenticationEntryPoint"
 			access-decision-manager-ref="accessDecisionManager">
+			<csrf disabled="true"/>
 			<anonymous enabled="false" />
 			<intercept-url pattern="/api//v1/**" method="OPTIONS"
 					access="permitAll" requires-channel="https" />
@@ -184,26 +178,12 @@
 			<beans:constructor-arg ref="clientDetailsService" />
 		</beans:bean>
 	
-	
-		<beans:bean id="passwordEncoder"
-			class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
-			<beans:constructor-arg value="256" />
-		</beans:bean>
-	
-		<beans:bean id="saltSource"
-			class="org.springframework.security.authentication.dao.ReflectionSaltSource">
-			<beans:property name="userPropertyToUse" value="id" />
-		</beans:bean>
-	
 		<beans:bean id="customAuthenticationProvider"
 			class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
 			<beans:property name="userDetailsService" ref="userDetailsService" />
 			<beans:property name="passwordEncoder" ref="passwordEncoder" />
-			<beans:property name="saltSource" ref="saltSource" />
 		</beans:bean>
-	
-	
-	
+
 		<beans:bean id="clientDetailsService"
 			class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService">
 			<beans:constructor-arg ref="routingDataSource" />

fineract-provider/src/main/resources/META-INF/spring/spmContext.xml

@@ -30,10 +30,8 @@
 		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
 		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd">
 
-    <tx:annotation-driven />
-
     <context:component-scan base-package="org.apache.fineract.spm.**"/>
 
     <jpa:repositories base-package="org.apache.fineract.spm.repository"/>
 
-</beans>
+</beans>

fineract-provider/src/main/resources/application.properties

@@ -17,4 +17,8 @@
 # under the License.
 #
 
-spring.profiles.default=basicauth
+spring.profiles.default=basicauth
+management.health.jms.enabled=false
+security.enable-csrf=false
+spring.jpa.show-sql=true
+spring.jpa.properties.hibernate.format_sql=true

fineract-provider/src/main/resources/sql/migrations/core_db/V353__migrate_passwords_to_ss_5.sql

@@ -0,0 +1,20 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements. See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership. The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied. See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+--
+
+UPDATE m_appuser SET password = CONCAT('{', id, '}', password) WHERE password NOT LIKE '{%';