FINERACT-1012: Upgrading OAuth support to Spring Security 5.6
This commit is contained in:
Petri Tuomola
committed by
Aleksandar Vidakovic
Aleksandar Vidakovic
parent
b6a9a2791d
commit
c74bfed1fe
@@ -1,167 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
|
||||
-->
|
||||
|
||||
<beans:beans xmlns="http://www.springframework.org/schema/security"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans"
|
||||
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
|
||||
xsi:schemaLocation="
|
||||
http://www.springframework.org/schema/beans
|
||||
https://www.springframework.org/schema/beans/spring-beans.xsd
|
||||
http://www.springframework.org/schema/security/oauth2
|
||||
https://www.springframework.org/schema/security/spring-security-oauth2.xsd
|
||||
http://www.springframework.org/schema/security
|
||||
https://www.springframework.org/schema/security/spring-security.xsd">
|
||||
|
||||
<beans:beans profile="oauth">
|
||||
<http create-session="stateless" use-expressions="true" pattern="/api/v1/**"
|
||||
entry-point-ref="oauthAuthenticationEntryPoint"
|
||||
access-decision-manager-ref="accessDecisionManager">
|
||||
<csrf disabled="true"/>
|
||||
<anonymous enabled="false" />
|
||||
<intercept-url pattern="/api//v1/**" method="OPTIONS"
|
||||
access="permitAll" requires-channel="https" />
|
||||
<intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
|
||||
method="GET" requires-channel="https" />
|
||||
<intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
|
||||
method="POST" requires-channel="https" />
|
||||
<intercept-url pattern="/api/*/twofactor/validate" access="isFullyAuthenticated()"
|
||||
method="POST" requires-channel="https" />
|
||||
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
||||
method="GET" requires-channel="https" />
|
||||
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
||||
method="POST" requires-channel="https" />
|
||||
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
||||
method="PUT" requires-channel="https" />
|
||||
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
||||
method="DELETE" requires-channel="https" />
|
||||
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
||||
method="HEAD" requires-channel="https" />
|
||||
<custom-filter ref="tenantIdentifierProcessingFilter"
|
||||
position="FIRST" />
|
||||
<custom-filter before="PRE_AUTH_FILTER" ref="resourceServerFilter" />
|
||||
<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
|
||||
<access-denied-handler ref="oauthAccessDeniedHandler" />
|
||||
</http>
|
||||
|
||||
<http pattern="/api/oauth/token" create-session="stateless"
|
||||
entry-point-ref="oauthAuthenticationEntryPoint" use-expressions="true"
|
||||
authentication-manager-ref="clientAuthenticationManager">
|
||||
<csrf disabled="true"/>
|
||||
<intercept-url pattern="/api/oauth/token" method="OPTIONS"
|
||||
access="permitAll" requires-channel="https" />
|
||||
<intercept-url pattern="/api/oauth/token" method="POST"
|
||||
access="isFullyAuthenticated()" requires-channel="https" />
|
||||
<anonymous enabled="false" />
|
||||
|
||||
<custom-filter ref="tenantIdentifierProcessingFilter"
|
||||
position="FIRST" />
|
||||
<custom-filter ref="clientCredentialsTokenEndpointFilter"
|
||||
before="BASIC_AUTH_FILTER" />
|
||||
<access-denied-handler ref="oauthAccessDeniedHandler" />
|
||||
</http>
|
||||
|
||||
<beans:bean id="oauthAuthenticationEntryPoint"
|
||||
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
|
||||
<beans:property name="realmName" value="Fineract Platform API" />
|
||||
</beans:bean>
|
||||
|
||||
<beans:bean id="oauthAccessDeniedHandler"
|
||||
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
|
||||
|
||||
<beans:bean id="clientCredentialsTokenEndpointFilter"
|
||||
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
|
||||
<beans:constructor-arg value="/api/oauth/token" />
|
||||
<beans:property name="authenticationManager" ref="clientAuthenticationManager" />
|
||||
</beans:bean>
|
||||
|
||||
<beans:bean id="accessDecisionManager"
|
||||
class="org.springframework.security.access.vote.UnanimousBased">
|
||||
<beans:constructor-arg>
|
||||
<beans:list>
|
||||
<beans:bean
|
||||
class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
|
||||
<beans:bean class="org.springframework.security.access.vote.RoleVoter" />
|
||||
<beans:bean
|
||||
class="org.springframework.security.access.vote.AuthenticatedVoter" />
|
||||
<beans:bean
|
||||
class="org.springframework.security.web.access.expression.WebExpressionVoter" />
|
||||
<beans:bean
|
||||
class="org.apache.fineract.infrastructure.security.vote.SelfServiceUserAccessVote" />
|
||||
</beans:list>
|
||||
</beans:constructor-arg>
|
||||
</beans:bean>
|
||||
|
||||
<authentication-manager id="clientAuthenticationManager" erase-credentials="false">
|
||||
<authentication-provider user-service-ref="clientDetailsUserService" />
|
||||
<authentication-provider ref="customAuthenticationProvider" />
|
||||
</authentication-manager>
|
||||
|
||||
<beans:bean id="clientDetailsUserService"
|
||||
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
|
||||
<beans:constructor-arg ref="clientDetailsService" />
|
||||
</beans:bean>
|
||||
|
||||
<beans:bean id="clientDetailsService"
|
||||
class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService">
|
||||
<beans:constructor-arg ref="routingDataSource" />
|
||||
</beans:bean>
|
||||
|
||||
<beans:bean id="tokenStore"
|
||||
class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
|
||||
<beans:constructor-arg ref="routingDataSource" />
|
||||
</beans:bean>
|
||||
|
||||
<beans:bean id="tokenServices"
|
||||
class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
|
||||
<beans:property name="tokenStore" ref="tokenStore" />
|
||||
<beans:property name="clientDetailsService" ref="clientDetailsService" />
|
||||
<beans:property name="supportRefreshToken" value="true" />
|
||||
<beans:property name="refreshTokenValiditySeconds"
|
||||
value="86400" />
|
||||
<beans:property name="accessTokenValiditySeconds"
|
||||
value="3600" />
|
||||
</beans:bean>
|
||||
|
||||
<beans:bean id="userApprovalHandler"
|
||||
class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
|
||||
<beans:property name="tokenStore" ref="tokenStore" />
|
||||
<beans:property name="clientDetailsService" ref="clientDetailsService" />
|
||||
<beans:property name="requestFactory" ref="oAuth2RequestFactory" />
|
||||
</beans:bean>
|
||||
|
||||
<beans:bean id="oAuth2RequestFactory"
|
||||
class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
|
||||
<beans:constructor-arg ref="clientDetailsService" />
|
||||
</beans:bean>
|
||||
|
||||
<oauth:authorization-server
|
||||
client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"
|
||||
user-approval-handler-ref="userApprovalHandler" token-endpoint-url="/api/oauth/token"
|
||||
authorization-endpoint-url="/api/oauth/authorize">
|
||||
<oauth:refresh-token />
|
||||
<oauth:password />
|
||||
</oauth:authorization-server>
|
||||
|
||||
<oauth:resource-server id="resourceServerFilter" stateless="false"
|
||||
token-services-ref="tokenServices" />
|
||||
</beans:beans>
|
||||
</beans:beans>
|
||||
@@ -2769,22 +2769,6 @@
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="#authenticationoauth">Authentication Oauth2</a></td>
|
||||
<td>oauth/token</td>
|
||||
<td><a href="#oauth">OAuth2 Access and refresh Token Request</a></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td><a href="#oauth_access_token_req">OAuth2 Access Token Request from refresh token</a></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>authenticated user</td>
|
||||
<td></td>
|
||||
<td><a href="#userdetails_request">Fetch Authenticated user details</a></td>
|
||||
@@ -4499,7 +4483,7 @@ function executeAjaxRequest(url, verbType, jsonData, basicAuthKey, successFuncti
|
||||
function getOauthToken(username, password) {
|
||||
|
||||
var jqxhr = $.ajax({
|
||||
url : "/fineract-provider/api/oauth/token",
|
||||
url : "URL of the authentication server",
|
||||
type : 'POST',
|
||||
dataType : 'json',
|
||||
data : {
|
||||
@@ -39103,174 +39087,6 @@ No Request Body
|
||||
<div class="method-description">
|
||||
<h3>Authentication Oauth2</h3>
|
||||
<p>An API capability that allows client applications to fetch current user details details using Oauth2.</p>
|
||||
<table class=matrixHeading>
|
||||
<tr class="matrixHeadingBG">
|
||||
<td><div class="fineractHeading2">Field Descriptions</div></td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>accessToken</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>HTTP Auth bearer key. See <a
|
||||
href="#authentication_overview">Authentication Overview</a> for
|
||||
an example of its use.
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<a id="oauth" name="oauth" class="old-syle-anchor"> </a>
|
||||
<div class="method-section">
|
||||
<div class="method-description">
|
||||
<h3>Authentication via OAuth2</h3>
|
||||
<p>API for requesting OAuth2 access token and refresh token.</p>
|
||||
<table class=matrixHeading>
|
||||
<tr class="matrixHeadingBG">
|
||||
<td><div class="fineractHeading2">Field Descriptions</div></td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>grant_type</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Mandatory field.
|
||||
Indicates the requested grant type. Supported values:
|
||||
<span>password</span>.
|
||||
</td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>client_id</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Mandatory field.
|
||||
Indicates the client application identity.
|
||||
</td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>client_secret</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Optional field.
|
||||
Indicates the client application password.
|
||||
</td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>username</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Mandatory field.
|
||||
Application User(resource) login name.
|
||||
</td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>password</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Mandatory field.
|
||||
Application User(resource) password.
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<a id="oauth_request" name="oauth_request" class="old-syle-anchor"> </a>
|
||||
<div class="method-section">
|
||||
<div class="method-description">
|
||||
<h4>OAuth2 Refresh and Access Token Request</h4>
|
||||
</div>
|
||||
<div class="method-example">
|
||||
<code class="method-declaration">
|
||||
POST https://DomainName/api/oauth/token?username={username}&password={password}&client_id={clientId}&grant_type={grant_type}&client_secret={client_secret}
|
||||
</code>
|
||||
<code class="method-request">
|
||||
POST api/oauth/token?username=mifos&password=password&client_id=community-app&grant_type=password&client_secret=123
|
||||
Content-Type: application/json
|
||||
No Request Body
|
||||
</code>
|
||||
<code class="method-response">
|
||||
{
|
||||
""access_token": "b771987f-82fc-45ba-b521-bfe280c4e603",
|
||||
"token_type": "bearer",
|
||||
"refresh_token":"a2a89b23-8d22-4d90-8585-8f464db433b0",
|
||||
"expires_in": 3599,
|
||||
"scope": "all"
|
||||
}
|
||||
</code>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<a id="oauth_access_token_req" name="oauth_access_token_req" class="old-syle-anchor"> </a>
|
||||
<div class="method-section">
|
||||
<div class="method-description">
|
||||
<h3>Authentication via OAuth2</h3>
|
||||
<p>API for requesting OAuth2 access tokens through oAuth2 refresh tokens.</p>
|
||||
<table class=matrixHeading>
|
||||
<tr class="matrixHeadingBG">
|
||||
<td><div class="fineractHeading2">Field Descriptions</div></td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>grant_type</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Mandatory field.
|
||||
Indicates the requested grant type. Supported values:
|
||||
<span>refresh_token</span>.
|
||||
</td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>client_id</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Mandatory field.
|
||||
Indicates the client application identity.
|
||||
</td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>client_secret</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Optional field.
|
||||
Indicates the client application password.
|
||||
</td>
|
||||
</tr>
|
||||
<tr class=alt>
|
||||
<td>refresh_token</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class=fielddesc>Mandatory field.
|
||||
Application refresh token to generate access token.
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<a id="oauth_request_with_refresh" name="oauth_request_with_refresh" class="old-syle-anchor"> </a>
|
||||
<div class="method-section">
|
||||
<div class="method-description">
|
||||
<h4>OAuth2 Token Request through Refresh Token</h4>
|
||||
</div>
|
||||
<div class="method-example">
|
||||
<code class="method-declaration">
|
||||
POST https://DomainName/api/oauth/token?refresh_token={refresh_token}&client_id={clientId}&grant_type={grant_type}&client_secret={client_secret}
|
||||
</code>
|
||||
<code class="method-request">
|
||||
POST api/oauth/token?client_id=community-app&grant_type=refresh_token&client_secret=123&refresh_token=a2a89b23-8d22-4d90-8585-8f464db433b0
|
||||
Content-Type: application/json
|
||||
No Request Body
|
||||
</code>
|
||||
<code class="method-response">
|
||||
{
|
||||
""access_token": "b771987f-82fc-45ba-b521-bfe280c4e643",
|
||||
"token_type": "bearer",
|
||||
"refresh_token":"a2a89b23-8d22-4d90-8585-8f464db433b0",
|
||||
"expires_in": 3599,
|
||||
"scope": "all"
|
||||
}
|
||||
</code>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -39282,10 +39098,10 @@ No Request Body
|
||||
</div>
|
||||
<div class="method-example">
|
||||
<code class="method-declaration">
|
||||
POST https://DomainName/api/v1/userdetails?access_token={access_token}
|
||||
GET https://DomainName/api/v1/userdetails
|
||||
</code>
|
||||
<code class="method-request">
|
||||
POST userdetails?access_token=bWlmb3M6cGFzc3dvcmQ=
|
||||
GET userdetails
|
||||
Content-Type: application/json
|
||||
No Request Body
|
||||
</code>
|
||||
@@ -39342,22 +39158,6 @@ No Request Body
|
||||
|
||||
|
||||
|
||||
|
||||
<code class="method-request">
|
||||
POST api/oauth/token?username=mifos&password=password&client_id=community-app&grant_type=password&client_secret=123
|
||||
Content-Type: application/json
|
||||
No Request Body
|
||||
</code>
|
||||
<code class="method-response">
|
||||
{
|
||||
"developerMessage": "Invalid authentication details were passed in api request.",
|
||||
"developerDocLink": "https://github.com/openMF/mifosx/wiki/HTTP-API-Error-codes",
|
||||
"httpStatusCode": "401",
|
||||
"defaultUserMessage": "Unauthenticated. Please login.",
|
||||
"userMessageGlobalisationCode": "error.msg.not.authenticated",
|
||||
"errors": []
|
||||
}
|
||||
</code>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -47220,10 +47020,10 @@ No Request Body
|
||||
</div>
|
||||
<div class="method-example">
|
||||
<code class="method-declaration">
|
||||
POST https://DomainName/api/v1/self/userdetails?access_token={access_token}
|
||||
POST https://DomainName/api/v1/self/userdetails
|
||||
</code>
|
||||
<code class="method-request">
|
||||
POST self/userdetails?access_token=bWlmb3M6cGFzc3dvcmQ=
|
||||
POST self/userdetails
|
||||
Content-Type: application/json
|
||||
No Request Body
|
||||
</code>
|
||||
@@ -47258,21 +47058,6 @@ No Request Body
|
||||
}
|
||||
</code>
|
||||
|
||||
<code class="method-request">
|
||||
POST api/oauth/token?username=mifos&password=password&client_id=community-app&grant_type=password&client_secret=123
|
||||
Content-Type: application/json
|
||||
No Request Body
|
||||
</code>
|
||||
<code class="method-response">
|
||||
{
|
||||
"developerMessage": "Invalid authentication details were passed in api request.",
|
||||
"developerDocLink": "https://github.com/openMF/mifosx/wiki/HTTP-API-Error-codes",
|
||||
"httpStatusCode": "401",
|
||||
"defaultUserMessage": "Unauthenticated. Please login.",
|
||||
"userMessageGlobalisationCode": "error.msg.not.authenticated",
|
||||
"errors": []
|
||||
}
|
||||
</code>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user