DRYD-22: Configure oauth2 token granting endpoint.

diff --git a/pom.xml b/pom.xml
index c8ae0aebd153179230e458ce8517bb48be32a73a..17fd5e61e558442ada0d6a0a3849d7885525d7d5 100644 (file)
--- a/pom.xml
+++ b/pom.xml
@@ -20,6 +20,7 @@
                <chemistry.opencmis.version.nx>0.12.0-NX2</chemistry.opencmis.version.nx>
                <spring.version>4.3.1.RELEASE</spring.version>
                <spring.security.version>4.1.0.RELEASE</spring.security.version>
+               <spring.security.oauth2.version>2.0.10.RELEASE</spring.security.oauth2.version>
        </properties>
 
        <distributionManagement>

diff --git a/services/JaxRsServiceProvider/pom.xml b/services/JaxRsServiceProvider/pom.xml
index 874cb307f27bd5770546d24fc202a0ff13779352..71cd0f4c79d156eacfdc3c0f90b1221cb4fb6e1a 100644 (file)
--- a/services/JaxRsServiceProvider/pom.xml
+++ b/services/JaxRsServiceProvider/pom.xml
@@ -417,6 +417,12 @@
             <version>${spring.security.version}</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.security.oauth</groupId>
+            <artifactId>spring-security-oauth2</artifactId>
+            <version>${spring.security.oauth2.version}</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-context</artifactId>

diff --git a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
index 877ee8f7e14d9305ef4884bef9bd0d113c79368a..40daafe55269698b06a69e684dd40a131398a1f8 100644 (file)
--- a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
+++ b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
@@ -11,9 +11,11 @@
 <beans xmlns="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns:sec="http://www.springframework.org/schema/security"
+       xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
        xsi:schemaLocation="
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
+       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
+       http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd">
 
     <!--
         debugging tips : enable following categories in
@@ -22,17 +24,28 @@
         org.springframework.security
     -->
 
+    <!-- Require client id and client secret via basic auth when granting tokens (https://tools.ietf.org/html/rfc6749#section-4.3.2).
+         Note that public (https://tools.ietf.org/html/rfc6749#section-2.1) clients, such as the CSpace web UI, may supply a
+         blank or publicly known "secret." The clientAuthenticationManager bean handles this client authentication. -->
+    <sec:http pattern="/oauth/token/**" create-session="stateless" authentication-manager-ref="clientAuthenticationManager">
+        <sec:intercept-url pattern="/oauth/token/**" access="isFullyAuthenticated()"/>
+        <sec:http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
+        <sec:anonymous enabled="false"/>
+        <sec:csrf disabled="true"/>
+        <sec:access-denied-handler ref="oauthAccessDeniedHandler"/>
+    </sec:http>
+
     <!-- Exclude the resource path to public items' content from AuthN and AuthZ.  Lets us publish resources with anonymous access. -->
     <sec:http pattern="/publicitems/*/*/content" security="none" />
     
     <!-- All other paths must be authenticated. -->
-    <sec:http realm="org.collectionspace.services" create-session="stateless" authentication-manager-ref="authenticationManager">
+    <sec:http realm="org.collectionspace.services" create-session="stateless" authentication-manager-ref="userAuthenticationManager">
         <sec:intercept-url pattern="/**" access="isFullyAuthenticated()" />
         <sec:http-basic />
         <sec:csrf disabled="true" />
     </sec:http>
 
-    <sec:authentication-manager alias="authenticationManager">
+    <sec:authentication-manager id="userAuthenticationManager">
         <sec:authentication-provider ref="jaasAuthenticationProvider"/>
     </sec:authentication-manager>
 
@@ -56,4 +69,45 @@
             </list>
         </property>
     </bean>
+    
+    <sec:authentication-manager id="clientAuthenticationManager">
+        <sec:authentication-provider user-service-ref="clientDetailsUserDetailsService"/>
+    </sec:authentication-manager>
+
+    <bean id="clientDetailsUserDetailsService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
+        <constructor-arg ref="clientDetails"/>
+    </bean>
+
+    <!-- The scope attribute below is a meaningless placeholder. In the future we may want to use it to limit
+         the permissions of particular clients. Currently a client has the full permissions of the user on 
+         behalf of whom it is acting . -->
+    <oauth:client-details-service id="clientDetails">
+        <oauth:client
+            client-id="cspace-ui"
+            resource-ids="cspace-services"
+            authorized-grant-types="password,refresh_token"
+            scope="full"
+            access-token-validity="3600"
+            refresh-token-validity="43200" />
+    </oauth:client-details-service>
+    
+    <bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
+        <property name="realmName" value="org.collectionspace.services/client"/>
+        <property name="typeName" value="Basic"/>
+    </bean>
+    
+    <bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>
+    
+    <bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
+        <property name="tokenStore" ref="tokenStore" />
+        <property name="tokenEnhancer" ref="tokenEnhancer" />
+        <property name="supportRefreshToken" value="true" />
+        <property name="clientDetailsService" ref="clientDetails" />
+    </bean>
+
+    <bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JwtTokenStore">
+        <constructor-arg ref="tokenEnhancer" />
+    </bean>
+
+    <bean id="tokenEnhancer" class="org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter" />
 </beans>

diff --git a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/oauth-servlet.xml b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/oauth-servlet.xml
new file mode 100644 (file)
index 0000000..543e542
--- /dev/null
+++ b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/oauth-servlet.xml
@@ -0,0 +1,26 @@
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns:mvc="http://www.springframework.org/schema/mvc"
+       xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
+       xsi:schemaLocation="
+       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+       http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
+       http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd">
+
+    <oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices">
+        <oauth:refresh-token />
+        <oauth:password authentication-manager-ref="userAuthenticationManager" />
+    </oauth:authorization-server>
+
+    <mvc:annotation-driven />
+
+    <mvc:default-servlet-handler />
+    
+    <bean id="viewResolver" class="org.springframework.web.servlet.view.ContentNegotiatingViewResolver">
+        <property name="defaultViews">
+            <bean class="org.springframework.web.servlet.view.json.MappingJackson2JsonView">
+                <property name="extractValueFromSingleKeyModel" value="true" />
+            </bean>
+        </property>
+    </bean>
+</beans>

diff --git a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml
index 9de96d989139c535e9ff2be1ff772bd39ee4c435..1ff6b2da8c707fe39f12f05a004ad0efa6dda35c 100644 (file)
--- a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml
+++ b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml
@@ -140,15 +140,25 @@
         </listener-class>
     </listener>
 
+    <servlet>
+        <servlet-name>oauth</servlet-name>
+        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
+        <load-on-startup>1</load-on-startup>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>oauth</servlet-name>
+        <url-pattern>/oauth/token/*</url-pattern>
+    </servlet-mapping>
+
     <servlet>
             <servlet-name>Resteasy</servlet-name>
             <servlet-class>
                 org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher
             </servlet-class>
-    </servlet>    
+    </servlet>
     <servlet-mapping>
         <servlet-name>Resteasy</servlet-name>
-        <url-pattern>/*</url-pattern>
+        <url-pattern>/</url-pattern>
     </servlet-mapping>
 
 </web-app>

diff --git a/services/authentication/service/pom.xml b/services/authentication/service/pom.xml
index 8e3cf394bac5a8189b26828fe466441a44c6fbb6..baedae47df8cee6c7bf140cf36c0da2fac95d5c1 100644 (file)
--- a/services/authentication/service/pom.xml
+++ b/services/authentication/service/pom.xml
@@ -78,6 +78,12 @@
             <version>${spring.version}</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.security.oauth</groupId>
+            <artifactId>spring-security-oauth2</artifactId>
+            <version>${spring.security.oauth2.version}</version>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
     <build>

diff --git a/services/common/lib/spring/spring-security-jwt-1.0.4.RELEASE.jar b/services/common/lib/spring/spring-security-jwt-1.0.4.RELEASE.jar
new file mode 100644 (file)
index 0000000..ac8dec1
Binary files /dev/null and b/services/common/lib/spring/spring-security-jwt-1.0.4.RELEASE.jar differ

diff --git a/services/common/lib/spring/spring-security-oauth2-2.0.10.RELEASE.jar b/services/common/lib/spring/spring-security-oauth2-2.0.10.RELEASE.jar
new file mode 100644 (file)
index 0000000..354b768
Binary files /dev/null and b/services/common/lib/spring/spring-security-oauth2-2.0.10.RELEASE.jar differ

diff --git a/services/common/lib/spring/spring-webmvc-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-webmvc-4.3.1.RELEASE.jar
new file mode 100644 (file)
index 0000000..1bec771
Binary files /dev/null and b/services/common/lib/spring/spring-webmvc-4.3.1.RELEASE.jar differ