|
|
@@ -9,8 +9,6 @@ import org.springframework.beans.factory.annotation.Value;
|
|
|
import org.springframework.context.annotation.Bean;
|
|
|
import org.springframework.context.annotation.Configuration;
|
|
|
import org.springframework.security.authentication.AuthenticationManager;
|
|
|
-import org.springframework.security.authorization.AuthorizationDecision;
|
|
|
-import org.springframework.security.authorization.AuthorizationManager;
|
|
|
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
|
|
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
|
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
|
@@ -22,17 +20,14 @@ import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
|
|
import org.springframework.security.crypto.password.PasswordEncoder;
|
|
|
import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
|
|
|
import org.springframework.security.web.SecurityFilterChain;
|
|
|
-import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
|
|
|
+import org.springframework.security.web.access.expression.WebExpressionAuthorizationManager;
|
|
|
import org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy;
|
|
|
import org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy;
|
|
|
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
|
|
|
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
|
|
|
import org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy;
|
|
|
import org.springframework.security.web.session.HttpSessionEventPublisher;
|
|
|
-import org.springframework.security.web.util.matcher.IpAddressMatcher;
|
|
|
-
|
|
|
import es.uv.saic.service.AuthProvider;
|
|
|
-import jakarta.servlet.http.HttpServletRequest;
|
|
|
|
|
|
|
|
|
@Configuration
|
|
|
@@ -53,11 +48,12 @@ public class SecurityConfig {
|
|
|
.requestMatchers("/login**").permitAll()
|
|
|
.requestMatchers("/keepalive").permitAll()
|
|
|
.requestMatchers("/public/**").permitAll()
|
|
|
- .requestMatchers("/actuator/**").access(hasIpAddress(this.validIp))
|
|
|
+ .requestMatchers("/actuator/**").access(new WebExpressionAuthorizationManager("hasIpAddress('" + this.validIp + "')"))
|
|
|
+ .requestMatchers("/actuator/**").access(new WebExpressionAuthorizationManager("hasIpAddress('127.0.0.1')"))
|
|
|
)
|
|
|
.authorizeHttpRequests((auth)-> auth
|
|
|
- //.anyRequest().fullyAuthenticated()
|
|
|
- .anyRequest().permitAll()
|
|
|
+ .anyRequest().authenticated()
|
|
|
+ //.anyRequest().permitAll()
|
|
|
)
|
|
|
.formLogin((form) -> form
|
|
|
.loginPage("/login")
|
|
|
@@ -70,7 +66,7 @@ public class SecurityConfig {
|
|
|
.logoutSuccessUrl("/login")
|
|
|
.invalidateHttpSession(true)
|
|
|
.clearAuthentication(true)
|
|
|
- .deleteCookies("JSESSIONID")
|
|
|
+ .deleteCookies("SAICSESSIONID")
|
|
|
.deleteCookies("SESSION")
|
|
|
)
|
|
|
.csrf((csrf) -> csrf.disable());
|
|
|
@@ -96,15 +92,6 @@ public class SecurityConfig {
|
|
|
|
|
|
return http.build();
|
|
|
}
|
|
|
-
|
|
|
- private static AuthorizationManager<RequestAuthorizationContext> hasIpAddress(String ipAddress) {
|
|
|
- IpAddressMatcher ipAddressMatcher = new IpAddressMatcher(ipAddress);
|
|
|
- return (authentication, context) -> {
|
|
|
- HttpServletRequest request = context.getRequest();
|
|
|
-
|
|
|
- return new AuthorizationDecision(ipAddressMatcher.matches(request));
|
|
|
- };
|
|
|
- }
|
|
|
|
|
|
@Bean
|
|
|
public AuthenticationManager authenticationManager(HttpSecurity http) throws Exception {
|