Skip to content

Commit 0c09a17

Browse files
sschujricher
sschu
authored and
jricher
committed
Adapted uma-server-webapp overlayed spring configuration files to changes in base webapp
1 parent 93deef9 commit 0c09a17

File tree

3 files changed

+38
-19
lines changed

3 files changed

+38
-19
lines changed

‎uma-server-webapp/src/main/webapp/WEB-INF/application-context.xml‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
xmlns:util="http://www.springframework.org/schema/util"
2626
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
2727
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd
28-
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
28+
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
2929
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
3030
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.3.xsd
3131
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.3.xsd
@@ -86,66 +86,77 @@
8686
<security:custom-filter ref="clientCredentialsEndpointFilter" after="BASIC_AUTH_FILTER" />
8787
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
8888
<security:access-denied-handler ref="oauthAccessDeniedHandler" />
89+
<security:csrf disabled="true"/>
8990
</security:http>
9091

9192
<!-- Allow open access to discovery endpoints -->
9293
<security:http pattern="/#{T(org.mitre.openid.connect.web.JWKSetPublishingEndpoint).URL}**" use-expressions="true" entry-point-ref="http403EntryPoint" create-session="stateless">
9394
<security:intercept-url pattern="/#{T(org.mitre.openid.connect.web.JWKSetPublishingEndpoint).URL}**" access="permitAll"/>
9495
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
96+
<security:csrf disabled="true"/>
9597
</security:http>
9698
<security:http pattern="/#{T(org.mitre.discovery.web.DiscoveryEndpoint).WELL_KNOWN_URL}/**" use-expressions="true" entry-point-ref="http403EntryPoint" create-session="stateless">
9799
<security:intercept-url pattern="/#{T(org.mitre.discovery.web.DiscoveryEndpoint).WELL_KNOWN_URL}/**" access="permitAll"/>
98100
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
101+
<security:csrf disabled="true"/>
99102
</security:http>
100103

101104
<!-- Allow open access to all static resources -->
102105
<security:http pattern="/resources/**" use-expressions="true" entry-point-ref="http403EntryPoint" create-session="stateless">
103106
<security:intercept-url pattern="/resources/**" access="permitAll"/>
104107
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
108+
<security:csrf disabled="true"/>
105109
</security:http>
106110

107111
<!-- OAuth-protect API and other endpoints -->
108112
<security:http pattern="/#{T(org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint).URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="stateless">
109-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
113+
<security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" />
110114
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
111115
<security:expression-handler ref="oauthWebExpressionHandler" />
112116
<security:intercept-url pattern="/register/**" access="permitAll"/>
117+
<security:csrf disabled="true"/>
113118
</security:http>
114119

115120
<security:http pattern="/#{T(org.mitre.openid.connect.web.ProtectedResourceRegistrationEndpoint).URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="stateless">
116-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
121+
<security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" />
117122
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
118123
<security:expression-handler ref="oauthWebExpressionHandler" />
119124
<security:intercept-url pattern="/resource/**" access="permitAll"/>
125+
<security:csrf disabled="true"/>
120126
</security:http>
121127

122128
<security:http pattern="/#{T(org.mitre.uma.web.ResourceSetRegistrationEndpoint).URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="never">
123-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
129+
<security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" />
124130
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
125131
<security:expression-handler ref="oauthWebExpressionHandler" />
132+
<security:csrf disabled="true"/>
126133
</security:http>
127134

128135
<security:http pattern="/#{T(org.mitre.uma.web.PermissionRegistrationEndpoint).URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="never">
129-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
136+
<security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" />
130137
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
131138
<security:expression-handler ref="oauthWebExpressionHandler" />
139+
<security:csrf disabled="true"/>
132140
</security:http>
133141

134142
<security:http pattern="/#{T(org.mitre.uma.web.AuthorizationRequestEndpoint).URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="never">
135-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
143+
<security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" />
136144
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
137145
<security:expression-handler ref="oauthWebExpressionHandler" />
146+
<security:csrf disabled="true"/>
138147
</security:http>
139148

140149
<security:http pattern="/#{T(org.mitre.openid.connect.web.UserInfoEndpoint).URL}**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="stateless">
141-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
150+
<security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" />
142151
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
143152
<security:expression-handler ref="oauthWebExpressionHandler" />
153+
<security:csrf disabled="true"/>
144154
</security:http>
145155

146156
<security:http pattern="/#{T(org.mitre.openid.connect.web.RootController).API_URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="never">
147-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
157+
<security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" />
148158
<security:expression-handler ref="oauthWebExpressionHandler" />
159+
<security:csrf disabled="true"/>
149160
</security:http>
150161

151162
<security:http pattern="/#{T(org.mitre.oauth2.web.IntrospectionEndpoint).URL}**"
@@ -154,10 +165,11 @@
154165
create-session="stateless"
155166
authentication-manager-ref="clientAuthenticationManager">
156167
<security:http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
157-
<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
168+
<!-- <security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" /> -->
158169
<security:custom-filter ref="clientAssertionEndpointFilter" after="PRE_AUTH_FILTER" /> <!-- this one has to go first -->
159170
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
160171
<security:custom-filter ref="clientCredentialsEndpointFilter" after="BASIC_AUTH_FILTER" />
172+
<security:csrf disabled="true"/>
161173
</security:http>
162174

163175
<security:http pattern="/#{T(org.mitre.oauth2.web.RevocationEndpoint).URL}**"
@@ -166,10 +178,11 @@
166178
create-session="stateless"
167179
authentication-manager-ref="clientAuthenticationManager">
168180
<security:http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
169-
<!-- <security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /> -->
181+
<!-- <security:custom-filter ref="resourceServerFilter" after="CHANNEL_FILTER" /> -->
170182
<security:custom-filter ref="clientAssertionEndpointFilter" after="PRE_AUTH_FILTER" /> <!-- this one has to go first -->
171183
<security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" />
172184
<security:custom-filter ref="clientCredentialsEndpointFilter" after="BASIC_AUTH_FILTER" />
185+
<security:csrf disabled="true"/>
173186
</security:http>
174187

175188
<bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">

‎uma-server-webapp/src/main/webapp/WEB-INF/server-config.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
2525
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
2626
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd
27-
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
27+
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
2828
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
2929
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.3.xsd
3030
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd">

‎uma-server-webapp/src/main/webapp/WEB-INF/user-context.xml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
2525
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
2626
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd
27-
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
27+
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
2828
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
2929
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.3.xsd
3030
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd">
@@ -47,7 +47,7 @@
4747
</security:http>
4848

4949
<bean id="externalAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
50-
<property name="loginFormUrl" value="/openid_connect_login" />
50+
<constructor-arg type="java.lang.String" value="/openid_connect_login"/>
5151
</bean>
5252

5353
<security:authentication-manager id="externalAuthenticationManager">
@@ -110,7 +110,7 @@
110110

111111
<!-- Standard configuration -->
112112

113-
<security:authentication-manager alias="authenticationManager">
113+
<security:authentication-manager id="authenticationManager">
114114
<security:authentication-provider>
115115
<security:jdbc-user-service data-source-ref="dataSource"/>
116116
</security:authentication-provider>
@@ -119,19 +119,25 @@
119119
<mvc:view-controller path="/login" view-name="login" />
120120

121121

122-
<security:http pattern="/login**" use-expressions="true" entry-point-ref="http403EntryPoint">
122+
<!--<security:http pattern="/login**" use-expressions="true" entry-point-ref="http403EntryPoint">
123123
<security:intercept-url pattern="/login**" access="permitAll"/>
124-
</security:http>
124+
</security:http>-->
125+
126+
<security:http authentication-manager-ref="authenticationManager">
125127

126-
<security:http disable-url-rewriting="true" use-expressions="true">
127-
<security:form-login login-page="/login" authentication-failure-url="/login?error=failure" authentication-success-handler-ref="authenticationTimeStamper" />
128128
<security:intercept-url pattern="/authorize" access="hasRole('ROLE_USER')" />
129129
<security:intercept-url pattern="/**" access="permitAll" />
130+
131+
<security:form-login login-page="/login" authentication-failure-url="/login?error=failure" authentication-success-handler-ref="authenticationTimeStamper" />
130132
<security:custom-filter before="PRE_AUTH_FILTER" ref="externalAuthenticationFilter" />
131133
<security:custom-filter ref="authRequestFilter" after="SECURITY_CONTEXT_FILTER" />
132134
<security:logout logout-url="/logout" />
133135
<security:anonymous />
134136
<security:expression-handler ref="oauthWebExpressionHandler" />
135-
</security:http>
137+
<security:headers>
138+
<security:frame-options policy="DENY" />
139+
</security:headers>
140+
<security:csrf />
141+
</security:http>
136142

137143
</beans>

0 commit comments

Comments
 (0)