com.allanditzel.dashboard.config.SecurityConfig.java Source code

Introduction

Here is the source code for com.allanditzel.dashboard.config.SecurityConfig.java

Source

/*
 * Copyright 2014 Allan Ditzel
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.allanditzel.dashboard.config;

import com.allanditzel.dashboard.security.handler.LocalUserPersistingAuthenticationSuccessHandler;
import com.allanditzel.springframework.security.web.csrf.CsrfTokenResponseHeaderBindingFilter;
import com.allanditzel.dashboard.Constants;
import com.stormpath.sdk.client.Client;
import com.stormpath.spring.security.client.ClientFactory;
import com.stormpath.spring.security.provider.StormpathAuthenticationProvider;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import org.springframework.security.web.csrf.CsrfFilter;

/**
 * Security related configuration class
 *
 * @author Allan Ditzel
 * @since 1.0
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private Environment env;

    @Value("${stormpath.application.url}")
    private String stormpathApplicationUrl;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(stormpathAuthenticationProvider());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        CsrfTokenResponseHeaderBindingFilter csrfFilter = csrfTokenResponseHeaderBindingFilter();

        http.addFilterAfter(csrfFilter, CsrfFilter.class).headers().cacheControl().xssProtection().and()
                .authorizeRequests().antMatchers("/static/bower_components/**").permitAll()
                .antMatchers("/static/login*.js").permitAll().antMatchers("/static/login*.css").permitAll()
                .antMatchers("/static/dashboard*.js").authenticated().antMatchers("/static/dashboard*.css")
                .authenticated().antMatchers("/static/DashboardApp/**").authenticated().anyRequest().authenticated()
                .and().formLogin().loginPage("/index.html").defaultSuccessUrl("/home.html", true)
                .successHandler(localUserPersistingAuthenticationSuccessHandler())
                .failureHandler(new SimpleUrlAuthenticationFailureHandler()).permitAll().and().logout()
                .logoutUrl("/logout").logoutSuccessUrl("/index.html").invalidateHttpSession(true).and()
                .requiresChannel().anyRequest().requiresSecure();
    }

    @Bean
    public CsrfTokenResponseHeaderBindingFilter csrfTokenResponseHeaderBindingFilter() {
        return new CsrfTokenResponseHeaderBindingFilter();
    }

    @Bean
    public Client stormpathClient() throws Exception {
        ClientFactory clientFactory = new ClientFactory();

        clientFactory.setApiKeyFileLocation(Constants.STORMPATH_API_KEY_LOCATION);

        return clientFactory.getClientBuilder().build();
    }

    @Bean
    public StormpathAuthenticationProvider stormpathAuthenticationProvider() throws Exception {
        StormpathAuthenticationProvider stormpathAuthenticationProvider = new StormpathAuthenticationProvider();

        Client client = stormpathClient();
        stormpathAuthenticationProvider.setClient(client);
        stormpathAuthenticationProvider.setApplicationRestUrl(stormpathApplicationUrl);

        return stormpathAuthenticationProvider;
    }

    @Bean
    public LocalUserPersistingAuthenticationSuccessHandler localUserPersistingAuthenticationSuccessHandler() {
        return new LocalUserPersistingAuthenticationSuccessHandler();
    }
}