- * This bean is auto-configured by {@link SpringAddonsOAuth2ClientBeans} as {@link ConditionalOnMissingBean @ConditionalOnMissingBean} of type
+ * This bean is auto-configured by {@link ReactiveSpringAddonsOidcClientBeans} as {@link ConditionalOnMissingBean @ConditionalOnMissingBean} of type
* {@link ServerLogoutSuccessHandler}. Usage:
*
*
@@ -42,11 +42,11 @@
*
* @author Jerome Wacongne ch4mp@c4-soft.com
* @see SpringAddonsOAuth2LogoutRequestUriBuilder
- * @see SpringAddonsOAuth2ClientProperties
+ * @see SpringAddonsOidcClientProperties
*/
@Data
@RequiredArgsConstructor
-public class SpringAddonsOAuth2ServerLogoutSuccessHandler implements ServerLogoutSuccessHandler {
+public class SpringAddonsServerLogoutSuccessHandler implements ServerLogoutSuccessHandler {
private final LogoutRequestUriBuilder uriBuilder;
private final ReactiveClientRegistrationRepository clientRegistrationRepo;
private final ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
diff --git a/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizationRequestResolver.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizationRequestResolver.java
similarity index 90%
rename from webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizationRequestResolver.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizationRequestResolver.java
index 6db7f988c..c14cf10ab 100644
--- a/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizationRequestResolver.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizationRequestResolver.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
+package com.c4_soft.springaddons.security.oidc.starter.reactive.client;
import java.util.HashMap;
import java.util.Map;
@@ -13,8 +13,8 @@
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
import org.springframework.web.server.ServerWebExchange;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties.RequestParam;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties.RequestParam;
import reactor.core.publisher.Mono;
@@ -27,7 +27,7 @@ public class SpringAddonsServerOAuth2AuthorizationRequestResolver extends Defaul
public SpringAddonsServerOAuth2AuthorizationRequestResolver(
InMemoryReactiveClientRegistrationRepository clientRegistrationRepository,
- SpringAddonsOAuth2ClientProperties addonsClientProperties) {
+ SpringAddonsOidcClientProperties addonsClientProperties) {
super(clientRegistrationRepository);
clientRegistrationRepository.forEach(reg -> {
final var params = addonsClientProperties.getAuthorizationRequestParams().get(reg.getRegistrationId());
diff --git a/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizedClientRepository.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizedClientRepository.java
similarity index 97%
rename from webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizedClientRepository.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizedClientRepository.java
index 3f0e74c18..bc51a2c5e 100644
--- a/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizedClientRepository.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizedClientRepository.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
+package com.c4_soft.springaddons.security.oidc.starter.reactive.client;
import java.util.Collections;
import java.util.HashSet;
@@ -20,8 +20,8 @@
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebSession;
-import com.c4_soft.springaddons.security.oauth2.config.reactive.SpringAddonsOAuth2ClientBeans.SpringAddonsWebSessionStore;
-import com.c4_soft.springaddons.security.oauth2.config.reactive.SpringAddonsOAuth2ClientBeans.WebSessionListener;
+import com.c4_soft.springaddons.security.oidc.starter.reactive.client.ReactiveSpringAddonsOidcClientBeans.SpringAddonsWebSessionStore;
+import com.c4_soft.springaddons.security.oidc.starter.reactive.client.ReactiveSpringAddonsOidcClientBeans.WebSessionListener;
import com.nimbusds.jwt.JWTClaimNames;
import reactor.core.publisher.Flux;
diff --git a/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/ReactiveJwtAbstractAuthenticationTokenConverter.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ReactiveJwtAbstractAuthenticationTokenConverter.java
similarity index 82%
rename from spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/ReactiveJwtAbstractAuthenticationTokenConverter.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ReactiveJwtAbstractAuthenticationTokenConverter.java
index 85829bf4b..c4c387ac8 100644
--- a/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/ReactiveJwtAbstractAuthenticationTokenConverter.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ReactiveJwtAbstractAuthenticationTokenConverter.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config;
+package com.c4_soft.springaddons.security.oidc.starter.reactive.resourceserver;
import org.springframework.core.convert.converter.Converter;
import org.springframework.security.authentication.AbstractAuthenticationToken;
diff --git a/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsWebSecurityBeans.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ReactiveSpringAddonsOidcResourceServerBeans.java
similarity index 66%
rename from webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsWebSecurityBeans.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ReactiveSpringAddonsOidcResourceServerBeans.java
index 329d8338f..48ff4ea14 100644
--- a/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsWebSecurityBeans.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ReactiveSpringAddonsOidcResourceServerBeans.java
@@ -1,8 +1,7 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
+package com.c4_soft.springaddons.security.oidc.starter.reactive.resourceserver;
import java.net.URI;
import java.nio.charset.Charset;
-import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.Optional;
@@ -10,19 +9,19 @@
import java.util.stream.Stream;
import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.AnyNestedCondition;
+import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
-import org.springframework.context.annotation.Import;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
+import org.springframework.core.convert.converter.Converter;
import org.springframework.core.io.buffer.DataBufferUtils;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.authentication.AnonymousAuthenticationToken;
import org.springframework.security.authentication.ReactiveAuthenticationManager;
import org.springframework.security.authentication.ReactiveAuthenticationManagerResolver;
@@ -42,15 +41,18 @@
import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler;
import org.springframework.security.web.server.csrf.CsrfToken;
import org.springframework.util.StringUtils;
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.reactive.CorsConfigurationSource;
-import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebFilter;
-import com.c4_soft.springaddons.security.oauth2.config.ReactiveJwtAbstractAuthenticationTokenConverter;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.CorsProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.CookieCsrfCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.DefaultAuthenticationManagerResolverCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.IsIntrospectingResourceServerCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.IsJwtDecoderResourceServerCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.configuration.IsNotServlet;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.configuration.IsOidcResourceServerCondition;
+import com.c4_soft.springaddons.security.oidc.starter.reactive.ReactiveConfigurationSupport;
+import com.c4_soft.springaddons.security.oidc.starter.reactive.ReactiveSpringAddonsOidcBeans;
import lombok.extern.slf4j.Slf4j;
import reactor.core.publisher.Mono;
@@ -66,9 +68,9 @@
*
*
* - SecurityWebFilterChain: applies CORS, CSRF, anonymous, sessionCreationPolicy, SSL redirect and 401 instead of redirect to login properties as
- * defined in {@link SpringAddonsSecurityProperties}
+ * defined in {@link SpringAddonsOidcProperties}
* - AuthorizeExchangeSpecPostProcessor. Override if you need fined grained HTTP security (more than authenticated() to all routes but the ones defined
- * as permitAll() in {@link SpringAddonsSecurityProperties}
+ * as permitAll() in {@link SpringAddonsOidcProperties}
* - Jwt2AuthoritiesConverter: responsible for converting the JWT into Collection<? extends GrantedAuthority>
* - ReactiveJwt2OpenidClaimSetConverter<T extends Map<String, Object> & Serializable>: responsible for converting the JWT into a
* claim-set of your choice (OpenID or not)
@@ -80,12 +82,12 @@
*
* @author Jerome Wacongne ch4mp@c4-soft.com
*/
-@ConditionalOnProperty(matchIfMissing = true, prefix = "com.c4-soft.springaddons.security", name = "enabled")
+@Conditional({ IsOidcResourceServerCondition.class, IsNotServlet.class })
@EnableWebFluxSecurity
@AutoConfiguration
+@ImportAutoConfiguration(ReactiveSpringAddonsOidcBeans.class)
@Slf4j
-@Import({ AddonsSecurityBeans.class })
-public class AddonsWebSecurityBeans {
+public class ReactiveSpringAddonsOidcResourceServerBeans {
/**
*
@@ -100,7 +102,7 @@ public class AddonsWebSecurityBeans {
*
* @param http HTTP security to configure
* @param serverProperties Spring "server" configuration properties
- * @param addonsProperties "com.c4-soft.springaddons.security" configuration properties
+ * @param addonsProperties "com.c4-soft.springaddons.oidc" configuration properties
* @param authorizePostProcessor Hook to override access-control rules for all path that are not listed in "permit-all"
* @param httpPostProcessor Hook to override all or part of HttpSecurity auto-configuration
* @param authenticationManagerResolver Converts successful JWT decoding result into an {@link Authentication}
@@ -108,20 +110,75 @@ public class AddonsWebSecurityBeans {
* @return A default {@link SecurityWebFilterChain} for reactive resource-servers with JWT decoder(matches all unmatched
* routes with lowest precedence)
*/
+ @Conditional(IsJwtDecoderResourceServerCondition.class)
@Order(Ordered.LOWEST_PRECEDENCE)
@Bean
- SecurityWebFilterChain springAddonsResourceServerSecurityFilterChain(
+ SecurityWebFilterChain springAddonsJwtResourceServerSecurityFilterChain(
ServerHttpSecurity http,
ServerProperties serverProperties,
- SpringAddonsSecurityProperties addonsProperties,
+ SpringAddonsOidcProperties addonsProperties,
ResourceServerAuthorizeExchangeSpecPostProcessor authorizePostProcessor,
ResourceServerHttpSecurityPostProcessor httpPostProcessor,
ReactiveAuthenticationManagerResolver authenticationManagerResolver,
ServerAccessDeniedHandler accessDeniedHandler) {
http.oauth2ResourceServer(server -> server.authenticationManagerResolver(authenticationManagerResolver));
- ReactiveConfigurationSupport
- .configureResourceServer(http, serverProperties, addonsProperties, accessDeniedHandler, authorizePostProcessor, httpPostProcessor);
+ ReactiveConfigurationSupport.configureResourceServer(
+ http,
+ serverProperties,
+ addonsProperties.getResourceserver(),
+ accessDeniedHandler,
+ authorizePostProcessor,
+ httpPostProcessor);
+
+ return http.build();
+ }
+
+ /**
+ *
+ * Applies SpringAddonsSecurityProperties to web security config. Be aware that defining a {@link SecurityWebFilterChain} bean with no security matcher and
+ * an order higher than LOWEST_PRECEDENCE will disable most of this lib auto-configuration for OpenID resource-servers.
+ *
+ *
+ * You should consider to set security matcher to all other {@link SecurityWebFilterChain} beans and provide a
+ * {@link ResourceServerHttpSecurityPostProcessor} bean to override anything from this bean
+ *
+ * .
+ *
+ * @param http HTTP security to configure
+ * @param serverProperties Spring "server" configuration properties
+ * @param addonsProperties "com.c4-soft.springaddons.oidc" configuration properties
+ * @param authorizePostProcessor Hook to override access-control rules for all path that are not listed in "permit-all"
+ * @param httpPostProcessor Hook to override all or part of HttpSecurity auto-configuration
+ * @param introspectionAuthenticationConverter Converts successful introspection result into an {@link Authentication}
+ * @param accessDeniedHandler handler for unauthorized requests (missing or invalid access-token)
+ * @return A default {@link SecurityWebFilterChain} for reactive resource-servers with access-token introspection
+ * (matches all unmatched routes with lowest precedence)
+ */
+ @Conditional(IsIntrospectingResourceServerCondition.class)
+ @Order(Ordered.LOWEST_PRECEDENCE)
+ @Bean
+ SecurityWebFilterChain springAddonsIntrospectingResourceServerSecurityFilterChain(
+ ServerHttpSecurity http,
+ ServerProperties serverProperties,
+ SpringAddonsOidcProperties addonsProperties,
+ ResourceServerAuthorizeExchangeSpecPostProcessor authorizePostProcessor,
+ ResourceServerHttpSecurityPostProcessor httpPostProcessor,
+ org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter introspectionAuthenticationConverter,
+ org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenIntrospector opaqueTokenIntrospector,
+ ServerAccessDeniedHandler accessDeniedHandler) {
+ http.oauth2ResourceServer(server -> server.opaqueToken(ot -> {
+ ot.introspector(opaqueTokenIntrospector);
+ ot.authenticationConverter(introspectionAuthenticationConverter);
+ }));
+
+ ReactiveConfigurationSupport.configureResourceServer(
+ http,
+ serverProperties,
+ addonsProperties.getResourceserver(),
+ accessDeniedHandler,
+ authorizePostProcessor,
+ httpPostProcessor);
return http.build();
}
@@ -149,54 +206,41 @@ ResourceServerHttpSecurityPostProcessor httpPostProcessor() {
return serverHttpSecurity -> serverHttpSecurity;
}
- CorsConfigurationSource corsConfig(CorsProperties[] corsProperties) {
- final var source = new UrlBasedCorsConfigurationSource();
- for (final var corsProps : corsProperties) {
- final var configuration = new CorsConfiguration();
- configuration.setAllowedOrigins(Arrays.asList(corsProps.getAllowedOrigins()));
- configuration.setAllowedMethods(Arrays.asList(corsProps.getAllowedMethods()));
- configuration.setAllowedHeaders(Arrays.asList(corsProps.getAllowedHeaders()));
- configuration.setExposedHeaders(Arrays.asList(corsProps.getExposedHeaders()));
- source.registerCorsConfiguration(corsProps.getPath(), configuration);
- }
- return source;
- }
-
/**
* Provides with multi-tenancy: builds a ReactiveAuthenticationManagerResolver per provided OIDC issuer URI
*
* @param auth2ResourceServerProperties "spring.security.oauth2.resourceserver" configuration properties
- * @param addonsProperties "com.c4-soft.springaddons.security" configuration properties
+ * @param addonsProperties "com.c4-soft.springaddons.oidc" configuration properties
* @param jwtAuthenticationConverter converts from a {@link Jwt} to an {@link Authentication} implementation
* @return Multi-tenant {@link ReactiveAuthenticationManagerResolver} (one for each configured issuer)
*/
- @ConditionalOnMissingBean
+ @Conditional(DefaultAuthenticationManagerResolverCondition.class)
@Bean
ReactiveAuthenticationManagerResolver authenticationManagerResolver(
OAuth2ResourceServerProperties auth2ResourceServerProperties,
- SpringAddonsSecurityProperties addonsProperties,
- ReactiveJwtAbstractAuthenticationTokenConverter jwtAuthenticationConverter) {
+ SpringAddonsOidcProperties addonsProperties,
+ Converter> jwtAuthenticationConverter) {
final var jwtProps = Optional.ofNullable(auth2ResourceServerProperties).map(OAuth2ResourceServerProperties::getJwt);
// @formatter:off
Optional.ofNullable(jwtProps.map(OAuth2ResourceServerProperties.Jwt::getIssuerUri)).orElse(jwtProps.map(OAuth2ResourceServerProperties.Jwt::getJwkSetUri))
.filter(StringUtils::hasLength)
.ifPresent(jwtConf -> {
- log.warn("spring.security.oauth2.resourceserver configuration will be ignored in favor of com.c4-soft.springaddons.security");
+ log.warn("spring.security.oauth2.resourceserver configuration will be ignored in favor of com.c4-soft.springaddons.oidc");
});
// @formatter:on
final Map> jwtManagers =
- Stream.of(addonsProperties.getIssuers()).collect(Collectors.toMap(issuer -> issuer.getLocation().toString(), issuer -> {
+ Stream.of(addonsProperties.getOps()).collect(Collectors.toMap(issuer -> issuer.getIss().toString(), issuer -> {
final var decoder = issuer.getJwkSetUri() != null && StringUtils.hasLength(issuer.getJwkSetUri().toString())
? NimbusReactiveJwtDecoder.withJwkSetUri(issuer.getJwkSetUri().toString()).build()
- : NimbusReactiveJwtDecoder.withIssuerLocation(issuer.getLocation().toString()).build();
+ : NimbusReactiveJwtDecoder.withIssuerLocation(issuer.getIss().toString()).build();
- final OAuth2TokenValidator defaultValidator = Optional.ofNullable(issuer.getLocation()).map(URI::toString)
+ final OAuth2TokenValidator defaultValidator = Optional.ofNullable(issuer.getIss()).map(URI::toString)
.map(JwtValidators::createDefaultWithIssuer).orElse(JwtValidators.createDefault());
// If the spring-addons conf for resource server contains a non empty audience, add an audience validator
// @formatter:off
- final OAuth2TokenValidator jwtValidator = Optional.ofNullable(issuer.getAudience())
+ final OAuth2TokenValidator jwtValidator = Optional.ofNullable(issuer.getAud())
.filter(StringUtils::hasText)
.map(audience -> new JwtClaimValidator>(
JwtClaimNames.AUD,
@@ -214,7 +258,7 @@ ReactiveAuthenticationManagerResolver authenticationManagerRe
log.debug(
"Building default JwtIssuerReactiveAuthenticationManagerResolver with: {} {}",
auth2ResourceServerProperties.getJwt(),
- Stream.of(addonsProperties.getIssuers()).toList());
+ Stream.of(addonsProperties.getOps()).toList());
return new JwtIssuerReactiveAuthenticationManagerResolver(issuerLocation -> jwtManagers.getOrDefault(issuerLocation, Mono.empty()));
}
@@ -240,7 +284,7 @@ ServerAccessDeniedHandler serverAccessDeniedHandler() {
/**
* https://docs.spring.io/spring-security/reference/5.8/migration/reactive.html#_i_am_using_angularjs_or_another_javascript_framework
*/
- @Conditional(CookieCsrf.class)
+ @Conditional(CookieCsrfCondition.class)
@ConditionalOnMissingBean(name = "csrfCookieWebFilter")
@Bean
WebFilter csrfCookieWebFilter() {
@@ -250,22 +294,4 @@ WebFilter csrfCookieWebFilter() {
}).then(chain.filter(exchange));
};
}
-
- static class CookieCsrf extends AnyNestedCondition {
-
- public CookieCsrf() {
- super(ConfigurationPhase.PARSE_CONFIGURATION);
- }
-
- @ConditionalOnProperty(name = "com.c4-soft.springaddons.security.csrf", havingValue = "cookie-accessible-from-js")
- static class Value1Condition {
-
- }
-
- @ConditionalOnProperty(name = "com.c4-soft.springaddons.security.csrf", havingValue = "cookie-http-only")
- static class Value2Condition {
-
- }
-
- }
}
\ No newline at end of file
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ResourceServerAuthorizeExchangeSpecPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ResourceServerAuthorizeExchangeSpecPostProcessor.java
new file mode 100644
index 000000000..83e365bf1
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ResourceServerAuthorizeExchangeSpecPostProcessor.java
@@ -0,0 +1,14 @@
+package com.c4_soft.springaddons.security.oidc.starter.reactive.resourceserver;
+
+import com.c4_soft.springaddons.security.oidc.starter.reactive.AuthorizeExchangeSpecPostProcessor;
+
+/**
+ * Customize access-control for routes which where not listed in
+ * {@link com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties#permitAll SpringAddonsOidcClientProperties::permit-all} or
+ * {@link com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcResourceServerProperties#permitAll
+ * SpringAddonsOidcResourceServerProperties::permit-all}
+ *
+ * @author ch4mp
+ */
+public interface ResourceServerAuthorizeExchangeSpecPostProcessor extends AuthorizeExchangeSpecPostProcessor {
+}
\ No newline at end of file
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ResourceServerHttpSecurityPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ResourceServerHttpSecurityPostProcessor.java
new file mode 100644
index 000000000..7a167d4dc
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/resourceserver/ResourceServerHttpSecurityPostProcessor.java
@@ -0,0 +1,14 @@
+package com.c4_soft.springaddons.security.oidc.starter.reactive.resourceserver;
+
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+
+import com.c4_soft.springaddons.security.oidc.starter.reactive.HttpSecurityPostProcessor;
+
+/**
+ * Process {@link ServerHttpSecurity} of default security filter-chain after it was processed by spring-addons. This enables to override anything that was
+ * auto-configured (or add to it).
+ *
+ * @author ch4mp
+ */
+public interface ResourceServerHttpSecurityPostProcessor extends HttpSecurityPostProcessor {
+}
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ExpressionInterceptUrlRegistryPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ExpressionInterceptUrlRegistryPostProcessor.java
similarity index 58%
rename from webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ExpressionInterceptUrlRegistryPostProcessor.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ExpressionInterceptUrlRegistryPostProcessor.java
index 3beea5559..f86d1c7fc 100644
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ExpressionInterceptUrlRegistryPostProcessor.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ExpressionInterceptUrlRegistryPostProcessor.java
@@ -1,13 +1,15 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcResourceServerProperties;
/**
- * Customize access-control for routes which where not listed in {@link SpringAddonsSecurityProperties#permitAll}
- *
+ * Customize access-control for routes which where not listed in {@link SpringAddonsOidcClientProperties#permitAll} or
+ * {@link SpringAddonsOidcResourceServerProperties#permitAll}
+ *
* @author ch4mp
*/
public interface ExpressionInterceptUrlRegistryPostProcessor {
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/HttpServletRequestSupport.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/HttpServletRequestSupport.java
similarity index 98%
rename from webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/HttpServletRequestSupport.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/HttpServletRequestSupport.java
index e8ee54062..aaf42bb8c 100644
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/HttpServletRequestSupport.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/HttpServletRequestSupport.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised;
import java.util.List;
import java.util.Optional;
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ServerHttpSecurityPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ServerHttpSecurityPostProcessor.java
similarity index 74%
rename from webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ServerHttpSecurityPostProcessor.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ServerHttpSecurityPostProcessor.java
index 9c5530f72..837c05246 100644
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ServerHttpSecurityPostProcessor.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ServerHttpSecurityPostProcessor.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ServletConfigurationSupport.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ServletConfigurationSupport.java
similarity index 78%
rename from webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ServletConfigurationSupport.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ServletConfigurationSupport.java
index 0b2eabdb9..87885bfe0 100644
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ServletConfigurationSupport.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/ServletConfigurationSupport.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised;
import static org.springframework.security.config.Customizer.withDefaults;
@@ -18,9 +18,14 @@
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.OncePerRequestFilter;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.CorsProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.CorsProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.Csrf;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcResourceServerProperties;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.client.ClientExpressionInterceptUrlRegistryPostProcessor;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.client.ClientHttpSecurityPostProcessor;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver.ResourceServerExpressionInterceptUrlRegistryPostProcessor;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver.ResourceServerHttpSecurityPostProcessor;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
@@ -32,7 +37,7 @@ public class ServletConfigurationSupport {
public static HttpSecurity configureResourceServer(
HttpSecurity http,
ServerProperties serverProperties,
- SpringAddonsSecurityProperties addonsResourceServerProperties,
+ SpringAddonsOidcResourceServerProperties addonsResourceServerProperties,
ResourceServerExpressionInterceptUrlRegistryPostProcessor authorizePostProcessor,
ResourceServerHttpSecurityPostProcessor httpPostProcessor)
throws Exception {
@@ -41,12 +46,10 @@ public static HttpSecurity configureResourceServer(
ServletConfigurationSupport.configureState(http, addonsResourceServerProperties.isStatlessSessions(), addonsResourceServerProperties.getCsrf());
ServletConfigurationSupport.configureAccess(http, addonsResourceServerProperties.getPermitAll(), authorizePostProcessor);
- if (!addonsResourceServerProperties.isRedirectToLoginIfUnauthorizedOnRestrictedContent()) {
- http.exceptionHandling(exceptionHandling -> exceptionHandling.authenticationEntryPoint((request, response, authException) -> {
- response.addHeader(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"Restricted Content\"");
- response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
- }));
- }
+ http.exceptionHandling(exceptionHandling -> exceptionHandling.authenticationEntryPoint((request, response, authException) -> {
+ response.addHeader(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"Restricted Content\"");
+ response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
+ }));
if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
http.requiresChannel(channel -> channel.anyRequest().requiresSecure());
@@ -58,7 +61,7 @@ public static HttpSecurity configureResourceServer(
public static HttpSecurity configureClient(
HttpSecurity http,
ServerProperties serverProperties,
- SpringAddonsOAuth2ClientProperties addonsClientProperties,
+ SpringAddonsOidcClientProperties addonsClientProperties,
ClientExpressionInterceptUrlRegistryPostProcessor authorizePostProcessor,
ClientHttpSecurityPostProcessor httpPostProcessor)
throws Exception {
@@ -92,10 +95,12 @@ public static HttpSecurity configureCors(HttpSecurity http, CorsProperties[] cor
final var source = new UrlBasedCorsConfigurationSource();
for (final var corsProps : corsProperties) {
final var configuration = new CorsConfiguration();
- configuration.setAllowedOrigins(Arrays.asList(corsProps.getAllowedOrigins()));
- configuration.setAllowedMethods(Arrays.asList(corsProps.getAllowedMethods()));
+ configuration.setAllowCredentials(corsProps.getAllowCredentials());
configuration.setAllowedHeaders(Arrays.asList(corsProps.getAllowedHeaders()));
+ configuration.setAllowedMethods(Arrays.asList(corsProps.getAllowedMethods()));
+ configuration.setAllowedOriginPatterns(Arrays.asList(corsProps.getAllowedOriginPatterns()));
configuration.setExposedHeaders(Arrays.asList(corsProps.getExposedHeaders()));
+ configuration.setMaxAge(corsProps.getMaxAge());
source.registerCorsConfiguration(corsProps.getPath(), configuration);
}
http.cors(cors -> cors.configurationSource(source));
@@ -103,7 +108,7 @@ public static HttpSecurity configureCors(HttpSecurity http, CorsProperties[] cor
return http;
}
- public static HttpSecurity configureState(HttpSecurity http, boolean isStatless, SpringAddonsSecurityProperties.Csrf csrfEnum) throws Exception {
+ public static HttpSecurity configureState(HttpSecurity http, boolean isStatless, Csrf csrfEnum) throws Exception {
if (isStatless) {
http.sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/SpringAddonsOidcBeans.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/SpringAddonsOidcBeans.java
new file mode 100644
index 000000000..bef06e916
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/SpringAddonsOidcBeans.java
@@ -0,0 +1,144 @@
+package com.c4_soft.springaddons.security.oidc.starter.synchronised;
+
+import java.time.Instant;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Stream;
+
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type;
+import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Conditional;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
+import org.springframework.security.oauth2.core.OAuth2AccessToken;
+import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal;
+import org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames;
+import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
+import org.springframework.security.oauth2.core.user.OAuth2UserAuthority;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthentication;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
+import org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionAuthenticatedPrincipal;
+import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenAuthenticationConverter;
+
+import com.c4_soft.springaddons.security.oidc.OpenidClaimSet;
+import com.c4_soft.springaddons.security.oidc.starter.ClaimSetAuthoritiesConverter;
+import com.c4_soft.springaddons.security.oidc.starter.ConfigurableClaimSetAuthoritiesConverter;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.DefaultGrantedAuthoritiesMapperCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.DefaultJwtAbstractAuthenticationTokenConverterCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.DefaultOpaqueTokenAuthenticationConverterCondition;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver.JwtAbstractAuthenticationTokenConverter;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * @author Jerome Wacongne ch4mp@c4-soft.com
+ */
+@ConditionalOnWebApplication(type = Type.SERVLET)
+@AutoConfiguration
+@ImportAutoConfiguration(SpringAddonsOidcProperties.class)
+@Slf4j
+public class SpringAddonsOidcBeans {
+
+ /**
+ * Retrieves granted authorities from a claims-set (decoded from JWT, introspected or obtained from userinfo end-point)
+ *
+ * @param addonsProperties spring-addons configuration properties
+ * @return
+ */
+ @ConditionalOnMissingBean
+ @Bean
+ ClaimSetAuthoritiesConverter authoritiesConverter(SpringAddonsOidcProperties addonsProperties) {
+ log.debug("Building default ConfigurableClaimSetAuthoritiesConverter with: {}", (Object[]) addonsProperties.getOps());
+ return new ConfigurableClaimSetAuthoritiesConverter(addonsProperties);
+ }
+
+ /**
+ * Converter bean from {@link Jwt} to {@link AbstractAuthenticationToken}
+ *
+ * @param authoritiesConverter converts access-token claims into Spring authorities
+ * @param addonsProperties spring-addons configuration properties
+ * @return a converter from {@link Jwt} to {@link AbstractAuthenticationToken}
+ */
+ @Conditional(DefaultJwtAbstractAuthenticationTokenConverterCondition.class)
+ @Bean
+ JwtAbstractAuthenticationTokenConverter jwtAuthenticationConverter(
+ Converter, Collection> authoritiesConverter,
+ SpringAddonsOidcProperties addonsProperties) {
+ return jwt -> new JwtAuthenticationToken(
+ jwt,
+ authoritiesConverter.convert(jwt.getClaims()),
+ new OpenidClaimSet(jwt.getClaims(), addonsProperties.getOpProperties(jwt.getIssuer()).getUsernameClaim()).getName());
+ }
+
+ /**
+ * Converter bean from successful introspection result to an {@link Authentication} instance
+ *
+ * @param authoritiesConverter converts access-token claims into Spring authorities
+ * @param addonsProperties spring-addons configuration properties
+ * @param resourceServerProperties Spring Boot standard resource server configuration properties
+ * @return a converter from successful introspection result to an {@link Authentication} instance
+ */
+ @Conditional(DefaultOpaqueTokenAuthenticationConverterCondition.class)
+ @Bean
+ @SuppressWarnings("unchecked")
+ OpaqueTokenAuthenticationConverter introspectionAuthenticationConverter(
+ Converter, Collection> authoritiesConverter,
+ SpringAddonsOidcProperties addonsProperties,
+ OAuth2ResourceServerProperties resourceServerProperties) {
+ return (String introspectedToken, OAuth2AuthenticatedPrincipal authenticatedPrincipal) -> {
+ return new BearerTokenAuthentication(
+ new OAuth2IntrospectionAuthenticatedPrincipal(
+ new OpenidClaimSet(
+ authenticatedPrincipal.getAttributes(),
+ Stream.of(addonsProperties.getOps())
+ .filter(
+ openidProvider -> resourceServerProperties.getOpaquetoken().getIntrospectionUri()
+ .contains(openidProvider.getIss().toString()))
+ .findAny().orElse(addonsProperties.getOps()[0]).getUsernameClaim()).getName(),
+ authenticatedPrincipal.getAttributes(),
+ (Collection) authenticatedPrincipal.getAuthorities()),
+ new OAuth2AccessToken(
+ OAuth2AccessToken.TokenType.BEARER,
+ introspectedToken,
+ Instant.ofEpochSecond(((Integer) authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.IAT)).longValue()),
+ Instant.ofEpochSecond(((Integer) authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.EXP)).longValue())),
+ authoritiesConverter.convert(authenticatedPrincipal.getAttributes()));
+ };
+ }
+
+ /**
+ * @param authoritiesConverter the authorities converter to use (by default {@link ConfigurableClaimSetAuthoritiesConverter})
+ * @return {@link GrantedAuthoritiesMapper} using the authorities converter in the context
+ */
+ @Conditional(DefaultGrantedAuthoritiesMapperCondition.class)
+ @Bean
+ GrantedAuthoritiesMapper grantedAuthoritiesMapper(Converter, Collection> authoritiesConverter) {
+ return (authorities) -> {
+ Set mappedAuthorities = new HashSet<>();
+
+ authorities.forEach(authority -> {
+ if (authority instanceof OidcUserAuthority oidcAuth) {
+ mappedAuthorities.addAll(authoritiesConverter.convert(oidcAuth.getIdToken().getClaims()));
+
+ } else if (authority instanceof OAuth2UserAuthority oauth2Auth) {
+ mappedAuthorities.addAll(authoritiesConverter.convert(oauth2Auth.getAttributes()));
+
+ }
+ });
+
+ return mappedAuthorities;
+ };
+ }
+}
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ClientExpressionInterceptUrlRegistryPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/ClientExpressionInterceptUrlRegistryPostProcessor.java
similarity index 56%
rename from webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ClientExpressionInterceptUrlRegistryPostProcessor.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/ClientExpressionInterceptUrlRegistryPostProcessor.java
index eedb75637..4b65f13e5 100644
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ClientExpressionInterceptUrlRegistryPostProcessor.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/ClientExpressionInterceptUrlRegistryPostProcessor.java
@@ -1,4 +1,6 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.client;
+
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.ExpressionInterceptUrlRegistryPostProcessor;
/**
* Post processor for access control in Java configuration.
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ClientHttpSecurityPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/ClientHttpSecurityPostProcessor.java
similarity index 59%
rename from webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ClientHttpSecurityPostProcessor.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/ClientHttpSecurityPostProcessor.java
index 0219f1f4e..0aa4ee38d 100644
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ClientHttpSecurityPostProcessor.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/ClientHttpSecurityPostProcessor.java
@@ -1,4 +1,6 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.client;
+
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.ServerHttpSecurityPostProcessor;
/**
* A post-processor to override anything from spring-addons client security filter-chain auto-configuration.
diff --git a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsBackChannelLogoutBeans.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsBackChannelLogoutBeans.java
similarity index 86%
rename from webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsBackChannelLogoutBeans.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsBackChannelLogoutBeans.java
index c69e4f3fd..91134555b 100644
--- a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsBackChannelLogoutBeans.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsBackChannelLogoutBeans.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.client;
import java.net.URL;
import java.util.Map;
@@ -8,10 +8,12 @@
import java.util.stream.StreamSupport;
import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Import;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpStatus;
@@ -34,7 +36,7 @@
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestController;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.SpringAddonsOidcBeans;
/**
*
@@ -46,16 +48,19 @@
* Implementation is made with a security filter-chain intercepting just the "/backchannel_logout" route and a controller handling requests to that end-point.
*
*
- * This beans are defined only if "com.c4-soft.springaddons.security.client.back-channel-logout-enabled" property is true.
+ * This beans are defined only if "com.c4-soft.springaddons.oidc.client.back-channel-logout-enabled" property is true.
*
*
* @author Jerome Wacongne ch4mp@c4-soft.com
*/
-@ConditionalOnProperty("com.c4-soft.springaddons.security.client.back-channel-logout-enabled")
+@ConditionalOnWebApplication(type = Type.SERVLET)
+@ConditionalOnProperty("com.c4-soft.springaddons.oidc.client.back-channel-logout-enabled")
@AutoConfiguration
-@Import({ SpringAddonsOAuth2ClientProperties.class })
+@ImportAutoConfiguration(SpringAddonsOidcBeans.class)
public class SpringAddonsBackChannelLogoutBeans {
+ private static final String BACKCHANNEL_LOGOUT_PATH = "/backchannel_logout";
+
/**
* Requests from the OP are anonymous, are not part of a session, and have no CSRF token. It contains a logout JWT which serves both to authenticate the
* request and protect against CSRF.
@@ -68,7 +73,7 @@ public class SpringAddonsBackChannelLogoutBeans {
@Order(Ordered.HIGHEST_PRECEDENCE)
@Bean
SecurityFilterChain springAddonsBackChannelLogoutClientFilterChain(HttpSecurity http, ServerProperties serverProperties) throws Exception {
- http.securityMatcher(new AntPathRequestMatcher("/backchannel_logout"));
+ http.securityMatcher(new AntPathRequestMatcher(BACKCHANNEL_LOGOUT_PATH));
http.authorizeHttpRequests(authorizeHttpRequests -> authorizeHttpRequests.anyRequest().permitAll());
if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
http.requiresChannel(channel -> channel.anyRequest().requiresSecure());
@@ -109,7 +114,7 @@ public BackChannelLogoutController(
Collectors.toMap(provider -> provider.getIssuerUri(), provider -> NimbusJwtDecoder.withJwkSetUri(provider.getJwkSetUri()).build()));
}
- @PostMapping(path = "/backchannel_logout", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
+ @PostMapping(path = BACKCHANNEL_LOGOUT_PATH, consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
public ResponseEntity backChannelLogout(@RequestParam MultiValueMap body) {
final var tokenString = body.get("logout_token");
if (tokenString == null || tokenString.size() != 1) {
diff --git a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2LogoutSuccessHandler.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsLogoutSuccessHandler.java
similarity index 75%
rename from webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2LogoutSuccessHandler.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsLogoutSuccessHandler.java
index fb41a3a31..1e3b0a541 100644
--- a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2LogoutSuccessHandler.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsLogoutSuccessHandler.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.client;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.security.core.Authentication;
@@ -7,9 +7,9 @@
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
-import com.c4_soft.springaddons.security.oauth2.config.LogoutRequestUriBuilder;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2LogoutRequestUriBuilder;
+import com.c4_soft.springaddons.security.oidc.starter.LogoutRequestUriBuilder;
+import com.c4_soft.springaddons.security.oidc.starter.SpringAddonsOAuth2LogoutRequestUriBuilder;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
@@ -20,14 +20,14 @@
/**
*
* Provide with RP-Initiated Logout for authorization-servers fully compliant with
- * OIDC standard as well as those "almost" implementing the spec. It is (auto)configured with {@link SpringAddonsOAuth2ClientProperties}.
+ * OIDC standard as well as those "almost" implementing the spec. It is (auto)configured with {@link SpringAddonsOidcClientProperties}.
*
*
* This implementation is not multi-tenant ready. It will terminate the user session on this application as well as on a single authorization-server (the
* one which emitted the access-token with which the logout request is made).
*
*
- * This bean is auto-configured by {@link SpringAddonsOAuth2ClientBeans} as {@link ConditionalOnMissingBean @ConditionalOnMissingBean} of type
+ * This bean is auto-configured by {@link SpringAddonsOidcClientBeans} as {@link ConditionalOnMissingBean @ConditionalOnMissingBean} of type
* {@link LogoutSuccessHandler}. Usage:
*
*
@@ -39,12 +39,12 @@
*
* @author Jerome Wacongne ch4mp@c4-soft.com
* @see SpringAddonsOAuth2LogoutRequestUriBuilder
- * @see SpringAddonsOAuth2ClientProperties
+ * @see SpringAddonsOidcClientProperties
*/
@Data
@RequiredArgsConstructor
@EqualsAndHashCode(callSuper = true)
-public class SpringAddonsOAuth2LogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
+public class SpringAddonsLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
private final LogoutRequestUriBuilder uriBuilder;
private final ClientRegistrationRepository clientRegistrationRepository;
diff --git a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2AuthorizationRequestResolver.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOAuth2AuthorizationRequestResolver.java
similarity index 89%
rename from webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2AuthorizationRequestResolver.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOAuth2AuthorizationRequestResolver.java
index aa5b86fcc..0b17f8047 100644
--- a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2AuthorizationRequestResolver.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOAuth2AuthorizationRequestResolver.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.client;
import java.net.URI;
import java.util.HashMap;
@@ -13,15 +13,15 @@
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.util.UriComponentsBuilder;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties.RequestParam;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties.RequestParam;
import jakarta.servlet.http.HttpServletRequest;
/**
* Support two features:
*
- * - usage of {@link SpringAddonsOAuth2ClientProperties#getClientUri() SpringAddonsOAuth2ClientProperties#client-uri} in post-login redirection URI
+ * - usage of {@link SpringAddonsOidcClientProperties#clientUri SpringAddonsOidcClientProperties#client-uri} in post-login redirection URI
* - defining authorization request additional parameters from properties (like audience for Auth0)
*
*
@@ -37,7 +37,7 @@ public class SpringAddonsOAuth2AuthorizationRequestResolver implements OAuth2Aut
public SpringAddonsOAuth2AuthorizationRequestResolver(
InMemoryClientRegistrationRepository clientRegistrationRepository,
- SpringAddonsOAuth2ClientProperties addonsClientProperties) {
+ SpringAddonsOidcClientProperties addonsClientProperties) {
clientRegistrationRepository.forEach(reg -> {
final var params = addonsClientProperties.getAuthorizationRequestParams().get(reg.getRegistrationId());
if (params != null) {
diff --git a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2AuthorizedClientRepository.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOAuth2AuthorizedClientRepository.java
similarity index 99%
rename from webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2AuthorizedClientRepository.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOAuth2AuthorizedClientRepository.java
index 06e2352d5..19d47cbc0 100644
--- a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2AuthorizedClientRepository.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOAuth2AuthorizedClientRepository.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.client;
import java.util.Collection;
import java.util.Collections;
diff --git a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2ClientBeans.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOidcClientBeans.java
similarity index 53%
rename from webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2ClientBeans.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOidcClientBeans.java
index dc6cdd97c..39b97f567 100644
--- a/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2ClientBeans.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/client/SpringAddonsOidcClientBeans.java
@@ -1,65 +1,52 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
-
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Set;
-import java.util.stream.Stream;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.client;
import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.AnyNestedCondition;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Import;
+import org.springframework.context.annotation.Conditional;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
-import org.springframework.core.convert.converter.Converter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestResolver;
-import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
-import org.springframework.security.oauth2.core.user.OAuth2UserAuthority;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.CorsConfigurationSource;
-import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.util.UriComponentsBuilder;
-import com.c4_soft.springaddons.security.oauth2.config.ClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.ConfigurableClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.LogoutRequestUriBuilder;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2ClientProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsOAuth2LogoutRequestUriBuilder;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.CorsProperties;
+import com.c4_soft.springaddons.security.oidc.starter.ClaimSetAuthoritiesConverter;
+import com.c4_soft.springaddons.security.oidc.starter.ConfigurableClaimSetAuthoritiesConverter;
+import com.c4_soft.springaddons.security.oidc.starter.LogoutRequestUriBuilder;
+import com.c4_soft.springaddons.security.oidc.starter.SpringAddonsOAuth2LogoutRequestUriBuilder;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcClientProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.configuration.IsOidcClientCondition;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.ServletConfigurationSupport;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.SpringAddonsOidcBeans;
import lombok.extern.slf4j.Slf4j;
/**
* The following {@link ConditionalOnMissingBean @ConditionalOnMissingBeans} are auto-configured
*
- * - springAddonsClientFilterChain: a {@link SecurityFilterChain}. Instantiated only if "com.c4-soft.springaddons.security.client.security-matchers" property
- * has at least one entry. If defined, it is with highest precedence, to ensure that all routes defined in this security matcher property are intercepted by
- * this filter-chain.
+ * - springAddonsClientFilterChain: a {@link SecurityFilterChain}. Instantiated only if "com.c4-soft.springaddons.oidc.client.security-matchers" property has
+ * at least one entry. If defined, it is with highest precedence, to ensure that all routes defined in this security matcher property are intercepted by this
+ * filter-chain.
* - oAuth2AuthorizationRequestResolver: a {@link OAuth2AuthorizationRequestResolver}. Default instance is a
* {@link SpringAddonsOAuth2AuthorizationRequestResolver} which sets the client hostname in the redirect URI with
- * {@link SpringAddonsOAuth2ClientProperties#getClientUri() SpringAddonsOAuth2ClientProperties#client-uri}
+ * {@link SpringAddonsOidcClientProperties#clientUri SpringAddonsOidcClientProperties#client-uri}
* - logoutRequestUriBuilder: builder for RP-Initiated Logout queries, taking
* configuration from properties for OIDC providers which do not strictly comply with the spec: logout URI not provided by OIDC conf or non standard parameter
* names (Auth0 and Cognito are samples of such OPs)
- * - logoutSuccessHandler: a {@link LogoutSuccessHandler}. Default instance is a {@link SpringAddonsOAuth2LogoutSuccessHandler} which logs a user out from the
- * last authorization server he logged on.
+ * - logoutSuccessHandler: a {@link LogoutSuccessHandler}. Default instance is a {@link SpringAddonsLogoutSuccessHandler} which logs a user out from the last
+ * authorization server he logged on.
* - authoritiesConverter: an {@link ClaimSetAuthoritiesConverter}. Default instance is a {@link ConfigurableClaimSetAuthoritiesConverter} which reads
- * spring-addons {@link SpringAddonsSecurityProperties}
+ * spring-addons {@link SpringAddonsOidcProperties}
* - oAuth2AuthorizedClientRepository: a {@link SpringAddonsOAuth2AuthorizedClientRepository} (which is also a session listener) capable of handling
* multi-tenancy and back-channel logout.
* - clientAuthorizePostProcessor: a {@link ClientExpressionInterceptUrlRegistryPostProcessor} post processor to fine tune access control from java
@@ -70,24 +57,25 @@
*
* @author Jerome Wacongne ch4mp@c4-soft.com
*/
-@ConditionalOnProperty(matchIfMissing = true, prefix = "com.c4-soft.springaddons.security.client", name = "enabled")
+@ConditionalOnWebApplication(type = Type.SERVLET)
+@Conditional(IsOidcClientCondition.class)
@EnableWebSecurity
@AutoConfiguration
-@Import({ SpringAddonsOAuth2ClientProperties.class })
+@ImportAutoConfiguration(SpringAddonsOidcBeans.class)
@Slf4j
-public class SpringAddonsOAuth2ClientBeans {
+public class SpringAddonsOidcClientBeans {
/**
*
- * Instantiated only if "com.c4-soft.springaddons.security.client.security-matchers" property has at least one entry. If defined, it is with highest
- * precedence, to ensure that all routes defined in this security matcher property are intercepted by this filter-chain.
+ * Instantiated only if "com.c4-soft.springaddons.oidc.client.security-matchers" property has at least one entry. If defined, it is with higher precedence
+ * than resource server one.
*
* It defines:
*
* - If the path to login page was provided in conf, a @Controller must be provided to handle it. Otherwise Spring Boot default generated one is used
* (be aware that it does not work when bound to 80 or 8080 with SSL enabled, so, in that case, use another port or define a login path and a controller to
* handle it)
- * - logout (using {@link SpringAddonsOAuth2LogoutSuccessHandler} by default)
+ * - logout (using {@link SpringAddonsLogoutSuccessHandler} by default)
* - forces SSL usage if it is enabled
properties
* - CSRF protection as defined in spring-addons client properties (enabled by default in this filter-chain).
* - allow access to unauthorized requests to path matchers listed in spring-security client "permit-all" property
@@ -99,7 +87,9 @@ public class SpringAddonsOAuth2ClientBeans {
* @param serverProperties Spring Boot standard server properties
* @param authorizationRequestResolver the authorization request resolver to use. By default {@link SpringAddonsOAuth2AuthorizationRequestResolver} (adds
* authorization request parameters defined in properties and builds absolutes callback URI)
- * @param clientProps {@link SpringAddonsOAuth2ClientProperties spring-addons client properties}
+ * @param logoutSuccessHandler Defaulted to {@link SpringAddonsLogoutSuccessHandler} which can handle "almost" RP Initiated Logout conformant OPs
+ * (like Auth0 and Cognito)
+ * @param addonsProperties {@link SpringAddonsOAuth2ClientProperties spring-addons client properties}
* @param authorizePostProcessor post process authorization after "permit-all" configuration was applied (default is "isAuthenticated()" to
* everything that was not matched)
* @param httpPostProcessor post process the "http" builder just before it is returned (enables to override anything from the
@@ -107,29 +97,28 @@ public class SpringAddonsOAuth2ClientBeans {
* @return a security filter-chain scoped to specified security-matchers and adapted to OAuth2 clients
* @throws Exception in case of miss-configuration
*/
- @ConditionalOnExpression("!(T(org.springframework.util.StringUtils).isEmpty('${com.c4-soft.springaddons.security.client.security-matchers:}') && T(org.springframework.util.StringUtils).isEmpty('${com.c4-soft.springaddons.security.client.security-matchers[0]:}'))")
- @Order(Ordered.HIGHEST_PRECEDENCE + 1)
+ @Order(Ordered.LOWEST_PRECEDENCE - 1)
@Bean
SecurityFilterChain springAddonsClientFilterChain(
HttpSecurity http,
ServerProperties serverProperties,
OAuth2AuthorizationRequestResolver authorizationRequestResolver,
LogoutSuccessHandler logoutSuccessHandler,
- SpringAddonsOAuth2ClientProperties clientProps,
+ SpringAddonsOidcProperties addonsProperties,
ClientExpressionInterceptUrlRegistryPostProcessor authorizePostProcessor,
ClientHttpSecurityPostProcessor httpPostProcessor)
throws Exception {
// @formatter:off
- log.info("Applying client OAuth2 configuration for: {}", (Object[]) clientProps.getSecurityMatchers());
- http.securityMatcher(clientProps.getSecurityMatchers());
+ log.info("Applying client OAuth2 configuration for: {}", (Object[]) addonsProperties.getClient().getSecurityMatchers());
+ http.securityMatcher(addonsProperties.getClient().getSecurityMatchers());
http.oauth2Login(login -> {
login.authorizationEndpoint(authorizationEndpoint -> authorizationEndpoint.authorizationRequestResolver(authorizationRequestResolver));
- clientProps.getLoginPath().ifPresent(loginPath -> {
- login.loginPage(UriComponentsBuilder.fromUri(clientProps.getClientUri()).path(loginPath).build().toString());
+ addonsProperties.getClient().getLoginPath().ifPresent(loginPath -> {
+ login.loginPage(UriComponentsBuilder.fromUri(addonsProperties.getClient().getClientUri()).path(loginPath).build().toString());
});
- clientProps.getPostLoginRedirectPath().ifPresent(postLoginRedirectPath -> {
- login.defaultSuccessUrl(UriComponentsBuilder.fromUri(clientProps.getClientUri()).path(postLoginRedirectPath).build().toString(), true);
+ addonsProperties.getClient().getPostLoginRedirectPath().ifPresent(postLoginRedirectPath -> {
+ login.defaultSuccessUrl(UriComponentsBuilder.fromUri(addonsProperties.getClient().getClientUri()).path(postLoginRedirectPath).build().toString(), true);
});
});
@@ -138,7 +127,7 @@ SecurityFilterChain springAddonsClientFilterChain(
});
// @formatter:on
- ServletConfigurationSupport.configureClient(http, serverProperties, clientProps, authorizePostProcessor, httpPostProcessor);
+ ServletConfigurationSupport.configureClient(http, serverProperties, addonsProperties.getClient(), authorizePostProcessor, httpPostProcessor);
return http.build();
}
@@ -151,29 +140,28 @@ SecurityFilterChain springAddonsClientFilterChain(
*
*
* @param clientRegistrationRepository
- * @param clientProps
+ * @param addonsProperties
* @return {@link SpringAddonsOAuth2AuthorizationRequestResolver}
*/
@ConditionalOnMissingBean
@Bean
- OAuth2AuthorizationRequestResolver oAuth2AuthorizationRequestResolver(
- InMemoryClientRegistrationRepository clientRegistrationRepository,
- SpringAddonsOAuth2ClientProperties clientProps) {
- return new SpringAddonsOAuth2AuthorizationRequestResolver(clientRegistrationRepository, clientProps);
+ OAuth2AuthorizationRequestResolver
+ oAuth2AuthorizationRequestResolver(InMemoryClientRegistrationRepository clientRegistrationRepository, SpringAddonsOidcProperties addonsProperties) {
+ return new SpringAddonsOAuth2AuthorizationRequestResolver(clientRegistrationRepository, addonsProperties.getClient());
}
/**
* Build logout request for RP-Initiated Logout. It works with most OIDC
* provider: those complying with the spec (Keycloak for instance), off course, but also those which are close enough to it (Auth0, Cognito, ...)
*
- * @param clientProps {@link SpringAddonsOAuth2ClientProperties} to pick logout configuration for divergence to the standard (logout URI not provided in
- * .well-known/openid-configuration and non-conform parameter names)
- * @return {@link SpringAddonsOAuth2LogoutRequestUriBuilder]
+ * @param addonsProperties {@link SpringAddonsOAuth2ClientProperties} to pick logout configuration for divergence to the standard (logout URI not provided
+ * in .well-known/openid-configuration and non-conform parameter names)
+ * @return {@link SpringAddonsOAuth2LogoutRequestUriBuilder]
*/
@ConditionalOnMissingBean
@Bean
- LogoutRequestUriBuilder logoutRequestUriBuilder(SpringAddonsOAuth2ClientProperties clientProps) {
- return new SpringAddonsOAuth2LogoutRequestUriBuilder(clientProps);
+ LogoutRequestUriBuilder logoutRequestUriBuilder(SpringAddonsOidcProperties addonsProperties) {
+ return new SpringAddonsOAuth2LogoutRequestUriBuilder(addonsProperties.getClient());
}
/**
@@ -182,67 +170,12 @@ LogoutRequestUriBuilder logoutRequestUriBuilder(SpringAddonsOAuth2ClientProperti
*
* @param logoutRequestUriBuilder delegate doing the smart job
* @param clientRegistrationRepository
- * @return {@link SpringAddonsOAuth2LogoutSuccessHandler}
+ * @return {@link SpringAddonsLogoutSuccessHandler}
*/
@ConditionalOnMissingBean
@Bean
LogoutSuccessHandler logoutSuccessHandler(LogoutRequestUriBuilder logoutRequestUriBuilder, ClientRegistrationRepository clientRegistrationRepository) {
- return new SpringAddonsOAuth2LogoutSuccessHandler(logoutRequestUriBuilder, clientRegistrationRepository);
- }
-
- /**
- * Instantiate a {@link ConfigurableClaimSetAuthoritiesConverter} from token claims to spring authorities (which claims to pick, how to transform roles
- * strings for each claim).
- *
- * @param addonsProperties converter configuration source
- * @return {@link ConfigurableClaimSetAuthoritiesConverter}
- */
- @ConditionalOnMissingBean
- @Bean
- ClaimSetAuthoritiesConverter authoritiesConverter(SpringAddonsSecurityProperties addonsProperties) {
- return new ConfigurableClaimSetAuthoritiesConverter(addonsProperties);
- }
-
- /**
- * @param authoritiesConverter the authorities converter to use (by default {@link ConfigurableClaimSetAuthoritiesConverter})
- * @return {@link GrantedAuthoritiesMapper} using the authorities converter in the context
- */
- @ConditionalOnMissingBean
- @Bean
- GrantedAuthoritiesMapper grantedAuthoritiesMapper(Converter, Collection> authoritiesConverter) {
- return (authorities) -> {
- Set mappedAuthorities = new HashSet<>();
-
- authorities.forEach(authority -> {
- if (authority instanceof OidcUserAuthority oidcAuth) {
- mappedAuthorities.addAll(authoritiesConverter.convert(oidcAuth.getIdToken().getClaims()));
-
- } else if (authority instanceof OAuth2UserAuthority oauth2Auth) {
- mappedAuthorities.addAll(authoritiesConverter.convert(oauth2Auth.getAttributes()));
-
- }
- });
-
- return mappedAuthorities;
- };
- }
-
- /**
- * @param corsProperties the properties to pick CORS configuration from
- * @return a CORS configuration built from properties
- */
- CorsConfigurationSource corsConfig(CorsProperties[] corsProperties) {
- log.debug("Building default CorsConfigurationSource with: {}", Stream.of(corsProperties).toList());
- final var source = new UrlBasedCorsConfigurationSource();
- for (final var corsProps : corsProperties) {
- final var configuration = new CorsConfiguration();
- configuration.setAllowedOrigins(Arrays.asList(corsProps.getAllowedOrigins()));
- configuration.setAllowedMethods(Arrays.asList(corsProps.getAllowedMethods()));
- configuration.setAllowedHeaders(Arrays.asList(corsProps.getAllowedHeaders()));
- configuration.setExposedHeaders(Arrays.asList(corsProps.getExposedHeaders()));
- source.registerCorsConfiguration(corsProps.getPath(), configuration);
- }
- return source;
+ return new SpringAddonsLogoutSuccessHandler(logoutRequestUriBuilder, clientRegistrationRepository);
}
/**
@@ -274,22 +207,4 @@ ClientExpressionInterceptUrlRegistryPostProcessor clientAuthorizePostProcessor()
ClientHttpSecurityPostProcessor clientHttpPostProcessor() {
return http -> http;
}
-
- static class HasClientSecurityMatcher extends AnyNestedCondition {
-
- public HasClientSecurityMatcher() {
- super(ConfigurationPhase.PARSE_CONFIGURATION);
- }
-
- @ConditionalOnExpression("!(T(org.springframework.util.StringUtils).isEmpty('${com.c4-soft.springaddons.security.client.security-matchers:}') && T(org.springframework.util.StringUtils).isEmpty('${com.c4-soft.springaddons.security.client.security-matchers[0]:}'))")
- static class Value1Condition {
-
- }
-
- @ConditionalOnProperty(name = "com.c4-soft.springaddons.security.client.security-matchers[0]")
- static class Value2Condition {
-
- }
-
- }
}
\ No newline at end of file
diff --git a/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/JwtAbstractAuthenticationTokenConverter.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/JwtAbstractAuthenticationTokenConverter.java
similarity index 78%
rename from spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/JwtAbstractAuthenticationTokenConverter.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/JwtAbstractAuthenticationTokenConverter.java
index 60a36460d..980f0e050 100644
--- a/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/JwtAbstractAuthenticationTokenConverter.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/JwtAbstractAuthenticationTokenConverter.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver;
import org.springframework.core.convert.converter.Converter;
import org.springframework.security.authentication.AbstractAuthenticationToken;
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/ResourceServerExpressionInterceptUrlRegistryPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/ResourceServerExpressionInterceptUrlRegistryPostProcessor.java
new file mode 100644
index 000000000..51b3b3c39
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/ResourceServerExpressionInterceptUrlRegistryPostProcessor.java
@@ -0,0 +1,6 @@
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver;
+
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.ExpressionInterceptUrlRegistryPostProcessor;
+
+public interface ResourceServerExpressionInterceptUrlRegistryPostProcessor extends ExpressionInterceptUrlRegistryPostProcessor {
+}
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ResourceServerHttpSecurityPostProcessor.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/ResourceServerHttpSecurityPostProcessor.java
similarity index 68%
rename from webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ResourceServerHttpSecurityPostProcessor.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/ResourceServerHttpSecurityPostProcessor.java
index e2694529e..129533ab3 100644
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ResourceServerHttpSecurityPostProcessor.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/ResourceServerHttpSecurityPostProcessor.java
@@ -1,7 +1,9 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.ServerHttpSecurityPostProcessor;
+
/**
* Process {@link HttpSecurity} of default security filter-chain after it was processed by spring-addons. This enables to override anything that was
* auto-configured (or add to it).
diff --git a/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/SpringAddonsOidcResourceServerBeans.java
similarity index 63%
rename from webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java
rename to spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/SpringAddonsOidcResourceServerBeans.java
index d8468e2d1..bb152a79d 100644
--- a/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/synchronised/resourceserver/SpringAddonsOidcResourceServerBeans.java
@@ -1,7 +1,6 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
+package com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver;
import java.net.URI;
-import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.Optional;
@@ -9,12 +8,15 @@
import java.util.stream.Stream;
import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Import;
+import org.springframework.context.annotation.Conditional;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.authentication.AbstractAuthenticationToken;
@@ -34,16 +36,19 @@
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
import org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver;
+import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenAuthenticationConverter;
+import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.util.StringUtils;
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.CorsConfigurationSource;
-import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
-import com.c4_soft.springaddons.security.oauth2.config.JwtAbstractAuthenticationTokenConverter;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.CorsProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.DefaultAuthenticationManagerResolverCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.IsIntrospectingResourceServerCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean.IsJwtDecoderResourceServerCondition;
+import com.c4_soft.springaddons.security.oidc.starter.properties.condition.configuration.IsOidcResourceServerCondition;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.ServletConfigurationSupport;
+import com.c4_soft.springaddons.security.oidc.starter.synchronised.SpringAddonsOidcBeans;
import jakarta.servlet.http.HttpServletRequest;
import lombok.extern.slf4j.Slf4j;
@@ -77,45 +82,82 @@
*
* @author Jerome Wacongne ch4mp@c4-soft.com
*/
-@ConditionalOnProperty(matchIfMissing = true, prefix = "com.c4-soft.springaddons.security", name = "enabled")
-@AutoConfiguration
+@ConditionalOnWebApplication(type = Type.SERVLET)
+@Conditional(IsOidcResourceServerCondition.class)
@EnableWebSecurity
+@AutoConfiguration
+@ImportAutoConfiguration(SpringAddonsOidcBeans.class)
@Slf4j
-@Import({ AddonsSecurityBeans.class })
-public class AddonsWebSecurityBeans {
+public class SpringAddonsOidcResourceServerBeans {
/**
*
- * Applies SpringAddonsSecurityProperties to web security config. Be aware that defining a {@link SecurityWebFilterChain} bean with no security matcher and
- * an order higher than LOWEST_PRECEDENCE will disable most of this lib auto-configuration for OpenID resource-servers.
- *
- *
- * You should consider to set security matcher to all other {@link SecurityWebFilterChain} beans and provide a {@link ServerHttpSecurityPostProcessor} bean
- * to override anything from this bean
+ * Configures a SecurityFilterChain for a resource server with JwtDecoder with @Order(LOWEST_PRECEDENCE). Defining a {@link SecurityWebFilterChain} bean
+ * with no security matcher and an order higher than LOWEST_PRECEDENCE will hide this filter-chain an disable most of spring-addons auto-configuration for
+ * OpenID resource-servers.
*
- * .
*
* @param http HTTP security to configure
* @param serverProperties Spring "server" configuration properties
- * @param addonsProperties "com.c4-soft.springaddons.security" configuration properties
+ * @param addonsProperties "com.c4-soft.springaddons.oidc" configuration properties
* @param authorizePostProcessor Hook to override access-control rules for all path that are not listed in "permit-all"
* @param httpPostProcessor Hook to override all or part of HttpSecurity auto-configuration
* @param authenticationManagerResolver Converts successful JWT decoding result into an {@link Authentication}
- * @return A default {@link SecurityWebFilterChain} for servlet resource-servers with JWT decoder (matches all unmatched
- * routes with lowest precedence)
+ * @return A {@link SecurityWebFilterChain} for servlet resource-servers with JWT decoder
*/
+ @ConditionalOnClass(IsJwtDecoderResourceServerCondition.class)
@Order(Ordered.LOWEST_PRECEDENCE)
@Bean
- SecurityFilterChain springAddonsResourceServerSecurityFilterChain(
+ SecurityFilterChain springAddonsJwtResourceServerSecurityFilterChain(
HttpSecurity http,
ServerProperties serverProperties,
- SpringAddonsSecurityProperties addonsProperties,
+ SpringAddonsOidcProperties addonsProperties,
ResourceServerExpressionInterceptUrlRegistryPostProcessor authorizePostProcessor,
ResourceServerHttpSecurityPostProcessor httpPostProcessor,
AuthenticationManagerResolver authenticationManagerResolver)
throws Exception {
http.oauth2ResourceServer(oauth2 -> oauth2.authenticationManagerResolver(authenticationManagerResolver));
- ServletConfigurationSupport.configureResourceServer(http, serverProperties, addonsProperties, authorizePostProcessor, httpPostProcessor);
+ ServletConfigurationSupport
+ .configureResourceServer(http, serverProperties, addonsProperties.getResourceserver(), authorizePostProcessor, httpPostProcessor);
+
+ return http.build();
+ }
+
+ /**
+ *
+ * Configures a SecurityFilterChain for a resource server with JwtDecoder with @Order(LOWEST_PRECEDENCE). Defining a {@link SecurityWebFilterChain} bean
+ * with no security matcher and an order higher than LOWEST_PRECEDENCE will hide this filter-chain an disable most of spring-addons auto-configuration for
+ * OpenID resource-servers.
+ *
+ *
+ * @param http HTTP security to configure
+ * @param serverProperties Spring "server" configuration properties
+ * @param addonsProperties "com.c4-soft.springaddons.oidc" configuration properties
+ * @param authorizePostProcessor Hook to override access-control rules for all path that are not listed in "permit-all"
+ * @param httpPostProcessor Hook to override all or part of HttpSecurity auto-configuration
+ * @param introspectionAuthenticationConverter Converts successful introspection result into an {@link Authentication}
+ * @param opaqueTokenIntrospector the instrospector to use
+ * @return A {@link SecurityWebFilterChain} for servlet resource-servers with access token introspection
+ */
+ @Conditional(IsIntrospectingResourceServerCondition.class)
+ @Order(Ordered.LOWEST_PRECEDENCE)
+ @Bean
+ SecurityFilterChain springAddonsIntrospectingResourceServerSecurityFilterChain(
+ HttpSecurity http,
+ ServerProperties serverProperties,
+ SpringAddonsOidcProperties addonsProperties,
+ ResourceServerExpressionInterceptUrlRegistryPostProcessor authorizePostProcessor,
+ ResourceServerHttpSecurityPostProcessor httpPostProcessor,
+ OpaqueTokenAuthenticationConverter introspectionAuthenticationConverter,
+ OpaqueTokenIntrospector opaqueTokenIntrospector)
+ throws Exception {
+ http.oauth2ResourceServer(server -> server.opaqueToken(ot -> {
+ ot.introspector(opaqueTokenIntrospector);
+ ot.authenticationConverter(introspectionAuthenticationConverter);
+ }));
+
+ ServletConfigurationSupport
+ .configureResourceServer(http, serverProperties, addonsProperties.getResourceserver(), authorizePostProcessor, httpPostProcessor);
return http.build();
}
@@ -143,54 +185,40 @@ ResourceServerHttpSecurityPostProcessor httpPostProcessor() {
return httpSecurity -> httpSecurity;
}
- CorsConfigurationSource corsConfig(CorsProperties[] corsProperties) {
- log.debug("Building default CorsConfigurationSource with: {}", Stream.of(corsProperties).toList());
- final var source = new UrlBasedCorsConfigurationSource();
- for (final var corsProps : corsProperties) {
- final var configuration = new CorsConfiguration();
- configuration.setAllowedOrigins(Arrays.asList(corsProps.getAllowedOrigins()));
- configuration.setAllowedMethods(Arrays.asList(corsProps.getAllowedMethods()));
- configuration.setAllowedHeaders(Arrays.asList(corsProps.getAllowedHeaders()));
- configuration.setExposedHeaders(Arrays.asList(corsProps.getExposedHeaders()));
- source.registerCorsConfiguration(corsProps.getPath(), configuration);
- }
- return source;
- }
-
/**
* Provides with multi-tenancy: builds a AuthenticationManagerResolver per provided OIDC issuer URI
*
* @param auth2ResourceServerProperties "spring.security.oauth2.resourceserver" configuration properties
- * @param addonsProperties "com.c4-soft.springaddons.security" configuration properties
+ * @param addonsProperties "com.c4-soft.springaddons.oidc" configuration properties
* @param jwtAuthenticationConverter converts from a {@link Jwt} to an {@link Authentication} implementation
* @return Multi-tenant {@link AuthenticationManagerResolver} (one for each configured issuer)
*/
- @ConditionalOnMissingBean
+ @Conditional(DefaultAuthenticationManagerResolverCondition.class)
@Bean
AuthenticationManagerResolver authenticationManagerResolver(
OAuth2ResourceServerProperties auth2ResourceServerProperties,
- SpringAddonsSecurityProperties addonsProperties,
+ SpringAddonsOidcProperties addonsProperties,
JwtAbstractAuthenticationTokenConverter jwtAuthenticationConverter) {
final var jwtProps = Optional.ofNullable(auth2ResourceServerProperties).map(OAuth2ResourceServerProperties::getJwt);
// @formatter:off
Optional.ofNullable(jwtProps.map(OAuth2ResourceServerProperties.Jwt::getIssuerUri)).orElse(jwtProps.map(OAuth2ResourceServerProperties.Jwt::getJwkSetUri))
.filter(StringUtils::hasLength)
.ifPresent(jwtConf -> {
- log.warn("spring.security.oauth2.resourceserver configuration will be ignored in favor of com.c4-soft.springaddons.security");
+ log.warn("spring.security.oauth2.resourceserver configuration will be ignored in favor of com.c4-soft.springaddons.oidc");
});
// @formatter:on
final Map jwtManagers =
- Stream.of(addonsProperties.getIssuers()).collect(Collectors.toMap(issuer -> issuer.getLocation().toString(), issuer -> {
+ Stream.of(addonsProperties.getOps()).collect(Collectors.toMap(issuer -> issuer.getIss().toString(), issuer -> {
final var decoder = issuer.getJwkSetUri() != null && StringUtils.hasLength(issuer.getJwkSetUri().toString())
? NimbusJwtDecoder.withJwkSetUri(issuer.getJwkSetUri().toString()).build()
- : NimbusJwtDecoder.withIssuerLocation(issuer.getLocation().toString()).build();
+ : NimbusJwtDecoder.withIssuerLocation(issuer.getIss().toString()).build();
- final OAuth2TokenValidator defaultValidator = Optional.ofNullable(issuer.getLocation()).map(URI::toString)
+ final OAuth2TokenValidator defaultValidator = Optional.ofNullable(issuer.getIss()).map(URI::toString)
.map(JwtValidators::createDefaultWithIssuer).orElse(JwtValidators.createDefault());
// @formatter:off
- final OAuth2TokenValidator jwtValidator = Optional.ofNullable(issuer.getAudience())
+ final OAuth2TokenValidator jwtValidator = Optional.ofNullable(issuer.getAud())
.filter(StringUtils::hasText)
.map(audience -> new JwtClaimValidator>(
JwtClaimNames.AUD,
@@ -208,7 +236,7 @@ AuthenticationManagerResolver authenticationManagerResolver(
log.debug(
"Building default JwtIssuerAuthenticationManagerResolver with: ",
auth2ResourceServerProperties.getJwt(),
- Stream.of(addonsProperties.getIssuers()).toList());
+ Stream.of(addonsProperties.getOps()).toList());
return new JwtIssuerAuthenticationManagerResolver((AuthenticationManagerResolver) jwtManagers::get);
}
diff --git a/spring-addons-starter-oidc/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/spring-addons-starter-oidc/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
new file mode 100644
index 000000000..ebb774812
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
@@ -0,0 +1,7 @@
+com.c4_soft.springaddons.security.oidc.starter.reactive.client.ReactiveSpringAddonsBackChannelLogoutBeans
+com.c4_soft.springaddons.security.oidc.starter.reactive.client.ReactiveSpringAddonsOidcClientBeans
+com.c4_soft.springaddons.security.oidc.starter.reactive.resourceserver.ReactiveSpringAddonsOidcResourceServerBeans
+
+com.c4_soft.springaddons.security.oidc.starter.synchronised.client.SpringAddonsBackChannelLogoutBeans
+com.c4_soft.springaddons.security.oidc.starter.synchronised.client.SpringAddonsOidcClientBeans
+com.c4_soft.springaddons.security.oidc.starter.synchronised.resourceserver.SpringAddonsOidcResourceServerBeans
diff --git a/spring-addons-oauth2/src/test/java/com/c4_soft/springaddons/security/oauth2/config/ConfigurableJwtGrantedAuthoritiesConverterTest.java b/spring-addons-starter-oidc/src/test/java/com/c4_soft/springaddons/security/oidc/starter/ConfigurableJwtGrantedAuthoritiesConverterTest.java
similarity index 74%
rename from spring-addons-oauth2/src/test/java/com/c4_soft/springaddons/security/oauth2/config/ConfigurableJwtGrantedAuthoritiesConverterTest.java
rename to spring-addons-starter-oidc/src/test/java/com/c4_soft/springaddons/security/oidc/starter/ConfigurableJwtGrantedAuthoritiesConverterTest.java
index eabafaa92..53e2d44d8 100644
--- a/spring-addons-oauth2/src/test/java/com/c4_soft/springaddons/security/oauth2/config/ConfigurableJwtGrantedAuthoritiesConverterTest.java
+++ b/spring-addons-starter-oidc/src/test/java/com/c4_soft/springaddons/security/oidc/starter/ConfigurableJwtGrantedAuthoritiesConverterTest.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config;
+package com.c4_soft.springaddons.security.oidc.starter;
import static org.assertj.core.api.Assertions.assertThat;
@@ -9,15 +9,16 @@
import java.util.Map;
import java.util.stream.Collectors;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtClaimNames;
-import com.c4_soft.springaddons.security.oauth2.OpenidClaimSet;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.Case;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.IssuerProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.SimpleAuthoritiesMappingProperties;
+import com.c4_soft.springaddons.security.oidc.OpenidClaimSet;
+import com.c4_soft.springaddons.security.oidc.starter.properties.OpenidProviderProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SimpleAuthoritiesMappingProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SimpleAuthoritiesMappingProperties.Case;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcProperties;
public class ConfigurableJwtGrantedAuthoritiesConverterTest {
@@ -46,11 +47,11 @@ public void test() throws URISyntaxException {
final var now = Instant.now();
final var jwt = new Jwt("a.b.C", now, Instant.ofEpochSecond(now.getEpochSecond() + 3600), Map.of("machin", "truc"), claims);
- final var issuerProperties = new IssuerProperties();
- issuerProperties.setLocation(issuer);
+ final var issuerProperties = new OpenidProviderProperties();
+ issuerProperties.setIss(issuer);
- final var properties = new SpringAddonsSecurityProperties();
- properties.setIssuers(new IssuerProperties[] { issuerProperties });
+ final var properties = new SpringAddonsOidcProperties();
+ properties.setOps(new OpenidProviderProperties[] { issuerProperties });
final var converter = new ConfigurableClaimSetAuthoritiesConverter(properties);
final var claimSet = new OpenidClaimSet(jwt.getClaims());
diff --git a/webflux/spring-addons-webflux-client/src/test/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizationRequestResolverTest.java b/spring-addons-starter-oidc/src/test/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizationRequestResolverTest.java
similarity index 91%
rename from webflux/spring-addons-webflux-client/src/test/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizationRequestResolverTest.java
rename to spring-addons-starter-oidc/src/test/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizationRequestResolverTest.java
index 9db3c0a54..6ca26a6c3 100644
--- a/webflux/spring-addons-webflux-client/src/test/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsServerOAuth2AuthorizationRequestResolverTest.java
+++ b/spring-addons-starter-oidc/src/test/java/com/c4_soft/springaddons/security/oidc/starter/reactive/client/SpringAddonsServerOAuth2AuthorizationRequestResolverTest.java
@@ -1,4 +1,4 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
+package com.c4_soft.springaddons.security.oidc.starter.reactive.client;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNull;
diff --git a/spring-addons-web-test/pom.xml b/spring-addons-web-test/pom.xml
deleted file mode 100644
index f9cdc1756..000000000
--- a/spring-addons-web-test/pom.xml
+++ /dev/null
@@ -1,36 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-web-test
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- org.springframework.boot
- spring-boot-autoconfigure
-
-
- org.springframework
- spring-web
-
-
- org.springframework.boot
- spring-boot-test
-
-
-
-
diff --git a/starters/spring-addons-starters-recaptcha/pom.xml b/starters/spring-addons-starters-recaptcha/pom.xml
index 9f9951355..1cb4617da 100644
--- a/starters/spring-addons-starters-recaptcha/pom.xml
+++ b/starters/spring-addons-starters-recaptcha/pom.xml
@@ -16,7 +16,7 @@
scm:git:git://github.com/ch4mpy/spring-addons.git
scm:git:git@github.com:ch4mpy/spring-addons.git
https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
+ HEAD
diff --git a/starters/spring-addons-starters-webclient/pom.xml b/starters/spring-addons-starters-webclient/pom.xml
index 97d61a457..800b1986e 100644
--- a/starters/spring-addons-starters-webclient/pom.xml
+++ b/starters/spring-addons-starters-webclient/pom.xml
@@ -16,7 +16,7 @@
scm:git:git://github.com/ch4mpy/spring-addons.git
scm:git:git@github.com:ch4mpy/spring-addons.git
https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
+ HEAD
diff --git a/webflux/pom.xml b/webflux/pom.xml
deleted file mode 100644
index b590836df..000000000
--- a/webflux/pom.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-
-
- 4.0.0
-
- com.c4-soft.springaddons
- spring-addons
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webflux
- pom
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
- spring-addons-webflux-core
- spring-addons-webflux-introspecting-resource-server
- spring-addons-webflux-jwt-resource-server
- spring-addons-webflux-test
- spring-addons-webflux-introspecting-test
- spring-addons-webflux-jwt-test
- spring-addons-webflux-client
-
-
-
diff --git a/webflux/spring-addons-webflux-client/README.md b/webflux/spring-addons-webflux-client/README.md
deleted file mode 100644
index f54cf7aab..000000000
--- a/webflux/spring-addons-webflux-client/README.md
+++ /dev/null
@@ -1,193 +0,0 @@
-# `spring-addons-webflux-client`
-A thin wrapper around `spring-boot-starter-oauth2-client` which pushes auto-configuration one step further.
-
-## How it works
-As any boot starter, a resource file defines what should be loaded: [`src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports) which specifies that two configuration sources should be loaded:
-- [`SpringAddonsOAuth2ClientBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsOAuth2ClientBeans.java) with a bunch of OAuth2 client related beans configurable from application properties
-- [`SpringAddonsBackChannelLogoutBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsBackChannelLogoutBeans.java) which contains the beans definition for a client [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) implementation: a security filter-chain and a `@RestController`.
-
-Also, as any serious Boot starter, any bean defined there is conditional, so that one way or another, you can deactivate or overload it.
-
-## What is auto configured
-The most accurate information about [`SpringAddonsOAuth2ClientBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsOAuth2ClientBeans.java) and [`SpringAddonsBackChannelLogoutBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/SpringAddonsBackChannelLogoutBeans.java) is in the source and Javadoc, but here is an idea of the auto configured beans.
-
-### SpringAddonsOAuth2ClientBeans
-All the beans below are `@ConditionalOnMissingBean`, with an exception of the first which is conditional on a property. This means that you keep complete control: if you define a bean of the same type as any of the following, your definition will replace the one from this starter.
-- `springAddonsClientFilterChain`: a security filter-chain instantiated only if `com.c4-soft.springaddons.security.client.security-matchers` property has at least one entry. If defined, it is a high precedence, to ensure that all routes defined in this security matcher property are intercepted by this filter-chain. Refer to [`SpringAddonsOAuth2ClientProperties`](https://github.com/ch4mpy/spring-addons/blob/master/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/SpringAddonsOAuth2ClientProperties.java) for configuration options. Mind the optional properties, and `login-path` in particular: if you provide one, you'll also have to provide with a @Controller to handle it.
-- `logoutRequestUriBuilder`: builder for [RP-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) queries, taking configuration from properties for OIDC providers which do not strictly comply with the spec: logout URI not provided by OIDC conf or non standard parameter names (Auth0 and Cognito are samples of such OPs)
-- `serverLogoutSuccessHandler`: default instance is a `SpringAddonsOAuth2ServerLogoutSuccessHandler` which logs a user out from the last authorization server he logged on
-- `authoritiesConverter`: an `OAuth2AuthoritiesConverter`. Default instance is a `ConfigurableClaimSet2AuthoritiesConverter` which reads spring-addons `SpringAddonsSecurityProperties`
-- `grantedAuthoritiesMapper`: a `GrantedAuthoritiesMapper` using the already configured `OAuth2AuthoritiesConverter`
-- `oAuth2AuthorizedClientRepository`: a `SpringAddonsServerOAuth2AuthorizedClientRepository` (which is also a session listener) capable of handling multi-tenancy and back-channel logout
-- `clientAuthorizePostProcessor`: a post processor to fine tune access control from java configuration. It applies to all routes not listed in "permit-all" property configuration. Default requires users to be authenticated. **This is a bean to provide in your application configuration if you prefer to define fine-grained access control rules with Java configuration rather than methods security.**
-- `clientHttpPostProcessor`: a post processor to override anything from above auto-configuration. It is called just before the security filter-chain is returned. Default is a no-op.
-- `csrfCookieWebFilter`: a `WebFilter` to set the CSRF cookie if `com.c4-soft.springaddons.security.client.csrf` is set with one of the two cookie options
-- `webSessionManager` with a custom `webSessionStore` which is a proxy of `InMemoryWebSessionStore` on which `WebSessionListener` can register to be notified with sessions `create` and `remove` event
-
-### SpringAddonsBackChannelLogoutBeans
-This two beans are instantiated only if `com.c4-soft.springaddons.security.client.back-channel-logout-enabled` is `true`
-- `springAddonsBackChannelLogoutClientFilterChain`: a filter chain with highest precedence intercepting requests to just `/backchannel_logout`, with no session, no CSRF protection and no access-control: security is based on ly on the logout JWT in the request payload.
-- `BackChannelLogoutController` a REST controller to handle just the POST requests to `/backchannel_logout` with a logout JWT provided as `application/x-www-form-urlencoded`
-
-## Sample usage
-The [BFF tutorial](https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials/bff) uses this starter to configure a `spring-cloud-gateway` instance as an OAuth2 client with Back-Channel Logout. In this sample, the Java web-security configuration is reduced to nothing, all the configuration being defined with the following properties:
-```yaml
-scheme: http
-keycloak-port: 8442
-keycloak-issuer: ${scheme}://localhost:${keycloak-port}/realms/master
-keycloak-secret: change-me
-cognito-issuer: https://cognito-idp.us-west-2.amazonaws.com/us-west-2_RzhmgLwjl
-cognito-secret: change-me
-auth0-issuer: https://dev-ch4mpy.eu.auth0.com/
-auth0-secret: change-me
-
-gateway-uri: ${scheme}://localhost:${server.port}
-greetings-api-uri: ${scheme}://localhost:6443/greetings
-angular-uri: ${scheme}://localhost:4200
-
-server:
- port: 8080
- ssl:
- enabled: false
-
-
-spring:
- lifecycle:
- timeout-per-shutdown-phase: 30s
- security:
- oauth2:
- client:
- provider:
- keycloak:
- issuer-uri: ${keycloak-issuer}
- cognito:
- issuer-uri: ${cognito-issuer}
- auth0:
- issuer-uri: ${auth0-issuer}
- registration:
- keycloak-confidential-user:
- authorization-grant-type: authorization_code
- client-name: Keycloak
- client-id: spring-addons-confidential
- client-secret: ${keycloak-secret}
- provider: keycloak
- scope: openid,profile,email,offline_access,roles
- cognito-confidential-user:
- authorization-grant-type: authorization_code
- client-name: Cognito
- client-id: 12olioff63qklfe9nio746es9f
- client-secret: ${cognito-secret}
- provider: cognito
- scope: openid,profile,email
- auth0-confidential-user:
- authorization-grant-type: authorization_code
- client-name: Auth0
- client-id: TyY0H7xkRMRe6lDf9F8EiNqCo8PdhICy
- client-secret: ${auth0-secret}
- provider: auth0
- scope: openid,profile,email,offline_access
- cloud:
- gateway:
- default-filters:
- - TokenRelay=
- - DedupeResponseHeader=Access-Control-Allow-Credentials Access-Control-Allow-Origin
- - SaveSession
- - SecureHeaders
- routes:
- - id: greetings
- uri: ${greetings-api-uri}
- predicates:
- - Path=/greetings/**
- - id: ui
- uri: ${angular-uri}
- predicates:
- - Path=/ui/**
- - id: home
- uri: ${angular-uri}
- predicates:
- - Path=/
- filters:
- - RewritePath=/,/ui
-
-com:
- c4-soft:
- springaddons:
- security:
- issuers:
- - location: ${keycloak-issuer}
- username-claim: $.preferred_username
- authorities:
- - path: $.realm_access.roles
- - path: $.resource_access.*.roles
- - location: ${cognito-issuer}
- username-claim: $.username
- authorities:
- - path: $.cognito:groups
- - location: ${auth0-issuer}
- username-claim: $['https://c4-soft.com/user']['name']
- authorities:
- - path: $['https://c4-soft.com/user']['roles']
- - path: $.permissions
- client:
- client-uri: ${gateway-uri}
- security-matchers: /**
- permit-all:
- - /login/**
- - /oauth2/**
- - /
- - /login-options
- - "/me"
- - /ui/**
- - /v3/api-docs/**
- csrf: cookie-accessible-from-js
- login-path: /ui/
- post-login-redirect-path: /ui/
- post-logout-redirect-path: /ui/
- back-channel-logout-enabled: true
- oauth2-logout:
- - client-registration-id: cognito-confidential-user
- uri: https://spring-addons.auth.us-west-2.amazoncognito.com/logout
- client-id-request-param: client_id
- post-logout-uri-request-param: logout_uri
- - client-registration-id: auth0-confidential-user
- uri: ${auth0-issuer}v2/logout
- client-id-request-param: client_id
- post-logout-uri-request-param: returnTo
- authorization-request-params:
- auth0-confidential-user:
- - name: audience
- value: demo.c4-soft.com
-
-management:
- endpoint:
- health:
- probes:
- enabled: true
- endpoints:
- web:
- exposure:
- include: '*'
- health:
- livenessstate:
- enabled: true
- readinessstate:
- enabled: true
-
-logging:
- level:
- root: ERROR
- org.springframework.security: DEBUG
-
----
-spring:
- config:
- activate:
- on-profile: ssl
-
-server:
- ssl:
- enabled: true
-
-scheme: https
-keycloak-port: 8443
-```
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-client/license.txt b/webflux/spring-addons-webflux-client/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webflux/spring-addons-webflux-client/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webflux/spring-addons-webflux-client/lombok.config b/webflux/spring-addons-webflux-client/lombok.config
deleted file mode 100644
index 8f7e8aa1a..000000000
--- a/webflux/spring-addons-webflux-client/lombok.config
+++ /dev/null
@@ -1 +0,0 @@
-lombok.addLombokGeneratedAnnotation = true
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-client/pom.xml b/webflux/spring-addons-webflux-client/pom.xml
deleted file mode 100644
index c9fe0b126..000000000
--- a/webflux/spring-addons-webflux-client/pom.xml
+++ /dev/null
@@ -1,61 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webflux
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webflux-client
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- io.projectreactor
- reactor-core
-
-
- org.springframework.boot
- spring-boot
-
-
- org.springframework.boot
- spring-boot-autoconfigure
- true
-
-
- org.springframework.security
- spring-security-config
-
-
- org.springframework.security
- spring-security-oauth2-client
-
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-core
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
- org.junit.jupiter
- junit-jupiter
- test
-
-
-
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webflux/spring-addons-webflux-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index e285dc245..000000000
--- a/webflux/spring-addons-webflux-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1,2 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.config.reactive.SpringAddonsOAuth2ClientBeans
-com.c4_soft.springaddons.security.oauth2.config.reactive.SpringAddonsBackChannelLogoutBeans
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-core/license.txt b/webflux/spring-addons-webflux-core/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webflux/spring-addons-webflux-core/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webflux/spring-addons-webflux-core/pom.xml b/webflux/spring-addons-webflux-core/pom.xml
deleted file mode 100644
index 98ddd049a..000000000
--- a/webflux/spring-addons-webflux-core/pom.xml
+++ /dev/null
@@ -1,53 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webflux
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webflux-core
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- com.c4-soft.springaddons
- spring-addons-oauth2
-
-
- org.springframework.security
- spring-security-oauth2-resource-server
-
-
- org.springframework.security
- spring-security-oauth2-jose
-
-
- org.springframework.security
- spring-security-config
-
-
- io.projectreactor
- reactor-core
-
-
- org.springframework.boot
- spring-boot-starter-webflux
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/ClientAuthorizeExchangeSpecPostProcessor.java b/webflux/spring-addons-webflux-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/ClientAuthorizeExchangeSpecPostProcessor.java
deleted file mode 100644
index 11fddb3b7..000000000
--- a/webflux/spring-addons-webflux-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/ClientAuthorizeExchangeSpecPostProcessor.java
+++ /dev/null
@@ -1,7 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
-
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-
-public interface ClientAuthorizeExchangeSpecPostProcessor {
- ServerHttpSecurity.AuthorizeExchangeSpec authorizeHttpRequests(ServerHttpSecurity.AuthorizeExchangeSpec spec);
-}
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/ClientHttpSecurityPostProcessor.java b/webflux/spring-addons-webflux-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/ClientHttpSecurityPostProcessor.java
deleted file mode 100644
index 0a811e8dc..000000000
--- a/webflux/spring-addons-webflux-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/ClientHttpSecurityPostProcessor.java
+++ /dev/null
@@ -1,7 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
-
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-
-public interface ClientHttpSecurityPostProcessor {
- ServerHttpSecurity process(ServerHttpSecurity serverHttpSecurity);
-}
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-introspecting-resource-server/README.MD b/webflux/spring-addons-webflux-introspecting-resource-server/README.MD
deleted file mode 100644
index e21c8c196..000000000
--- a/webflux/spring-addons-webflux-introspecting-resource-server/README.MD
+++ /dev/null
@@ -1,131 +0,0 @@
-# `spring-addons-webflux-introspecting-resource-server`
-A thin wrapper around `spring-boot-starter-oauth2-client` which pushes auto-configuration one step further for reactive resource servers using access token introspection.
-
-## How it works
-As any boot starter, a resource file defines what should be loaded: [`src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports) which specifies that two configuration sources should be loaded:
-- [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) with a single `OAuth2AuthoritiesConverter` (an alias for `Converter, Collection>`)
-- [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) which contains a few other beans involved in the creation of a security filter chain for a single-tenant resource server using access token introspection.
-
-Also, as any serious Boot starter, any bean defined there is conditional, so that one way or another, you can deactivate or overload it, with one notable exception: the `springAddonsResourceServerSecurityFilterChain` is not conditional and instantiated in any case (with lowest precedence) if you depend on this starter.
-
-## What is auto configured
-The most accurate information about [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) and [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) is in the source and Javadoc, but here is an idea of the auto configured beans.
-
-### AddonsSecurityBeans
-Provides with:
-- `authoritiesConverter` which is an instance of `ConfigurableClaimSet2AuthoritiesConverter`. This bean is configured with application properties and is able to map spring-security authorities from any claims with prefix and case transformation defined for each claim.
-- `introspectionAuthenticationConverter`: a converter from a successful introspection to any implementation of `Authentication`. The default instantiate a `BearerTokenAuthentication` with authorities mapping as configured for the issuer declared in the introspected claims. The easiest to override the type of `Authentication`, is to provide with a `ReactiveOpaqueTokenAuthenticationConverter` bean.
-
-### AddonsWebSecurityBeans
-Provides with a (non conditional) security filter-chain as well as (conditional) defaults for all the beans required to configure it:
-- `springAddonsResourceServerSecurityFilterChain`: applies CORS, CSRF, anonymous, sessionCreationPolicy, SSL, redirect and 401 instead of redirect to login as defined in [`SpringAddonsSecurityProperties`](https://github.com/ch4mpy/spring-addons/blob/master/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/SpringAddonsSecurityProperties.java)
-- `authorizePostProcessor`: a bean of type `AuthorizeExchangeSpecPostProcessor` to fine tune access control from java configuration. It applies to all routes not listed in "permit-all" property configuration. Default requires users to be authenticated. **This is a bean to provide in your application configuration if you prefer to define fine-grained access control rules with Java configuration rather than methods security.**
-- `httpPostProcessor`: a bean of type `ServerHttpSecurityPostProcessor` to override anything from above auto-configuration. It is called just before the security filter-chain is returned. Default is a no-op.
-- `csrfCookieWebFilter`: a `WebFilter` to set the CSRF cookie if `com.c4-soft.springaddons.security.client.csrf` is set with one of the two cookie options
-- `serverAccessDeniedHandler`: a bean to switch from default behavior of redirecting unauthorized users to login (302) to returning 401 (unauthorized)
-
-## Usage
-Please take time to browse [tutorials](https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials) and [samples](https://github.com/ch4mpy/spring-addons/tree/master/samples).
-
-All you need is declare a dependency on `spring-addons-webflux-introspection-resource-server` and define a few properties.
-
-You might use any OIDC Provider (including Keycloak, Auth0, Cognito, etc.), but only one at a time.
-
-``` xml
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-introspection-resource-server
- ${com.c4-soft.springaddons.version}
-
-
-```
-``` java
-@SpringBootApplication
-public class SampleApi {
- public static void main(String[] args) {
- new SpringApplicationBuilder(SampleApi.class).web(WebApplicationType.REACTIVE).run(args);
- }
-
- @Configuration
- @EnableReactiveMethodSecurity
- public static class WebSecurityConfig {
- }
-}
-```
-```yaml
-scheme: http
-origins: ${scheme}://localhost:4200
-keycloak-port: 8442
-keycloak-issuer: ${scheme}://localhost:${keycloak-port}/realms/master
-
-server:
- error:
- include-message: always
- ssl:
- enabled: false
-
-spring:
- lifecycle:
- timeout-per-shutdown-phase: 30s
- security:
- oauth2:
- resourceserver:
- opaquetoken:
- client-id: spring-addons-confidential
- client-secret: change-me
- introspection-uri: ${keycloak-issuer}/protocol/openid-connect/token/introspect
-
-com:
- c4-soft:
- springaddons:
- security:
- cors:
- - path: /**
- allowed-origins: ${origins}
- issuers:
- - location: ${keycloak-issuer}
- username-claim: preferred_username
- authorities:
- - path: $.realm_access.roles
- - path: $.resource_access.*.roles
- permit-all:
- - "/actuator/health/readiness"
- - "/actuator/health/liveness"
- - "/v3/api-docs/**"
-
-logging:
- level:
- org:
- springframework:
- security: DEBUG
-
-management:
- endpoint:
- health:
- probes:
- enabled: true
- endpoints:
- web:
- exposure:
- include: '*'
- health:
- livenessstate:
- enabled: true
- readinessstate:
- enabled: true
-
----
-scheme: https
-keycloak-port: 8443
-
-server:
- ssl:
- enabled: true
-
-spring:
- config:
- activate:
- on-profile: ssl
-
-```
diff --git a/webflux/spring-addons-webflux-introspecting-resource-server/license.txt b/webflux/spring-addons-webflux-introspecting-resource-server/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webflux/spring-addons-webflux-introspecting-resource-server/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webflux/spring-addons-webflux-introspecting-resource-server/pom.xml b/webflux/spring-addons-webflux-introspecting-resource-server/pom.xml
deleted file mode 100644
index d71cb171a..000000000
--- a/webflux/spring-addons-webflux-introspecting-resource-server/pom.xml
+++ /dev/null
@@ -1,46 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webflux
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webflux-introspecting-resource-server
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-core
-
-
- org.springframework.security
- spring-security-config
-
-
-
- org.springframework.boot
- spring-boot-autoconfigure
-
-
- org.springframework.boot
- spring-boot
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsSecurityBeans.java b/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsSecurityBeans.java
deleted file mode 100644
index 1874856f9..000000000
--- a/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsSecurityBeans.java
+++ /dev/null
@@ -1,84 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
-
-import java.util.Collection;
-import java.util.Map;
-import java.util.stream.Stream;
-
-import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Import;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.oauth2.core.OAuth2AccessToken;
-import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal;
-import org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames;
-import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthentication;
-import org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionAuthenticatedPrincipal;
-import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter;
-
-import com.c4_soft.springaddons.security.oauth2.OpenidClaimSet;
-import com.c4_soft.springaddons.security.oauth2.config.ClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.ConfigurableClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-
-import lombok.extern.slf4j.Slf4j;
-import reactor.core.publisher.Mono;
-
-/**
- * @author Jerome Wacongne ch4mp@c4-soft.com
- */
-@AutoConfiguration
-@Slf4j
-@Import({ SpringAddonsSecurityProperties.class })
-public class AddonsSecurityBeans {
-
- /**
- * Retrieves granted authorities from the introspected token attributes according to the configuration set for issuer (iss attribute)
- *
- * @param securityProperties
- * @return
- */
- @ConditionalOnMissingBean
- @Bean
- ClaimSetAuthoritiesConverter authoritiesConverter(SpringAddonsSecurityProperties addonsProperties) {
- log.debug("Building default CorsConfigurationSource with: {}", addonsProperties);
- return new ConfigurableClaimSetAuthoritiesConverter(addonsProperties);
- }
-
- /**
- * Converter bean from successful introspection result to {@link Authentication} instance
- *
- * @param authoritiesConverter converts access-token claims into Spring authorities
- * @param authenticationFactory builds an {@link Authentication} instance from access-token string and claims
- * @return a converter from successful introspection result to {@link Authentication} instance
- */
- @SuppressWarnings("unchecked")
- @ConditionalOnMissingBean
- @Bean
- ReactiveOpaqueTokenAuthenticationConverter introspectionAuthenticationConverter(
- Converter, Collection> authoritiesConverter,
- SpringAddonsSecurityProperties addonsProperties,
- OAuth2ResourceServerProperties resourceServerProperties) {
- return (String introspectedToken, OAuth2AuthenticatedPrincipal authenticatedPrincipal) -> Mono.just(
- new BearerTokenAuthentication(
- new OAuth2IntrospectionAuthenticatedPrincipal(
- new OpenidClaimSet(
- authenticatedPrincipal.getAttributes(),
- Stream.of(addonsProperties.getIssuers())
- .filter(
- issProps -> resourceServerProperties.getOpaquetoken().getIntrospectionUri()
- .contains(issProps.getLocation().toString()))
- .findAny().orElse(addonsProperties.getIssuers()[0]).getUsernameClaim()).getName(),
- authenticatedPrincipal.getAttributes(),
- (Collection) authenticatedPrincipal.getAuthorities()),
- new OAuth2AccessToken(
- OAuth2AccessToken.TokenType.BEARER,
- introspectedToken,
- authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.IAT),
- authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.EXP)),
- authoritiesConverter.convert(authenticatedPrincipal.getAttributes())));
- }
-}
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsWebSecurityBeans.java b/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsWebSecurityBeans.java
deleted file mode 100644
index aba138e92..000000000
--- a/webflux/spring-addons-webflux-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsWebSecurityBeans.java
+++ /dev/null
@@ -1,200 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
-
-import java.nio.charset.Charset;
-import java.util.Arrays;
-
-import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.AnyNestedCondition;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.autoconfigure.web.ServerProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Conditional;
-import org.springframework.context.annotation.Import;
-import org.springframework.core.Ordered;
-import org.springframework.core.annotation.Order;
-import org.springframework.core.io.buffer.DataBufferUtils;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.security.authentication.AnonymousAuthenticationToken;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter;
-import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenIntrospector;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler;
-import org.springframework.security.web.server.csrf.CsrfToken;
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.reactive.CorsConfigurationSource;
-import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
-import org.springframework.web.server.WebFilter;
-
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.CorsProperties;
-
-import lombok.extern.slf4j.Slf4j;
-import reactor.core.publisher.Mono;
-
-/**
- *
- * Usage
- * If not using spring-boot, @Import or @ComponentScan this class. All beans defined here are @ConditionalOnMissingBean => just define your own
- * @Beans to override.
- *
- *
- * Provided @Beans
- *
- *
- * - SecurityWebFilterChain: applies CORS, CSRF, anonymous, sessionCreationPolicy, SSL redirect and 401 instead of redirect to login properties as
- * defined in {@link SpringAddonsSecurityProperties}
- * - AuthorizeExchangeSpecPostProcessor. Override if you need fined grained HTTP security (more than authenticated() to all routes but the ones defined
- * as permitAll() in {@link SpringAddonsSecurityProperties}
- * - Jwt2AuthoritiesConverter: responsible for converting the JWT into Collection<? extends GrantedAuthority>
- * - ReactiveJwt2OpenidClaimSetConverter<T extends Map<String, Object> & Serializable>: responsible for converting the JWT into a
- * claim-set of your choice (OpenID or not)
- * - ReactiveJwt2AuthenticationConverter<OAuthentication<T extends OpenidClaimSet>>: responsible for converting the JWT into an
- * Authentication (uses both beans above)
- * - ReactiveAuthenticationManagerResolver: required to be able to define more than one token issuer until
- * https://github.com/spring-projects/spring-boot/issues/30108 is solved
- *
- *
- * @author Jerome Wacongne ch4mp@c4-soft.com
- */
-@ConditionalOnProperty(matchIfMissing = true, prefix = "com.c4-soft.springaddons.security", name = "enabled")
-@EnableWebFluxSecurity
-@AutoConfiguration
-@Slf4j
-@Import({ AddonsSecurityBeans.class })
-public class AddonsWebSecurityBeans {
-
- /**
- *
- * Applies SpringAddonsSecurityProperties to web security config. Be aware that defining a {@link SecurityWebFilterChain} bean with no security matcher and
- * an order higher than LOWEST_PRECEDENCE will disable most of this lib auto-configuration for OpenID resource-servers.
- *
- *
- * You should consider to set security matcher to all other {@link SecurityWebFilterChain} beans and provide a
- * {@link ResourceServerHttpSecurityPostProcessor} bean to override anything from this bean
- *
- * .
- *
- * @param http HTTP security to configure
- * @param serverProperties Spring "server" configuration properties
- * @param addonsProperties "com.c4-soft.springaddons.security" configuration properties
- * @param authorizePostProcessor Hook to override access-control rules for all path that are not listed in "permit-all"
- * @param httpPostProcessor Hook to override all or part of HttpSecurity auto-configuration
- * @param introspectionAuthenticationConverter Converts successful introspection result into an {@link Authentication}
- * @param accessDeniedHandler handler for unauthorized requests (missing or invalid access-token)
- * @return A default {@link SecurityWebFilterChain} for reactive resource-servers with access-token introspection
- * (matches all unmatched routes with lowest precedence)
- */
- @Order(Ordered.LOWEST_PRECEDENCE)
- @Bean
- SecurityWebFilterChain springAddonsResourceServerSecurityFilterChain(
- ServerHttpSecurity http,
- ServerProperties serverProperties,
- SpringAddonsSecurityProperties addonsProperties,
- ResourceServerAuthorizeExchangeSpecPostProcessor authorizePostProcessor,
- ResourceServerHttpSecurityPostProcessor httpPostProcessor,
- ReactiveOpaqueTokenAuthenticationConverter introspectionAuthenticationConverter,
- ReactiveOpaqueTokenIntrospector opaqueTokenIntrospector,
- ServerAccessDeniedHandler accessDeniedHandler) {
- http.oauth2ResourceServer(server -> server.opaqueToken(ot -> {
- ot.introspector(opaqueTokenIntrospector);
- ot.authenticationConverter(introspectionAuthenticationConverter);
- }));
-
- ReactiveConfigurationSupport
- .configureResourceServer(http, serverProperties, addonsProperties, accessDeniedHandler, authorizePostProcessor, httpPostProcessor);
-
- return http.build();
- }
-
- /**
- * Hook to override security rules for all path that are not listed in "permit-all". Default is isAuthenticated().
- *
- * @return a hook to override security rules for all path that are not listed in "permit-all". Default is isAuthenticated().
- */
- @ConditionalOnMissingBean
- @Bean
- ResourceServerAuthorizeExchangeSpecPostProcessor authorizePostProcessor() {
- return (ServerHttpSecurity.AuthorizeExchangeSpec spec) -> spec.anyExchange().authenticated();
- }
-
- /**
- * Hook to override all or part of HttpSecurity auto-configuration. Called after spring-addons configuration was applied so that you can modify anything
- *
- * @return a hook to override all or part of HttpSecurity auto-configuration. Called after spring-addons configuration was applied so that you can modify
- * anything
- */
- @ConditionalOnMissingBean
- @Bean
- ResourceServerHttpSecurityPostProcessor httpPostProcessor() {
- return serverHttpSecurity -> serverHttpSecurity;
- }
-
- CorsConfigurationSource corsConfig(CorsProperties[] corsProperties) {
- final var source = new UrlBasedCorsConfigurationSource();
- for (final var corsProps : corsProperties) {
- final var configuration = new CorsConfiguration();
- configuration.setAllowedOrigins(Arrays.asList(corsProps.getAllowedOrigins()));
- configuration.setAllowedMethods(Arrays.asList(corsProps.getAllowedMethods()));
- configuration.setAllowedHeaders(Arrays.asList(corsProps.getAllowedHeaders()));
- configuration.setExposedHeaders(Arrays.asList(corsProps.getExposedHeaders()));
- source.registerCorsConfiguration(corsProps.getPath(), configuration);
- }
- return source;
- }
-
- /**
- * Switch from default behavior of redirecting unauthorized users to login (302) to returning 401 (unauthorized)
- *
- * @return a bean to switch from default behavior of redirecting unauthorized users to login (302) to returning 401 (unauthorized)
- */
- @ConditionalOnMissingBean
- @Bean
- ServerAccessDeniedHandler serverAccessDeniedHandler() {
- log.debug("Building default ServerAccessDeniedHandler");
- return (var exchange, var ex) -> exchange.getPrincipal().flatMap(principal -> {
- var response = exchange.getResponse();
- response.setStatusCode(principal instanceof AnonymousAuthenticationToken ? HttpStatus.UNAUTHORIZED : HttpStatus.FORBIDDEN);
- response.getHeaders().setContentType(MediaType.TEXT_PLAIN);
- var dataBufferFactory = response.bufferFactory();
- var buffer = dataBufferFactory.wrap(ex.getMessage().getBytes(Charset.defaultCharset()));
- return response.writeWith(Mono.just(buffer)).doOnError(error -> DataBufferUtils.release(buffer));
- });
- }
-
- /**
- * https://docs.spring.io/spring-security/reference/5.8/migration/reactive.html#_i_am_using_angularjs_or_another_javascript_framework
- */
- @Conditional(CookieCsrf.class)
- @ConditionalOnMissingBean(name = "csrfCookieWebFilter")
- @Bean
- WebFilter csrfCookieWebFilter() {
- return (exchange, chain) -> {
- Mono csrfToken = exchange.getAttributeOrDefault(CsrfToken.class.getName(), Mono.empty());
- return csrfToken.doOnSuccess(token -> {
- }).then(chain.filter(exchange));
- };
- }
-
- static class CookieCsrf extends AnyNestedCondition {
-
- public CookieCsrf() {
- super(ConfigurationPhase.PARSE_CONFIGURATION);
- }
-
- @ConditionalOnProperty(name = "com.c4-soft.springaddons.security.csrf", havingValue = "cookie-accessible-from-js")
- static class Value1Condition {
-
- }
-
- @ConditionalOnProperty(name = "com.c4-soft.springaddons.security.csrf", havingValue = "cookie-http-only")
- static class Value2Condition {
-
- }
-
- }
-}
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webflux/spring-addons-webflux-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index f902ae469..000000000
--- a/webflux/spring-addons-webflux-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1,2 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsSecurityBeans
-com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsWebSecurityBeans
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-introspecting-test/pom.xml b/webflux/spring-addons-webflux-introspecting-test/pom.xml
deleted file mode 100644
index 923c4279d..000000000
--- a/webflux/spring-addons-webflux-introspecting-test/pom.xml
+++ /dev/null
@@ -1,57 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webflux
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webflux-introspecting-test
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- org.springframework.security
- spring-security-config
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-introspecting-resource-server
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-test
-
-
- org.projectlombok
- lombok
- true
- provided
-
-
- org.junit.jupiter
- junit-jupiter-api
- true
-
-
-
- junit
- junit
- test
-
-
- org.assertj
- assertj-core
- test
-
-
-
diff --git a/webflux/spring-addons-webflux-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsSecurity.java b/webflux/spring-addons-webflux-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsSecurity.java
deleted file mode 100644
index 39d494513..000000000
--- a/webflux/spring-addons-webflux-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsSecurity.java
+++ /dev/null
@@ -1,32 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.mockmvc.introspecting;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.junit.jupiter.api.TestInstance;
-import org.junit.jupiter.api.TestInstance.Lifecycle;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.test.context.junit.jupiter.SpringExtension;
-
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.test.webflux.AuthenticationFactoriesTestConf;
-
-/**
- *
- * To be used to test services or repositories but not controllers: auto-configures {@link AddonsSecurityBeans} only
- *
- * See {@link AutoConfigureAddonsWebSecurity}
- *
- * @author Jérôme Wacongne <ch4mp#64;c4-soft.com>
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@ImportAutoConfiguration({ SpringAddonsSecurityProperties.class, AddonsSecurityBeans.class, AuthenticationFactoriesTestConf.class })
-@ExtendWith(SpringExtension.class)
-@TestInstance(Lifecycle.PER_CLASS)
-public @interface AutoConfigureAddonsSecurity {
-}
diff --git a/webflux/spring-addons-webflux-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsWebSecurity.java b/webflux/spring-addons-webflux-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsWebSecurity.java
deleted file mode 100644
index 7bf3655a8..000000000
--- a/webflux/spring-addons-webflux-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsWebSecurity.java
+++ /dev/null
@@ -1,28 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.mockmvc.introspecting;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-
-import com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsWebSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.test.webflux.AddonsWebfluxTestConf;
-
-/**
- *
- * Auto-configures {@link AddonsSecurityBeans} and {@link AddonsWebSecurityBeans}. To be used to test controllers but not services or repositories (web context
- * is not desired in that case).
- *
- * See {@link AutoConfigureAddonsSecurity}
- *
- * @author Jérôme Wacongne <ch4mp#64;c4-soft.com>
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@AutoConfigureAddonsSecurity
-@ImportAutoConfiguration({ AddonsWebSecurityBeans.class, AddonsWebfluxTestConf.class })
-public @interface AutoConfigureAddonsWebSecurity {
-}
diff --git a/webflux/spring-addons-webflux-jwt-resource-server/README.MD b/webflux/spring-addons-webflux-jwt-resource-server/README.MD
deleted file mode 100644
index 460c4bcd2..000000000
--- a/webflux/spring-addons-webflux-jwt-resource-server/README.MD
+++ /dev/null
@@ -1,31 +0,0 @@
-# `spring-addons-webflux-jwt-resource-server`
-A thin wrapper around `spring-boot-starter-oauth2-resource-server` which pushes auto-configuration one step further for Spring Boot 3 reactive resource servers using JWT decoders.
-
-## 1. Usage
-All you need is declaring a dependency on `spring-addons-webflux-jwt-resource-server` and defining a few properties.
-
-The [`webflux-jwt-default` sample](https://github.com/ch4mpy/spring-addons/tree/master/samples/webflux-jwt-default) explains basic configuration and is the best starting point. You might find some more advanced use-cases in [tutorials](https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials) and [samples](https://github.com/ch4mpy/spring-addons/tree/master/samples).
-
-## 2. How it works
-As any boot starter, a resource file defines what should be loaded: [`src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports) which specifies that two configuration sources should be loaded:
-- [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) with a single `OAuth2AuthoritiesConverter` (an alias for `Converter, Collection>`)
-- [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) which contains a few other beans involved in the creation of a security filter chain for a multi-tenant ready resource server using JWT decoder(s).
-
-Also, as any serious Boot starter, any bean defined there is conditional, so that one way or another, you can deactivate or overload it.
-
-## 3. What is auto configured
-The most accurate information about [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) and [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) is in the source and Javadoc, but here is an idea of the auto configured beans.
-
-### 3.1. AddonsSecurityBeans
-Provides with:
-- `authoritiesConverter` which is an instance of `ConfigurableClaimSet2AuthoritiesConverter`. This bean is configured with application properties and is able to map spring-security authorities from any claims with prefix and case transformation defined for each claim.
-- `jwtAuthenticationConverter`: a converter from a `Jwt` to something inheriting from `AbstractAuthenticationToken`. The default instantiate a `JwtAuthenticationToken` with username and authorities as configured for the issuer of thi token. The easiest to override the type of `AbstractAuthenticationToken`, is to provide with a `Converter>` bean.
-
-### 3.2. AddonsWebSecurityBeans
-Provides with a (non conditional) security filter-chain as well as (conditional) defaults for all the beans required to configure it:
-- `springAddonsResourceServerSecurityFilterChain`: applies CORS, CSRF, anonymous, sessionCreationPolicy, SSL, redirect and 401 instead of redirect to login as defined in [`SpringAddonsSecurityProperties`](https://github.com/ch4mpy/spring-addons/blob/master/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/SpringAddonsSecurityProperties.java)
-- `authorizePostProcessor`: a bean of type `AuthorizeExchangeSpecPostProcessor` to fine tune access control from java configuration. It applies to all routes not listed in "permit-all" property configuration. Default requires users to be authenticated. **This is a bean to provide in your application configuration if you prefer to define fine-grained access control rules with Java configuration rather than methods security.**
-- `httpPostProcessor`: a bean of type `ServerHttpSecurityPostProcessor` to override anything from above auto-configuration. It is called just before the security filter-chain is returned. Default is a no-op.
-- `authenticationManagerResolver`: to accept identities issued by more than a single OP, the recommended way is to provide an `ReactiveAuthenticationManagerResolver` supporting it. Default keeps a `JwtReactiveAuthenticationManager` with its own `ReactiveJwtDecoder` for each issuer.
-- `csrfCookieWebFilter`: a `WebFilter` to set the CSRF cookie if `com.c4-soft.springaddons.security.client.csrf` is set with one of the two cookie options
-- `serverAccessDeniedHandler`: a bean to switch from default behavior of redirecting unauthorized users to login (302) to returning 401 (unauthorized)
diff --git a/webflux/spring-addons-webflux-jwt-resource-server/license.txt b/webflux/spring-addons-webflux-jwt-resource-server/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webflux/spring-addons-webflux-jwt-resource-server/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webflux/spring-addons-webflux-jwt-resource-server/lombok.config b/webflux/spring-addons-webflux-jwt-resource-server/lombok.config
deleted file mode 100644
index 8f7e8aa1a..000000000
--- a/webflux/spring-addons-webflux-jwt-resource-server/lombok.config
+++ /dev/null
@@ -1 +0,0 @@
-lombok.addLombokGeneratedAnnotation = true
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-jwt-resource-server/pom.xml b/webflux/spring-addons-webflux-jwt-resource-server/pom.xml
deleted file mode 100644
index 0ed5ecf81..000000000
--- a/webflux/spring-addons-webflux-jwt-resource-server/pom.xml
+++ /dev/null
@@ -1,46 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webflux
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webflux-jwt-resource-server
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-core
-
-
- org.springframework.security
- spring-security-config
-
-
-
- org.springframework.boot
- spring-boot-autoconfigure
-
-
- org.springframework.boot
- spring-boot
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsSecurityBeans.java b/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsSecurityBeans.java
deleted file mode 100644
index 391ca50c6..000000000
--- a/webflux/spring-addons-webflux-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/reactive/AddonsSecurityBeans.java
+++ /dev/null
@@ -1,59 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.reactive;
-
-import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.context.annotation.Bean;
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
-
-import com.c4_soft.springaddons.security.oauth2.OpenidClaimSet;
-import com.c4_soft.springaddons.security.oauth2.config.ClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.ConfigurableClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.ReactiveJwtAbstractAuthenticationTokenConverter;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-
-import lombok.extern.slf4j.Slf4j;
-import reactor.core.publisher.Mono;
-
-/**
- * @author Jerome Wacongne ch4mp@c4-soft.com
- */
-@AutoConfiguration
-@Slf4j
-@ImportAutoConfiguration(SpringAddonsSecurityProperties.class)
-public class AddonsSecurityBeans {
-
- /**
- * Retrieves granted authorities from the Jwt (from its private claims or with the help of an external service)
- *
- * @param securityProperties
- * @return
- */
- @ConditionalOnMissingBean
- @Bean
- ClaimSetAuthoritiesConverter authoritiesConverter(SpringAddonsSecurityProperties addonsProperties) {
- log.debug("Building default CorsConfigurationSource with: {}", addonsProperties);
- return new ConfigurableClaimSetAuthoritiesConverter(addonsProperties);
- }
-
- /**
- * Converter bean from {@link Jwt} to {@link AbstractAuthenticationToken}
- *
- * @param authoritiesConverter converts access-token claims into Spring authorities
- * @param authenticationFactory builds an {@link Authentication} instance from access-token string and claims
- * @return a converter from {@link Jwt} to {@link AbstractAuthenticationToken}
- */
- @ConditionalOnMissingBean
- @Bean
- ReactiveJwtAbstractAuthenticationTokenConverter
- jwtAuthenticationConverter(ClaimSetAuthoritiesConverter authoritiesConverter, SpringAddonsSecurityProperties addonsProperties) {
- return jwt -> Mono.just(
- new JwtAuthenticationToken(
- jwt,
- authoritiesConverter.convert(jwt.getClaims()),
- new OpenidClaimSet(jwt.getClaims(), addonsProperties.getIssuerProperties(jwt.getIssuer()).getUsernameClaim()).getName()));
- }
-}
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webflux/spring-addons-webflux-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index f902ae469..000000000
--- a/webflux/spring-addons-webflux-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1,2 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsSecurityBeans
-com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsWebSecurityBeans
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-jwt-test/pom.xml b/webflux/spring-addons-webflux-jwt-test/pom.xml
deleted file mode 100644
index 43ca481ce..000000000
--- a/webflux/spring-addons-webflux-jwt-test/pom.xml
+++ /dev/null
@@ -1,61 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webflux
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webflux-jwt-test
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- org.springframework.security
- spring-security-config
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-client
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-jwt-resource-server
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-test
-
-
- org.projectlombok
- lombok
- true
- provided
-
-
- org.junit.jupiter
- junit-jupiter-api
- true
-
-
-
- junit
- junit
- test
-
-
- org.assertj
- assertj-core
- test
-
-
-
diff --git a/webflux/spring-addons-webflux-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/jwt/AutoConfigureAddonsSecurity.java b/webflux/spring-addons-webflux-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/jwt/AutoConfigureAddonsSecurity.java
deleted file mode 100644
index 812449fe1..000000000
--- a/webflux/spring-addons-webflux-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/jwt/AutoConfigureAddonsSecurity.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.webflux.jwt;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.junit.jupiter.api.TestInstance;
-import org.junit.jupiter.api.TestInstance.Lifecycle;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.test.context.junit.jupiter.SpringExtension;
-
-import com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.test.webflux.AuthenticationFactoriesTestConf;
-
-/**
- *
- * To be used to test services or repositories but not controllers: auto-configures {@link AddonsSecurityBeans} only
- *
- * See {@link AutoConfigureAddonsWebSecurity}
- *
- * @author Jérôme Wacongne <ch4mp#64;c4-soft.com>
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@ExtendWith(SpringExtension.class)
-@ImportAutoConfiguration({ AddonsSecurityBeans.class, AuthenticationFactoriesTestConf.class })
-@TestInstance(Lifecycle.PER_CLASS)
-public @interface AutoConfigureAddonsSecurity {
-}
diff --git a/webflux/spring-addons-webflux-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/jwt/AutoConfigureAddonsWebSecurity.java b/webflux/spring-addons-webflux-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/jwt/AutoConfigureAddonsWebSecurity.java
deleted file mode 100644
index 34de0eeee..000000000
--- a/webflux/spring-addons-webflux-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/jwt/AutoConfigureAddonsWebSecurity.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.webflux.jwt;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-
-import com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.config.reactive.AddonsWebSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.config.reactive.SpringAddonsOAuth2ClientBeans;
-import com.c4_soft.springaddons.security.oauth2.test.webflux.AddonsWebfluxTestConf;
-
-/**
- *
- * Auto-configures {@link AddonsSecurityBeans} and {@link AddonsWebSecurityBeans}. To be used to test controllers but not services or repositories (web context
- * is not desired in that case).
- *
- * See {@link AutoConfigureAddonsSecurity}
- *
- * @author Jérôme Wacongne <ch4mp#64;c4-soft.com>
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@AutoConfigureAddonsSecurity
-@ImportAutoConfiguration({ AddonsWebSecurityBeans.class, SpringAddonsOAuth2ClientBeans.class, AddonsWebfluxTestConf.class })
-public @interface AutoConfigureAddonsWebSecurity {
-}
diff --git a/webflux/spring-addons-webflux-test/README.MD b/webflux/spring-addons-webflux-test/README.MD
deleted file mode 100644
index 3ea404762..000000000
--- a/webflux/spring-addons-webflux-test/README.MD
+++ /dev/null
@@ -1,56 +0,0 @@
-# spring-addons-webflux-test
-
-Set of tools I find useful to test Spring reactive web apps (webflux).
-
-``` xml
-
-
- com.c4-soft.springaddons
- spring-addons-webflux-test
- ${com.c4-soft.springaddons.version}
- test
-
-
-```
-
-## `WebTestClient` configurers
-I propose two classes implementing both `WebTestClientConfigurer` and `MockServerConfigurer` to use with `WebTestClient`:
- * `MockAuthenticationWebTestClientConfigurer` to use a Mockito mock of an `Authentication` descendent of your choice (any type implementing `Authentication`)
- * `OidcIdAuthenticationTokenWebTestClientConfigurer` to have `TestSecurityContext` populated with an ... `OidcIdAuthenticationToken`
-
-Browse unit tests to see more samples:
- ``` java
-import static com.c4_soft.springaddons.security.oauth2.test.webflux.MockAuthenticationWebTestClientConfigurer.mockAuthentication;
-
- @Test
- public void testAccessSecuredMethodWithoutRequiredAuthority() {
- client.mutateWith(mockAuthentication()).get("/secured-method")
- .expectStatus().isForbidden();
- }
- ```
- ``` java
-import static com.c4_soft.springaddons.security.oauth2.test.webflux.OidcIdAuthenticationTokenWebTestClientConfigurer.oidcId;
-
- @Test
- public void testDefaultAccessTokenConfigurer() {
- client.mutateWith(oidcId()).get("/greet").expectBody(String.class)
- .isEqualTo("Hello user! You are granted with [].");
- }
- ```
-
- ## `WebTestClientSupport`
- A wrapper for `WebTestClient` providing with configurable default charset and media-type along with shortcuts for most requests.
-
- Configuration properties are:
- * `com.c4-soft.springaddons.test.web.default-charset` defaulted to `utf-8`
- * `com.c4-soft.springaddons.test.web.default-media-type` defaulted to `application+json`
-
-``` java
-webTestClient.get().uri("/greet").accept(MediaType.APPLICATION_JSON).acceptCharset(Charset.forName("UTF-8")).exchange()
-```
-becomes
-``` java
-webTestClient.get("/greet")
-```
-
-To use it, you can for instance `@Import(WebTestClientSupport.class)`, scan for components in `com.c4_soft.springaddons.security.oauth2.test.webflux` package, add `WebTestClientSupport.class` to `@ContextConfiguration` classes, etc. (has to be instantiated by Spring for config properties to be parsed / defaulted)
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/AuthenticationFactoriesTestConf.java b/webflux/spring-addons-webflux-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/AuthenticationFactoriesTestConf.java
deleted file mode 100644
index c04bac74a..000000000
--- a/webflux/spring-addons-webflux-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webflux/AuthenticationFactoriesTestConf.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.webflux;
-
-import java.util.Optional;
-
-import org.springframework.boot.test.context.TestConfiguration;
-import org.springframework.context.annotation.Bean;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter;
-
-import com.c4_soft.springaddons.security.oauth2.test.annotations.WithJwt;
-import com.c4_soft.springaddons.security.oauth2.test.annotations.WithOpaqueToken;
-
-import reactor.core.publisher.Mono;
-
-@TestConfiguration
-public class AuthenticationFactoriesTestConf {
-
-
- @Bean
- WithJwt.AuthenticationFactory jwtAuthFactory(Optional>> authenticationConverter) {
- return new WithJwt.AuthenticationFactory(Optional.empty(), authenticationConverter);
- }
-
- @Bean
- WithOpaqueToken.AuthenticationFactory opaquetokenAuthFactory(Optional authenticationConverter) {
- return new WithOpaqueToken.AuthenticationFactory(Optional.empty(), authenticationConverter);
- }
-
-}
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-test/src/main/resources/META-INF/additional-spring-configuration-metadata.json b/webflux/spring-addons-webflux-test/src/main/resources/META-INF/additional-spring-configuration-metadata.json
deleted file mode 100644
index 7879858f6..000000000
--- a/webflux/spring-addons-webflux-test/src/main/resources/META-INF/additional-spring-configuration-metadata.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{"properties": [
- {
- "name": "com.c4-soft.springaddons.test.web.default-charset",
- "type": "java.lang.String",
- "sourceType": "com.c4_soft.springaddons.security.oauth2.test.mockmvc.MockMvcSupport$MockMvcProperties",
- "defaultValue": "utf-8",
- "description": "Default charset for requests issued with WebTestClientSupport"
- },
- {
- "name": "com.c4-soft.springaddons.test.web.default-media-type",
- "type": "java.lang.String",
- "sourceType": "com.c4_soft.springaddons.security.oauth2.test.mockmvc.MockMvcSupport$MockMvcProperties",
- "defaultValue": "application\/json",
- "description": "Default media-type for requests issued with WebTestClientSupport"
- }]}
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-test/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webflux/spring-addons-webflux-test/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index 96e6dfd14..000000000
--- a/webflux/spring-addons-webflux-test/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.test.webflux.WebTestClientProperties
\ No newline at end of file
diff --git a/webflux/spring-addons-webflux-test/src/main/resources/mockito-extensions/org.mockito.plugins.MockMaker b/webflux/spring-addons-webflux-test/src/main/resources/mockito-extensions/org.mockito.plugins.MockMaker
deleted file mode 100644
index ca6ee9cea..000000000
--- a/webflux/spring-addons-webflux-test/src/main/resources/mockito-extensions/org.mockito.plugins.MockMaker
+++ /dev/null
@@ -1 +0,0 @@
-mock-maker-inline
\ No newline at end of file
diff --git a/webmvc/pom.xml b/webmvc/pom.xml
deleted file mode 100644
index 65501b1cb..000000000
--- a/webmvc/pom.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-
-
- 4.0.0
-
- com.c4-soft.springaddons
- spring-addons
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc
- pom
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
- spring-addons-webmvc-core
- spring-addons-webmvc-introspecting-resource-server
- spring-addons-webmvc-jwt-resource-server
- spring-addons-webmvc-test
- spring-addons-webmvc-introspecting-test
- spring-addons-webmvc-jwt-test
- spring-addons-webmvc-client
-
-
-
diff --git a/webmvc/spring-addons-webmvc-client/README.md b/webmvc/spring-addons-webmvc-client/README.md
deleted file mode 100644
index 8c859639f..000000000
--- a/webmvc/spring-addons-webmvc-client/README.md
+++ /dev/null
@@ -1,201 +0,0 @@
-# `spring-addons-webmvc-client`
-A thin wrapper around `spring-boot-starter-oauth2-client` which pushes auto-configuration one step further.
-
-## How it works
-As any boot starter, a resource file defines what should be loaded: [`src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports) which specifies that two configuration sources should be loaded:
-- [`SpringAddonsOAuth2ClientBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2ClientBeans.java) with a bunch of OAuth2 client related beans configurable from application properties
-- [`SpringAddonsBackChannelLogoutBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsBackChannelLogoutBeans.java) which contains the beans definition for a client [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) implementation: a security filter-chain and a `@RestController`.
-
-Also, as any serious Boot starter, any bean defined there is conditional, so that one way or another, you can deactivate or overload it.
-
-## What is auto configured
-The most accurate information about [`SpringAddonsOAuth2ClientBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsOAuth2ClientBeans.java) and [`SpringAddonsBackChannelLogoutBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-client/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/SpringAddonsBackChannelLogoutBeans.java) is in the source and Javadoc, but here is an idea of the auto configured beans.
-
-### SpringAddonsOAuth2ClientBeans
-- `springAddonsClientFilterChain`: a security filter-chain instantiated only if `com.c4-soft.springaddons.security.client.security-matchers` property has at least one entry. If defined, it is a high precedence, to ensure that all routes defined in this security matcher property are intercepted by this filter-chain. Refer to [`SpringAddonsOAuth2ClientProperties`](https://github.com/ch4mpy/spring-addons/blob/master/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/SpringAddonsOAuth2ClientProperties.java) for configuration options. **If you provide a `login-path` in the application properties, you'll also have to provide with a controller to handle that path**. There can be two motivation for that: you want to write your own login page or you want to enable SSL when bound to port `80` or `8080`.
-- `oAuth2AuthorizationRequestResolver`: default instance is a `SpringAddonsOAuth2AuthorizationRequestResolver` which sets the client hostname in the redirect URI with `com.c4-soft.springaddons.security.client.client-uri`. It is configured as the authorization request resolver to use only if a `login-path` was provided (this resolver was designed to work around PortMapperImpl aggressively modifying 80 and 8080 ports in all login redirect URIs when SSL is enabled and works in together with an absolute URI for the login page).
-- `logoutRequestUriBuilder`: builder for [RP-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) queries, taking configuration from properties for OIDC providers which do not strictly comply with the spec: logout URI not provided by OIDC conf or non standard parameter names (Auth0 and Cognito are samples of such OPs)
-- `logoutSuccessHandler`: default instance is a `SpringAddonsOAuth2LogoutSuccessHandler` which logs a user out from the last authorization server he logged on
-- `authoritiesConverter`: an `OAuth2AuthoritiesConverter`. Default instance is a `ConfigurableClaimSet2AuthoritiesConverter` which reads spring-addons `SpringAddonsSecurityProperties`
-- `grantedAuthoritiesMapper`: a `GrantedAuthoritiesMapper` using the already configured `OAuth2AuthoritiesConverter`
-- `corsConfigurationSource`: CORS configuration built from `SpringAddonsOAuth2ClientProperties`
-- `oAuth2AuthorizedClientRepository`: a `SpringAddonsOAuth2AuthorizedClientRepository` (which is also a session listener) capable of handling multi-tenancy and [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html)
-- `clientAuthorizePostProcessor`: a post processor to fine tune access control from java configuration. It applies to all routes not listed in "permit-all" property configuration. Default requires users to be authenticated. **This is a bean to provide in your application configuration if you prefer to define fine-grained access control rules with Java configuration rather than methods security.**
-- `clientHttpPostProcessor`: a post processor to override anything from above auto-configuration. It is called just before the security filter-chain is returned. Default is a no-op.
-
-### SpringAddonsBackChannelLogoutBeans
-This two beans are instantiated only if `com.c4-soft.springaddons.security.client.back-channel-logout-enabled` is `true`
-- `springAddonsBackChannelLogoutClientFilterChain`: a filter chain with highest precedence intercepting requests to just `/backchannel_logout`, with no session, no CSRF protection and no access-control: security is based on ly on the logout JWT in the request payload.
-- `BackChannelLogoutController` a REST controller to handle just the POST requests to `/backchannel_logout` with a logout JWT provided as `application/x-www-form-urlencoded`
-
-## Sample usage
-The [resource server & UI](https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials/resource-server_with_ui) tutorial uses this starter to configure a Spring Boot application with a client security filter-chain (in addition to a resource server one configured with `spring-addons-webmvc-jwt-resource-server` starter). In this sample, the Java web-security configuration is reduced to almost nothing, all the configuration being defined with the following properties:
-```yaml
-api-host: ${scheme}://localhost:${server.port}
-ui-host: ${api-host}
-rp-initiated-logout-enabled: true
-
-scheme: http
-keycloak-port: 8442
-keycloak-issuer: ${scheme}://localhost:${keycloak-port}/realms/master
-keycloak-secret: change-me
-cognito-issuer: https://cognito-idp.us-west-2.amazonaws.com/us-west-2_RzhmgLwjl
-cognito-secret: change-me
-auth0-issuer: https://dev-ch4mpy.eu.auth0.com/
-auth0-secret: change-me
-
-server:
- port: 7443
- ssl:
- enabled: false
-
-spring:
- lifecycle:
- timeout-per-shutdown-phase: 30s
- security:
- oauth2:
- client:
- provider:
- keycloak:
- issuer-uri: ${keycloak-issuer}
- cognito:
- issuer-uri: ${cognito-issuer}
- auth0:
- issuer-uri: ${auth0-issuer}
- registration:
- keycloak-user:
- authorization-grant-type: authorization_code
- client-name: a local Keycloak instance
- client-id: spring-addons-confidential
- client-secret: ${keycloak-secret}
- provider: keycloak
- scope: openid,profile,email,offline_access
- keycloak-programmatic:
- authorization-grant-type: client_credentials
- client-id: spring-addons-confidential
- client-secret: ${keycloak-secret}
- provider: keycloak
- scope: openid,offline_access
- cognito-confidential-user:
- authorization-grant-type: authorization_code
- client-name: Amazon Cognito
- client-id: 12olioff63qklfe9nio746es9f
- client-secret: ${cognito-secret}
- provider: cognito
- scope: openid,profile,email
- auth0-confidential-user:
- authorization-grant-type: authorization_code
- client-name: Auth0
- client-id: TyY0H7xkRMRe6lDf9F8EiNqCo8PdhICy
- client-secret: ${auth0-secret}
- provider: auth0
- scope: openid,profile,email,offline_access
-
-com:
- c4-soft:
- springaddons:
- security:
- cors:
- - path: /api/greet
- issuers:
- - location: ${keycloak-issuer}
- username-claim: $.preferred_username
- authorities:
- - path: $.realm_access.roles
- - path: $.resource_access.*.roles
- - location: ${cognito-issuer}
- username-claim: $.username
- authorities:
- - path: $.cognito:groups
- - location: ${auth0-issuer}
- username-claim: $['https://c4-soft.com/user']['name']
- authorities:
- - path: $['https://c4-soft.com/user']['roles']
- - path: $.permissions
- permit-all:
- - /actuator/health/readiness
- - /actuator/health/liveness
- - /v3/api-docs/**
- - /api/public
- client:
- security-matchers:
- - /login/**
- - /oauth2/**
- - /
- - /ui/**
- - /swagger-ui.html
- - /swagger-ui/**
- permit-all:
- - /login/**
- - /oauth2/**
- - /
- - /ui/
- - /swagger-ui.html
- - /swagger-ui/**
- client-uri: ${ui-host}
- post-login-redirect-path: /ui/greet
- post-logout-redirect-path: /ui/greet
- back-channel-logout-enabled: true
- oauth2-logout:
- - client-registration-id: cognito-confidential-user
- uri: https://spring-addons.auth.us-west-2.amazoncognito.com/logout
- client-id-request-param: client_id
- post-logout-uri-request-param: logout_uri
- - client-registration-id: auth0-confidential-user
- uri: ${auth0-issuer}v2/logout
- client-id-request-param: client_id
- post-logout-uri-request-param: returnTo
- authorization-request-params:
- auth0-confidential-user:
- - name: audience
- value: demo.c4-soft.com
-
-logging:
- level:
- org:
- springframework:
- security: DEBUG
-
-management:
- endpoint:
- health:
- probes:
- enabled: true
- endpoints:
- web:
- exposure:
- include: '*'
- health:
- livenessstate:
- enabled: true
- readinessstate:
- enabled: true
-
----
-scheme: https
-keycloak-port: 8443
-
-server:
- ssl:
- enabled: true
-
-spring:
- config:
- activate:
- on-profile: ssl
-
----
-server:
- port: 8080
-com:
- c4-soft:
- springaddons:
- security:
- client:
- login-path: /login
-
-spring:
- config:
- activate:
- on-profile: custom-login
-```
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-client/license.txt b/webmvc/spring-addons-webmvc-client/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webmvc/spring-addons-webmvc-client/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webmvc/spring-addons-webmvc-client/lombok.config b/webmvc/spring-addons-webmvc-client/lombok.config
deleted file mode 100644
index 8f7e8aa1a..000000000
--- a/webmvc/spring-addons-webmvc-client/lombok.config
+++ /dev/null
@@ -1 +0,0 @@
-lombok.addLombokGeneratedAnnotation = true
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-client/pom.xml b/webmvc/spring-addons-webmvc-client/pom.xml
deleted file mode 100644
index 2bd5ac1dc..000000000
--- a/webmvc/spring-addons-webmvc-client/pom.xml
+++ /dev/null
@@ -1,56 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc-client
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- jakarta.servlet
- jakarta.servlet-api
-
-
-
- org.springframework.boot
- spring-boot
-
-
- org.springframework.boot
- spring-boot-autoconfigure
- true
-
-
- org.springframework.security
- spring-security-config
-
-
- org.springframework.security
- spring-security-oauth2-client
-
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-core
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webmvc/spring-addons-webmvc-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index 8f8da5dba..000000000
--- a/webmvc/spring-addons-webmvc-client/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1,2 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.config.synchronised.SpringAddonsOAuth2ClientBeans
-com.c4_soft.springaddons.security.oauth2.config.synchronised.SpringAddonsBackChannelLogoutBeans
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-core/license.txt b/webmvc/spring-addons-webmvc-core/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webmvc/spring-addons-webmvc-core/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webmvc/spring-addons-webmvc-core/pom.xml b/webmvc/spring-addons-webmvc-core/pom.xml
deleted file mode 100644
index 01e8bf89b..000000000
--- a/webmvc/spring-addons-webmvc-core/pom.xml
+++ /dev/null
@@ -1,56 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc-core
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- com.c4-soft.springaddons
- spring-addons-oauth2
-
-
- org.springframework.security
- spring-security-oauth2-resource-server
-
-
- org.springframework.security
- spring-security-oauth2-jose
-
-
- org.springframework.security
- spring-security-config
-
-
- org.springframework.boot
- spring-boot-starter-web
-
-
-
- jakarta.servlet
- jakarta.servlet-api
- provided
- true
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ResourceServerExpressionInterceptUrlRegistryPostProcessor.java b/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ResourceServerExpressionInterceptUrlRegistryPostProcessor.java
deleted file mode 100644
index 1636cc57a..000000000
--- a/webmvc/spring-addons-webmvc-core/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/ResourceServerExpressionInterceptUrlRegistryPostProcessor.java
+++ /dev/null
@@ -1,4 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
-
-public interface ResourceServerExpressionInterceptUrlRegistryPostProcessor extends ExpressionInterceptUrlRegistryPostProcessor {
-}
diff --git a/webmvc/spring-addons-webmvc-introspecting-resource-server/README.MD b/webmvc/spring-addons-webmvc-introspecting-resource-server/README.MD
deleted file mode 100644
index 5e56b6e68..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-resource-server/README.MD
+++ /dev/null
@@ -1,129 +0,0 @@
-# `spring-addons-webmvc-introspecting-resource-server`
-A thin wrapper around `spring-boot-starter-oauth2-client` which pushes auto-configuration one step further for servlet resource servers using access token introspection.
-
-## How it works
-As any boot starter, a resource file defines what should be loaded: [`src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports) which specifies that two configuration sources should be loaded:
-- [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) with a single `OAuth2AuthoritiesConverter` (an alias for `Converter, Collection>`)
-- [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) which contains a few other beans involved in the creation of a security filter chain for a single-tenant resource server using access token introspection.
-
-Also, as any serious Boot starter, any bean defined there is conditional, so that one way or another, you can deactivate or overload it, with one notable exception: the `springAddonsResourceServerSecurityFilterChain` is not conditional and instantiated in any case (with lowest precedence) if you depend on this starter.
-
-## What is auto configured
-The most accurate information about [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) and [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) is in the source and Javadoc, but here is an idea of the auto configured beans.
-
-### AddonsSecurityBeans
-Provides with:
-- `authoritiesConverter` which is an instance of `ConfigurableClaimSet2AuthoritiesConverter`. This bean is configured with application properties and is able to map spring-security authorities from any claims with prefix and case transformation defined for each claim.
-- `introspectionAuthenticationConverter`: a converter from a successful introspection to something inheriting from `AbstractAuthenticationToken`. The default instantiate a `BearerTokenAuthentication` with authorities mapping as configured for the issuer declared in the introspected claims. The easiest to override the type of `AbstractAuthenticationToken`, is to provide with an `OpaqueTokenAuthenticationConverter` bean.
-
-### AddonsWebSecurityBeans
-Provides with a (non conditional) security filter-chain as well as (conditional) defaults for all the beans required to configure it:
-- `springAddonsResourceServerSecurityFilterChain`: applies CORS, CSRF, anonymous, sessionCreationPolicy, SSL, redirect and 401 instead of redirect to login as defined in [`SpringAddonsSecurityProperties`](https://github.com/ch4mpy/spring-addons/blob/master/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/SpringAddonsSecurityProperties.java)
-- `authorizePostProcessor`: a bean of type `ExpressionInterceptUrlRegistryPostProcessor` to fine tune access control from java configuration. It applies to all routes not listed in "permit-all" property configuration. Default requires users to be authenticated. **This is a bean to provide in your application configuration if you prefer to define fine-grained access control rules with Java configuration rather than methods security.**
-- `httpPostProcessor`: a bean of type `HttpSecurityPostProcessor` to override anything from above auto-configuration. It is called just before the security filter-chain is returned. Default is a no-op.
-
-## Usage
-Please take time to browse [tutorials](https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials) and [samples](https://github.com/ch4mpy/spring-addons/tree/master/samples).
-
-All you need is declare a dependency on `spring-addons-webmvc-introspection-resource-server` and define a few properties.
-
-You might use any OIDC Provider (including Keycloak, Auth0, Cognito, etc.), but only one at a time.
-
-``` xml
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-introspection-resource-server
- ${com.c4-soft.springaddons.version}
-
-
-```
-``` java
-@SpringBootApplication
-public class SampleApi {
- public static void main(String[] args) {
- new SpringApplicationBuilder(SampleApi.class).web(WebApplicationType.SERVLET).run(args);
- }
-
- @Configuration
- @EnableMethodSecurity
- public static class WebSecurityConfig {
- }
-}
-```
-```yaml
-scheme: http
-origins: ${scheme}://localhost:4200
-keycloak-port: 8442
-keycloak-issuer: ${scheme}://localhost:${keycloak-port}/realms/master
-
-server:
- error:
- include-message: always
- ssl:
- enabled: false
-
-spring:
- lifecycle:
- timeout-per-shutdown-phase: 30s
- security:
- oauth2:
- resourceserver:
- opaquetoken:
- client-id: spring-addons-confidential
- client-secret: change-me
- introspection-uri: ${keycloak-issuer}/protocol/openid-connect/token/introspect
-
-com:
- c4-soft:
- springaddons:
- security:
- cors:
- - path: /**
- allowed-origins: ${origins}
- issuers:
- - location: ${keycloak-issuer}
- username-claim: preferred_username
- authorities:
- - path: $.realm_access.roles
- - path: $.resource_access.*.roles
- permit-all:
- - "/actuator/health/readiness"
- - "/actuator/health/liveness"
- - "/v3/api-docs/**"
-
-logging:
- level:
- org:
- springframework:
- security: DEBUG
-
-management:
- endpoint:
- health:
- probes:
- enabled: true
- endpoints:
- web:
- exposure:
- include: '*'
- health:
- livenessstate:
- enabled: true
- readinessstate:
- enabled: true
-
----
-scheme: https
-keycloak-port: 8443
-
-server:
- ssl:
- enabled: true
-
-spring:
- config:
- activate:
- on-profile: ssl
-
-```
diff --git a/webmvc/spring-addons-webmvc-introspecting-resource-server/license.txt b/webmvc/spring-addons-webmvc-introspecting-resource-server/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-resource-server/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webmvc/spring-addons-webmvc-introspecting-resource-server/pom.xml b/webmvc/spring-addons-webmvc-introspecting-resource-server/pom.xml
deleted file mode 100644
index e497e30cf..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-resource-server/pom.xml
+++ /dev/null
@@ -1,47 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc-introspecting-resource-server
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-core
-
-
-
- org.springframework.boot
- spring-boot-autoconfigure
- true
-
-
- org.springframework.security
- spring-security-config
-
-
- org.springframework.boot
- spring-boot
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java b/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java
deleted file mode 100644
index 518413988..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java
+++ /dev/null
@@ -1,85 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
-
-import java.time.Instant;
-import java.util.Collection;
-import java.util.Map;
-import java.util.stream.Stream;
-
-import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Import;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.oauth2.core.OAuth2AccessToken;
-import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal;
-import org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames;
-import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthentication;
-import org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionAuthenticatedPrincipal;
-import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenAuthenticationConverter;
-
-import com.c4_soft.springaddons.security.oauth2.OpenidClaimSet;
-import com.c4_soft.springaddons.security.oauth2.config.ClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.ConfigurableClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * @author Jerome Wacongne ch4mp@c4-soft.com
- */
-@AutoConfiguration
-@Slf4j
-@Import({ SpringAddonsSecurityProperties.class })
-public class AddonsSecurityBeans {
-
- /**
- * Retrieves granted authorities from the introspected token attributes, according to configuration set for the issuer set in this attributes
- *
- * @param securityProperties
- * @return
- */
- @ConditionalOnMissingBean
- @Bean
- ClaimSetAuthoritiesConverter authoritiesConverter(SpringAddonsSecurityProperties addonsProperties) {
- log.debug("Building default SimpleJwtGrantedAuthoritiesConverter with: {}", addonsProperties);
- return new ConfigurableClaimSetAuthoritiesConverter(addonsProperties);
- }
-
- /**
- * Converter bean from successful introspection result to an {@link Authentication} instance
- *
- * @param authoritiesConverter converts access-token claims into Spring authorities
- * @param authenticationFactory builds an {@link Authentication} instance from access-token string and claims
- * @return a converter from successful introspection result to an {@link Authentication} instance
- */
- @SuppressWarnings("unchecked")
- @ConditionalOnMissingBean
- @Bean
- OpaqueTokenAuthenticationConverter introspectionAuthenticationConverter(
- Converter, Collection> authoritiesConverter,
- SpringAddonsSecurityProperties addonsProperties,
- OAuth2ResourceServerProperties resourceServerProperties) {
- return (String introspectedToken, OAuth2AuthenticatedPrincipal authenticatedPrincipal) -> {
- return new BearerTokenAuthentication(
- new OAuth2IntrospectionAuthenticatedPrincipal(
- new OpenidClaimSet(
- authenticatedPrincipal.getAttributes(),
- Stream.of(addonsProperties.getIssuers())
- .filter(
- issProps -> resourceServerProperties.getOpaquetoken().getIntrospectionUri()
- .contains(issProps.getLocation().toString()))
- .findAny().orElse(addonsProperties.getIssuers()[0]).getUsernameClaim()).getName(),
- authenticatedPrincipal.getAttributes(),
- (Collection) authenticatedPrincipal.getAuthorities()),
- new OAuth2AccessToken(
- OAuth2AccessToken.TokenType.BEARER,
- introspectedToken,
- Instant.ofEpochSecond(((Integer) authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.IAT)).longValue()),
- Instant.ofEpochSecond(((Integer) authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.EXP)).longValue())),
- authoritiesConverter.convert(authenticatedPrincipal.getAttributes()));
- };
- }
-}
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java b/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java
deleted file mode 100644
index 519f6ab5b..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java
+++ /dev/null
@@ -1,140 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
-
-import java.util.Arrays;
-import java.util.stream.Stream;
-
-import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.autoconfigure.web.ServerProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Import;
-import org.springframework.core.Ordered;
-import org.springframework.core.annotation.Order;
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenAuthenticationConverter;
-import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
-import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.CorsConfigurationSource;
-import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
-
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties.CorsProperties;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- *
- * Usage
- * If not using spring-boot, @Import or @ComponentScan this class. All beans defined here are @ConditionalOnMissingBean => just define your own
- * @Beans to override.
- *
- *
- * Provided @Beans
- *
- *
- * - springAddonsResourceServerSecurityFilterChain: applies CORS, CSRF, anonymous, sessionCreationPolicy, SSL, redirect and 401 instead of redirect to login
- * as defined in SpringAddonsSecurityProperties
- * - authorizePostProcessor: a bean of type {@link ExpressionInterceptUrlRegistryPostProcessor} to fine tune access control from java configuration. It
- * applies to all routes not listed in "permit-all" property configuration. Default requires users to be authenticated. This is a bean to provide in your
- * application configuration if you prefer to define fine-grained access control rules with Java configuration rather than methods security.
- * - httpPostProcessor: a bean of type {@link ResourceServerHttpSecurityPostProcessor} to override anything from above auto-configuration. It is called just
- * before the security filter-chain is returned. Default is a no-op.
- * - introspectionAuthenticationConverter: a converter from a successful introspection to something inheriting from {@link AbstractAuthenticationToken}. The
- * default instantiate a `BearerTokenAuthentication` with authorities mapping as configured for the issuer declared in the introspected claims. The easiest to
- * override the type of {@link AbstractAuthenticationToken}, is to provide with an Converter<Jwt, ? extends AbstractAuthenticationToken> bean.
- *
- *
- * @author Jerome Wacongne ch4mp@c4-soft.com
- */
-@ConditionalOnProperty(matchIfMissing = true, prefix = "com.c4-soft.springaddons.security", name = "enabled")
-@AutoConfiguration
-@EnableWebSecurity
-@Slf4j
-@Import({ AddonsSecurityBeans.class })
-public class AddonsWebSecurityBeans {
-
- /**
- *
- * Applies SpringAddonsSecurityProperties to web security config. Be aware that defining a {@link SecurityWebFilterChain} bean with no security matcher and
- * an order higher than LOWEST_PRECEDENCE will disable most of this lib auto-configuration for OpenID resource-servers.
- *
- *
- * You should consider to set security matcher to all other {@link SecurityWebFilterChain} beans and provide a {@link ServerHttpSecurityPostProcessor} bean
- * to override anything from this bean
- *
- * .
- *
- * @param http HTTP security to configure
- * @param serverProperties Spring "server" configuration properties
- * @param addonsProperties "com.c4-soft.springaddons.security" configuration properties
- * @param authorizePostProcessor Hook to override access-control rules for all path that are not listed in "permit-all"
- * @param httpPostProcessor Hook to override all or part of HttpSecurity auto-configuration
- * @param introspectionAuthenticationConverter Converts successful introspection result into an {@link Authentication}
- * @return A default {@link SecurityWebFilterChain} for servlet resource-servers with access-token introspection
- * (matches all unmatched routes with lowest precedence)
- */
- @Order(Ordered.LOWEST_PRECEDENCE)
- @Bean
- SecurityFilterChain springAddonsResourceServerSecurityFilterChain(
- HttpSecurity http,
- ServerProperties serverProperties,
- SpringAddonsSecurityProperties addonsProperties,
- ResourceServerExpressionInterceptUrlRegistryPostProcessor authorizePostProcessor,
- ResourceServerHttpSecurityPostProcessor httpPostProcessor,
- OpaqueTokenAuthenticationConverter introspectionAuthenticationConverter,
- OpaqueTokenIntrospector opaqueTokenIntrospector)
- throws Exception {
- http.oauth2ResourceServer(server -> server.opaqueToken(ot -> {
- ot.introspector(opaqueTokenIntrospector);
- ot.authenticationConverter(introspectionAuthenticationConverter);
- }));
-
- ServletConfigurationSupport.configureResourceServer(http, serverProperties, addonsProperties, authorizePostProcessor, httpPostProcessor);
-
- return http.build();
- }
-
- /**
- * Hook to override security rules for all path that are not listed in "permit-all". Default is isAuthenticated().
- *
- * @return a hook to override security rules for all path that are not listed in "permit-all". Default is isAuthenticated().
- */
- @ConditionalOnMissingBean
- @Bean
- ResourceServerExpressionInterceptUrlRegistryPostProcessor authorizePostProcessor() {
- return registry -> registry.anyRequest().authenticated();
- }
-
- /**
- * Hook to override all or part of HttpSecurity auto-configuration. Called after spring-addons configuration was applied so that you can modify anything
- *
- * @return a hook to override all or part of HttpSecurity auto-configuration. Called after spring-addons configuration was applied so that you can modify
- * anything
- */
- @ConditionalOnMissingBean
- @Bean
- ResourceServerHttpSecurityPostProcessor httpPostProcessor() {
- return httpSecurity -> httpSecurity;
- }
-
- CorsConfigurationSource corsConfig(CorsProperties[] corsProperties) {
- log.debug("Building default CorsConfigurationSource with: {}", Stream.of(corsProperties).toList());
- final var source = new UrlBasedCorsConfigurationSource();
- for (final var corsProps : corsProperties) {
- final var configuration = new CorsConfiguration();
- configuration.setAllowedOrigins(Arrays.asList(corsProps.getAllowedOrigins()));
- configuration.setAllowedMethods(Arrays.asList(corsProps.getAllowedMethods()));
- configuration.setAllowedHeaders(Arrays.asList(corsProps.getAllowedHeaders()));
- configuration.setExposedHeaders(Arrays.asList(corsProps.getExposedHeaders()));
- source.registerCorsConfiguration(corsProps.getPath(), configuration);
- }
- return source;
- }
-}
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index a419f7ff5..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1,2 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsSecurityBeans
-com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsWebSecurityBeans
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-introspecting-test/pom.xml b/webmvc/spring-addons-webmvc-introspecting-test/pom.xml
deleted file mode 100644
index 54e8390b4..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-test/pom.xml
+++ /dev/null
@@ -1,61 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc-introspecting-test
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- org.springframework.security
- spring-security-config
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-introspecting-resource-server
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-test
-
-
- org.springframework
- spring-webmvc
-
-
- org.projectlombok
- lombok
- true
- provided
-
-
- org.junit.jupiter
- junit-jupiter-api
- true
-
-
-
- junit
- junit
- test
-
-
- org.assertj
- assertj-core
- test
-
-
-
diff --git a/webmvc/spring-addons-webmvc-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsSecurity.java b/webmvc/spring-addons-webmvc-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsSecurity.java
deleted file mode 100644
index 5e0fa3b77..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsSecurity.java
+++ /dev/null
@@ -1,24 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.mockmvc.introspecting;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.junit.jupiter.api.TestInstance;
-import org.junit.jupiter.api.TestInstance.Lifecycle;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.test.context.junit.jupiter.SpringExtension;
-
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.test.mockmvc.AuthenticationFactoriesTestConf;
-
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@ImportAutoConfiguration({ SpringAddonsSecurityProperties.class, AddonsSecurityBeans.class, AuthenticationFactoriesTestConf.class })
-@ExtendWith(SpringExtension.class)
-@TestInstance(Lifecycle.PER_CLASS)
-public @interface AutoConfigureAddonsSecurity {
-}
diff --git a/webmvc/spring-addons-webmvc-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsWebSecurity.java b/webmvc/spring-addons-webmvc-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsWebSecurity.java
deleted file mode 100644
index 1a9276ad6..000000000
--- a/webmvc/spring-addons-webmvc-introspecting-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/introspecting/AutoConfigureAddonsWebSecurity.java
+++ /dev/null
@@ -1,28 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.mockmvc.introspecting;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-
-import com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsWebSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.test.mockmvc.AddonsWebmvcTestConf;
-
-/**
- *
- * Auto-configures {@link AddonsSecurityBeans} and {@link AddonsWebSecurityBeans}. To be used to test controllers but not services or repositories (web context
- * is not desired in that case).
- *
- * See {@link AutoConfigureAddonsSecurity}
- *
- * @author Jérôme Wacongne <ch4mp#64;c4-soft.com>
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@AutoConfigureAddonsSecurity
-@ImportAutoConfiguration({ AddonsWebSecurityBeans.class, AddonsWebmvcTestConf.class })
-public @interface AutoConfigureAddonsWebSecurity {
-}
diff --git a/webmvc/spring-addons-webmvc-jwt-resource-server/README.MD b/webmvc/spring-addons-webmvc-jwt-resource-server/README.MD
deleted file mode 100644
index d693c9bdb..000000000
--- a/webmvc/spring-addons-webmvc-jwt-resource-server/README.MD
+++ /dev/null
@@ -1,28 +0,0 @@
-# `spring-addons-webmvc-jwt-resource-server`
-A thin wrapper around `spring-boot-starter-oauth2-resource-server` which pushes auto-configuration one step further for Spring Boot 3 servlet resource servers using JWT decoders.
-
-## 1. Usage
-All you need is declaring a dependency on `spring-addons-webmvc-jwt-resource-server` and defining a few properties.
-
-The [`webmvc-jwt-default` sample](https://github.com/ch4mpy/spring-addons/tree/master/samples/webmvc-jwt-default) explains basic configuration and is the best starting point. You might find some more advanced use-cases in [tutorials](https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials) and [samples](https://github.com/ch4mpy/spring-addons/tree/master/samples).
-
-## 2. How it works
-As any boot starter, a resource file defines what should be loaded: [`src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports) which specifies that two configuration sources should be loaded:
-- [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) with a single `OAuth2AuthoritiesConverter` (an alias for `Converter, Collection>`)
-- [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) which contains a few other beans involved in the creation of a security filter chain for a multi-tenant ready resource server using JWT decoder(s).
-
-Also, as any serious Boot starter, any bean defined there is conditional, so that one way or another, you can deactivate or overload it.
-
-## 3. What is auto configured
-The most accurate information about [`AddonsWebSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsWebSecurityBeans.java) and [`AddonsSecurityBeans`](https://github.com/ch4mpy/spring-addons/blob/master/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java) is in the source and Javadoc, but here is an idea of the auto configured beans.
-
-### 3.1. AddonsSecurityBeans
-Provides with an `authoritiesConverter` which is an instance of `ConfigurableClaimSet2AuthoritiesConverter`. This bean is configured with application properties and is able to map spring-security authorities from any claims with prefix and case transformation defined for each claim.
-
-### 3.2. AddonsWebSecurityBeans
-Provides with a (non conditional) security filter-chain as well as (conditional) defaults for all the beans required to configure it:
-- `springAddonsResourceServerSecurityFilterChain`: applies CORS, CSRF, anonymous, sessionCreationPolicy, SSL, redirect and 401 instead of redirect to login as defined in [`SpringAddonsSecurityProperties`](https://github.com/ch4mpy/spring-addons/blob/master/spring-addons-oauth2/src/main/java/com/c4_soft/springaddons/security/oauth2/config/SpringAddonsSecurityProperties.java)
-- `authorizePostProcessor`: a bean of type `ExpressionInterceptUrlRegistryPostProcessor` to fine tune access control from java configuration. It applies to all routes not listed in "permit-all" property configuration. Default requires users to be authenticated. **This is a bean to provide in your application configuration if you prefer to define fine-grained access control rules with Java configuration rather than methods security.**
-- `httpPostProcessor`: a bean of type `HttpSecurityPostProcessor` to override anything from above auto-configuration. It is called just before the security filter-chain is returned. Default is a no-op.
-- `jwtAuthenticationConverter`: a converter from a `Jwt` to something inheriting from `AbstractAuthenticationToken`. The default instantiate a `JwtAuthenticationToken` with username and authorities as configured for the issuer of thi token. The easiest to override the type of `AbstractAuthenticationToken`, is to provide with a `Converter` bean.
-- `authenticationManagerResolver`: to accept identities issued by more than a single OP, the recommended way is to provide an `JwtIssuerAuthenticationManagerResolver` supporting it. Default keeps a `JwtAuthenticationProvider` with its own `JwtDecoder` for each issuer.
diff --git a/webmvc/spring-addons-webmvc-jwt-resource-server/license.txt b/webmvc/spring-addons-webmvc-jwt-resource-server/license.txt
deleted file mode 100644
index 20e4bd856..000000000
--- a/webmvc/spring-addons-webmvc-jwt-resource-server/license.txt
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- https://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright [yyyy] [name of copyright owner]
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
diff --git a/webmvc/spring-addons-webmvc-jwt-resource-server/lombok.config b/webmvc/spring-addons-webmvc-jwt-resource-server/lombok.config
deleted file mode 100644
index 8f7e8aa1a..000000000
--- a/webmvc/spring-addons-webmvc-jwt-resource-server/lombok.config
+++ /dev/null
@@ -1 +0,0 @@
-lombok.addLombokGeneratedAnnotation = true
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-jwt-resource-server/pom.xml b/webmvc/spring-addons-webmvc-jwt-resource-server/pom.xml
deleted file mode 100644
index 200c4da64..000000000
--- a/webmvc/spring-addons-webmvc-jwt-resource-server/pom.xml
+++ /dev/null
@@ -1,51 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc-jwt-resource-server
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-core
-
-
-
- org.springframework.boot
- spring-boot-autoconfigure
- true
-
-
- org.springframework.security
- spring-security-config
-
-
- org.springframework.boot
- spring-boot
-
-
- org.springframework.boot
- spring-boot-starter-webflux
-
-
-
- org.projectlombok
- lombok
- provided
-
-
-
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java b/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java
deleted file mode 100644
index 6c6ec874f..000000000
--- a/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/java/com/c4_soft/springaddons/security/oauth2/config/synchronised/AddonsSecurityBeans.java
+++ /dev/null
@@ -1,64 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.config.synchronised;
-
-import java.util.Collection;
-import java.util.Map;
-
-import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Import;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
-
-import com.c4_soft.springaddons.security.oauth2.OpenidClaimSet;
-import com.c4_soft.springaddons.security.oauth2.config.ClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.ConfigurableClaimSetAuthoritiesConverter;
-import com.c4_soft.springaddons.security.oauth2.config.JwtAbstractAuthenticationTokenConverter;
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * @author Jerome Wacongne ch4mp@c4-soft.com
- */
-@AutoConfiguration
-@Slf4j
-@Import({ SpringAddonsSecurityProperties.class })
-public class AddonsSecurityBeans {
-
- /**
- * Retrieves granted authorities from the Jwt (from its private claims or with the help of an external service)
- *
- * @param securityProperties
- * @return
- */
- @ConditionalOnMissingBean
- @Bean
- ClaimSetAuthoritiesConverter authoritiesConverter(SpringAddonsSecurityProperties addonsProperties) {
- log.debug("Building default SimpleJwtGrantedAuthoritiesConverter with: {}", addonsProperties);
- return new ConfigurableClaimSetAuthoritiesConverter(addonsProperties);
- }
-
- /**
- * Converter bean from {@link Jwt} to {@link AbstractAuthenticationToken}
- *
- * @param authoritiesConverter converts access-token claims into Spring authorities
- * @param securityProperties Spring "spring.security" configuration properties
- * @param authenticationFactory builds an {@link Authentication} instance from access-token string and claims
- * @return a converter from {@link Jwt} to {@link AbstractAuthenticationToken}
- */
- @ConditionalOnMissingBean
- @Bean
- JwtAbstractAuthenticationTokenConverter jwtAuthenticationConverter(
- Converter, Collection> authoritiesConverter,
- SpringAddonsSecurityProperties addonsProperties) {
- return jwt -> new JwtAuthenticationToken(
- jwt,
- authoritiesConverter.convert(jwt.getClaims()),
- new OpenidClaimSet(jwt.getClaims(), addonsProperties.getIssuerProperties(jwt.getIssuer()).getUsernameClaim()).getName());
- }
-}
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index a419f7ff5..000000000
--- a/webmvc/spring-addons-webmvc-jwt-resource-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1,2 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsSecurityBeans
-com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsWebSecurityBeans
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-jwt-test/pom.xml b/webmvc/spring-addons-webmvc-jwt-test/pom.xml
deleted file mode 100644
index 14cbf86d5..000000000
--- a/webmvc/spring-addons-webmvc-jwt-test/pom.xml
+++ /dev/null
@@ -1,65 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc-jwt-test
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- org.springframework.security
- spring-security-config
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-jwt-resource-server
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-client
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-test
-
-
- org.springframework
- spring-webmvc
-
-
- org.projectlombok
- lombok
- true
- provided
-
-
- org.junit.jupiter
- junit-jupiter-api
- true
-
-
-
- junit
- junit
- test
-
-
- org.assertj
- assertj-core
- test
-
-
-
diff --git a/webmvc/spring-addons-webmvc-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webmvc/jwt/AutoConfigureAddonsSecurity.java b/webmvc/spring-addons-webmvc-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webmvc/jwt/AutoConfigureAddonsSecurity.java
deleted file mode 100644
index f67f95345..000000000
--- a/webmvc/spring-addons-webmvc-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webmvc/jwt/AutoConfigureAddonsSecurity.java
+++ /dev/null
@@ -1,32 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.webmvc.jwt;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.junit.jupiter.api.TestInstance;
-import org.junit.jupiter.api.TestInstance.Lifecycle;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.test.context.junit.jupiter.SpringExtension;
-
-import com.c4_soft.springaddons.security.oauth2.config.SpringAddonsSecurityProperties;
-import com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.test.mockmvc.AuthenticationFactoriesTestConf;
-
-/**
- *
- * To be used to test services or repositories but not controllers: auto-configures {@link AddonsSecurityBeans} only
- *
- * See {@link AutoConfigureAddonsWebSecurity}
- *
- * @author Jérôme Wacongne <ch4mp#64;c4-soft.com>
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@ImportAutoConfiguration({ SpringAddonsSecurityProperties.class, AddonsSecurityBeans.class, AuthenticationFactoriesTestConf.class })
-@ExtendWith(SpringExtension.class)
-@TestInstance(Lifecycle.PER_CLASS)
-public @interface AutoConfigureAddonsSecurity {
-}
diff --git a/webmvc/spring-addons-webmvc-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webmvc/jwt/AutoConfigureAddonsWebSecurity.java b/webmvc/spring-addons-webmvc-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webmvc/jwt/AutoConfigureAddonsWebSecurity.java
deleted file mode 100644
index 64c32f710..000000000
--- a/webmvc/spring-addons-webmvc-jwt-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/webmvc/jwt/AutoConfigureAddonsWebSecurity.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.webmvc.jwt;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-
-import com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.config.synchronised.AddonsWebSecurityBeans;
-import com.c4_soft.springaddons.security.oauth2.config.synchronised.SpringAddonsOAuth2ClientBeans;
-import com.c4_soft.springaddons.security.oauth2.test.mockmvc.AddonsWebmvcTestConf;
-
-/**
- *
- * Auto-configures {@link AddonsSecurityBeans} and {@link AddonsWebSecurityBeans}. To be used to test controllers but not services or repositories (web context
- * is not desired in that case).
- *
- * See {@link AutoConfigureAddonsSecurity}
- *
- * @author Jérôme Wacongne <ch4mp#64;c4-soft.com>
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@AutoConfigureAddonsSecurity
-@ImportAutoConfiguration({ AddonsWebSecurityBeans.class, SpringAddonsOAuth2ClientBeans.class, AddonsWebmvcTestConf.class })
-public @interface AutoConfigureAddonsWebSecurity {
-}
diff --git a/webmvc/spring-addons-webmvc-test/README.MD b/webmvc/spring-addons-webmvc-test/README.MD
deleted file mode 100644
index 3fd6ff528..000000000
--- a/webmvc/spring-addons-webmvc-test/README.MD
+++ /dev/null
@@ -1,79 +0,0 @@
-# spring-addons-webmvc-test
-
-Set of tools I find useful to test Spring servlet web apps (webmvc).
-
-```xml
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-test
- ${com.c4-soft.springaddons.version}
- test
-
-
-```
-
-## Sample applications
-
-I put quite a few spring-boot app samples. To keep jar small, it is under `src/test` folders but can still be run / debug from within your favorite IDE.
-
-I recommand you clone my repo and debug the samples with a REST client like Postman, so that you can hack the config and tests.
-Adapting the samples to your Keycloak instance should be just a matter of editing `application.properties`.
-
-**Caveat** do not narrow your exploration to `keycloak` sample just beacause you are using a Keycloak authorization-server:
-I run all samples against a Keycloak instance.
-
-You should have a look at other samples too which might be simpler, not pulling Keycloak dependencies and more flexible.
-
-Last, `*RetrievingAuthoritiesFromDatabase` samples retrieve authorities from a DB instead of extracting it from JWT claims. The key in the DB is the user "subject".
-In that case, Keycloak authorisation-server is responsible for ensuring user ID only, authorities are the responsibility of the resource-server.
-As a consequence, (to run only, not in unit-tests) those samples expect a database to be accessible and populated, which I can't do for you
-as I can't know the "subject" claims for your test users registered in your Keycloak instance.
-
-## `MockMvc` post-processors
-
-I propose a few classes implementing `RequestPostProcessor` to use with `MockMvc`:
-
-- `MockAuthenticationRequestPostProcessor` to use a Mockito mock of an `Authentication` descendent of your choice (any type implementing `Authentication`)
-- `OidcIdAuthenticationRequestPostProcessor` to have `TestSecurityContext` populated with an ... `OidcIdAuthenticationToken`
-- `KeycloakAuthRequestPostProcessor` to have `TestSecurityContext` populated with a ... `KeycloakAuthenticationToken`
-
-```java
-import static com.c4_soft.springaddons.security.oauth2.test.mockmvc.OidcIdAuthenticationRequestPostProcessor.mockOidcId;
-
-@Test
-public void givenUserIsCh4mpy_whenGetGreet_thenOk() throws Exception {
- mockMvc.with(ch4mpy())
- .get("/greet")
- .andExpect(content().string("Hello Ch4mpy! You are granted with [ROLE_AUTHORIZED_PERSONNEL]."));
-}
-
-private OidcIdAuthenticationRequestPostProcessor ch4mpy() {
- return mockOidcId().token(oidcId -> oidcId.preferredUsername("Ch4mpy"))
- .authorities("ROLE_AUTHORIZED_PERSONNEL");
-}
-```
-
-again, browse the test sources for more samples, there are quite a few there.
-
-## `WebTestClientSupport`
-
-A wrapper for `MockMvcSupport` providing with configurable default charset and media-type, payloads serialization using `SerializationHelper` and shortcuts for most requests.
-`SerializationHelper` scans for registered `HttpMessageConverters` and then serializes payloads according to media-type and charset you specified, configured with below properties, or using defaults
-
-Configuration properties are:
-
-- `com.c4-soft.springaddons.test.web.default-charset` defaulted to `utf-8`
-- `com.c4-soft.springaddons.test.web.default-media-type` defaulted to `application+json`
-
-```java
-mockMvc.perform(get("/greet").accept(MediaType.APPLICATION_JSON).header("Accept-Encoding", "UTF-8"))
-```
-
-becomes
-
-```java
-mockMvc.get("/greet")
-```
-
-To use it, you can for instance `@Import(MockMvcSupport.class)`, scan for components in `com.c4_soft.springaddons.security.oauth2.test.mockmvc` package, add `MockMvcSupport.class` to `@ContextConfiguration` classes, etc. (has to be instantiated by Spring for config properties to be parsed / defaulted)
diff --git a/webmvc/spring-addons-webmvc-test/pom.xml b/webmvc/spring-addons-webmvc-test/pom.xml
deleted file mode 100644
index 995593ea2..000000000
--- a/webmvc/spring-addons-webmvc-test/pom.xml
+++ /dev/null
@@ -1,74 +0,0 @@
-
-
- 4.0.0
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc
- 6.2.1-SNAPSHOT
- ..
-
- spring-addons-webmvc-test
-
- https://github.com/ch4mpy/spring-addons/
-
- scm:git:git://github.com/ch4mpy/spring-addons.git
- scm:git:git@github.com:ch4mpy/spring-addons.git
- https://github.com/ch4mpy/spring-addons
- spring-addons-6.1.14
-
-
-
-
- org.springframework.boot
- spring-boot-starter-web
-
-
- org.springframework.security
- spring-security-config
-
-
- org.springframework.security
- spring-security-oauth2-client
-
-
- com.c4-soft.springaddons
- spring-addons-webmvc-core
-
-
- com.c4-soft.springaddons
- spring-addons-oauth2-test
-
-
- com.c4-soft.springaddons
- spring-addons-web-test
-
-
- org.springframework
- spring-webmvc
-
-
- org.projectlombok
- lombok
- true
- provided
-
-
-
- org.springframework.boot
- spring-boot-configuration-processor
- true
-
-
-
- junit
- junit
- test
-
-
- org.assertj
- assertj-core
- test
-
-
-
diff --git a/webmvc/spring-addons-webmvc-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/AuthenticationFactoriesTestConf.java b/webmvc/spring-addons-webmvc-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/AuthenticationFactoriesTestConf.java
deleted file mode 100644
index a5d70be3d..000000000
--- a/webmvc/spring-addons-webmvc-test/src/main/java/com/c4_soft/springaddons/security/oauth2/test/mockmvc/AuthenticationFactoriesTestConf.java
+++ /dev/null
@@ -1,27 +0,0 @@
-package com.c4_soft.springaddons.security.oauth2.test.mockmvc;
-
-import java.util.Optional;
-
-import org.springframework.boot.test.context.TestConfiguration;
-import org.springframework.context.annotation.Bean;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenAuthenticationConverter;
-
-import com.c4_soft.springaddons.security.oauth2.test.annotations.WithJwt;
-import com.c4_soft.springaddons.security.oauth2.test.annotations.WithOpaqueToken;
-
-@TestConfiguration
-public class AuthenticationFactoriesTestConf {
-
- @Bean
- WithJwt.AuthenticationFactory jwtAuthFactory(Optional> jwtAuthenticationConverter) {
- return new WithJwt.AuthenticationFactory(jwtAuthenticationConverter, Optional.empty());
- }
-
- @Bean
- WithOpaqueToken.AuthenticationFactory opaquetokenAuthFactory(Optional authenticationConverter) {
- return new WithOpaqueToken.AuthenticationFactory(authenticationConverter, Optional.empty());
- }
-}
diff --git a/webmvc/spring-addons-webmvc-test/src/main/resources/META-INF/additional-spring-configuration-metadata.json b/webmvc/spring-addons-webmvc-test/src/main/resources/META-INF/additional-spring-configuration-metadata.json
deleted file mode 100644
index 5597c50e3..000000000
--- a/webmvc/spring-addons-webmvc-test/src/main/resources/META-INF/additional-spring-configuration-metadata.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
- "properties": [
- {
- "name": "com.c4-soft.springaddons.test.web.default-charset",
- "type": "java.lang.String",
- "sourceType": "com.c4_soft.springaddons.security.oauth2.test.mockmvc.MockMvcSupport$MockMvcProperties",
- "defaultValue": "utf-8",
- "description": "Default charset for requests issued with MockMvcSupport"
- },
- {
- "name": "com.c4-soft.springaddons.test.web.default-media-type",
- "type": "java.lang.String",
- "sourceType": "com.c4_soft.springaddons.security.oauth2.test.mockmvc.MockMvcSupport$MockMvcProperties",
- "defaultValue": "application\/json",
- "description": "Default media-type for requests issued with MockMvcSupport"
- }
- ]}
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-test/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/webmvc/spring-addons-webmvc-test/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
deleted file mode 100644
index 9f253b2b7..000000000
--- a/webmvc/spring-addons-webmvc-test/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ /dev/null
@@ -1 +0,0 @@
-com.c4_soft.springaddons.security.oauth2.test.mockmvc.MockMvcProperties
\ No newline at end of file
diff --git a/webmvc/spring-addons-webmvc-test/src/main/resources/mockito-extensions/org.mockito.plugins.MockMaker b/webmvc/spring-addons-webmvc-test/src/main/resources/mockito-extensions/org.mockito.plugins.MockMaker
deleted file mode 100644
index ca6ee9cea..000000000
--- a/webmvc/spring-addons-webmvc-test/src/main/resources/mockito-extensions/org.mockito.plugins.MockMaker
+++ /dev/null
@@ -1 +0,0 @@
-mock-maker-inline
\ No newline at end of file