From 05116c5aaf5d2df9655519d6a8aeee5ba69ea114 Mon Sep 17 00:00:00 2001
From: "dmitriy.churmeev" <dmitriy.churmeev@gmail.com>
Date: Sat, 28 Mar 2026 20:44:02 +0300
Subject: [PATCH] add security configuration

---
 build.gradle                                  |  5 +++
 .../com/auth/config/WebSecurityConfig.kt      | 35 +++++++++++++++++++
 .../com/test/test/rest/TestController.kt      | 11 ++++++
 src/main/resources/application.yaml           | 31 +++++++++++++---
 4 files changed, 77 insertions(+), 5 deletions(-)
 create mode 100644 src/main/kotlin/com/auth/config/WebSecurityConfig.kt

diff --git a/build.gradle b/build.gradle
index 8bf2c87..85ac6ec 100644
--- a/build.gradle
+++ b/build.gradle
@@ -28,11 +28,16 @@ dependencies {
 	implementation 'org.springframework.boot:spring-boot-starter-undertow'
 
 	implementation 'org.springframework.boot:spring-boot-starter-security'
+	implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
+	implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
+	//implementation 'org.keycloak:keycloak-spring-boot-starter'
 
 	implementation 'com.fasterxml.jackson.module:jackson-module-kotlin'
 	implementation 'org.jetbrains.kotlin:kotlin-reflect'
 	implementation("org.springframework.boot:spring-boot-starter-actuator:3.5.7")
 
+	//implementation 'org.keycloak.bom:keycloak-adapter-bom:25.0.6'
+
 	//implementation("org.springframework.boot:spring-boot-starter-data-jpa")
 	//implementation("org.flywaydb:flyway-database-postgresql:10.10.0")
 	//runtimeOnly("org.postgresql:postgresql")
diff --git a/src/main/kotlin/com/auth/config/WebSecurityConfig.kt b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
new file mode 100644
index 0000000..6fff8e7
--- /dev/null
+++ b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
@@ -0,0 +1,35 @@
+package com.auth.config
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.config.Customizer
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer
+import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer
+import org.springframework.security.web.SecurityFilterChain
+
+
+@Configuration
+@EnableWebSecurity
+class WebSecurityConfig () {
+
+    @Bean
+    @Throws(Exception::class)
+    fun filterChain(http: HttpSecurity): SecurityFilterChain? {
+        http
+            .authorizeHttpRequests(Customizer { auth -> auth
+                .requestMatchers("/", "/home").permitAll()
+                .anyRequest().authenticated()
+            })
+            .oauth2Login(Customizer { oauth2: OAuth2LoginConfigurer<HttpSecurity?>? ->
+                oauth2!!
+                    .defaultSuccessUrl("/dashboard", true)
+                    .loginPage("/oauth2/authorization/keycloak") } // Spring сам редиректит
+            ).logout(Customizer { logout: LogoutConfigurer<HttpSecurity?>? ->
+                logout!!
+                    .logoutSuccessUrl("/") })
+
+        return http.build()
+    }
+}
\ No newline at end of file
diff --git a/src/main/kotlin/com/test/test/rest/TestController.kt b/src/main/kotlin/com/test/test/rest/TestController.kt
index 3429037..f081bc6 100644
--- a/src/main/kotlin/com/test/test/rest/TestController.kt
+++ b/src/main/kotlin/com/test/test/rest/TestController.kt
@@ -1,8 +1,12 @@
 package com.test.test.rest
 
+import org.springframework.security.access.prepost.PreAuthorize
+import org.springframework.security.core.Authentication
+import org.springframework.security.core.context.SecurityContextHolder
 import org.springframework.web.bind.annotation.GetMapping
 import org.springframework.web.bind.annotation.RestController
 
+
 @RestController
 class TestController {
 
@@ -11,6 +15,7 @@ class TestController {
         return "Test page"
     }
 
+    @PreAuthorize("hasRole('USER')")
     @GetMapping("/users")
     fun users(): ArrayList<String> {
         return ArrayList()
@@ -20,4 +25,10 @@ class TestController {
     fun home(): String {
         return "Home page"
     }
+
+    @GetMapping("/me")
+    fun getMe(): Any {
+        val authentication: Authentication = SecurityContextHolder.getContext().getAuthentication()
+        return authentication.getName()
+    }
 }
\ No newline at end of file
diff --git a/src/main/resources/application.yaml b/src/main/resources/application.yaml
index 090e417..850f99a 100644
--- a/src/main/resources/application.yaml
+++ b/src/main/resources/application.yaml
@@ -4,10 +4,10 @@ spring:
   application:
    name: app
 
-  security:
-    user:
-      name: admin
-      password: pass
+#  security:
+#    user:
+#      name: admin
+#      password: pass
 
   # Datasource
   datasource:
@@ -27,8 +27,29 @@ spring:
     database: postgresql
     database-platform: org.hibernate.dialect.PostgreSQLDialect
 
+  # Keycloak Security
+  security:
+    oauth2:
+      client:
+        registration:
+          keycloak:
+            client-id: test_client
+            client-secret: jyO0RTH9dzPaschkpfjzwZ6WprTlMPZ6
+           # scope: openid,profile,email
+            redirect-uri: http://app.dmitriy-churmeev.tech
+        provider:
+          keycloak:
+            issuer-uri: https://keycloak.dmitriy-churmeev.tech/realms/test_realm
+
+
   # Flyway
   flyway:
     enabled: true
     locations: classpath:db/migration
-    baseline-on-migrate: true
\ No newline at end of file
+    baseline-on-migrate: true
+
+#keycloak:
+#  auth-server-url: http://keycloak.dmitriy-churmeev.tech/auth
+#  realm: test_realm
+#  resource: test_client
+#  public-client: true
\ No newline at end of file