add security configuration

build.gradle

@@ -28,11 +28,16 @@ dependencies {
 	implementation 'org.springframework.boot:spring-boot-starter-undertow'
 
 	implementation 'org.springframework.boot:spring-boot-starter-security'
+	implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
+	implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
+	//implementation 'org.keycloak:keycloak-spring-boot-starter'
 
 	implementation 'com.fasterxml.jackson.module:jackson-module-kotlin'
 	implementation 'org.jetbrains.kotlin:kotlin-reflect'
 	implementation("org.springframework.boot:spring-boot-starter-actuator:3.5.7")
 
+	//implementation 'org.keycloak.bom:keycloak-adapter-bom:25.0.6'
+
 	//implementation("org.springframework.boot:spring-boot-starter-data-jpa")
 	//implementation("org.flywaydb:flyway-database-postgresql:10.10.0")
 	//runtimeOnly("org.postgresql:postgresql")

src/main/kotlin/com/auth/config/WebSecurityConfig.kt

@@ -0,0 +1,35 @@
+package com.auth.config
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.config.Customizer
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer
+import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer
+import org.springframework.security.web.SecurityFilterChain
+
+
+@Configuration
+@EnableWebSecurity
+class WebSecurityConfig () {
+
+    @Bean
+    @Throws(Exception::class)
+    fun filterChain(http: HttpSecurity): SecurityFilterChain? {
+        http
+            .authorizeHttpRequests(Customizer { auth -> auth
+                .requestMatchers("/", "/home").permitAll()
+                .anyRequest().authenticated()
+            })
+            .oauth2Login(Customizer { oauth2: OAuth2LoginConfigurer<HttpSecurity?>? ->
+                oauth2!!
+                    .defaultSuccessUrl("/dashboard", true)
+                    .loginPage("/oauth2/authorization/keycloak") } // Spring сам редиректит
+            ).logout(Customizer { logout: LogoutConfigurer<HttpSecurity?>? ->
+                logout!!
+                    .logoutSuccessUrl("/") })
+
+        return http.build()
+    }
+}

src/main/kotlin/com/test/test/rest/TestController.kt

@@ -1,8 +1,12 @@
 package com.test.test.rest
 
+import org.springframework.security.access.prepost.PreAuthorize
+import org.springframework.security.core.Authentication
+import org.springframework.security.core.context.SecurityContextHolder
 import org.springframework.web.bind.annotation.GetMapping
 import org.springframework.web.bind.annotation.RestController
 
+
 @RestController
 class TestController {
 
@@ -11,6 +15,7 @@ class TestController {
         return "Test page"
     }
 
+    @PreAuthorize("hasRole('USER')")
     @GetMapping("/users")
     fun users(): ArrayList<String> {
         return ArrayList()
@@ -20,4 +25,10 @@ class TestController {
     fun home(): String {
         return "Home page"
     }
+
+    @GetMapping("/me")
+    fun getMe(): Any {
+        val authentication: Authentication = SecurityContextHolder.getContext().getAuthentication()
+        return authentication.getName()
+    }
 }

src/main/resources/application.yaml

@@ -4,10 +4,10 @@ spring:
   application:
    name: app
 
-  security:
-    user:
-      name: admin
-      password: pass
+#  security:
+#    user:
+#      name: admin
+#      password: pass
 
   # Datasource
   datasource:
@@ -27,8 +27,29 @@ spring:
     database: postgresql
     database-platform: org.hibernate.dialect.PostgreSQLDialect
 
+  # Keycloak Security
+  security:
+    oauth2:
+      client:
+        registration:
+          keycloak:
+            client-id: test_client
+            client-secret: jyO0RTH9dzPaschkpfjzwZ6WprTlMPZ6
+           # scope: openid,profile,email
+            redirect-uri: http://app.dmitriy-churmeev.tech
+        provider:
+          keycloak:
+            issuer-uri: https://keycloak.dmitriy-churmeev.tech/realms/test_realm
+
+
   # Flyway
   flyway:
     enabled: true
     locations: classpath:db/migration
     baseline-on-migrate: true
+
+#keycloak:
+#  auth-server-url: http://keycloak.dmitriy-churmeev.tech/auth
+#  realm: test_realm
+#  resource: test_client
+#  public-client: true