fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful

This commit is contained in:
dmitriy.churmeev
2026-03-29 16:29:48 +03:00
parent eb61706091
commit 705d686bb2
3 changed files with 35 additions and 31 deletions

View File

@@ -1,4 +1,4 @@
package com.test.test package com.test
import org.springframework.boot.autoconfigure.SpringBootApplication import org.springframework.boot.autoconfigure.SpringBootApplication
import org.springframework.boot.runApplication import org.springframework.boot.runApplication

View File

@@ -1,5 +1,6 @@
package com.auth.config package com.test.auth.config
import org.slf4j.LoggerFactory
import org.springframework.context.annotation.Bean import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration import org.springframework.context.annotation.Configuration
import org.springframework.security.config.Customizer import org.springframework.security.config.Customizer
@@ -12,13 +13,16 @@ import org.springframework.security.config.http.SessionCreationPolicy
import org.springframework.security.core.authority.SimpleGrantedAuthority import org.springframework.security.core.authority.SimpleGrantedAuthority
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
import org.springframework.security.web.SecurityFilterChain import org.springframework.security.web.SecurityFilterChain
import org.springframework.core.convert.converter.Converter
import org.springframework.security.core.GrantedAuthority
import org.springframework.security.oauth2.jwt.Jwt
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableMethodSecurity @EnableMethodSecurity
class WebSecurityConfig { class WebSecurityConfig {
private val logger = org.slf4j.LoggerFactory.getLogger(WebSecurityConfig::class.java) private val logger = LoggerFactory.getLogger(WebSecurityConfig::class.java)
@Bean @Bean
@Throws(Exception::class) @Throws(Exception::class)
@@ -52,12 +56,13 @@ class WebSecurityConfig {
val converter = JwtAuthenticationConverter() val converter = JwtAuthenticationConverter()
converter.setJwtGrantedAuthoritiesConverter { jwt -> // 🔑 КЛЮЧЕВОЕ ИЗМЕНЕНИЕ: используем явный объект вместо лямбды
converter.setJwtGrantedAuthoritiesConverter(
Converter<Jwt, Collection<GrantedAuthority>> { jwt ->
logger.info("=== JWT Converter called for token ===") logger.info("=== JWT Converter called for token ===")
val roles = mutableSetOf<SimpleGrantedAuthority>() val roles = mutableSetOf<SimpleGrantedAuthority>()
// Извлекаем роли из resource_access.test_client.roles
val resourceAccess = jwt.claims["resource_access"] as? Map<*, *> val resourceAccess = jwt.claims["resource_access"] as? Map<*, *>
logger.info("resource_access: $resourceAccess") logger.info("resource_access: $resourceAccess")
@@ -69,7 +74,6 @@ class WebSecurityConfig {
roles.add(SimpleGrantedAuthority("ROLE_$role")) roles.add(SimpleGrantedAuthority("ROLE_$role"))
} }
// Альтернативно: можно также читать из realm_access.roles
val realmAccess = jwt.claims["realm_access"] as? Map<*, *> val realmAccess = jwt.claims["realm_access"] as? Map<*, *>
val realmRoles = realmAccess?.get("roles") as? List<*> val realmRoles = realmAccess?.get("roles") as? List<*>
@@ -81,12 +85,12 @@ class WebSecurityConfig {
logger.info("Final authorities: ${roles.map { it.authority }}") logger.info("Final authorities: ${roles.map { it.authority }}")
roles.toList() roles.toList()
} }
)
return converter return converter
} }
// // Конвертер JWT Authentication (извлекает роли из токена) // // Конвертер JWT Authentication (извлекает роли из токена)
// private fun jwtAuthenticationConverter(): JwtAuthenticationConverter { // private fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
// val converter = JwtAuthenticationConverter() // val converter = JwtAuthenticationConverter()

View File

@@ -1,6 +1,6 @@
package com.test.test.rest package com.test.rest
import com.auth.config.WebSecurityConfig import org.slf4j.LoggerFactory
import org.springframework.security.access.prepost.PreAuthorize import org.springframework.security.access.prepost.PreAuthorize
import org.springframework.security.core.Authentication import org.springframework.security.core.Authentication
import org.springframework.security.core.context.SecurityContextHolder import org.springframework.security.core.context.SecurityContextHolder
@@ -11,7 +11,7 @@ import org.springframework.web.bind.annotation.RestController
@RestController @RestController
open class TestController { open class TestController {
private val logger = org.slf4j.LoggerFactory.getLogger(TestController::class.java) private val logger = LoggerFactory.getLogger(TestController::class.java)
@PreAuthorize("hasRole('ADMIN')") @PreAuthorize("hasRole('ADMIN')")