fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
This commit is contained in:
@@ -1,4 +1,4 @@
|
|||||||
package com.test.test
|
package com.test
|
||||||
|
|
||||||
import org.springframework.boot.autoconfigure.SpringBootApplication
|
import org.springframework.boot.autoconfigure.SpringBootApplication
|
||||||
import org.springframework.boot.runApplication
|
import org.springframework.boot.runApplication
|
||||||
@@ -1,5 +1,6 @@
|
|||||||
package com.auth.config
|
package com.test.auth.config
|
||||||
|
|
||||||
|
import org.slf4j.LoggerFactory
|
||||||
import org.springframework.context.annotation.Bean
|
import org.springframework.context.annotation.Bean
|
||||||
import org.springframework.context.annotation.Configuration
|
import org.springframework.context.annotation.Configuration
|
||||||
import org.springframework.security.config.Customizer
|
import org.springframework.security.config.Customizer
|
||||||
@@ -12,13 +13,16 @@ import org.springframework.security.config.http.SessionCreationPolicy
|
|||||||
import org.springframework.security.core.authority.SimpleGrantedAuthority
|
import org.springframework.security.core.authority.SimpleGrantedAuthority
|
||||||
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
|
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
|
||||||
import org.springframework.security.web.SecurityFilterChain
|
import org.springframework.security.web.SecurityFilterChain
|
||||||
|
import org.springframework.core.convert.converter.Converter
|
||||||
|
import org.springframework.security.core.GrantedAuthority
|
||||||
|
import org.springframework.security.oauth2.jwt.Jwt
|
||||||
|
|
||||||
@Configuration
|
@Configuration
|
||||||
@EnableWebSecurity
|
@EnableWebSecurity
|
||||||
@EnableMethodSecurity
|
@EnableMethodSecurity
|
||||||
class WebSecurityConfig {
|
class WebSecurityConfig {
|
||||||
|
|
||||||
private val logger = org.slf4j.LoggerFactory.getLogger(WebSecurityConfig::class.java)
|
private val logger = LoggerFactory.getLogger(WebSecurityConfig::class.java)
|
||||||
|
|
||||||
@Bean
|
@Bean
|
||||||
@Throws(Exception::class)
|
@Throws(Exception::class)
|
||||||
@@ -52,12 +56,13 @@ class WebSecurityConfig {
|
|||||||
|
|
||||||
val converter = JwtAuthenticationConverter()
|
val converter = JwtAuthenticationConverter()
|
||||||
|
|
||||||
converter.setJwtGrantedAuthoritiesConverter { jwt ->
|
// 🔑 КЛЮЧЕВОЕ ИЗМЕНЕНИЕ: используем явный объект вместо лямбды
|
||||||
|
converter.setJwtGrantedAuthoritiesConverter(
|
||||||
|
Converter<Jwt, Collection<GrantedAuthority>> { jwt ->
|
||||||
logger.info("=== JWT Converter called for token ===")
|
logger.info("=== JWT Converter called for token ===")
|
||||||
|
|
||||||
val roles = mutableSetOf<SimpleGrantedAuthority>()
|
val roles = mutableSetOf<SimpleGrantedAuthority>()
|
||||||
|
|
||||||
// Извлекаем роли из resource_access.test_client.roles
|
|
||||||
val resourceAccess = jwt.claims["resource_access"] as? Map<*, *>
|
val resourceAccess = jwt.claims["resource_access"] as? Map<*, *>
|
||||||
logger.info("resource_access: $resourceAccess")
|
logger.info("resource_access: $resourceAccess")
|
||||||
|
|
||||||
@@ -69,7 +74,6 @@ class WebSecurityConfig {
|
|||||||
roles.add(SimpleGrantedAuthority("ROLE_$role"))
|
roles.add(SimpleGrantedAuthority("ROLE_$role"))
|
||||||
}
|
}
|
||||||
|
|
||||||
// Альтернативно: можно также читать из realm_access.roles
|
|
||||||
val realmAccess = jwt.claims["realm_access"] as? Map<*, *>
|
val realmAccess = jwt.claims["realm_access"] as? Map<*, *>
|
||||||
val realmRoles = realmAccess?.get("roles") as? List<*>
|
val realmRoles = realmAccess?.get("roles") as? List<*>
|
||||||
|
|
||||||
@@ -81,12 +85,12 @@ class WebSecurityConfig {
|
|||||||
logger.info("Final authorities: ${roles.map { it.authority }}")
|
logger.info("Final authorities: ${roles.map { it.authority }}")
|
||||||
roles.toList()
|
roles.toList()
|
||||||
}
|
}
|
||||||
|
)
|
||||||
|
|
||||||
return converter
|
return converter
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
// // Конвертер JWT Authentication (извлекает роли из токена)
|
// // Конвертер JWT Authentication (извлекает роли из токена)
|
||||||
// private fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
|
// private fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
|
||||||
// val converter = JwtAuthenticationConverter()
|
// val converter = JwtAuthenticationConverter()
|
||||||
@@ -1,6 +1,6 @@
|
|||||||
package com.test.test.rest
|
package com.test.rest
|
||||||
|
|
||||||
import com.auth.config.WebSecurityConfig
|
import org.slf4j.LoggerFactory
|
||||||
import org.springframework.security.access.prepost.PreAuthorize
|
import org.springframework.security.access.prepost.PreAuthorize
|
||||||
import org.springframework.security.core.Authentication
|
import org.springframework.security.core.Authentication
|
||||||
import org.springframework.security.core.context.SecurityContextHolder
|
import org.springframework.security.core.context.SecurityContextHolder
|
||||||
@@ -11,7 +11,7 @@ import org.springframework.web.bind.annotation.RestController
|
|||||||
@RestController
|
@RestController
|
||||||
open class TestController {
|
open class TestController {
|
||||||
|
|
||||||
private val logger = org.slf4j.LoggerFactory.getLogger(TestController::class.java)
|
private val logger = LoggerFactory.getLogger(TestController::class.java)
|
||||||
|
|
||||||
|
|
||||||
@PreAuthorize("hasRole('ADMIN')")
|
@PreAuthorize("hasRole('ADMIN')")
|
||||||
Reference in New Issue
Block a user