-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #91 from FraunhoferISST/feat/security
Feat: Add API Key security
- Loading branch information
Showing
26 changed files
with
692 additions
and
293 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
67 changes: 67 additions & 0 deletions
67
backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/SecurityConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| /* | ||
| * Copyright (c) 2023 Volkswagen AG | ||
| * Copyright (c) 2023 Contributors to the Eclipse Foundation | ||
| * | ||
| * See the NOTICE file(s) distributed with this work for additional | ||
| * information regarding copyright ownership. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0. | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations | ||
| * under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.eclipse.tractusx.puris.backend.common.security; | ||
|
|
||
|
|
||
| import lombok.AllArgsConstructor; | ||
| import org.eclipse.tractusx.puris.backend.common.security.logic.ApiKeyAuthenticationFilter; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.security.config.Customizer; | ||
| import org.springframework.security.config.annotation.web.builders.HttpSecurity; | ||
| import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; | ||
| import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; | ||
| import org.springframework.security.config.http.SessionCreationPolicy; | ||
| import org.springframework.security.web.SecurityFilterChain; | ||
| import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; | ||
|
|
||
| @Configuration | ||
| @EnableWebSecurity | ||
| @AllArgsConstructor | ||
| public class SecurityConfig { | ||
|
|
||
| private final ApiKeyAuthenticationFilter apiKeyAuthenticationFilter; | ||
|
|
||
| /** | ||
| * Configuration of API Key Authentication for all routes except docker | ||
| */ | ||
| @Bean | ||
| public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { | ||
| http.csrf(AbstractHttpConfigurer::disable) | ||
| .authorizeHttpRequests( | ||
| // any request in spring context | ||
| (authorizeHttpRequests) -> authorizeHttpRequests | ||
| .requestMatchers("/stockView/**", "/partners/**", "/materials/**", "/materialpartnerrelations/**", "/product-stock/**", "/edrendpoint/**").authenticated() | ||
| .requestMatchers("/swagger-ui/**", "/v3/api-docs/**").permitAll() | ||
| ) | ||
| .httpBasic( | ||
| AbstractHttpConfigurer::disable | ||
| ) | ||
| .sessionManagement( | ||
| (sessionManagement) -> sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS) | ||
| ) | ||
| .cors(Customizer.withDefaults()); | ||
|
|
||
| http.addFilterBefore(apiKeyAuthenticationFilter, UsernamePasswordAuthenticationFilter.class); | ||
|
|
||
| return http.build(); | ||
| } | ||
|
|
||
| } |
74 changes: 74 additions & 0 deletions
74
.../java/org/eclipse/tractusx/puris/backend/common/security/domain/ApiKeyAuthentication.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| /* | ||
| * Copyright (c) 2023 Volkswagen AG | ||
| * Copyright (c) 2023 Contributors to the Eclipse Foundation | ||
| * | ||
| * See the NOTICE file(s) distributed with this work for additional | ||
| * information regarding copyright ownership. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0. | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations | ||
| * under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.eclipse.tractusx.puris.backend.common.security.domain; | ||
|
|
||
| import lombok.AllArgsConstructor; | ||
| import lombok.Getter; | ||
| import lombok.Setter; | ||
| import org.springframework.security.core.Authentication; | ||
| import org.springframework.security.core.GrantedAuthority; | ||
|
|
||
| import java.util.Collection; | ||
|
|
||
| /** | ||
| * Authentication holding apiKey as principal and authenticated flag. No authorities given as the key is set per config. | ||
| */ | ||
| @Getter | ||
| @Setter | ||
| @AllArgsConstructor | ||
| public class ApiKeyAuthentication implements Authentication { | ||
|
|
||
| private final String apiKey; | ||
| private final boolean authenticatedFlag; | ||
| @Override | ||
| public Collection<? extends GrantedAuthority> getAuthorities() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public Object getCredentials() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public Object getDetails() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public Object getPrincipal() { | ||
| return apiKey; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isAuthenticated() { | ||
| return authenticatedFlag; | ||
| } | ||
|
|
||
| @Override | ||
| public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException { | ||
|
|
||
| } | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return null; | ||
| } | ||
| } |
56 changes: 56 additions & 0 deletions
56
.../org/eclipse/tractusx/puris/backend/common/security/logic/ApiKeyAuthenticationFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| /* | ||
| * Copyright (c) 2023 Volkswagen AG | ||
| * Copyright (c) 2023 Contributors to the Eclipse Foundation | ||
| * | ||
| * See the NOTICE file(s) distributed with this work for additional | ||
| * information regarding copyright ownership. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0. | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations | ||
| * under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.eclipse.tractusx.puris.backend.common.security.logic; | ||
|
|
||
| import jakarta.servlet.FilterChain; | ||
| import jakarta.servlet.ServletException; | ||
| import jakarta.servlet.http.HttpServletRequest; | ||
| import jakarta.servlet.http.HttpServletResponse; | ||
| import lombok.AllArgsConstructor; | ||
| import org.eclipse.tractusx.puris.backend.common.security.domain.ApiKeyAuthentication; | ||
| import org.springframework.security.core.Authentication; | ||
| import org.springframework.security.core.context.SecurityContextHolder; | ||
| import org.springframework.stereotype.Component; | ||
| import org.springframework.web.filter.OncePerRequestFilter; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| /** | ||
| * Authentication filter that checks if X-API-KEY header is given and set to value from config | ||
| */ | ||
| @Component | ||
| @AllArgsConstructor | ||
| public class ApiKeyAuthenticationFilter extends OncePerRequestFilter { | ||
|
|
||
| public final String API_KEY_HEADER = "X-API-KEY"; | ||
| private final ApiKeyAuthenticationProvider apiKeyAuthenticationProvider; | ||
| @Override | ||
| protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { | ||
| String headerKey = request.getHeader(API_KEY_HEADER); | ||
|
|
||
| if (headerKey != null){ | ||
| ApiKeyAuthentication apiKeyAuthentication = new ApiKeyAuthentication(headerKey, false); | ||
| Authentication authenticatedObject = apiKeyAuthenticationProvider.authenticate(apiKeyAuthentication); | ||
| SecurityContextHolder.getContext().setAuthentication(authenticatedObject); | ||
| } | ||
|
|
||
| filterChain.doFilter(request,response); | ||
| } | ||
| } |
Oops, something went wrong.