forked from operaton/operaton
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(run): add oauth2 identity provider (#4570)
related to camunda/camunda-bpm-platform#4453 Backported commit a485ee9828 from the camunda-bpm-platform repository. Original author: Daniel Kelemen <[email protected]>
- Loading branch information
1 parent
45aa0a7
commit 002a043
Showing
6 changed files
with
649 additions
and
3 deletions.
There are no files selected for viewing
81 changes: 81 additions & 0 deletions
81
.../src/main/java/org/operaton/bpm/spring/boot/starter/security/oauth2/OAuth2Properties.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| /* | ||
| * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH | ||
| * under one or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information regarding copyright | ||
| * ownership. Camunda licenses this file to you under the Apache License, | ||
| * Version 2.0; you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.operaton.bpm.spring.boot.starter.security.oauth2; | ||
|
|
||
| import org.operaton.bpm.spring.boot.starter.security.oauth2.impl.OAuth2IdentityProvider; | ||
| import org.operaton.bpm.spring.boot.starter.property.OperatonBpmProperties; | ||
| import org.springframework.boot.context.properties.ConfigurationProperties; | ||
|
|
||
| @ConfigurationProperties(OAuth2Properties.PREFIX) | ||
| public class OAuth2Properties { | ||
|
|
||
| public static final String PREFIX = OperatonBpmProperties.PREFIX + ".oauth2"; | ||
|
|
||
| /** | ||
| * OAuth2 identity provider properties. | ||
| */ | ||
| private OAuth2IdentityProviderProperties identityProvider; | ||
|
|
||
| public static class OAuth2IdentityProviderProperties { | ||
| /** | ||
| * Enable {@link OAuth2IdentityProvider}. | ||
| */ | ||
| private boolean enabled = false; | ||
|
|
||
| /** | ||
| * Name of the attribute (claim) that holds the groups. | ||
| */ | ||
| private String groupNameAttribute; | ||
|
|
||
| /** | ||
| * Group name attribute delimiter. Only used if the {@link #groupNameAttribute} is a {@link String}. | ||
| */ | ||
| private String groupNameDelimiter = ","; | ||
|
|
||
| public boolean isEnabled() { | ||
| return enabled; | ||
| } | ||
|
|
||
| public void setEnabled(boolean enabled) { | ||
| this.enabled = enabled; | ||
| } | ||
|
|
||
| public String getGroupNameAttribute() { | ||
| return groupNameAttribute; | ||
| } | ||
|
|
||
| public void setGroupNameAttribute(String groupNameAttribute) { | ||
| this.groupNameAttribute = groupNameAttribute; | ||
| } | ||
|
|
||
| public String getGroupNameDelimiter() { | ||
| return groupNameDelimiter; | ||
| } | ||
|
|
||
| public void setGroupNameDelimiter(String groupNameDelimiter) { | ||
| this.groupNameDelimiter = groupNameDelimiter; | ||
| } | ||
| } | ||
|
|
||
| public OAuth2IdentityProviderProperties getIdentityProvider() { | ||
| return identityProvider; | ||
| } | ||
|
|
||
| public void setIdentityProvider(OAuth2IdentityProviderProperties identityProvider) { | ||
| this.identityProvider = identityProvider; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
83 changes: 83 additions & 0 deletions
83
...operaton/bpm/spring/boot/starter/security/oauth2/impl/OAuth2GrantedAuthoritiesMapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| /* | ||
| * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH | ||
| * under one or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information regarding copyright | ||
| * ownership. Camunda licenses this file to you under the Apache License, | ||
| * Version 2.0; you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.operaton.bpm.spring.boot.starter.security.oauth2.impl; | ||
|
|
||
| import org.operaton.bpm.spring.boot.starter.security.oauth2.OAuth2Properties; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.security.core.GrantedAuthority; | ||
| import org.springframework.security.core.authority.SimpleGrantedAuthority; | ||
| import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper; | ||
| import org.springframework.security.oauth2.core.user.OAuth2UserAuthority; | ||
|
|
||
| import java.util.Arrays; | ||
| import java.util.Collection; | ||
| import java.util.HashSet; | ||
| import java.util.Set; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| public class OAuth2GrantedAuthoritiesMapper implements GrantedAuthoritiesMapper { | ||
|
|
||
| private static final Logger logger = LoggerFactory.getLogger(OAuth2GrantedAuthoritiesMapper.class); | ||
| private final OAuth2Properties oAuth2Properties; | ||
|
|
||
| public OAuth2GrantedAuthoritiesMapper(OAuth2Properties oAuth2Properties) { | ||
| this.oAuth2Properties = oAuth2Properties; | ||
| } | ||
|
|
||
| @Override | ||
| public Collection<? extends GrantedAuthority> mapAuthorities(Collection<? extends GrantedAuthority> authorities) { | ||
| var identityProviderProperties = oAuth2Properties.getIdentityProvider(); | ||
| var groupNameAttribute = identityProviderProperties.getGroupNameAttribute(); | ||
| Set<GrantedAuthority> mappedAuthorities = new HashSet<>(); | ||
|
|
||
| authorities.forEach(authority -> { | ||
| if (authority instanceof OAuth2UserAuthority) { | ||
| var oauth2UserAuthority = (OAuth2UserAuthority) authority; | ||
| Object groupAttribute = oauth2UserAuthority.getAttributes().get(groupNameAttribute); | ||
|
|
||
| if (groupAttribute == null) { | ||
| logger.debug("Attribute {} is not available", groupNameAttribute); | ||
| return; | ||
| } | ||
|
|
||
| if (groupAttribute instanceof Collection) { | ||
| //noinspection unchecked | ||
| Collection<String> groupsAttribute = (Collection<String>) groupAttribute; | ||
| var grantedAuthorities = groupsAttribute.stream() | ||
| .map(SimpleGrantedAuthority::new) | ||
| .collect(Collectors.toSet()); | ||
| mappedAuthorities.addAll(grantedAuthorities); | ||
| } else if (groupAttribute instanceof String) { | ||
| String groupNameDelimiter = identityProviderProperties.getGroupNameDelimiter(); | ||
| String groupsAttribute = (String) groupAttribute; | ||
|
|
||
| var grantedAuthorities = Arrays.stream(groupsAttribute.split(groupNameDelimiter)) | ||
| .map(SimpleGrantedAuthority::new) | ||
| .collect(Collectors.toSet()); | ||
| mappedAuthorities.addAll(grantedAuthorities); | ||
| } else { | ||
| logger.error("Could not map granted authorities, unsupported group attribute type: {}", groupAttribute.getClass()); | ||
| } | ||
| } | ||
| }); | ||
|
|
||
| logger.debug("Authorities mapped from {} to {}", authorities, mappedAuthorities); | ||
| return mappedAuthorities; | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.