ms/vlantag-api/src/main/java/org/onap/ccsdk/apps/ms/vlantagapi/core/ApplicationSecurityConfig.java

   1 /*******************************************************************************\r
   2  * Copyright © 2017-2018 AT&T Intellectual Property.\r
   3  * \r
   4  * Licensed under the Apache License, Version 2.0 (the "License");\r
   5  * you may not use this file except in compliance with the License.\r
   6  * You may obtain a copy of the License at\r
   7  * \r
   8  *     http://www.apache.org/licenses/LICENSE-2.0\r
   9  * \r
  10  * Unless required by applicable law or agreed to in writing, software\r
  11  * distributed under the License is distributed on an "AS IS" BASIS,\r
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  13  * See the License for the specific language governing permissions and\r
  14  * limitations under the License.\r
  15  ******************************************************************************/\r
  16 package org.onap.ccsdk.apps.ms.vlantagapi.core;\r
  17 \r
  18 import java.util.ArrayList;\r
  19 import java.util.Base64;\r
  20 import java.util.List;\r
  21 import org.slf4j.Logger;\r
  22 import org.slf4j.LoggerFactory;\r
  23 import org.springframework.beans.factory.annotation.Autowired;\r
  24 import org.springframework.context.annotation.Configuration;\r
  25 import org.springframework.core.env.Environment;\r
  26 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;\r
  27 import org.springframework.security.config.annotation.web.builders.HttpSecurity;\r
  28 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;\r
  29 import org.springframework.security.config.http.SessionCreationPolicy;\r
  30 import org.springframework.security.core.userdetails.User;\r
  31 import org.springframework.security.core.userdetails.UserDetails;\r
  32 import org.springframework.security.crypto.factory.PasswordEncoderFactories;\r
  33 import org.springframework.security.crypto.password.PasswordEncoder;\r
  34 import org.springframework.security.provisioning.InMemoryUserDetailsManager;\r
  35 \r
  36 /**\r
  37  * ApplicationSecurityConfig.java Purpose: Configures and validates\r
  38  * Application Security configurations\r
  39  * \r
  40  * @author Saurav Paira\r
  41  * @version 1.0\r
  42  */\r
  43 @Configuration\r
  44 public class ApplicationSecurityConfig extends WebSecurityConfigurerAdapter{\r
  45         private Logger logger = LoggerFactory.getLogger(ApplicationSecurityConfig.class);\r
  46          \r
  47         @Autowired\r
  48         private Environment environment;\r
  49 \r
  50         @Override\r
  51         protected void configure(AuthenticationManagerBuilder auth) throws Exception {\r
  52                 List<UserDetails> userDetails = new ArrayList<>();\r
  53                 \r
  54                 PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();\r
  55         final User.UserBuilder userBuilder = User.builder().passwordEncoder(encoder::encode);\r
  56 \r
  57                 String authString = environment.getProperty("application.authToken");\r
  58                 String[] tokens = authString.split(";");\r
  59                 for (int i = 0; i < tokens.length; i++) {\r
  60                         String token = tokens[i];\r
  61                         String[] cred = token.split("~"); \r
  62                         String[] uidpwdarr = decode(cred[0]);\r
  63                         logger.info("------uid/pwd ----------------{}, {}",uidpwdarr[0],uidpwdarr[1]);  \r
  64                         \r
  65                         UserDetails user = userBuilder\r
  66                     .username(uidpwdarr[0])\r
  67                     .password(uidpwdarr[1])\r
  68                     .roles(cred[1])\r
  69                     .build();\r
  70                         \r
  71                         userDetails.add(user);\r
  72                 }\r
  73                 \r
  74                 logger.info("-------------------------------{}",userDetails);\r
  75                 auth.userDetailsService(inMemoryUserDetailsManager(userDetails));\r
  76         }\r
  77         \r
  78     \r
  79     public InMemoryUserDetailsManager inMemoryUserDetailsManager(List<UserDetails> userDetails) {           \r
  80         return new InMemoryUserDetailsManager(userDetails);\r
  81     }\r
  82 \r
  83         @Override\r
  84         protected void configure(HttpSecurity http) throws Exception {\r
  85                 http.authorizeRequests().anyRequest().fullyAuthenticated();\r
  86             http.httpBasic().and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);\r
  87                 http.csrf().disable();\r
  88         }\r
  89         \r
  90     private static String[] decode(String encoded) {\r
  91         final byte[] decodedBytes \r
  92                 = Base64.getDecoder().decode(encoded.getBytes());\r
  93         final String pair = new String(decodedBytes);\r
  94         return pair.split(":", 2);\r
  95     }\r
  96 \r
  97 }\r