Fix for SO-2598

Change-Id: If2086de6cb635f39a03927be35fed9c177919211
Issue-ID: SO-2598
Signed-off-by: waqas.ikram <waqas.ikram@est.tech>
Making WebSecurityConfigurerAdapter configurable so that other
components can configure it per there requirement

Change-Id: I8f7674710ff41195946a710b86c7c8d7b52815f8
Signed-off-by: waqas.ikram <waqas.ikram@est.tech>

diff --git a/adapters/mso-vnfm-adapter/mso-vnfm-etsi-adapter/src/main/java/org/onap/so/adapters/vnfmadapter/VnfmBasicWebSecurityConfigurerAdapter.java b/adapters/mso-vnfm-adapter/mso-vnfm-etsi-adapter/src/main/java/org/onap/so/adapters/vnfmadapter/VnfmBasicHttpSecurityConfigurer.java
similarity index 66%
rename from adapters/mso-vnfm-adapter/mso-vnfm-etsi-adapter/src/main/java/org/onap/so/adapters/vnfmadapter/VnfmBasicWebSecurityConfigurerAdapter.java
rename to adapters/mso-vnfm-adapter/mso-vnfm-etsi-adapter/src/main/java/org/onap/so/adapters/vnfmadapter/VnfmBasicHttpSecurityConfigurer.java
index a540460..1e0a18a 100644 (file)
--- a/adapters/mso-vnfm-adapter/mso-vnfm-etsi-adapter/src/main/java/org/onap/so/adapters/vnfmadapter/VnfmBasicWebSecurityConfigurerAdapter.java
+++ b/adapters/mso-vnfm-adapter/mso-vnfm-etsi-adapter/src/main/java/org/onap/so/adapters/vnfmadapter/VnfmBasicHttpSecurityConfigurer.java
@@ -22,34 +22,41 @@
 
 package org.onap.so.adapters.vnfmadapter;
 
-import org.onap.so.security.SoBasicWebSecurityConfigurerAdapter;
+import org.onap.so.security.HttpSecurityConfigurer;
 import org.onap.so.security.SoUserCredentialConfiguration;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
 
 /**
  * @author Waqas Ikram (waqas.ikram@est.tech)
  * @author Gareth Roper (gareth.roper@est.tech)
  *
  */
-@EnableWebSecurity
-@Configuration
-public class VnfmBasicWebSecurityConfigurerAdapter extends SoBasicWebSecurityConfigurerAdapter {
+@Primary
+@Component
+public class VnfmBasicHttpSecurityConfigurer implements HttpSecurityConfigurer {
+
+    @Autowired
+    private SoUserCredentialConfiguration soUserCredentialConfiguration;
 
     @Value("${server.ssl.client-auth:none}")
     private String clientAuth;
-    SoUserCredentialConfiguration soUserCredentialConfiguration;
 
     @Override
-    protected void configure(final HttpSecurity http) throws Exception {
+    public void configure(final HttpSecurity http) throws Exception {
         if (("need").equalsIgnoreCase(clientAuth)) {
             http.csrf().disable().authorizeRequests().anyRequest().permitAll();
         } else {
-            super.configure(http);
-            http.authorizeRequests().antMatchers(HttpMethod.GET, "/etsi/subscription/notification").permitAll();
+            http.csrf().disable().authorizeRequests().antMatchers("/manage/health", "/manage/info").permitAll()
+                    .antMatchers(HttpMethod.GET, "/etsi/subscription/notification").permitAll().antMatchers("/**")
+                    .hasAnyRole(StringUtils.collectionToDelimitedString(soUserCredentialConfiguration.getRoles(), ","))
+                    .and().httpBasic();
+
         }
     }
 }

diff --git a/common/src/main/java/org/onap/so/security/HttpSecurityConfigurer.java b/common/src/main/java/org/onap/so/security/HttpSecurityConfigurer.java
new file mode 100644 (file)
index 0000000..ffd5931
--- /dev/null
+++ b/common/src/main/java/org/onap/so/security/HttpSecurityConfigurer.java
@@ -0,0 +1,32 @@
+/*-
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2020 Ericsson. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * 
+ * SPDX-License-Identifier: Apache-2.0
+ * ============LICENSE_END=========================================================
+ */
+package org.onap.so.security;
+
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+
+/**
+ * @author Waqas Ikram (waqas.ikram@est.tech)
+ *
+ */
+public interface HttpSecurityConfigurer {
+
+    void configure(final HttpSecurity http) throws Exception;
+
+}

diff --git a/common/src/main/java/org/onap/so/security/SoBasicHttpSecurityConfigurer.java b/common/src/main/java/org/onap/so/security/SoBasicHttpSecurityConfigurer.java
new file mode 100644 (file)
index 0000000..9aceb03
--- /dev/null
+++ b/common/src/main/java/org/onap/so/security/SoBasicHttpSecurityConfigurer.java
@@ -0,0 +1,45 @@
+/*-
+ * ============LICENSE_START=======================================================
+ *  Copyright (C) 2020 Nordix Foundation.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * 
+ * SPDX-License-Identifier: Apache-2.0
+ * ============LICENSE_END=========================================================
+ */
+package org.onap.so.security;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+
+/**
+ * @author Waqas Ikram (waqas.ikram@est.tech)
+ *
+ */
+@Component
+public class SoBasicHttpSecurityConfigurer implements HttpSecurityConfigurer {
+
+    @Autowired
+    private SoUserCredentialConfiguration soUserCredentialConfiguration;
+
+    @Override
+    public void configure(final HttpSecurity http) throws Exception {
+        http.csrf().disable().authorizeRequests().antMatchers("/manage/health", "/manage/info").permitAll()
+                .antMatchers("/**")
+                .hasAnyRole(StringUtils.collectionToDelimitedString(soUserCredentialConfiguration.getRoles(), ","))
+                .and().httpBasic();
+    }
+
+}

diff --git a/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java b/common/src/main/java/org/onap/so/security/SoWebSecurityConfigurerAdapter.java
similarity index 81%
rename from common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java
rename to common/src/main/java/org/onap/so/security/SoWebSecurityConfigurerAdapter.java
index 21176e0..903d586 100644 (file)
--- a/common/src/main/java/org/onap/so/security/SoBasicWebSecurityConfigurerAdapter.java
+++ b/common/src/main/java/org/onap/so/security/SoWebSecurityConfigurerAdapter.java
@@ -1,6 +1,6 @@
 /*-
  * ============LICENSE_START=======================================================
- *  Copyright (C) 2020 Nordix Foundation.
+ *  Copyright (C) 2020 Ericsson. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,8 @@
  */
 package org.onap.so.security;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Profile;
@@ -31,7 +33,6 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.web.firewall.StrictHttpFirewall;
-import org.springframework.util.StringUtils;
 
 /**
  * @author Waqas Ikram (waqas.ikram@est.tech)
@@ -40,11 +41,12 @@ import org.springframework.util.StringUtils;
 @EnableWebSecurity
 @Configuration
 @Order(1)
-@Profile({"basic"})
-public class SoBasicWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
+@Profile({"basic", "test"})
+public class SoWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
+    private static final Logger LOGGER = LoggerFactory.getLogger(SoWebSecurityConfigurerAdapter.class);
 
     @Autowired
-    private SoUserCredentialConfiguration soUserCredentialConfiguration;
+    private HttpSecurityConfigurer httpSecurityConfigurer;
 
     @Autowired
     private UserDetailsService userDetailsService;
@@ -54,10 +56,9 @@ public class SoBasicWebSecurityConfigurerAdapter extends WebSecurityConfigurerAd
 
     @Override
     protected void configure(final HttpSecurity http) throws Exception {
-        http.csrf().disable().authorizeRequests().antMatchers("/manage/health", "/manage/info").permitAll()
-                .antMatchers("/**")
-                .hasAnyRole(StringUtils.collectionToDelimitedString(soUserCredentialConfiguration.getRoles(), ","))
-                .and().httpBasic();
+        LOGGER.debug("Injecting {} configuration ...", httpSecurityConfigurer.getClass());
+
+        httpSecurityConfigurer.configure(http);
     }
 
     @Override