ecomp-portal-BE-os/src/main/webapp/WEB-INF/oid-context.xml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!--
   3   ================================================================================
   4   eCOMP Portal
   5   ================================================================================
   6   Copyright (C) 2017 AT&T Intellectual Property
   7   ================================================================================
   8   Licensed under the Apache License, Version 2.0 (the "License");
   9   you may not use this file except in compliance with the License.
  10   You may obtain a copy of the License at
  11
  12        http://www.apache.org/licenses/LICENSE-2.0
  13
  14   Unless required by applicable law or agreed to in writing, software
  15   distributed under the License is distributed on an "AS IS" BASIS,
  16   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  17   See the License for the specific language governing permissions and
  18   limitations under the License.
  19   ================================================================================
  20   -->
  21
  22 <beans xmlns="http://www.springframework.org/schema/beans"
  23         xmlns:mvc="http://www.springframework.org/schema/mvc"
  24         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  25         xmlns:tx="http://www.springframework.org/schema/tx"
  26         xmlns:context="http://www.springframework.org/schema/context"
  27         xmlns:security="http://www.springframework.org/schema/security"
  28         xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
  29         xmlns:util="http://www.springframework.org/schema/util"
  30         xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
  31                 http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.1.xsd
  32                 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
  33                 http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
  34                 http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.1.xsd
  35                 http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.1.xsd
  36                 http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd">
  37
  38         <!-- DispatcherServlet Context: defines this servlet's request-processing
  39                 infrastructure -->
  40
  41
  42         <bean
  43                 class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
  44                 <property name="location">
  45                         <value>classpath:openid-connect.properties</value>
  46                 </property>
  47         </bean>
  48
  49
  50         <!-- Enables the Spring MVC @Controller programming model -->
  51         <mvc:annotation-driven />
  52
  53         <mvc:interceptors>
  54                 <!-- Inject the UserInfo into the current context -->
  55                 <bean id="userInfoInterceptor" class="org.mitre.openid.connect.web.UserInfoInterceptor" />
  56         </mvc:interceptors>
  57
  58         <!-- Handles HTTP GET requests for /resources/** by efficiently serving
  59                 up static resources in the ${webappRoot}/resources directory -->
  60         <mvc:resources mapping="/resources/**" location="/resources/" />
  61
  62         <!-- Resolves views selected for rendering by @Controllers to .jsp resources
  63                 in the /WEB-INF/views directory -->
  64         <bean
  65                 class="org.springframework.web.servlet.view.InternalResourceViewResolver">
  66                 <property name="prefix" value="/WEB-INF/views/" />
  67                 <property name="suffix" value=".jsp" />
  68         </bean>
  69
  70         <context:component-scan base-package="org.openecomp.portalapp.security.openid.controllers" />
  71
  72         <security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="authenticationManager"/>
  73
  74         <security:http auto-config="false" use-expressions="true" disable-url-rewriting="true" entry-point-ref="authenticationEntryPoint" pattern="/**">
  75                 <security:custom-filter before="PRE_AUTH_FILTER" ref="openIdConnectAuthenticationFilter" />
  76                 <security:logout />
  77         </security:http>
  78
  79         <bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
  80                 <property name="loginFormUrl" value="/openid_connect_login" />
  81         </bean>
  82
  83         <security:authentication-manager alias="authenticationManager">
  84                 <security:authentication-provider ref="openIdConnectAuthenticationProvider" />
  85         </security:authentication-manager>
  86
  87         <bean id="openIdConnectAuthenticationProvider" class="org.mitre.openid.connect.client.OIDCAuthenticationProvider">
  88                 <property name="authoritiesMapper">
  89                         <bean class="org.mitre.openid.connect.client.NamedAdminAuthoritiesMapper">
  90                                 <property name="admins" ref="namedAdmins" />
  91                         </bean>
  92                 </property>
  93         </bean>
  94
  95         <util:set id="namedAdmins" value-type="org.mitre.openid.connect.client.SubjectIssuerGrantedAuthority">
  96                 <!--
  97                         This is an example of how to set up a user as an administrator: they'll be given ROLE_ADMIN in addition to ROLE_USER.
  98                         Note that having an administrator role on the IdP doesn't grant administrator access on this client.
  99
 100                         These are values from the demo "openid-connect-server-webapp" project of MITREid Connect.
 101                 -->
 102                 <bean class="org.mitre.openid.connect.client.SubjectIssuerGrantedAuthority">
 103                         <constructor-arg name="subject" value="90342.ASDFJWFA" />
 104                         <constructor-arg name="issuer" value="${authentication_server_url}" />
 105                 </bean>
 106         </util:set>
 107
 108
 109         <!--
 110           -
 111           - The authentication filter
 112           -
 113           -->
 114         <bean id="openIdConnectAuthenticationFilter" class="org.mitre.openid.connect.client.OIDCAuthenticationFilter">
 115                 <property name="authenticationManager" ref="authenticationManager" />
 116
 117                 <property name="issuerService" ref="hybridIssuerService" />
 118                 <property name="serverConfigurationService" ref="dynamicServerConfigurationService" />
 119                 <property name="clientConfigurationService" ref="dynamicClientConfigurationService" />
 120                 <property name="authRequestOptionsService" ref="staticAuthRequestOptionsService" />
 121                 <property name="authRequestUrlBuilder" ref="plainAuthRequestUrlBuilder" />
 122
 123         </bean>
 124
 125
 126
 127         <!--
 128           -
 129           -     Issuer Services: Determine which identity provider issuer is used.
 130           -
 131           -->
 132
 133
 134         <!--
 135                 Static issuer service, returns the same issuer for every request.
 136         -->
 137         <bean class="org.mitre.openid.connect.client.service.impl.StaticSingleIssuerService" id="staticIssuerService">
 138                 <property name="issuer" value="${authentication_server_url}" />
 139         </bean>
 140
 141         <!--
 142                 WebFinger issuer service, does OpenID Connect Discovery on user-entered text (received from the
 143                 loginPageUrl page) to find the issuer. The login page needs to return the user-entered text
 144                 as the "identifier" parameter as a query parameter.
 145         -->
 146         <bean class="org.mitre.openid.connect.client.service.impl.WebfingerIssuerService" id="webfingerIssuerService">
 147                 <property name="loginPageUrl" value="login" />
 148         </bean>
 149
 150         <!--
 151                 Third-party (account chooser) issuer service. Looks for the "iss" parameter on the request
 152                 and returns that as the issuer. If there is no "iss" value, redirects to the configured
 153                 account chooser URI. This URI should direct back to the login filter URL with an
 154                 "iss" value as a query parameter.
 155         -->
 156         <bean class="org.mitre.openid.connect.client.service.impl.ThirdPartyIssuerService">
 157           <property name="accountChooserUrl" value="http://localhost/account-chooser/" />
 158         </bean>
 159
 160         <!--
 161                 Hybrid issuer service. If an issuer is passed in directly with the "iss" parameter, it will use that. If not, it will
 162                 look for an "identifier" parameter to do Webfinger discovery on that. Failing that, it will redirect to the login
 163                 page URL.
 164         -->
 165         <bean class="org.mitre.openid.connect.client.service.impl.HybridIssuerService" id="hybridIssuerService">
 166                 <property name="loginPageUrl" value="login" />
 167                 <property name="forceHttps" value="false" /> <!-- this default property forces the webfinger issuer URL to be HTTPS, turn off for development work -->
 168         </bean>
 169
 170         <!--
 171           -
 172           - Server configuration: determines the parameters and URLs of the server to talk to.
 173           -
 174           -->
 175
 176         <!--
 177                 Static server configuration, contains a map of server configuration objects keyed by the issuer URL.
 178         -->
 179         <bean class="org.mitre.openid.connect.client.service.impl.StaticServerConfigurationService">
 180                 <property name="servers">
 181                         <map>
 182                                 <entry key="${authentication_server_url}">
 183                                         <bean class="org.mitre.openid.connect.config.ServerConfiguration">
 184                                                 <property name="issuer" value="${authentication_server_url}" />
 185                                                 <property name="authorizationEndpointUri"       value="${authentication_server_url}authorize" />
 186                                                 <property name="tokenEndpointUri"       value="${authentication_server_url}token" />
 187                                                 <property name="userInfoUri" value="${authentication_server_url}userinfo" />
 188                                                 <property name="jwksUri" value="${authentication_server_url}jwk" />
 189                                         </bean>
 190                                 </entry>
 191                         </map>
 192                 </property>
 193         </bean>
 194
 195         <!--
 196                 Dynamic server configuration, fetches the server's information using OIDC Discovery.
 197         -->
 198         <bean class="org.mitre.openid.connect.client.service.impl.DynamicServerConfigurationService" id="dynamicServerConfigurationService" />
 199
 200         <!--
 201                 Hybrid server configuration. Tries to look up a statically configured server in the map, does
 202                 dynamic OIDC Discovery if the static lookup fails.
 203         -->
 204         <bean class="org.mitre.openid.connect.client.service.impl.HybridServerConfigurationService">
 205                 <property name="servers">
 206                         <map>
 207                                 <entry key="${authentication_server_url}">
 208                                         <bean class="org.mitre.openid.connect.config.ServerConfiguration">
 209                                                 <property name="issuer" value="${authentication_server_url}" />
 210                                                 <property name="authorizationEndpointUri"       value="${authentication_server_url}authorize" />
 211                                                 <property name="tokenEndpointUri"       value="${authentication_server_url}token" />
 212                                                 <property name="userInfoUri" value="${authentication_server_url}userinfo" />
 213                                                 <property name="jwksUri" value="${authentication_server_url}jwk" />
 214                                         </bean>
 215                                 </entry>
 216                         </map>
 217                 </property>
 218         </bean>
 219
 220
 221         <!--
 222           -
 223           -     Client Configuration: Determine which client identifier and credentials are used.
 224           -
 225           -->
 226
 227
 228         <!--
 229                 Dynamic Client Configuration, uses dynamic client registration. This version stores the registered
 230             clients in an in-memory map. To override, add a bean to the registeredClientService property.
 231         -->
 232
 233         <bean class="org.mitre.openid.connect.client.service.impl.DynamicRegistrationClientConfigurationService" id="dynamicClientConfigurationService">
 234                 <property name="template">
 235                         <bean class="org.mitre.oauth2.model.RegisteredClient">
 236                                 <property name="clientName" value="ECOMP Portal OpenId Connect Client1" />
 237
 238                                 <property name="scope">
 239                                         <set value-type="java.lang.String">
 240                                                 <value>openid</value>
 241                                                 <value>email</value>
 242                                                 <value>address</value>
 243                                                 <value>profile</value>
 244                                                 <value>phone</value>
 245                                         </set>
 246                                 </property>
 247                                 <property name="tokenEndpointAuthMethod" value="SECRET_BASIC" />
 248                                 <property name="redirectUris">
 249                                         <set>
 250                                                 <value>${ecomp_openid_connect_client}</value>
 251                                         </set>
 252                                 </property>
 253                         </bean>
 254                 </property>
 255                 <!--
 256                         Registered Client Service. Uncomment this to save dynamically registered clients out to a
 257                         file on disk (indicated by the filename property) or replace this with another implementation
 258                         of RegisteredClientService. This defaults to an in-memory implementation of RegisteredClientService
 259                         which will forget and re-register all clients on restart.
 260                 -->
 261                 <!--
 262                 <property name="registeredClientService">
 263                         <bean class="org.mitre.openid.connect.client.service.impl.JsonFileRegisteredClientService">
 264                                 <constructor-arg name="filename" value="/tmp/simple-web-app-clients.json" />
 265                         </bean>
 266                 </property>
 267                  -->
 268         </bean>
 269
 270         <!--
 271                 Static Client Configuration. Configures a client statically by storing configuration on a per-issuer basis.
 272         -->
 273
 274         <bean class="org.mitre.openid.connect.client.service.impl.StaticClientConfigurationService" id="staticClientConfigurationService">
 275                 <property name="clients">
 276                         <map>
 277                                 <entry key="${authentication_server_url}">
 278                                         <bean class="org.mitre.oauth2.model.RegisteredClient">
 279                                                 <property name="clientId" value="ecomp" />
 280                                                 <property name="clientSecret" value="secret" />
 281                                                 <property name="scope">
 282                                                         <set value-type="java.lang.String">
 283                                                                 <value>openid</value>
 284                                                                 <value>email</value>
 285                                                                 <value>address</value>
 286                                                                 <value>profile</value>
 287                                                                 <value>phone</value>
 288                                                         </set>
 289                                                 </property>
 290                                                 <property name="tokenEndpointAuthMethod" value="SECRET_BASIC" />
 291                                                 <property name="redirectUris">
 292                                                         <set>
 293                                                                 <value>${ecomp_openid_connect_client}</value>
 294                                                         </set>
 295                                                 </property>
 296                                         </bean>
 297                                 </entry>
 298                         </map>
 299                 </property>
 300         </bean>
 301
 302         <!--
 303                 Hybrid Client Configuration. Tries to configure a client statically first, but if a client isn't found in the map,
 304                 it will dynamically configure one.
 305         -->
 306         <bean class="org.mitre.openid.connect.client.service.impl.HybridClientConfigurationService" id="hybridClientConfigurationService">
 307                 <property name="clients">
 308                         <map>
 309                                 <entry key="${authentication_server_url}">
 310                                         <bean class="org.mitre.oauth2.model.RegisteredClient">
 311                                                 <property name="clientId" value="client" />
 312                                                 <property name="clientSecret" value="secret" />
 313                                                 <property name="scope">
 314                                                         <set value-type="java.lang.String">
 315                                                                 <value>openid</value>
 316                                                                 <value>email</value>
 317                                                                 <value>address</value>
 318                                                                 <value>profile</value>
 319                                                                 <value>phone</value>
 320                                                         </set>
 321                                                 </property>
 322                                                 <property name="tokenEndpointAuthMethod" value="SECRET_BASIC" />
 323                                                 <property name="redirectUris">
 324                                                         <set>
 325                                                                 <value>${ecomp_openid_connect_client}</value>
 326                                                         </set>
 327                                                 </property>
 328
 329                                         </bean>
 330                                 </entry>
 331                         </map>
 332                 </property>
 333                 <property name="template">
 334                         <bean class="org.mitre.oauth2.model.RegisteredClient">
 335                                 <property name="clientName" value="ECOMP Portal OpenId Connect Client2" />
 336                                 <property name="scope">
 337                                         <set value-type="java.lang.String">
 338                                                 <value>openid</value>
 339                                                 <value>email</value>
 340                                                 <value>address</value>
 341                                                 <value>profile</value>
 342                                                 <value>phone</value>
 343                                         </set>
 344                                 </property>
 345                                 <property name="tokenEndpointAuthMethod" value="SECRET_BASIC" />
 346                                 <property name="redirectUris">
 347                                         <set>
 348                                                 <value>${ecomp_openid_connect_client}</value>
 349                                         </set>
 350                                 </property>
 351                         </bean>
 352                 </property>
 353                 <!--
 354                         Registered Client Service. Uncomment this to save dynamically registered clients out to a
 355                         file on disk (indicated by the filename property) or replace this with another implementation
 356                         of RegisteredClientService. This defaults to an in-memory implementation of RegisteredClientService
 357                         which will forget and re-register all clients on restart.
 358                 -->
 359                 <!--
 360                 <property name="registeredClientService">
 361                         <bean class="org.mitre.openid.connect.client.service.impl.JsonFileRegisteredClientService">
 362                                 <constructor-arg name="filename" value="/tmp/simple-web-app-clients.json" />
 363                         </bean>
 364                 </property>
 365                  -->
 366         </bean>
 367
 368
 369         <!--
 370           -
 371           -     Auth request options service: returns the optional components of the request
 372           -
 373           -->
 374         <bean class="org.mitre.openid.connect.client.service.impl.StaticAuthRequestOptionsService" id="staticAuthRequestOptionsService">
 375                 <property name="options">
 376                         <map>
 377                                 <!-- Entries in this map are sent as key-value parameters to the auth request -->
 378                                 <!--
 379                                 <entry key="display" value="page" />
 380                                 <entry key="max_age" value="30" />
 381                                 <entry key="prompt" value="none" />
 382                                 -->
 383                         </map>
 384                 </property>
 385         </bean>
 386
 387         <!--
 388           -
 389           - Authorization URL Builders: create the URL to redirect the user to for authorization.
 390           -
 391           -->
 392
 393         <!--
 394                 Plain authorization request builder, puts all options as query parameters on the GET request
 395         -->
 396         <bean class="org.mitre.openid.connect.client.service.impl.PlainAuthRequestUrlBuilder" id="plainAuthRequestUrlBuilder" />
 397
 398         <!--
 399                 Signed authorization request builder, puts all options as elements in a JWS-signed request object
 400         -->
 401         <bean class="org.mitre.openid.connect.client.service.impl.SignedAuthRequestUrlBuilder" id="signedAuthRequestUrlBuilder">
 402           <property name="signingAndValidationService" ref="defaultSignerService" />
 403         </bean>
 404
 405         <!--
 406                 Encrypted authorization request builder, puts all the options as elements in a JWE-encrypted request object
 407         -->
 408         <bean class="org.mitre.openid.connect.client.service.impl.EncryptedAuthRequestUrlBuilder" id="encryptedAuthRequestUrlBuilder">
 409           <property name="encrypterService" ref="validatorCache" />
 410             <property name="alg">
 411               <util:constant static-field="com.nimbusds.jose.JWEAlgorithm.RSA1_5"/>
 412             </property>
 413             <property name="enc">
 414               <util:constant static-field="com.nimbusds.jose.EncryptionMethod.A128GCM"/>
 415             </property>
 416         </bean>
 417
 418
 419
 420
 421         <!--
 422          -
 423          - Utility beans for the above classes
 424          -
 425          -->
 426
 427         <!--
 428                 This service fetches and caches JWK sets from URLs.
 429         -->
 430
 431         <bean id="validatorCache" class="org.mitre.jwt.signer.service.impl.JWKSetCacheService" />
 432
 433         <!--
 434                 This service sets up a bunch of signers and validators based on our own keys.
 435                 Replace this keystore's contents for a production deployment.
 436          -->
 437         <bean id="defaultSignerService" class="org.mitre.jwt.signer.service.impl.DefaultJWTSigningAndValidationService">
 438                 <constructor-arg name="keyStore">
 439                         <bean id="defaultKeyStore" class="org.mitre.jose.keystore.JWKSetKeyStore">
 440                                 <property name="location" value="classpath:openid-keystore.jwks" />
 441                         </bean>
 442                 </constructor-arg>
 443                 <property name="defaultSignerKeyId" value="rsa1" />
 444                 <property name="defaultSigningAlgorithmName" value="RS256" />
 445         </bean>
 446
 447         <!--
 448                 This service publishes the client's public key on a the endpoint "jwk" off the root of this client.
 449         -->
 450         <bean id="clientKeyPublisher" class="org.mitre.openid.connect.client.keypublisher.ClientKeyPublisher">
 451                 <property name="jwkPublishUrl" value="jwk" />
 452                 <property name="signingAndValidationService" ref="defaultSignerService" />
 453         </bean>
 454
 455 </beans>