diff --git a/pom.xml b/pom.xml index 336c4df..02e872e 100644 --- a/pom.xml +++ b/pom.xml @@ -55,102 +55,90 @@ UTF-8 - [3.4,3.5) - [6.2,6.5) - 2.18.2 - 4.12.0 - 7.1.0 + 4.0.2 + 7.5.2 0.8.12 - 3.14.0 + 3.14.1 3.5.0 - 3.4.2 - 3.2.7 - 3.11.2 + 3.5.0 + 3.2.8 + 3.12.0 3.21.0 - 3.3.1 - 3.5.2 + 3.4.0 + 3.5.4 1.7.0 4.0.0 - 2.18.0 + 2.21.0 + + + + org.springframework.boot + spring-boot-dependencies + ${spring-boot.version} + pom + import + + + + + + org.springframework.boot - spring-boot-starter - ${spring-boot.version} + spring-boot-security-oauth2-client - org.springframework.boot - spring-boot-starter-oauth2-client - ${spring-boot.version} + org.springframework.security + spring-security-config org.springframework.boot - spring-boot-starter-security - ${spring-boot.version} + spring-boot-autoconfigure org.springframework.boot - spring-boot-starter-web - ${spring-boot.version} + spring-boot-webclient org.springframework.boot - spring-boot-starter-webflux - ${spring-boot.version} + spring-boot-jackson + + - org.springframework.boot - spring-boot-starter-oauth2-resource-server - ${spring-boot.version} + io.fabric8 + mockwebserver + ${fabric8-mockwebserver.version} + test - com.fasterxml.jackson.core - jackson-databind - ${jackson.version} + org.springframework.boot + spring-boot-starter-oauth2-resource-server test - com.squareup.okhttp3 - mockwebserver - ${okhttp3.version} + org.springframework.boot + spring-boot-starter-test test - io.fabric8 - mockwebserver - ${fabric8-mockwebserver.version} + org.springframework.boot + spring-boot-starter-web test - - - tools - com.sun - - org.springframework.boot - spring-boot-starter-test - ${spring-boot.version} + spring-boot-webmvc-test test - - - junit-vintage-engine - org.junit.vintage - - - org.slf4j - slf4j-api - - org.springframework.security spring-security-test - ${spring-security.version} test diff --git a/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfiguration.java b/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfiguration.java index 6610036..11294e1 100644 --- a/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfiguration.java +++ b/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfiguration.java @@ -4,10 +4,10 @@ import org.springframework.boot.autoconfigure.AutoConfiguration; import org.springframework.boot.autoconfigure.AutoConfigureAfter; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; -import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration; -import org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration; -import org.springframework.boot.autoconfigure.web.reactive.function.client.WebClientAutoConfiguration; import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration; +import org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration; +import org.springframework.boot.webclient.autoconfigure.WebClientAutoConfiguration; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Scope; import org.springframework.security.oauth2.client.AuthorizedClientServiceOAuth2AuthorizedClientManager; diff --git a/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityAutoConfiguration.java b/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityAutoConfiguration.java index 8ff2932..7b8a4d7 100644 --- a/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityAutoConfiguration.java +++ b/src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityAutoConfiguration.java @@ -4,10 +4,8 @@ import java.util.Optional; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.boot.autoconfigure.AutoConfiguration; -import org.springframework.boot.autoconfigure.AutoConfigureBefore; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; -import org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; import org.springframework.security.config.Customizer; @@ -17,21 +15,16 @@ import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.web.AuthenticationEntryPoint; import org.springframework.security.web.SecurityFilterChain; -import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher; -import org.springframework.web.servlet.handler.HandlerMappingIntrospector; +import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; +import org.springframework.security.web.util.matcher.RequestMatcher; /** * An autoconfiguration that enables OIDC-based authentication for all HTTP endpoints (except for /actuator/* as soon as the * property microservice.security.oauth2.resourceserver.jwt.jwk-set-uri is set to the JWK Set URI of an OpenID Connect * provider. - *

- * In case both {@link OAuth2ClientAutoConfiguration} and this auto-configuration are applied onto an application, both would try and add a - * {@link SecurityFilterChain}. To avoid such a conflict, the one defined in this class will take precedence over the one provided via - * {@link OAuth2ClientAutoConfiguration}. */ @AutoConfiguration @EnableWebSecurity -@AutoConfigureBefore(OAuth2ClientAutoConfiguration.class) @ConditionalOnProperty("spring.security.oauth2.resourceserver.jwt.jwk-set-uri") @ConditionalOnWebApplication @EnableConfigurationProperties({MicroserviceSecurityConfigurationProperties.class}) @@ -42,7 +35,6 @@ public class WebSecurityAutoConfiguration { SecurityFilterChain oidcResourceServerSecurityFilterChainReduced( HttpSecurity http, MicroserviceSecurityConfigurationProperties microserviceSecurityConfigurationProperties, - HandlerMappingIntrospector introspector, @Qualifier("oauth2AuthenticationEntryPoint") Optional oauth2AuthenticationEntryPoint) throws Exception { return http.csrf(AbstractHttpConfigurer::disable) .logout(AbstractHttpConfigurer::disable) @@ -50,8 +42,8 @@ SecurityFilterChain oidcResourceServerSecurityFilterChainReduced( .authorizeHttpRequests(authorizationManagerRequestMatcherRegistry -> authorizationManagerRequestMatcherRegistry.requestMatchers(microserviceSecurityConfigurationProperties.getAllowlist() .stream() - .map(path -> new MvcRequestMatcher(introspector, path)) - .toArray(MvcRequestMatcher[]::new)) + .map(path -> PathPatternRequestMatcher.withDefaults().matcher(path)) + .toArray(RequestMatcher[]::new)) .permitAll() .anyRequest() .authenticated()) @@ -65,4 +57,3 @@ SecurityFilterChain oidcResourceServerSecurityFilterChainReduced( .build(); } } - diff --git a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfigurationTest.java b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfigurationTest.java index d202b4b..0316a81 100644 --- a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfigurationTest.java +++ b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfigurationTest.java @@ -1,6 +1,7 @@ package io.dwpbank.movewp3.microservice.security.autoconfiguration.client; import static org.assertj.core.api.Assertions.assertThat; +import static org.junit.jupiter.api.Assertions.assertFalse; import io.fabric8.mockwebserver.DefaultMockServer; import io.fabric8.mockwebserver.utils.ResponseProviders; @@ -68,7 +69,7 @@ void testRegularWebClientOmitsBearerToken() { var responseEntity = webClientBuilder .baseUrl("http://foo") .exchangeFunction(clientRequest -> { - assertThat(clientRequest.headers()).doesNotContainKeys("Authorization"); + assertFalse(clientRequest.headers().containsHeader("Authorization")); return Mono.just(ClientResponse.create(HttpStatus.OK).build()); }) .build() diff --git a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigAllowlistTest.java b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigAllowlistTest.java index 202d1cb..b98a27f 100644 --- a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigAllowlistTest.java +++ b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigAllowlistTest.java @@ -10,7 +10,7 @@ import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.autoconfigure.ImportAutoConfiguration; -import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest; +import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest; import org.springframework.test.context.TestPropertySource; import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.setup.MockMvcBuilders; diff --git a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigMultipleSecurityFilterChainsOrderedTest.java b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigMultipleSecurityFilterChainsOrderedTest.java index a544d4f..876695c 100644 --- a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigMultipleSecurityFilterChainsOrderedTest.java +++ b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigMultipleSecurityFilterChainsOrderedTest.java @@ -14,8 +14,8 @@ import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.autoconfigure.ImportAutoConfiguration; -import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest; import org.springframework.boot.test.context.TestConfiguration; +import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Import; import org.springframework.core.annotation.Order; diff --git a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigWithAuthEntryPointTest.java b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigWithAuthEntryPointTest.java index 78c96d9..ec34e19 100644 --- a/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigWithAuthEntryPointTest.java +++ b/src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigWithAuthEntryPointTest.java @@ -13,7 +13,7 @@ import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.autoconfigure.ImportAutoConfiguration; -import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest; +import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest; import org.springframework.context.annotation.Import; import org.springframework.security.web.AuthenticationEntryPoint; import org.springframework.test.context.ContextConfiguration;