implemented user roles and security context support

Author: Juraj Veverka

spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/config/AuthenticationImpl.java

@@ -0,0 +1,62 @@
+package itx.examples.springboot.security.springsecurity.config;
+
+import itx.examples.springboot.security.springsecurity.services.dto.RoleId;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+
+public class AuthenticationImpl implements Authentication {
+
+    private final String name;
+    private final Collection<GrantedAuthorityImpl> grantedAuthorities;
+
+    public AuthenticationImpl(String name, Set<RoleId> roles) {
+        this.name = name;
+        List<GrantedAuthorityImpl> authorities = new ArrayList<>();
+        roles.forEach(r->{
+            authorities.add(new GrantedAuthorityImpl(r.getId()));
+        });
+        this.grantedAuthorities = Collections.unmodifiableCollection(authorities);
+    }
+
+
+    @Override
+    public Collection<? extends GrantedAuthority> getAuthorities() {
+        return grantedAuthorities;
+    }
+
+    @Override
+    public Object getCredentials() {
+        return null;
+    }
+
+    @Override
+    public Object getDetails() {
+        return null;
+    }
+
+    @Override
+    public Object getPrincipal() {
+        return null;
+    }
+
+    @Override
+    public boolean isAuthenticated() {
+        return true;
+    }
+
+    @Override
+    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
+
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+}

spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/config/GrantedAuthorityImpl.java

@@ -0,0 +1,17 @@
+package itx.examples.springboot.security.springsecurity.config;
+
+import org.springframework.security.core.GrantedAuthority;
+
+public class GrantedAuthorityImpl implements GrantedAuthority {
+
+    private final String authority;
+
+    public GrantedAuthorityImpl(String authority) {
+        this.authority = authority;
+    }
+
+    @Override
+    public String getAuthority() {
+        return authority;
+    }
+}

spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/config/SecurityFilter.java

@@ -1,9 +1,12 @@
 package itx.examples.springboot.security.springsecurity.config;
 
 import itx.examples.springboot.security.springsecurity.services.UserAccessService;
+import itx.examples.springboot.security.springsecurity.services.dto.UserData;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
 
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -12,7 +15,9 @@
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
 import java.io.IOException;
+import java.util.Optional;
 
 public class SecurityFilter implements Filter {
 
@@ -28,7 +33,12 @@ public SecurityFilter(UserAccessService userAccessService) {
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
         HttpServletRequest httpServletRequest = (HttpServletRequest)request;
         String sessionId = httpServletRequest.getSession(true).getId();
-        if (userAccessService.isAuthorized(sessionId)) {
+        Optional<UserData> userData = userAccessService.isAuthorized(sessionId);
+        if (userData.isPresent()) {
+            SecurityContext securityContext = SecurityContextHolder.getContext();
+            securityContext.setAuthentication(new AuthenticationImpl(userData.get().getUserName(), userData.get().getRoles()));
+            HttpSession session = httpServletRequest.getSession();
+            session.setAttribute("SPRING_SECURITY_CONTEXT", securityContext);
             chain.doFilter(request, response);
         } else {
             LOG.error("session is not authorized: {}", sessionId);

…ty/springsecurity/rest/DataResource.java …ingsecurity/rest/DataRestController.javaspring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/DataResource.java renamed to spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/DataRestController.java spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/DataResource.java renamed to spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/DataRestController.java

@@ -2,22 +2,34 @@
 
 import itx.examples.springboot.security.springsecurity.services.DataService;
 import itx.examples.springboot.security.springsecurity.services.dto.ServerData;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+
 @RestController
 @RequestMapping("/services/data/")
-public class DataResource {
+public class DataRestController {
+
+    private static final Logger LOG = LoggerFactory.getLogger(DataRestController.class);
 
     @Autowired
     private DataService dataService;
 
     @GetMapping("/all")
     public ResponseEntity<ServerData> getData() {
-        return ResponseEntity.ok().body(dataService.getSecuredData("Secured"));
+        SecurityContext securityContext = SecurityContextHolder.getContext();
+        LOG.info("getData: authentication={}", securityContext.getAuthentication().getName());
+        securityContext.getAuthentication().getAuthorities().forEach(a->{
+            LOG.info("authority={}", a.getAuthority());
+        });
+        return ResponseEntity.ok().body(dataService.getSecuredData("Secured for " + securityContext.getAuthentication().getName()));
     }
 
 }

…/springsecurity/rest/PublicResource.java …gsecurity/rest/PublicRestController.javaspring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/PublicResource.java renamed to spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/PublicRestController.java spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/PublicResource.java renamed to spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/PublicRestController.java

@@ -2,6 +2,8 @@
 
 import itx.examples.springboot.security.springsecurity.services.DataService;
 import itx.examples.springboot.security.springsecurity.services.dto.ServerData;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -10,13 +12,16 @@
 
 @RestController
 @RequestMapping("/services/public/")
-public class PublicResource {
+public class PublicRestController {
+
+    private static final Logger LOG = LoggerFactory.getLogger(PublicRestController.class);
 
     @Autowired
     private DataService dataService;
 
     @GetMapping("/all")
     public ResponseEntity<ServerData> getData() {
+        LOG.info("getData: ");
         return ResponseEntity.ok().body(dataService.getSecuredData("Public"));
     }
 

…pringsecurity/rest/SecurityResource.java …ecurity/rest/SecurityRestController.javaspring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/SecurityResource.java renamed to spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/SecurityRestController.java spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/SecurityResource.java renamed to spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/rest/SecurityRestController.java

@@ -2,6 +2,7 @@
 
 import itx.examples.springboot.security.springsecurity.services.UserAccessService;
 import itx.examples.springboot.security.springsecurity.services.dto.LoginRequest;
+import itx.examples.springboot.security.springsecurity.services.dto.UserData;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -12,10 +13,11 @@
 import org.springframework.web.bind.annotation.RestController;
 
 import javax.servlet.http.HttpSession;
+import java.util.Optional;
 
 @RestController
 @RequestMapping("/services/security/")
-public class SecurityResource {
+public class SecurityRestController {
 
     @Autowired
     private UserAccessService userAccessService;
@@ -24,9 +26,10 @@ public class SecurityResource {
     private HttpSession httpSession;
 
     @PostMapping("/login")
-    public ResponseEntity login(@RequestBody LoginRequest loginRequest) {
-        if (userAccessService.login(httpSession.getId(), loginRequest)) {
-            return ResponseEntity.ok().build();
+    public ResponseEntity<UserData> login(@RequestBody LoginRequest loginRequest) {
+        Optional<UserData> userData = userAccessService.login(httpSession.getId(), loginRequest);
+        if (userData.isPresent()) {
+            return ResponseEntity.ok().body(userData.get());
         }
         return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
     }

spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/services/UserAccessService.java

@@ -1,12 +1,15 @@
 package itx.examples.springboot.security.springsecurity.services;
 
 import itx.examples.springboot.security.springsecurity.services.dto.LoginRequest;
+import itx.examples.springboot.security.springsecurity.services.dto.UserData;
+
+import java.util.Optional;
 
 public interface UserAccessService {
 
-    boolean login(String sessionId, LoginRequest loginRequest);
+    Optional<UserData> login(String sessionId, LoginRequest loginRequest);
 
-    boolean isAuthorized(String sessionId);
+    Optional<UserData> isAuthorized(String sessionId);
 
     void logout(String sessionId);
 

spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/services/UserAccessServiceImpl.java

@@ -1,44 +1,46 @@
 package itx.examples.springboot.security.springsecurity.services;
 
 import itx.examples.springboot.security.springsecurity.services.dto.LoginRequest;
+import itx.examples.springboot.security.springsecurity.services.dto.UserData;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Service;
 
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.ConcurrentHashMap;
 
 @Service
 public class UserAccessServiceImpl implements UserAccessService {
 
     private static final Logger LOG = LoggerFactory.getLogger(UserAccessServiceImpl.class);
 
-    private final Map<String, LoginRequest> sessions;
-    private final Map<String, String> users;
+    private final Map<String, UserData> sessions;
+    private final Map<String, UserData> users;
 
     public UserAccessServiceImpl() {
         this.sessions = new ConcurrentHashMap<>();
         this.users = new HashMap<>();
-        this.users.put("joe", "secret");
-        this.users.put("jane", "secret");
+        this.users.put("joe", new UserData("joe", "secret", "USER"));
+        this.users.put("jane", new UserData("jane", "secret", "ADMIN", "USER"));
     }
 
     @Override
-    public boolean login(String sessionId, LoginRequest loginRequest) {
-        String password = users.get(loginRequest.getUserName());
-        if (password != null && password.equals(loginRequest.getPassword())) {
+    public Optional<UserData> login(String sessionId, LoginRequest loginRequest) {
+        UserData userData = users.get(loginRequest.getUserName());
+        if (userData != null && userData.verifyPassword(loginRequest.getPassword())) {
             LOG.info("login OK: {} {}", sessionId, loginRequest.getUserName());
-            sessions.put(sessionId, loginRequest);
-            return true;
+            sessions.put(sessionId, userData);
+            return Optional.of(userData);
         }
         LOG.info("login Failed: {} {}", sessionId, loginRequest.getUserName());
-        return false;
+        return Optional.empty();
     }
 
     @Override
-    public boolean isAuthorized(String sessionId) {
-        return sessions.get(sessionId)!=null ? true : false;
+    public Optional<UserData> isAuthorized(String sessionId) {
+        return Optional.ofNullable(sessions.get(sessionId));
     }
 
     @Override

spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/services/dto/RoleId.java

@@ -0,0 +1,35 @@
+package itx.examples.springboot.security.springsecurity.services.dto;
+
+import java.util.Objects;
+
+public class RoleId {
+
+    private final String id;
+
+    public RoleId(String id) {
+        this.id = id;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+        RoleId roleId = (RoleId) o;
+        return Objects.equals(id, roleId.id);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(id);
+    }
+
+    @Override
+    public String toString() {
+        return id;
+    }
+
+}

spring/spring-security/src/main/java/itx/examples/springboot/security/springsecurity/services/dto/UserData.java

@@ -0,0 +1,39 @@
+package itx.examples.springboot.security.springsecurity.services.dto;
+
+import java.util.HashSet;
+import java.util.Set;
+
+public class UserData {
+
+    private final String userName;
+    private final String password;
+    private final Set<RoleId> roles;
+
+    public UserData(String userName, String password, Set<RoleId> roles) {
+        this.userName = userName;
+        this.password = password;
+        this.roles = roles;
+    }
+
+    public UserData(String userName, String password, String ... roles) {
+        this.userName = userName;
+        this.password = password;
+        this.roles = new HashSet<>();
+        for (String role: roles) {
+            this.roles.add(new RoleId(role));
+        }
+    }
+
+    public String getUserName() {
+        return userName;
+    }
+
+    public boolean verifyPassword(String password) {
+        return this.password.equals(password);
+    }
+
+    public Set<RoleId> getRoles() {
+        return roles;
+    }
+
+}