From b02b3faa57bf74a8bddf2a8a1e10a0ac6bce8f6e Mon Sep 17 00:00:00 2001 From: Andrew Lalis Date: Mon, 13 May 2019 14:33:04 +0200 Subject: [PATCH] Removed test controller, added login controller, and authentication Only a temporary authentication is set up at the moment. --- .../config/WebSecurityConfig.java | 79 +++++++++++++------ .../controllers/LoginController.java | 22 ++++++ .../controllers/TestController.java | 17 ---- .../model/security/UserDetailsService.java | 2 + .../resources/templates/fragments/header.html | 1 + src/main/resources/templates/index.html | 2 +- src/main/resources/templates/login.html | 24 ++++++ src/main/resources/templates/test.html | 12 --- 8 files changed, 103 insertions(+), 56 deletions(-) create mode 100644 src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/LoginController.java delete mode 100644 src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/TestController.java create mode 100644 src/main/resources/templates/login.html delete mode 100644 src/main/resources/templates/test.html diff --git a/src/main/java/nl/andrewlalis/teaching_assistant_assistant/config/WebSecurityConfig.java b/src/main/java/nl/andrewlalis/teaching_assistant_assistant/config/WebSecurityConfig.java index c6f134a..647a294 100644 --- a/src/main/java/nl/andrewlalis/teaching_assistant_assistant/config/WebSecurityConfig.java +++ b/src/main/java/nl/andrewlalis/teaching_assistant_assistant/config/WebSecurityConfig.java @@ -1,41 +1,68 @@ package nl.andrewlalis.teaching_assistant_assistant.config; +import nl.andrewlalis.teaching_assistant_assistant.model.security.UserDetailsService; +import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; -import org.springframework.security.core.userdetails.User; -import org.springframework.security.core.userdetails.UserDetails; -import org.springframework.security.core.userdetails.UserDetailsService; -import org.springframework.security.provisioning.InMemoryUserDetailsManager; +import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; +import org.springframework.security.crypto.password.PasswordEncoder; @Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { - @Override - protected void configure(HttpSecurity http) throws Exception { - http.authorizeRequests() - .antMatchers("/").permitAll() - .anyRequest().authenticated() - .and() - .authorizeRequests() - .antMatchers("/resources/**").permitAll().anyRequest().permitAll() - .and() - .formLogin() - .loginPage("/login") - .permitAll() - .and() - .logout() - .permitAll(); + private UserDetailsService userDetailsService; + + protected WebSecurityConfig(UserDetailsService userDetailsService) { + this.userDetailsService = userDetailsService; } - public UserDetailsService userDetailsService () { - UserDetails user = User.withDefaultPasswordEncoder() - .username("andrewlalis") - .password("test") - .roles("USER") - .build(); - return new InMemoryUserDetailsManager(user); + @Override + protected void configure(final AuthenticationManagerBuilder auth) throws Exception { + auth.inMemoryAuthentication() + .withUser("tester") + .password(passwordEncoder().encode("tester")) + .roles("USER"); + auth.userDetailsService(this.userDetailsService); + } + + @Override + protected void configure(final HttpSecurity http) throws Exception { + http + .csrf().disable() // So that we can GET the logout page. + + .authorizeRequests() // Let anyone view the login and logout pages. + .antMatchers("/login*", "/logout*") + .permitAll() + .anyRequest() + .authenticated() + .and() + + .authorizeRequests() // Only logged in users should be able to see site content. + .antMatchers("/**") + .hasRole("USER") + .and() + + .formLogin() + .loginPage("/login") + .loginProcessingUrl("/login") + .defaultSuccessUrl("/", true) + .failureUrl("/login?error") + .and() + + .logout() + .clearAuthentication(true) + .invalidateHttpSession(true) + .logoutUrl("/logout") + .logoutSuccessUrl("/login") + .deleteCookies("JSESSIONID"); + } + + @Bean + public PasswordEncoder passwordEncoder() { + return new BCryptPasswordEncoder(); } } diff --git a/src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/LoginController.java b/src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/LoginController.java new file mode 100644 index 0000000..c33ee37 --- /dev/null +++ b/src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/LoginController.java @@ -0,0 +1,22 @@ +package nl.andrewlalis.teaching_assistant_assistant.controllers; + +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.GetMapping; + +/** + * Controller for the login page, visible to all users. + */ +@Controller +public class LoginController { + + private final Logger logger = LogManager.getLogger(LoginController.class); + + @GetMapping("/login") + public String get() { + logger.info("User got login page."); + + return "login"; + } +} diff --git a/src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/TestController.java b/src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/TestController.java deleted file mode 100644 index 0fdec93..0000000 --- a/src/main/java/nl/andrewlalis/teaching_assistant_assistant/controllers/TestController.java +++ /dev/null @@ -1,17 +0,0 @@ -package nl.andrewlalis.teaching_assistant_assistant.controllers; - -import org.springframework.stereotype.Controller; -import org.springframework.ui.Model; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.RequestParam; - -@Controller -public class TestController { - - @GetMapping("/test") - public String test (@RequestParam(name="name", required=false, defaultValue="World") String name, Model model) { - model.addAttribute("name", name); - return "test"; - } - -} diff --git a/src/main/java/nl/andrewlalis/teaching_assistant_assistant/model/security/UserDetailsService.java b/src/main/java/nl/andrewlalis/teaching_assistant_assistant/model/security/UserDetailsService.java index 6658a33..24ff5d0 100644 --- a/src/main/java/nl/andrewlalis/teaching_assistant_assistant/model/security/UserDetailsService.java +++ b/src/main/java/nl/andrewlalis/teaching_assistant_assistant/model/security/UserDetailsService.java @@ -3,9 +3,11 @@ package nl.andrewlalis.teaching_assistant_assistant.model.security; import nl.andrewlalis.teaching_assistant_assistant.model.repositories.UserRepository; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UsernameNotFoundException; +import org.springframework.stereotype.Service; import java.util.Optional; +@Service public class UserDetailsService implements org.springframework.security.core.userdetails.UserDetailsService { private UserRepository userRepository; diff --git a/src/main/resources/templates/fragments/header.html b/src/main/resources/templates/fragments/header.html index 5b1b3f6..09f10f5 100644 --- a/src/main/resources/templates/fragments/header.html +++ b/src/main/resources/templates/fragments/header.html @@ -15,6 +15,7 @@
  • Courses
  • Students
  • Teaching Assistants
    • +
  • Log Out
    • diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html index 1bcd1e6..4a2c306 100644 --- a/src/main/resources/templates/index.html +++ b/src/main/resources/templates/index.html @@ -1,5 +1,5 @@ - + Homepage diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html new file mode 100644 index 0000000..3661c17 --- /dev/null +++ b/src/main/resources/templates/login.html @@ -0,0 +1,24 @@ + + + + + Login + + + +
    + Invalid username or password! +
    + +
    + You have been logged out! +
    + +
    + + + +
    + + + \ No newline at end of file diff --git a/src/main/resources/templates/test.html b/src/main/resources/templates/test.html deleted file mode 100644 index 3cae43e..0000000 --- a/src/main/resources/templates/test.html +++ /dev/null @@ -1,12 +0,0 @@ - - - - Test Controller Page - - - - -

    - - - \ No newline at end of file