iSharkFly-Docs/java-tutorials
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove oauth extra resource

Browse Source
This commit is contained in:
DOHA 2016-02-24 01:10:50 +02:00
parent 595c1c2b11
commit 11461268fe
7 changed files with 18 additions and 156 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/config/OAuth2ResourceServerConfig.java
View File

@ -29,15 +29,13 @@ public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter
http http
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
.and() .and()
.requestMatchers().antMatchers("/foos/**","/bars/**","/bazes/**") .requestMatchers().antMatchers("/foos/**","/bars/**")
.and() .and()
.authorizeRequests() .authorizeRequests()
.antMatchers(HttpMethod.GET,"/foos/**").access("#oauth2.hasScope('foo') and #oauth2.hasScope('read')") .antMatchers(HttpMethod.GET,"/foos/**").access("#oauth2.hasScope('foo') and #oauth2.hasScope('read')")
.antMatchers(HttpMethod.POST,"/foos/**").access("#oauth2.hasScope('foo') and #oauth2.hasScope('write')") .antMatchers(HttpMethod.POST,"/foos/**").access("#oauth2.hasScope('foo') and #oauth2.hasScope('write')")
.antMatchers(HttpMethod.GET,"/bars/**").access("#oauth2.hasScope('bar') and #oauth2.hasScope('read')") .antMatchers(HttpMethod.GET,"/bars/**").access("#oauth2.hasScope('bar') and #oauth2.hasScope('read')")
.antMatchers(HttpMethod.POST,"/bars/**").access("#oauth2.hasScope('bar') and #oauth2.hasScope('write')") .antMatchers(HttpMethod.POST,"/bars/**").access("#oauth2.hasScope('bar') and #oauth2.hasScope('write') and hasRole('ROLE_ADMIN')")
.antMatchers(HttpMethod.GET,"/bazes/**").access("#oauth2.hasScope('read') and hasRole('ROLE_ADMIN')")
.antMatchers(HttpMethod.POST,"/bazes/**").access("#oauth2.hasScope('write') and hasRole('ROLE_ADMIN')")
; ;
// @formatter:on // @formatter:on
} }

2
spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BarController.java
View File

@ -29,7 +29,7 @@ public class BarController {
} }
// API - write // API - write
// @PreAuthorize("#oauth2.hasScope('bar') and #oauth2.hasScope('write')") // @PreAuthorize("#oauth2.hasScope('bar') and #oauth2.hasScope('write') and hasRole('ROLE_ADMIN')")
@RequestMapping(method = RequestMethod.POST, value = "/bars") @RequestMapping(method = RequestMethod.POST, value = "/bars")
@ResponseStatus(HttpStatus.CREATED) @ResponseStatus(HttpStatus.CREATED)
@ResponseBody @ResponseBody

41
spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BazController.java
View File

@ -1,41 +0,0 @@
package org.baeldung.web.controller;
import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
import static org.apache.commons.lang3.RandomStringUtils.randomNumeric;
import org.baeldung.web.dto.Baz;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.ResponseStatus;
@Controller
public class BazController {
public BazController() {
super();
}
// API - read
// @PreAuthorize("#oauth2.hasScope('read') and hasRole('ROLE_ADMIN')")
@RequestMapping(method = RequestMethod.GET, value = "/bazes/{id}")
@ResponseBody
public Baz findById(@PathVariable final long id) {
return new Baz(Long.parseLong(randomNumeric(2)), randomAlphabetic(4));
}
// API - write
// @PreAuthorize("#oauth2.hasScope('write') and hasRole('ROLE_ADMIN')")
@RequestMapping(method = RequestMethod.POST, value = "/bazes")
@ResponseStatus(HttpStatus.CREATED)
@ResponseBody
public Baz create(@RequestBody final Baz baz) {
baz.setId(Long.parseLong(randomNumeric(2)));
return baz;
}
}

36
spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/dto/Baz.java
View File

@ -1,36 +0,0 @@
package org.baeldung.web.dto;
public class Baz {
private long id;
private String name;
public Baz() {
super();
}
public Baz(final long id, final String name) {
super();
this.id = id;
this.name = name;
}
//
public long getId() {
return id;
}
public void setId(final long id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(final String name) {
this.name = name;
}
}

19
spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/header.html
View File

@ -94,25 +94,6 @@ app.controller('mainCtrl', function($scope,$resource,$http,$rootScope) {
}); });
} }
// baz
$scope.baz = {id:0 , name:"sample baz"};
$scope.bazes = $resource("http://localhost:8081/spring-security-oauth-resource/bazes/:bazId",{bazId:'@id'});
$scope.getBaz = function(){
$scope.baz = $scope.bazes.get({bazId:$scope.baz.id});
}
$scope.createBaz = function(){
if($scope.baz.name.length==0)
{
$rootScope.message = "Baz name can not be empty";
return;
}
$scope.baz.id = null;
$scope.baz = $scope.bazes.save($scope.baz, function(){
$rootScope.message = "Baz Created Successfully";
});
}
}); });
/*]]>*/ /*]]>*/

22
spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/index.html
View File

@ -51,28 +51,6 @@
<a class="btn btn-default" href="#" ng-click="createBar()">Create Bar</a> <a class="btn btn-default" href="#" ng-click="createBar()">Create Bar</a>
</div> </div>
</div> </div>
<br/>
<hr/>
<br/>
<br/>
<br/>
<h1>Baz Details</h1>
<div class="col-sm-6">
<div class="col-sm-12">
<label class="col-sm-2">ID</label>
<span class="col-sm-10"><input class="form-control" ng-model="baz.id"/></span>
</div>
<div class="col-sm-12">
<label class="col-sm-2">Name</label>
<span class="col-sm-10"><input class="form-control" ng-model="baz.name"/></span>
</div>
<div class="col-sm-12">
<a class="btn btn-default" href="#" ng-click="getBaz()">Get Baz</a>
<a class="btn btn-default" href="#" ng-click="createBaz()">Create Baz</a>
</div>
</div>
</div> </div>

48
spring-security-oauth/spring-security-oauth-ui-password/src/test/java/org/baeldung/live/AuthorizationLiveTest.java
View File

@ -7,6 +7,7 @@ import java.util.HashMap;
import java.util.Map; import java.util.Map;
import org.junit.Test; import org.junit.Test;
import org.springframework.http.MediaType;
import com.jayway.restassured.RestAssured; import com.jayway.restassured.RestAssured;
import com.jayway.restassured.response.Response; import com.jayway.restassured.response.Response;
@ -33,56 +34,37 @@ public class AuthorizationLiveTest {
final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1"); final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1");
assertEquals(403, barResponse.getStatusCode()); assertEquals(403, barResponse.getStatusCode());
final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1");
assertEquals(403, bazResponse.getStatusCode());
} }
@Test @Test
public void givenUser_whenUseBarClient_thenOkForBarResourceOnly() { public void givenUser_whenUseBarClient_thenOkForBarResourceReadOnly() {
final String accessToken = obtainAccessToken("barClientIdPassword", "john", "123"); final String accessToken = obtainAccessToken("barClientIdPassword", "john", "123");
final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1");
assertEquals(200, barResponse.getStatusCode());
assertNotNull(barResponse.jsonPath().get("name"));
final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1"); final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1");
assertEquals(403, fooResponse.getStatusCode()); assertEquals(403, fooResponse.getStatusCode());
final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1"); final Response barReadResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1");
assertEquals(403, bazResponse.getStatusCode()); assertEquals(200, barReadResponse.getStatusCode());
assertNotNull(barReadResponse.jsonPath().get("name"));
final Response barWritResponse = RestAssured.given().contentType(MediaType.APPLICATION_JSON_VALUE).header("Authorization", "Bearer " + accessToken).body("{\"id\":1,\"name\":\"MyBar\"}").post("http://localhost:8081/spring-security-oauth-resource/bars");
assertEquals(403, barWritResponse.getStatusCode());
} }
@Test @Test
public void givenAdmin_whenUseFooClient_thenOkForFooAndBazResourceOnly() { public void givenAdmin_whenUseBarClient_thenOkForBarResourceReadWrite() {
final String accessToken = obtainAccessToken("fooClientIdPassword", "tom", "111");
final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1");
assertEquals(200, fooResponse.getStatusCode());
assertNotNull(fooResponse.jsonPath().get("name"));
final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1");
assertEquals(200, bazResponse.getStatusCode());
assertNotNull(bazResponse.jsonPath().get("name"));
final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1");
assertEquals(403, barResponse.getStatusCode());
}
@Test
public void givenAdmin_whenUseBarClient_thenOkForBarAndBazResourceOnly() {
final String accessToken = obtainAccessToken("barClientIdPassword", "tom", "111"); final String accessToken = obtainAccessToken("barClientIdPassword", "tom", "111");
final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1");
assertEquals(403, fooResponse.getStatusCode());
final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1"); final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1");
assertEquals(200, barResponse.getStatusCode()); assertEquals(200, barResponse.getStatusCode());
assertNotNull(barResponse.jsonPath().get("name")); assertNotNull(barResponse.jsonPath().get("name"));
final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1"); final Response barWritResponse = RestAssured.given().contentType(MediaType.APPLICATION_JSON_VALUE).header("Authorization", "Bearer " + accessToken).body("{\"id\":1,\"name\":\"MyBar\"}").post("http://localhost:8081/spring-security-oauth-resource/bars");
assertEquals(200, bazResponse.getStatusCode()); assertEquals(201, barWritResponse.getStatusCode());
assertNotNull(bazResponse.jsonPath().get("name")); assertEquals("MyBar", barWritResponse.jsonPath().get("name"));
final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1");
assertEquals(403, fooResponse.getStatusCode());
} }
} }