Security configuration in multiple jars - spring-security

Question

I want to ask if it's possible to have my security configuration spread in multiple jars. For instance I have my project (myproj.war) that defines all the security rules in a #Configuration, but I also have my rest #Configuration in a separate jar(rest.jar) so people can put it in their classpath and immediately have the /rest/* support.
This all works good until the point I want to add security to the rest configuration. I add the #Configuration with the #EnableWebSecurity in my rest.jar but it doesn't get picked up! I have a breakpoint in my DigestAuthenticationFilter and it never goes through it!!! However I can see that the bean is being created during startup the filter itself is never triggered!
EDIT:
Here's my war's Security web configuration:
#Order(value = 0)
public class StorefrontWebConfig implements WebApplicationInitializer {
#Override
public void onStartup(final ServletContext servletContext) throws ServletException {
final AnnotationConfigWebApplicationContext webCtx = new AnnotationConfigWebApplicationContext();
webCtx.register(StorefrontSecurityConfig.class);
webCtx.register(StorefrontMVCConfig.class);
servletContext.addListener(new RequestContextListener());
servletContext.addListener(new HttpSessionMutexListener());
servletContext.addListener(new ContextLoaderListener(webCtx));
servletContext.addListener(new BroadcasterCreator());
/* JAWR */
.... jawr definitions ....
/* Spring Delegating Dispatcher Servlet */
final Servlet dispatcherServlet = new DispatcherServlet(webCtx);
final ServletRegistration.Dynamic dispatcherServletReg = servletContext.addServlet("dispatcherServlet", dispatcherServlet);
dispatcherServletReg.setLoadOnStartup(1);
dispatcherServletReg.setInitParameter("contextConfigLocation", "");
dispatcherServletReg.addMapping("/");
/* Character Encoding Filter */
final FilterRegistration charEncodingfilterReg = servletContext.addFilter("characterEncodingFilter", CharacterEncodingFilter.class);
charEncodingfilterReg.setInitParameter("encoding", "UTF-8");
charEncodingfilterReg.setInitParameter("forceEncoding", "true");
charEncodingfilterReg.addMappingForServletNames(null, false, dispatcherServletReg.getName());
/* Resources Filter */
final FilterRegistration resourcesFilterReg = servletContext.addFilter("resourceFilter", ResourceFilter.class);
resourcesFilterReg.addMappingForUrlPatterns(null, false, "/resources/*");
resourcesFilterReg.addMappingForUrlPatterns(null, false, "/webjars/*");
/* Storefront Delegating Filter */
final FilterRegistration storefrontFilterChainReg = servletContext.addFilter("storefrontFilterChain", DelegatingFilterProxy.class);
storefrontFilterChainReg.addMappingForServletNames(null, false, dispatcherServletReg.getName());
/* HiddenHttpMethodFilter Filter */
final FilterRegistration hiddenHttpMethodFilterReg = servletContext.addFilter("hiddenHttpMethodFilter", HiddenHttpMethodFilter.class);
hiddenHttpMethodFilterReg.addMappingForServletNames(null, false, dispatcherServletReg.getName());
/* Spring Security Delegating Filter */
final FilterRegistration springSecurityFilterChainReg = servletContext.addFilter("springSecurityFilterChain", DelegatingFilterProxy.class);
springSecurityFilterChainReg.addMappingForServletNames(EnumSet.<DispatcherType>of(DispatcherType.REQUEST, DispatcherType.ERROR, DispatcherType.ASYNC), false, dispatcherServletReg.getName());
}
}
also the security configuration:
#Configuration
#EnableWebSecurity
public class StorefrontSecurityConfig {
#Autowired
private ObjectPostProcessor<Object> opp;
#Resource
public ApplicationContext context;
// #formatter:off
#Order(1)
#Configuration
public static class CheckoutStorefrontSecurityConfig extends WebSecurityConfigurerAdapter {
#Resource
public ApplicationContext context;
#Override
public void configure(final WebSecurity web) throws Exception {
web.ignoring().antMatchers("/resources/**");
}
#Override
protected void configure(final HttpSecurity http) throws Exception {
http
.headers().frameOptions().disable()
.antMatcher("/checkout/**")
.anonymous().principal("anonymous").authorities("ROLE_ANONYMOUS").and()
.sessionManagement().sessionAuthenticationStrategy(new NullAuthenticatedSessionStrategy()).and()
.authorizeRequests().and()
.requiresChannel()
.antMatchers("/checkout*").requiresSecure()
.antMatchers("/checkout/**").requiresSecure()
.antMatchers("/checkout/j_spring_security_check").requiresSecure().and()
.formLogin()
.loginProcessingUrl("/checkout/j_spring_security_check").permitAll()
.loginPage("/checkout/login")
.failureHandler(defaultCheckoutAuthenticationFailureHandler())
.successHandler(defaultLoginCheckoutGUIDAuthenticationSuccessHandler()).and()
.logout()
.logoutUrl("/j_spring_security_logout")
.logoutSuccessHandler((SimpleUrlLogoutSuccessHandler) context.getBean(StoreFrontLogoutSuccessHandler.NAME)).and()
.rememberMe().rememberMeServices(context.getBean(DefaultRememberMeServices.class)).and()
.portMapper()
.http(80).mapsTo(443)
.http(8111).mapsTo(8112)
.http(8080).mapsTo(8443).and()
.exceptionHandling().accessDeniedHandler(defaultCheckoutAccessDeniedHandler()).and()
.requestCache().requestCache(httpSessionRequestCache());
}
#Bean(name = {"defaultLoginCheckoutGUIDAuthenticationSuccessHandler", "loginCheckoutGUIDAuthenticationSuccessHandler"})
protected AuthenticationSuccessHandler defaultLoginCheckoutGUIDAuthenticationSuccessHandler() {
final GUIDAuthenticationSuccessHandler guidAuthenticationSuccessHandler = new GUIDAuthenticationSuccessHandler();
guidAuthenticationSuccessHandler.setAuthenticationSuccessHandler(defaultLoginCheckoutAuthenticationSuccessHandler());
return guidAuthenticationSuccessHandler;
}
#Bean(name = {"defaultLoginCheckoutAuthenticationSuccessHandler", "loginCheckoutAuthenticationSuccessHandler"})
protected AuthenticationSuccessHandler defaultLoginCheckoutAuthenticationSuccessHandler() {
final StoreFrontAuthenticationSuccessHandler storeFrontAuthenticationSuccessHandler = new StoreFrontAuthenticationSuccessHandler();
storeFrontAuthenticationSuccessHandler.setDefaultTargetUrl("/checkout");
final Map<UiExperienceLevel, Boolean> forceDefaultTargetForUiExperienceLevel = new HashMap<UiExperienceLevel, Boolean>();
forceDefaultTargetForUiExperienceLevel.put(UiExperienceLevel.MOBILE, Boolean.TRUE);
forceDefaultTargetForUiExperienceLevel.put(UiExperienceLevel.NORMAL, Boolean.TRUE);
storeFrontAuthenticationSuccessHandler.setForceDefaultTargetForUiExperienceLevel(forceDefaultTargetForUiExperienceLevel);
return storeFrontAuthenticationSuccessHandler;
}
#Bean(name = {"defaultCheckoutAuthenticationFailureHandler", "checkoutAuthenticationFailureHandler"})
protected AuthenticationFailureHandler defaultCheckoutAuthenticationFailureHandler() {
final LoginAuthenticationFailureHandler loginAuthenticationFailureHandler = new LoginAuthenticationFailureHandler();
loginAuthenticationFailureHandler.setDefaultFailureUrl("/checkout/login?failed=auth");
return loginAuthenticationFailureHandler;
}
#Bean(name = {"defaultCheckoutAccessDeniedHandler", "checkoutAccessDeniedHandler"})
protected AccessDeniedHandler defaultCheckoutAccessDeniedHandler() {
final AccessDeniedHandlerImpl accessDeniedHandler = new AccessDeniedHandlerImpl();
accessDeniedHandler.setErrorPage("/403");
return accessDeniedHandler;
}
}
#Order(2)
#Configuration
public static class DefaultStorefrontSecurityConfig extends WebSecurityConfigurerAdapter {
#Resource
public ApplicationContext context;
#Override
public void configure(final WebSecurity web) throws Exception {
web.ignoring().antMatchers("/resources/**");
}
#Override
protected void configure(final HttpSecurity http) throws Exception {
http
.headers().frameOptions().disable()
.anonymous().principal("anonymous").authorities("ROLE_ANONYMOUS").and()
.sessionManagement().sessionAuthenticationStrategy(new NullAuthenticatedSessionStrategy()).and()
.authorizeRequests()
.antMatchers("/my-account*").hasRole("CUSTOMERGROUP")
.antMatchers("/my-account/**").hasRole("CUSTOMERGROUP").and()
.requiresChannel()
.antMatchers("/login").requiresSecure()
.antMatchers("/login/**").requiresSecure()
.antMatchers("/register/**").requiresSecure()
.antMatchers("/signin/**").requiresSecure()
.antMatchers("/j_spring_security_check").requiresSecure()
.antMatchers("/logout").requiresSecure()
.antMatchers("/**").requiresInsecure().and()
.formLogin()
.loginProcessingUrl("/j_spring_security_check").permitAll()
.loginPage("/login").permitAll()
.defaultSuccessUrl("/my-account", false)
.failureHandler(defaultAuthenticationFailureHandler())
.successHandler(defaultLoginGUIDAuthenticationSuccessHandler()).and()
.logout()
.logoutUrl("/j_spring_security_logout")
.logoutSuccessHandler(context.getBean(StoreFrontLogoutSuccessHandler.class)).and() .rememberMe().rememberMeServices(context.getBean(DefaultRememberMeServices.class)).and()
.portMapper()
.http(80).mapsTo(443)
.http(8111).mapsTo(8112)
.http(8080).mapsTo(8443).and()
.exceptionHandling().accessDeniedHandler(defaultAccessDeniedHandler()).and()
.requestCache().requestCache(httpSessionRequestCache());
}
#Bean(name = {"defaultLoginGUIDAuthenticationSuccessHandler", "loginGUIDAuthenticationSuccessHandler"})
protected AuthenticationSuccessHandler defaultLoginGUIDAuthenticationSuccessHandler() {
final GUIDAuthenticationSuccessHandler guidAuthenticationSuccessHandler = new GUIDAuthenticationSuccessHandler();
guidAuthenticationSuccessHandler.setAuthenticationSuccessHandler(defaultLoginAuthenticationSuccessHandler());
return guidAuthenticationSuccessHandler;
}
#Bean(name = {"defaultLoginAuthenticationSuccessHandler", "loginAuthenticationSuccessHandler"})
protected StoreFrontAuthenticationSuccessHandler defaultLoginAuthenticationSuccessHandler() {
final StoreFrontAuthenticationSuccessHandler storeFrontAuthenticationSuccessHandler = new StoreFrontAuthenticationSuccessHandler();
storeFrontAuthenticationSuccessHandler.setDefaultTargetUrl("/my-account");
storeFrontAuthenticationSuccessHandler.setUseReferer(true);
storeFrontAuthenticationSuccessHandler.setRequestCache(httpSessionRequestCache());
final Map<UiExperienceLevel, Boolean> forceDefaultTargetForUiExperienceLevel = new HashMap<UiExperienceLevel, Boolean>();
forceDefaultTargetForUiExperienceLevel.put(UiExperienceLevel.MOBILE, Boolean.TRUE);
forceDefaultTargetForUiExperienceLevel.put(UiExperienceLevel.NORMAL, Boolean.FALSE);
storeFrontAuthenticationSuccessHandler.setForceDefaultTargetForUiExperienceLevel(forceDefaultTargetForUiExperienceLevel);
return storeFrontAuthenticationSuccessHandler;
}
#Bean(name = {"defaultAuthenticationFailureHandler", "authenticationFailureHandler"})
protected AuthenticationFailureHandler defaultAuthenticationFailureHandler() {
final LoginAuthenticationFailureHandler loginAuthenticationFailureHandler = new LoginAuthenticationFailureHandler();
loginAuthenticationFailureHandler.setDefaultFailureUrl("/login?failed=auth");
return loginAuthenticationFailureHandler;
}
#Bean(name = {"defaultAccessDeniedHandler", "accessDeniedHandler"})
protected AccessDeniedHandler defaultAccessDeniedHandler() {
final AccessDeniedHandlerImpl accessDeniedHandler = new AccessDeniedHandlerImpl();
accessDeniedHandler.setErrorPage("/403");
return accessDeniedHandler;
}
}
#Bean(name = {"defaultAuthenticationManager", "authenticationManager"})
public AuthenticationManager defaultAuthenticationManager() throws Exception {
return new AuthenticationManagerBuilder(opp).userDetailsService(context.getBean(PlatformUserDetailsService.class)).passwordEncoder(new Md5PasswordEncoder()).and().build();
}
// #formatter:on
#Bean(name = { "defaultRedirectStrategy", "redirectStrategy" })
protected DefaultRedirectStrategy defaultRedirectStrategy() {
return new DefaultRedirectStrategy();
}
#Bean(name = { "httpSessionRequestCache", "requestCache" })
protected static HttpSessionRequestCache httpSessionRequestCache() {
return new WebHttpSessionRequestCache();
}
/* Remember-me services */
#Bean(name = { "defaultRememberMeAuthenticationFilter", "rememberMeAuthenticationFilter" })
protected RememberMeAuthenticationFilter defaultRememberMeAuthenticationFilter() throws Exception {
return new RememberMeAuthenticationFilter(defaultAuthenticationManager(), context.getBean(DefaultRememberMeServices.class));
}
#Bean(name = { "defaultRememberMeAuthenticationProvider", "rememberMeAuthenticationProvider" })
protected RememberMeAuthenticationProvider defaultRememberMeAuthenticationProvider() {
return new RememberMeAuthenticationProvider("storefront");
}
}
And then here's the REST web-config:
#Order(value = 1)
public class RestServicesWebConfig implements WebApplicationInitializer {
#Override
public void onStartup(ServletContext servletContext) throws ServletException {
AnnotationConfigWebApplicationContext webCtx = new AnnotationConfigWebApplicationContext();
webCtx.register(RestServicesSecurityConfig.class);
webCtx.register(RestServicesConfig.class);
servletContext.addListener(new RequestContextListener());
servletContext.addListener(new HttpSessionMutexListener());
/* Spring REST Delegating Dispatcher Servlet */
Servlet restDispatcherServlet = new RepositoryRestDispatcherServlet(webCtx);
ServletRegistration.Dynamic restDispatcherServletReg = servletContext.addServlet("restDispatcherServlet", restDispatcherServlet);
restDispatcherServletReg.setLoadOnStartup(1);
restDispatcherServletReg.addMapping("/rest/*");
/* Character Encoding Filter */
FilterRegistration charEncodingfilterReg = servletContext.addFilter("restCharacterEncodingFilter", CharacterEncodingFilter.class);
charEncodingfilterReg.setInitParameter("encoding", "UTF-8");
charEncodingfilterReg.setInitParameter("forceEncoding", "true");
charEncodingfilterReg.addMappingForServletNames(null, false, restDispatcherServletReg.getName());
FilterRegistration corsFilter = servletContext.addFilter("corsFilter", CorsFilter.class);
corsFilter.addMappingForUrlPatterns(null, false, "/*");
/* Spring Security Delegating Filter */
FilterRegistration springSecurityFilterChainReg = servletContext.getFilterRegistration("springSecurityFilterChain");
springSecurityFilterChainReg.addMappingForServletNames(EnumSet.<DispatcherType>of(DispatcherType.REQUEST, DispatcherType.ERROR, DispatcherType.ASYNC), false, restDispatcherServletReg.getName());
}
}
and the security config of the rest module:
#Order(3)
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class RestServicesSecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private ObjectPostProcessor<Object> opp;
#Resource
public ApplicationContext context;
#Resource(name = PlatformUserDetailsService.NAME)
private PlatformUserDetailsService platformUserDetailsService;
// #formatter:off
#Override
protected void configure(final HttpSecurity http) throws Exception {
http
.antMatcher("/rest/**")
.exceptionHandling()
.authenticationEntryPoint(defaultDigestAuthenticationEntryPoint()).and()
.authorizeRequests()
.anyRequest().authenticated().and()
.requiresChannel()
.antMatchers("/rest/**").requiresSecure().and()
.logout()
.logoutUrl("/logout").and()
.addFilter(defaultDigestAuthenticationFilter());
}
// #formatter:on
/* Digest authentication */
#Bean(name = { "defaultDigestAuthenticationFilter", "digestFilter" })
protected DigestAuthenticationFilter defaultDigestAuthenticationFilter() {
DigestAuthenticationFilter filter = new DigestAuthenticationFilter();
filter.setUserDetailsService(context.getBean(PlatformUserDetailsService.class));
filter.setAuthenticationEntryPoint(defaultDigestAuthenticationEntryPoint());
return filter;
}
#Bean(name = { "defaultDigestAuthenticationEntryPoint", "digestEntryPoint" })
protected DigestAuthenticationEntryPoint defaultDigestAuthenticationEntryPoint() {
DigestAuthenticationEntryPoint entryPoint = new DigestAuthenticationEntryPoint();
entryPoint.setKey("key");
entryPoint.setRealmName("Contacts Realm via Digest Authentication");
entryPoint.setNonceValiditySeconds(10);
return entryPoint;
}
#Bean(name = { "defaultRestLoginAuthenticationSuccessHandler", "restLoginAuthenticationSuccessHandler" })
protected AuthenticationSuccessHandler defaultRestLoginAuthenticationSuccessHandler() {
return new RestAuthenticationSuccessHandler();
}
#Bean(name = {"defaultAuthenticationManager", "authenticationManager"})
public AuthenticationManager defaultAuthenticationManager() throws Exception {
return new AuthenticationManagerBuilder(opp).userDetailsService(context.getBean(PlatformUserDetailsService.class)).passwordEncoder(new Md5PasswordEncoder()).and().build();
}
}