Skip to content

Commit 8294883

Browse files
fmichielssenfmichielssen
committed
Merge pull request 'Improve possibilities to debug OpenID issues' (#20) from feature/23998 into develop
2 parents aa71e35 + 7b815f0 commit 8294883

File tree

6 files changed

+123
-14
lines changed

6 files changed

+123
-14
lines changed

‎src/main/java/eu/openanalytics/containerproxy/ContainerProxyApplication.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,8 @@ private static void setDefaultProperties(SpringApplication app ) {
155155

156156
// disable logging of requests, since this reads part of the requests and therefore undertow is unable to correctly handle those requests
157157
properties.put("logging.level.org.springframework.web.servlet.DispatcherServlet", "INFO");
158+
159+
properties.put("spring.application.name", "ContainerProxy");
158160
app.setDefaultProperties(properties);
159161
}
160162

‎src/main/java/eu/openanalytics/containerproxy/auth/impl/KeycloakAuthenticationBackend.java

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
import javax.inject.Inject;
3131
import javax.servlet.ServletException;
3232

33-
import org.keycloak.OAuth2Constants;
3433
import org.keycloak.adapters.AdapterDeploymentContext;
3534
import org.keycloak.adapters.KeycloakConfigResolver;
3635
import org.keycloak.adapters.KeycloakDeployment;
@@ -44,7 +43,6 @@
4443
import org.keycloak.adapters.springsecurity.authentication.KeycloakLogoutHandler;
4544
import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter;
4645
import org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter;
47-
import org.keycloak.adapters.springsecurity.filter.QueryParamPresenceRequestMatcher;
4846
import org.keycloak.adapters.springsecurity.management.HttpSessionManager;
4947
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken;
5048
import org.keycloak.representations.IDToken;
@@ -53,9 +51,9 @@
5351
import org.springframework.context.ApplicationContext;
5452
import org.springframework.context.annotation.Bean;
5553
import org.springframework.core.env.Environment;
56-
import org.springframework.security.authentication.AuthenticationManager;
5754
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
5855
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
56+
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
5957
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.AuthorizedUrl;
6058
import org.springframework.security.core.Authentication;
6159
import org.springframework.security.core.AuthenticationException;
@@ -83,7 +81,7 @@ public class KeycloakAuthenticationBackend implements IAuthenticationBackend {
8381
Environment environment;
8482

8583
@Inject
86-
AuthenticationManager authenticationManager;
84+
WebSecurityConfigurerAdapter webSecurityConfigurerAdapter;
8785

8886
@Inject
8987
ApplicationContext ctx;
@@ -135,7 +133,7 @@ protected KeycloakAuthenticationProcessingFilter keycloakAuthenticationProcessin
135133
new RequestHeaderRequestMatcher(KeycloakAuthenticationProcessingFilter.AUTHORIZATION_HEADER)
136134
);
137135

138-
KeycloakAuthenticationProcessingFilter filter = new KeycloakAuthenticationProcessingFilter(authenticationManager, requestMatcher);
136+
KeycloakAuthenticationProcessingFilter filter = new KeycloakAuthenticationProcessingFilter(webSecurityConfigurerAdapter.authenticationManagerBean(), requestMatcher);
139137
filter.setSessionAuthenticationStrategy(sessionAuthenticationStrategy());
140138
// Fix: call afterPropertiesSet manually, because Spring doesn't invoke it for some reason.
141139
filter.setApplicationContext(ctx);

‎src/main/java/eu/openanalytics/containerproxy/auth/impl/OpenIDAuthenticationBackend.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
*/
2121
package eu.openanalytics.containerproxy.auth.impl;
2222

23+
import java.io.IOException;
2324
import java.util.ArrayList;
2425
import java.util.Collections;
2526
import java.util.HashSet;
@@ -28,6 +29,9 @@
2829
import java.util.stream.Collectors;
2930

3031
import javax.inject.Inject;
32+
import javax.servlet.ServletException;
33+
import javax.servlet.http.HttpServletRequest;
34+
import javax.servlet.http.HttpServletResponse;
3135

3236
import org.apache.logging.log4j.LogManager;
3337
import org.apache.logging.log4j.Logger;
@@ -36,6 +40,7 @@
3640
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3741
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.AuthorizedUrl;
3842
import org.springframework.security.core.Authentication;
43+
import org.springframework.security.core.AuthenticationException;
3944
import org.springframework.security.core.GrantedAuthority;
4045
import org.springframework.security.core.authority.SimpleGrantedAuthority;
4146
import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
@@ -56,6 +61,7 @@
5661
import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
5762
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
5863
import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
64+
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
5965

6066
import eu.openanalytics.containerproxy.auth.IAuthenticationBackend;
6167
import eu.openanalytics.containerproxy.security.FixedDefaultOAuth2AuthorizationRequestResolver;
@@ -103,6 +109,16 @@ public void configureHttpSecurity(HttpSecurity http, AuthorizedUrl anyRequestCon
103109
.authorizationEndpoint()
104110
.authorizationRequestResolver(new FixedDefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepo, OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI))
105111
.and()
112+
.failureHandler(new AuthenticationFailureHandler() {
113+
114+
@Override
115+
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
116+
AuthenticationException exception) throws IOException, ServletException {
117+
log.error(exception);
118+
response.sendRedirect("/auth-error");
119+
}
120+
121+
})
106122
.userInfoEndpoint()
107123
.userAuthoritiesMapper(createAuthoritiesMapper())
108124
.oidcUserService(createOidcUserService());

‎src/main/java/eu/openanalytics/containerproxy/security/WebSecurityConfig.java

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,19 +29,16 @@
2929
import org.springframework.context.annotation.Configuration;
3030
import org.springframework.core.env.Environment;
3131
import org.springframework.security.authentication.AuthenticationEventPublisher;
32-
import org.springframework.security.authentication.AuthenticationManager;
3332
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
3433
import org.springframework.security.config.annotation.authentication.configuration.GlobalAuthenticationConfigurerAdapter;
3534
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
36-
import org.springframework.security.config.annotation.web.builders.HttpSecurity.RequestMatcherConfigurer;
3735
import org.springframework.security.config.annotation.web.builders.WebSecurity;
3836
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
3937
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
4038
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
4139
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
4240
import org.springframework.security.web.header.writers.StaticHeadersWriter;
4341
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
44-
import org.springframework.security.web.util.matcher.AnyRequestMatcher;
4542

4643
import eu.openanalytics.containerproxy.auth.IAuthenticationBackend;
4744
import eu.openanalytics.containerproxy.auth.UserLogoutHandler;
@@ -128,7 +125,7 @@ protected void configure(HttpSecurity http) throws Exception {
128125

129126
if (auth.hasAuthorization()) {
130127
http.authorizeRequests().antMatchers(
131-
"/login", "/signin/**",
128+
"/login", "/signin/**", "/auth-error",
132129
"/favicon.ico", "/css/**", "/img/**", "/js/**", "/assets/**", "/webjars/**").permitAll();
133130
http
134131
.formLogin()
@@ -166,9 +163,4 @@ public void init(AuthenticationManagerBuilder amb) throws Exception {
166163
};
167164
}
168165

169-
@Bean(name="authenticationManager")
170-
@Override
171-
public AuthenticationManager authenticationManagerBean() throws Exception {
172-
return super.authenticationManagerBean();
173-
}
174166
}

‎src/main/java/eu/openanalytics/containerproxy/ui/AuthErrorController.java

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* ContainerProxy
3+
*
4+
* Copyright (C) 2016-2020 Open Analytics
5+
*
6+
* ===========================================================================
7+
*
8+
* This program is free software: you can redistribute it and/or modify
9+
* it under the terms of the Apache License as published by
10+
* The Apache Software Foundation, either version 2 of the License, or
11+
* (at your option) any later version.
12+
*
13+
* This program is distributed in the hope that it will be useful,
14+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
* Apache License for more details.
17+
*
18+
* You should have received a copy of the Apache License
19+
* along with this program. If not, see <http://www.apache.org/licenses/>
20+
*/
21+
package eu.openanalytics.containerproxy.ui;
22+
23+
import javax.inject.Inject;
24+
import javax.servlet.http.HttpServletRequest;
25+
26+
import org.springframework.core.env.Environment;
27+
import org.springframework.stereotype.Controller;
28+
import org.springframework.ui.ModelMap;
29+
import org.springframework.web.bind.annotation.RequestMapping;
30+
import org.springframework.web.bind.annotation.RequestMethod;
31+
32+
import eu.openanalytics.containerproxy.api.BaseController;
33+
34+
@Controller
35+
public class AuthErrorController extends BaseController {
36+
37+
@Inject
38+
private Environment environment;
39+
40+
@RequestMapping(value = "/auth-error", method = RequestMethod.GET)
41+
public String getAuthErrorPage(ModelMap map, HttpServletRequest request) {
42+
map.put("application_name", environment.getProperty("spring.application.name"));
43+
return "auth-error";
44+
}
45+
46+
}

‎src/main/resources/templates/auth-error.html

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<!--
2+
3+
ContainerProxy
4+
5+
Copyright (C) 2016-2020 Open Analytics
6+
7+
===========================================================================
8+
9+
This program is free software: you can redistribute it and/or modify
10+
it under the terms of the Apache License as published by
11+
The Apache Software Foundation, either version 2 of the License, or
12+
(at your option) any later version.
13+
14+
This program is distributed in the hope that it will be useful,
15+
but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
Apache License for more details.
18+
19+
You should have received a copy of the Apache License
20+
along with this program. If not, see <http://www.apache.org/licenses/>
21+
22+
-->
23+
<!DOCTYPE html>
24+
<html
25+
xmlns:th="http://www.thymeleaf.org"
26+
xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
27+
28+
<head lang="en">
29+
<title th:text="${title}"></title>
30+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
31+
<link rel="stylesheet" media="screen" th:href="@{/webjars/bootstrap/3.4.1/css/bootstrap.min.css}"/>
32+
<link rel="stylesheet" media="screen" th:href="@{/css/login.css}"/>
33+
<link rel="stylesheet" media="screen" type="text/css" href="https://cdn.jsdelivr.net/bootstrap-social/5.1.1/bootstrap-social.css"/>
34+
<link rel="stylesheet" media="screen" type="text/css" href="https://cdn.jsdelivr.net/fontawesome/4.7.0/css/font-awesome.min.css"/>
35+
<script th:src="@{/webjars/jquery/3.5.0/jquery.min.js}"></script>
36+
<script th:src="@{/webjars/bootstrap/3.4.1/js/bootstrap.min.js}"></script>
37+
</head>
38+
39+
<body>
40+
<div class="container">
41+
<h2>An error occurred during the authentication procedure.</h2>
42+
<p><b>If you are a user of <span th:text="${application_name}"></span>:</b> please report this issue to your administrator.</p>
43+
<p><b>If you are an administrator of <span th:text="${application_name}"></span>:</b> this error page is typically shown because of an configuration error in the OpenID setup. See the ShinyProxy logs for more information.</p>
44+
</div>
45+
46+
<style>
47+
h2 {
48+
margin-bottom: 20px;
49+
margin-top: 20px;
50+
}
51+
</style>
52+
53+
</body>
54+
55+
</html>

0 commit comments

Comments
 (0)