【第3回】Webアプリケーションの実装(1)¶

package org.debugroom.mynavi.sample.aws.microservice.frontend.webapp.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.AuthenticationEntryPoint;

import org.debugroom.mynavi.sample.aws.microservice.frontend.webapp.app.web.security.CustomUserDetailsService;
import org.debugroom.mynavi.sample.aws.microservice.frontend.webapp.app.web.security.LoginSuccessHandler;
import org.debugroom.mynavi.sample.aws.microservice.frontend.webapp.app.web.security.SessionExpiredDetectingLoginUrlAuthenticationEntryPoint;

@EnableWebSecurity                                                           //(A)
public class SecurityConfig extends WebSecurityConfigurerAdapter {           //(B)

    // omit

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/static/**");                            //(C)
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
             .antMatchers("/favicon.ico").permitAll()                        //(D)
             .antMatchers("/webjars/**").permitAll()
             .antMatchers("/static/**").permitAll()
             .antMatchers("/timeout").permitAll()
             .anyRequest().authenticated()                                   //(E)
             .and()
             .csrf().disable()                                               //(F)
             .formLogin()
             .loginProcessingUrl("/authenticate")                            //(G)
             .loginPage("/login")                                            //(H)
             .successHandler(loginSuccessHandler())                          //(I)
             .failureUrl("/login")                                           //(J)
             .usernameParameter("username")                                  //(K)
             .passwordParameter("password")                                  //(L)
             .permitAll()                                                    //(M)
             .and()
             .exceptionHandling()
             .authenticationEntryPoint(authenticationEntryPoint())           //(O)
             .and()
             .logout()                                                       //(P)
             .logoutSuccessUrl("/login")
             .permitAll();
    }

    @Bean
    public LoginSuccessHandler loginSuccessHandler(){                        //(Q)
        return new LoginSuccessHandler();
    }

    @Bean
    AuthenticationEntryPoint authenticationEntryPoint() {                    //(R)
        return new SessionExpiredDetectingLoginUrlAuthenticationEntryPoint("/login");
    }

    @Bean
    public PasswordEncoder passwordEncoder(){                                //(S)
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Override
    protected UserDetailsService userDetailsService() {                      //(T)
        return new CustomUserDetailsService();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
         auth
             .userDetailsService(userDetailsService())
             .passwordEncoder(passwordEncoder);                              //(U)
    }
}