How to secure Apache Camel rest endpoint with Spring Security and OAuth2 -
i'm working on spring boot application configured sso/oauth2 security. authentication works fine rest controllers , need secure apache camel route rest endpoint.
as understand there several ways how it:
- by adding auth processor route
- by adding policy (springsecurityauthorizationpolicy) route
- by handlers option jetty endpoint
i'm trying adding new auth processor rest endpoint stuck on exception:
org.springframework.security.oauth2.common.exceptions.oauth2exception: no authenticationprovider found org.springframework.security.web.authentication.preauth.preauthenticatedauthenticationtoken
during debugging see org.springframework.security.authentication.providermanager.getproviders() contains 1 provider anonymousauthenticationprovider have register appropriate provider...
can me find right way solve problem please?
@configuration public class securityconfig extends websecurityconfigureradapter { protected void configure(httpsecurity http) throws exception { http.csrf().disable().authorizerequests().anyrequest().permitall(); } @configuration @enableresourceserver protected static class resourceserverconfiguration extends resourceserverconfigureradapter { @value("${oauth2.token.endpoint}") private string tokenendpoint; @bean public resourceservertokenservices tokenservice() { remotetokenservices tokenservices = new remotetokenservices(); tokenservices.setclientid("clientid"); tokenservices.setclientsecret("clientsecret"); tokenservices.setchecktokenendpointurl(tokenendpoint); return tokenservices; } @override public void configure(httpsecurity http) throws exception { http.authorizerequests().anyrequest().authenticated(); } } } @configuration public class embeddedserverroute { @bean public routesbuilder embeddedserver() { return new routebuilder() { @override public void configure() throws exception { restconfiguration().component("jetty").port("8081").bindingmode(restbindingmode.json); } }; } } @component public class resttestroute extends routebuilder { @autowired private authprocessor authprocessor; @override public void configure() throws exception { from("rest:get:/test").process(authprocessor).to("mock:end").end(); } } @component public class authprocessor implements processor { @autowired private authenticationmanager authenticationmanager; private tokenextractor tokenextractor = new bearertokenextractor(); private authenticationdetailssource<httpservletrequest, ?> authenticationdetailssource = new oauth2authenticationdetailssource(); @override public void process(exchange exchange) throws exception { httpservletrequest request = exchange.getin().getbody(httpservletrequest.class); subject subject = new subject(); authentication auth = getauth(request); subject.getprincipals().add(auth); exchange.getin().setheader(exchange.authentication, subject); } private authentication getauth(httpservletrequest request) throws oauth2exception { authentication authentication = null; try { authentication = tokenextractor.extract(request); if (authentication != null) { request.setattribute(oauth2authenticationdetails.access_token_value, authentication.getprincipal()); if (authentication instanceof abstractauthenticationtoken) { abstractauthenticationtoken needsdetails = (abstractauthenticationtoken) authentication; needsdetails.setdetails(authenticationdetailssource.builddetails(request)); } return authenticationmanager.authenticate(authentication); } } catch (exception e) { throw new oauth2exception(e.getmessage()); } throw new oauth2exception("not authorized view resource"); } }
as final solution decided use spring boot embedded servlet container instead of apache camel rest component. secured spring security. done creating additional beans:
@bean public servletregistrationbean servletregistrationbean() { springserverservlet serverservlet = new springserverservlet(); servletregistrationbean regbean = new servletregistrationbean(serverservlet, "/camel/*"); map<string, string> params = new hashmap<>(); params.put("org.restlet.component", "restletcomponent"); regbean.setinitparameters(params); return regbean; } @bean public component restletcomponent() { return new component(); } @bean public restletcomponent restletcomponentservice() { return new restletcomponent(restletcomponent()); }
Comments
Post a Comment