From 79cd0c273eda51029749e9f7783cd03763a3a068 Mon Sep 17 00:00:00 2001 From: viktor Date: Tue, 23 Jun 2020 15:39:19 +0300 Subject: [PATCH] Implemented OAuth2Controller --- .../server/controller/AuthController.java | 14 ---- .../server/controller/OAuth2Controller.java | 73 ++++++++++++++++++- .../service/security/permission/Resource.java | 4 +- .../server/dao/oauth2/OAuth2ServiceImpl.java | 7 +- 4 files changed, 77 insertions(+), 21 deletions(-) diff --git a/application/src/main/java/org/thingsboard/server/controller/AuthController.java b/application/src/main/java/org/thingsboard/server/controller/AuthController.java index 2cf9e5d86b..adffcba3d6 100644 --- a/application/src/main/java/org/thingsboard/server/controller/AuthController.java +++ b/application/src/main/java/org/thingsboard/server/controller/AuthController.java @@ -84,9 +84,6 @@ public class AuthController extends BaseController { @Autowired private AuditLogService auditLogService; - @Autowired - private OAuth2Service oauth2Service; - @PreAuthorize("isAuthenticated()") @RequestMapping(value = "/auth/user", method = RequestMethod.GET) public @ResponseBody User getUser() throws ThingsboardException { @@ -336,15 +333,4 @@ public class AuthController extends BaseController { throw handleException(e); } } - - // TODO ask why POST - @RequestMapping(value = "/noauth/oauth2Clients", method = RequestMethod.POST) - @ResponseBody - public List getOAuth2Clients(HttpServletRequest request) throws ThingsboardException { - try { - return oauth2Service.getOAuth2Clients(request.getServerName()); - } catch (Exception e) { - throw handleException(e); - } - } } diff --git a/application/src/main/java/org/thingsboard/server/controller/OAuth2Controller.java b/application/src/main/java/org/thingsboard/server/controller/OAuth2Controller.java index c0c3034c7b..31bc3e9fff 100644 --- a/application/src/main/java/org/thingsboard/server/controller/OAuth2Controller.java +++ b/application/src/main/java/org/thingsboard/server/controller/OAuth2Controller.java @@ -17,12 +17,23 @@ package org.thingsboard.server.controller; import lombok.extern.slf4j.Slf4j; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.http.HttpStatus; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.*; import org.thingsboard.server.common.data.exception.ThingsboardException; +import org.thingsboard.server.common.data.id.EntityId; +import org.thingsboard.server.common.data.id.TenantId; +import org.thingsboard.server.common.data.oauth2.OAuth2ClientInfo; import org.thingsboard.server.common.data.oauth2.OAuth2ClientRegistration; +import org.thingsboard.server.common.data.oauth2.OAuth2ClientsParams; +import org.thingsboard.server.common.data.security.Authority; import org.thingsboard.server.dao.oauth2.OAuth2Service; import org.thingsboard.server.queue.util.TbCoreComponent; +import org.thingsboard.server.service.security.permission.Operation; +import org.thingsboard.server.service.security.permission.Resource; + +import javax.servlet.http.HttpServletRequest; +import java.util.List; @RestController @TbCoreComponent @@ -34,14 +45,68 @@ public class OAuth2Controller extends BaseController { @Autowired private OAuth2Service oauth2Service; - @PreAuthorize("hasAnyAuthority('SYS_ADMIN')") - @RequestMapping(value = "/oauth2/config/{" + REGISTRATION_ID + "}", method = RequestMethod.GET) + // TODO ask why POST + @RequestMapping(value = "/noauth/oauth2Clients", method = RequestMethod.POST) + @ResponseBody + public List getOAuth2Clients(HttpServletRequest request) throws ThingsboardException { + try { + return oauth2Service.getOAuth2Clients(request.getServerName()); + } catch (Exception e) { + throw handleException(e); + } + } + + @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')") + @RequestMapping(value = "/oauth2/currentOAuth2Configuration", method = RequestMethod.GET, produces = "application/json") + @ResponseBody + public OAuth2ClientsParams getCurrentOAuth2ClientsParams() throws ThingsboardException { + try { + Authority authority = getCurrentUser().getAuthority(); + checkOAuth2ConfigPermissions(Operation.READ); + OAuth2ClientsParams oAuth2ClientsParams = null; + if (Authority.SYS_ADMIN.equals(authority)) { + oAuth2ClientsParams = oauth2Service.getSystemOAuth2ClientsParams(TenantId.SYS_TENANT_ID); + } else if (Authority.TENANT_ADMIN.equals(authority)) { + oAuth2ClientsParams = oauth2Service.getTenantOAuth2ClientsParams(getCurrentUser().getTenantId()); + } + return oAuth2ClientsParams; + } catch (Exception e) { + throw handleException(e); + } + } + + @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')") + @RequestMapping(value = "/oauth2/oAuth2Configuration", method = RequestMethod.POST) + @ResponseStatus(value = HttpStatus.OK) + public OAuth2ClientsParams saveLoginWhiteLabelParams(@RequestBody OAuth2ClientsParams oAuth2ClientsParams) throws ThingsboardException { + try { + Authority authority = getCurrentUser().getAuthority(); + checkOAuth2ConfigPermissions(Operation.WRITE); + OAuth2ClientsParams savedOAuth2ClientsParams = null; + if (Authority.SYS_ADMIN.equals(authority)) { + savedOAuth2ClientsParams = oauth2Service.saveSystemOAuth2ClientsParams(oAuth2ClientsParams); + } else if (Authority.TENANT_ADMIN.equals(authority)) { + savedOAuth2ClientsParams = oauth2Service.saveTenantOAuth2ClientsParams(getCurrentUser().getTenantId(), oAuth2ClientsParams); + } + return savedOAuth2ClientsParams; + } catch (Exception e) { + throw handleException(e); + } + } + + @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')") + @RequestMapping(value = "/oauth2/isOAuth2ConfigurationAllowed", method = RequestMethod.GET) @ResponseBody - public OAuth2ClientRegistration getClientRegistrationById(@PathVariable(REGISTRATION_ID) String registrationId) throws ThingsboardException { + public Boolean isOAuth2ConfigurationAllowed() throws ThingsboardException { try { - return oauth2Service.getClientRegistration(registrationId); + return oauth2Service.isOAuth2ClientRegistrationAllowed(getTenantId()); } catch (Exception e) { throw handleException(e); } } + + + private void checkOAuth2ConfigPermissions(Operation operation) throws ThingsboardException { + accessControlService.checkPermission(getCurrentUser(), Resource.OAUTH2_CONFIGURATION, operation); + } } diff --git a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java index a66b822fca..dfdea59e05 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java +++ b/application/src/main/java/org/thingsboard/server/service/security/permission/Resource.java @@ -31,7 +31,9 @@ public enum Resource { RULE_CHAIN(EntityType.RULE_CHAIN), USER(EntityType.USER), WIDGETS_BUNDLE(EntityType.WIDGETS_BUNDLE), - WIDGET_TYPE(EntityType.WIDGET_TYPE); + WIDGET_TYPE(EntityType.WIDGET_TYPE), + OAUTH2_CONFIGURATION(), + ; private final EntityType entityType; diff --git a/dao/src/main/java/org/thingsboard/server/dao/oauth2/OAuth2ServiceImpl.java b/dao/src/main/java/org/thingsboard/server/dao/oauth2/OAuth2ServiceImpl.java index e9d3b76395..da783ea297 100644 --- a/dao/src/main/java/org/thingsboard/server/dao/oauth2/OAuth2ServiceImpl.java +++ b/dao/src/main/java/org/thingsboard/server/dao/oauth2/OAuth2ServiceImpl.java @@ -75,14 +75,17 @@ public class OAuth2ServiceImpl implements OAuth2Service { private final Map clientRegistrationsByRegistrationId = new ConcurrentHashMap<>(); + + // TODO add field that invalidates cache in case write to cache fails after successful saving in DB @PostConstruct public void init(){ - + OAuth2ClientsParams systemOAuth2ClientsParams = getSystemOAuth2ClientsParams(TenantId.SYS_TENANT_ID); + // TODO get all attributes with key OAUTH2_CLIENT_REGISTRATIONS_PARAMS and put into the map } @Override public OAuth2ClientRegistration getClientRegistration(String registrationId) { - return null; + return clientRegistrationsByRegistrationId.get(registrationId); } @Override