Skip to content

Commit c6f288b

Browse files
OKaluznyOKaluzny
committed
Added some security changes
1 parent 79a7d46 commit c6f288b

File tree

5 files changed

+70
-56
lines changed

5 files changed

+70
-56
lines changed

‎Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM openjdk:17
2+
ADD /target/spring-boot-keycloak-docker-postgres.jar spring-boot-keycloak-docker-postgres.jar
3+
ENTRYPOINT ["java", "-jar", "spring-boot-keycloak-docker-postgres.jar"]

‎docker-compose.yml

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,30 @@
11
# Docker Compose file Reference (https://docs.docker.com/compose/compose-file/)
2-
#version: '3.9'
3-
4-
services: # <-- Define services
5-
app: # <-- App backend service
6-
# This service depends on postgres. Start that first.
2+
version: '3.9'
3+
# Define services
4+
services:
5+
# App backend service
6+
app:
7+
# This service depends on postgres db and keycloak auth. Start that first.
78
depends_on:
89
db:
910
condition: service_healthy
1011
keycloak:
1112
condition: service_started
1213
image: spring-boot-keycloak-docker-postgres:latest
14+
build:
15+
context: ./
16+
dockerfile: "Dockerfile"
1317
# Give the container the name web-app. You can change to something else.
1418
container_name: web-app
15-
#hostname: web-app
1619
# Forward the exposed port 8080 on the container to port 8080 on the host machine
1720
ports:
18-
- 8088:8080
21+
- "8088:8080"
1922
networks:
2023
- backend
21-
# entrypoint: [ "java", "-Xms512m", "-Xmx1g", "-jar" ]
22-
db: # <-- Database Service (Postgres)
23-
# Use the Docker Image postgres. This will pull the 12 version.
24+
# entrypoint: [ "java", "-Xms512m", "-Xmx1g", "-jar" ]
25+
# Database Service (Postgres)
26+
db:
27+
# Use the Docker Image postgres. This will pull the 14 version.
2428
image: postgres:14-alpine
2529
# Give the container the name postgres-db. You can change to something else.
2630
container_name: postgres-db
@@ -46,9 +50,10 @@ services: # <-- Define services
4650
keycloak:
4751
image: quay.io/keycloak/keycloak:22.0.1
4852
container_name: keycloak-auth
49-
command: start-dev
53+
command:
54+
- "start-dev"
5055
ports:
51-
- 8180:8080
56+
- "8180:8080"
5257
networks:
5358
- backend
5459
environment:
@@ -61,7 +66,7 @@ services: # <-- Define services
6166
KC_DB_PASSWORD: password
6267
KC_HEALTH_ENABLED: true
6368
depends_on:
64-
- keycloak-db
69+
- keycloak-db
6570
#volumes:
6671
# - /home/keycloak/automobile-realm.json:/opt/keycloak/data/import/automobile-realm.json
6772
# Database Service (Postgres) for Keycloak
@@ -78,6 +83,8 @@ services: # <-- Define services
7883
POSTGRES_PASSWORD: password
7984
networks:
8085
- backend
86+
healthcheck:
87+
test: "pg_isready -U keycloak"
8188

8289
networks:
8390
backend:

‎pom.xml

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -115,29 +115,26 @@
115115
</plugin>
116116

117117
<plugin>
118-
<groupId>com.spotify</groupId>
118+
<groupId>io.fabric8</groupId>
119119
<artifactId>docker-maven-plugin</artifactId>
120-
<version>1.2.2</version>
121-
<configuration>
122-
<imageName>${project.artifactId}</imageName>
123-
<baseImage>openjdk:17</baseImage>
124-
<entryPoint>["java", "-jar", "/${project.build.finalName}.jar"]</entryPoint>
125-
<!-- copy the service's jar file from target into the root directory of the image -->
126-
<resources>
127-
<resource>
128-
<targetPath>/</targetPath>
129-
<directory>${project.build.directory}</directory>
130-
<include>${project.build.finalName}.jar</include>
131-
</resource>
132-
</resources>
133-
</configuration>
120+
<version>0.43.0</version>
134121
<executions>
135122
<execution>
136-
<id>build-image</id>
123+
<id>docker-build</id>
137124
<phase>package</phase>
138125
<goals>
139126
<goal>build</goal>
140127
</goals>
128+
<configuration>
129+
<images>
130+
<image>
131+
<name>spring-boot-keycloak-docker-postgres</name>
132+
<build>
133+
<dockerFile>${project.basedir}/Dockerfile</dockerFile>
134+
</build>
135+
</image>
136+
</images>
137+
</configuration>
141138
</execution>
142139
</executions>
143140
</plugin>

‎src/main/java/com/kaluzny/demo/config/SecurityConfig.java

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
package com.kaluzny.demo.config;
22

3+
import lombok.RequiredArgsConstructor;
4+
import org.springframework.beans.factory.annotation.Value;
35
import org.springframework.context.annotation.Bean;
46
import org.springframework.context.annotation.Configuration;
57
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
68
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
79
import org.springframework.security.core.authority.SimpleGrantedAuthority;
10+
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
11+
import org.springframework.security.oauth2.jwt.JwtDecoder;
12+
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
813
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
914
import org.springframework.security.web.SecurityFilterChain;
1015

@@ -14,26 +19,39 @@
1419

1520
@Configuration
1621
@EnableWebSecurity
22+
//@EnableMethodSecurity
23+
@RequiredArgsConstructor
1724
class SecurityConfig {
1825

26+
@Value("${spring.security.oauth2.resource-server.jwt.jwk-set-uri}")
27+
private String jwkSetUri;
28+
1929
@Bean
2030
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
31+
2132
httpSecurity
2233
.authorizeHttpRequests(registry -> registry
2334
.requestMatchers("/api/**").hasRole("ADMIN")
2435
.anyRequest().authenticated()
2536
)
2637
.oauth2ResourceServer(oauth2Configurer -> oauth2Configurer
27-
.jwt(jwtConfigurer -> jwtConfigurer.jwtAuthenticationConverter(jwt -> {
28-
Map<String, Collection<String>> realmAccess = jwt.getClaim("realm_access");
29-
Collection<String> roles = realmAccess.get("roles");
30-
var grantedAuthorities = roles.stream()
31-
.map(role -> new SimpleGrantedAuthority("ROLE_" + role))
32-
.collect(Collectors.toList());
33-
return new JwtAuthenticationToken(jwt, grantedAuthorities);
34-
})))
35-
;
36-
38+
.jwt(jwtConfigurer -> jwtConfigurer
39+
.jwtAuthenticationConverter(jwt -> {
40+
// Map<String, Collection<String>> realmAccess = jwt.getClaim("realm_access");
41+
Map<String, Collection<String>> realmAccess = jwt.getClaim("resource_access");
42+
Collection<String> roles = realmAccess.get("roles");
43+
var grantedAuthorities = roles.stream()
44+
.map(role -> new SimpleGrantedAuthority("ROLE_" + role))
45+
.collect(Collectors.toList());
46+
return new JwtAuthenticationToken(jwt, grantedAuthorities);
47+
}).decoder(jwtDecoder())));
3748
return httpSecurity.build();
3849
}
39-
}
50+
51+
@Bean
52+
public JwtDecoder jwtDecoder() {
53+
return NimbusJwtDecoder
54+
.withJwkSetUri(jwkSetUri)
55+
.jwsAlgorithm(SignatureAlgorithm.RS256).build();
56+
}
57+
}

‎src/main/resources/application.yml

Lines changed: 5 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,31 +28,20 @@ spring:
2828
resource-server:
2929
jwt:
3030
issuer-uri: http://localhost:8180/realms/automobile-realm
31-
client:
32-
registration:
33-
keycloak:
34-
client-id: automobile-management-api
35-
client-secret: IdaFymmCJaKLhwp1gTnEpBRrE56BLyqy
36-
authorization-grant-type: authorization_code
37-
redirect-uri: http://localhost:8180/login/oauth2/code/automobile-management-api
38-
scope:
39-
- openid
40-
provider:
41-
keycloak:
42-
issuer-uri: http://localhost:8180/realms/automobile-realm
31+
jwk-set-uri: http://localhost:8180/realms/automobile-realm/protocol/openid-connect/certs
32+
4333
# Logger configuration
4434
logging:
4535
pattern:
4636
console: "%d %-5level %logger : %msg%n"
4737
level:
48-
#org.springframework: debug
49-
org.keycloak: info
38+
org.springframework: info
5039
#org.hibernate: debug
5140
# Server configuration
5241
server:
5342
port: 8088 #set your port
54-
servlet:
55-
context-path: /demo
43+
#servlet:
44+
# context-path: /demo
5645
# Swagger configuration
5746
springdoc:
5847
swagger-ui:

0 commit comments

Comments
 (0)