Remove anonymous controller support (eclipse-hawkbit#2285)

It's not usable feature, and is error prone - someone could left anonymous enabled by mistake Signed-off-by: Avgustin Marinov <[email protected]>
bosch-io · Feb 17, 2025 · cace8bd · cace8bd
1 parent 59f2eed
commit cace8bd
Show file tree

Hide file tree

Showing 9 changed files with 65 additions and 330 deletions.
diff --git a/...n/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerDownloadSecurityConfiguration.java b/...n/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerDownloadSecurityConfiguration.java
@@ -13,12 +13,10 @@
 
 import lombok.extern.slf4j.Slf4j;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.ControllerTenantAwareAuthenticationDetailsSource;
-import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticateAnonymousDownloadFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticateSecurityTokenFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedGatewaySecurityTokenFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedSecurityHeaderFilter;
 import org.eclipse.hawkbit.ddi.rest.api.DdiRestConstants;
-import org.eclipse.hawkbit.im.authentication.SpPermission;
 import org.eclipse.hawkbit.repository.ControllerManagement;
 import org.eclipse.hawkbit.repository.TenantConfigurationManagement;
 import org.eclipse.hawkbit.rest.SecurityManagedConfiguration;
@@ -39,9 +37,7 @@
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
 
 /**
  * Security configuration for the hawkBit server DDI download interface.
@@ -93,8 +89,7 @@ public FilterRegistrationBean<DosFilter> dosFilterDDIDL(final HawkbitSecurityPro
     @Bean
     @Order(300) // higher priority than HawkBit DDI security, so that the DDI DL security is applied first
     protected SecurityFilterChain filterChainDDIDL(final HttpSecurity http) throws Exception {
-        final AuthenticationManager authenticationManager = ControllerSecurityConfiguration.setAuthenticationManager(
-                http, ddiSecurityConfiguration);
+        final AuthenticationManager authenticationManager = ControllerSecurityConfiguration.setAuthenticationManager(http, ddiSecurityConfiguration);
 
         http
                 .securityMatcher(DDI_DL_ANT_MATCHER)
@@ -106,55 +101,35 @@ protected SecurityFilterChain filterChainDDIDL(final HttpSecurity http) throws E
 
         final ControllerTenantAwareAuthenticationDetailsSource authenticationDetailsSource = new ControllerTenantAwareAuthenticationDetailsSource();
 
-        if (ddiSecurityConfiguration.getAuthentication().getAnonymous().isEnabled()) {
-            log.warn(
-                    SecurityManagedConfiguration.ANONYMOUS_CONTROLLER_SECURITY_ENABLED_SHOULD_ONLY_BE_USED_FOR_DEVELOPMENT_PURPOSES);
-
-            final AnonymousAuthenticationFilter anonymousFilter = new AnonymousAuthenticationFilter(
-                    "controllerAnonymousFilter", "anonymous",
-                    List.of(new SimpleGrantedAuthority(SpPermission.SpringEvalExpressions.CONTROLLER_ROLE_ANONYMOUS)));
-            anonymousFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-            http
-                    .securityContext(AbstractHttpConfigurer::disable)
-                    .anonymous(configurer -> configurer.authenticationFilter(anonymousFilter));
-        } else {
-            final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
-                    ddiSecurityConfiguration.getRp().getCnHeader(),
-                    ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
-                    tenantAware, systemSecurityContext);
-            securityHeaderFilter.setAuthenticationManager(authenticationManager);
-            securityHeaderFilter.setCheckForPrincipalChanges(true);
-            securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
-            securityTokenFilter.setAuthenticationManager(authenticationManager);
-            securityTokenFilter.setCheckForPrincipalChanges(true);
-            securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, systemSecurityContext);
-            gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
-            gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
-            gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            final HttpControllerPreAuthenticateAnonymousDownloadFilter controllerAnonymousDownloadFilter = new HttpControllerPreAuthenticateAnonymousDownloadFilter(
-                    tenantConfigurationManagement, tenantAware, systemSecurityContext);
-            controllerAnonymousDownloadFilter.setAuthenticationManager(authenticationManager);
-            controllerAnonymousDownloadFilter.setCheckForPrincipalChanges(true);
-            controllerAnonymousDownloadFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            http
-                    .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
-                    .anonymous(AbstractHttpConfigurer::disable)
-                    .addFilter(securityHeaderFilter)
-                    .addFilter(securityTokenFilter)
-                    .addFilter(gatewaySecurityTokenFilter)
-                    .addFilter(controllerAnonymousDownloadFilter)
-                    .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
-                            (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
-                    .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
-        }
+        final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
+                ddiSecurityConfiguration.getRp().getCnHeader(),
+                ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
+                tenantAware, systemSecurityContext);
+        securityHeaderFilter.setAuthenticationManager(authenticationManager);
+        securityHeaderFilter.setCheckForPrincipalChanges(true);
+        securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+
+        final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
+        securityTokenFilter.setAuthenticationManager(authenticationManager);
+        securityTokenFilter.setCheckForPrincipalChanges(true);
+        securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+
+        final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, systemSecurityContext);
+        gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
+        gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
+        gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+
+        http
+                .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
+                .anonymous(AbstractHttpConfigurer::disable)
+                .addFilter(securityHeaderFilter)
+                .addFilter(securityTokenFilter)
+                .addFilter(gatewaySecurityTokenFilter)
+                .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
+                        (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
+                .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
 
         MdcHandler.Filter.addMdcFilter(http);
 

diff --git a/.../src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerSecurityConfiguration.java b/.../src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerSecurityConfiguration.java
@@ -17,7 +17,6 @@
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedGatewaySecurityTokenFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedSecurityHeaderFilter;
 import org.eclipse.hawkbit.ddi.rest.api.DdiRestConstants;
-import org.eclipse.hawkbit.im.authentication.SpPermission;
 import org.eclipse.hawkbit.repository.ControllerManagement;
 import org.eclipse.hawkbit.repository.TenantConfigurationManagement;
 import org.eclipse.hawkbit.rest.SecurityManagedConfiguration;
@@ -41,9 +40,7 @@
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
 
 /**
  * Security configuration for the hawkBit server DDI interface.
@@ -53,8 +50,7 @@
 @EnableWebSecurity
 class ControllerSecurityConfiguration {
 
-    private static final String[] DDI_ANT_MATCHERS = {
-            DdiRestConstants.BASE_V1_REQUEST_MAPPING + "/**" };
+    private static final String[] DDI_ANT_MATCHERS = { DdiRestConstants.BASE_V1_REQUEST_MAPPING + "/**" };
 
     private final ControllerManagement controllerManagement;
     private final TenantConfigurationManagement tenantConfigurationManagement;
@@ -108,47 +104,36 @@ protected SecurityFilterChain filterChainDDI(final HttpSecurity http) throws Exc
         }
 
         final ControllerTenantAwareAuthenticationDetailsSource authenticationDetailsSource = new ControllerTenantAwareAuthenticationDetailsSource();
-        if (ddiSecurityConfiguration.getAuthentication().getAnonymous().isEnabled()) {
-            log.warn(SecurityManagedConfiguration.ANONYMOUS_CONTROLLER_SECURITY_ENABLED_SHOULD_ONLY_BE_USED_FOR_DEVELOPMENT_PURPOSES);
-
-            final AnonymousAuthenticationFilter anonymousFilter = new AnonymousAuthenticationFilter(
-                    "controllerAnonymousFilter", "anonymous",
-                    List.of(new SimpleGrantedAuthority(SpPermission.SpringEvalExpressions.CONTROLLER_ROLE_ANONYMOUS)));
-            anonymousFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-            http
-                    .securityContext(AbstractHttpConfigurer::disable)
-                    .anonymous(configurer -> configurer.authenticationFilter(anonymousFilter));
-        } else {
-            final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
-                    ddiSecurityConfiguration.getRp().getCnHeader(),
-                    ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
-                    tenantAware, systemSecurityContext);
-            securityHeaderFilter.setAuthenticationManager(authenticationManager);
-            securityHeaderFilter.setCheckForPrincipalChanges(true);
-            securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
-            securityTokenFilter.setAuthenticationManager(authenticationManager);
-            securityTokenFilter.setCheckForPrincipalChanges(true);
-            securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, systemSecurityContext);
-            gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
-            gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
-            gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            http
-                    .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
-                    .anonymous(AbstractHttpConfigurer::disable)
-                    .addFilter(securityHeaderFilter)
-                    .addFilter(securityTokenFilter)
-                    .addFilter(gatewaySecurityTokenFilter)
-                    .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
-                            (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
-                    .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
-        }
+
+        final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
+                ddiSecurityConfiguration.getRp().getCnHeader(),
+                ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
+                tenantAware, systemSecurityContext);
+        securityHeaderFilter.setAuthenticationManager(authenticationManager);
+        securityHeaderFilter.setCheckForPrincipalChanges(true);
+        securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+
+        final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
+        securityTokenFilter.setAuthenticationManager(authenticationManager);
+        securityTokenFilter.setCheckForPrincipalChanges(true);
+        securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+
+        final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, systemSecurityContext);
+        gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
+        gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
+        gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+
+        http
+                .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
+                .anonymous(AbstractHttpConfigurer::disable)
+                .addFilter(securityHeaderFilter)
+                .addFilter(securityTokenFilter)
+                .addFilter(gatewaySecurityTokenFilter)
+                .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
+                        (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
+                .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
 
         MdcHandler.Filter.addMdcFilter(http);
 

diff --git a/...kbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateAnonymousDownloadFilter.java b/...kbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateAnonymousDownloadFilter.java
diff --git a/.../hawkbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateSecurityTokenFilter.java b/.../hawkbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateSecurityTokenFilter.java
@@ -13,7 +13,7 @@
 import org.eclipse.hawkbit.repository.ControllerManagement;
 import org.eclipse.hawkbit.repository.TenantConfigurationManagement;
 import org.eclipse.hawkbit.security.SystemSecurityContext;
-import org.eclipse.hawkbit.security.controller.ControllerPreAuthenticateSecurityTokenFilter;
+import org.eclipse.hawkbit.security.controller.ControllerPreAuthenticatedSecurityTokenFilter;
 import org.eclipse.hawkbit.security.controller.PreAuthenticationFilter;
 import org.eclipse.hawkbit.tenancy.TenantAware;
 import org.slf4j.Logger;
@@ -56,7 +56,7 @@ public HttpControllerPreAuthenticateSecurityTokenFilter(
 
     @Override
     protected PreAuthenticationFilter createControllerAuthenticationFilter() {
-        return new ControllerPreAuthenticateSecurityTokenFilter(tenantConfigurationManagement, controllerManagement,
+        return new ControllerPreAuthenticatedSecurityTokenFilter(tenantConfigurationManagement, controllerManagement,
                 tenantAware, systemSecurityContext);
     }