Jetty intégré + Spring MVC + sécurité Spring + Https

Question

Je suis un système équipé ces exigences:

• Spring MVC
• jetée 9 intégré
• Spring Security sur Https

printemps Boot pourrait être un bon point de départ, mais cela ne fonctionne pas en raison de notre ancien matériel. Nous devons configurer Spring juste avec ces pièces.

J'ai un code de travail avec Spring MVC, la jetée et de la sécurité du printemps, mais sur Http:

Spring Security:

@Configuration 
@EnableWebSecurity 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Value("${web.security.http.username1}") private String webUser1; 
    @Value("${web.security.http.password1}") private String webPassword1; 

    private static String REALM = "MY_TEST_REALM"; 

    @Autowired 
    protected void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception, BadCredentialsException { 

     auth.inMemoryAuthentication() 
      .withUser(webUser1).password(webPassword1).roles("USER"); 
    } 

    /** 
    * Ignored resources 
    */ 
    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web 
     .ignoring().antMatchers("/css/**", "/js/**", "/webjars/**") 
     .and() 
     .ignoring().antMatchers(HttpMethod.OPTIONS, "/**"); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 

     http  
     .authorizeRequests() 
     .antMatchers("/**").hasRole("USER") 
     .and() 
      .csrf()   
     .and() 
      .httpBasic().authenticationEntryPoint(entryPoint()) 
     .and() 
      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).sessionFixation().none() 
     .and() 
      .headers() 
       .xssProtection() 
      .and() 
       .frameOptions() 
      .and() 
       .httpStrictTransportSecurity() 
       .includeSubDomains(true) 
       .maxAgeInSeconds(60 * 60)    
      .and() 
       .contentTypeOptions() 
      .and() 
       .contentSecurityPolicy("" 
          + "default-src 'self'; " 
          + "script-src 'self'; " 
          + "connect-src 'self'; " 
          + "img-src 'self'; " 
          + "font-src 'self'; " 
          + "frame-ancestors 'none'; " 
          + "base-uri 'self'; " 
          + "form-action 'self'; " 
          + "style-src 'self' 'unsafe-inline' 'unsafe-eval'; ") 
      .and() 
       // internet explorer 
       .addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy","sandbox")); 
    } 

    @Bean 
    public BasicAuthenticationEntryPoint entryPoint() { 
     BasicAuthenticationEntryPoint entryPoint = new BasicAuthenticationEntryPoint(); 
     entryPoint.setRealmName(REALM); 
     return entryPoint; 
    } 
} 

Configuration Jetty:

@Bean 
    public WebAppContext jettyWebAppContext() throws IOException { 

     WebAppContext webUiContext = new WebAppContext(); 
     webUiContext.setContextPath(jettyContextPath); 
     webUiContext.setWar(new ClassPathResource("webapp").getURI().toString()); 
     webUiContext.setInitParameter("dirAllowed", "false"); 
     webUiContext.setParentLoaderPriority(true); 

     GenericWebApplicationContext webApplicationContext = new GenericWebApplicationContext(); 
     webApplicationContext.setParent(applicationContext); 
     webApplicationContext.refresh(); 
     webUiContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, webApplicationContext); 
     webUiContext.addEventListener(new WebMvcContextInit()); 
     webUiContext.addFilter(
      new FilterHolder(new DelegatingFilterProxy( 
        AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)), 
        "/*", EnumSet.allOf(DispatcherType.class) 
     ); 

     return webUiContext; 
    } 



@Bean(initMethod = "start", destroyMethod = "stop") 
    public Server jettyServer() throws IOException { 

JettyConfigurationMapper mappedFile = readJettyAccessConfigurationMapper(); 
      Server server = new Server(new InetSocketAddress(jettyHost, jettyPort)); 
      InetAccessHandler inetAccessHandler = buildInetAccessHandler(mappedFile); 
      server.setHandler(inetAccessHandler); 
      inetAccessHandler.setHandler(jettyWebAppContext()); 
      return server; 
} 

Lorsque Je change la configuration de la jetée en https avec le code suivant, je ne vois que 403 Forbidden dans le navigateur, avec toute forme de sécurité (http auth de base):

@Bean(initMethod = "start", destroyMethod = "stop") 
    public Server jettyServer() throws IOException { 

     System.setProperty("jsse.enableSNIExtension", "false"); 

      HttpConfiguration httpConfig = new HttpConfiguration();   
      httpConfig.setSecureScheme("https"); 
      httpConfig.setSecurePort(jettyPort); 

      HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig); 
      httpsConfig.addCustomizer(new SecureRequestCustomizer()); 

      Resource jksFile = resourceLoader.getResource("classpath:" + myKeystoreJks); 
      SslContextFactory sslContextFactory = new SslContextFactory(); 
      sslContextFactory.setKeyStorePath(jksFile.getURL().toExternalForm()); 
      sslContextFactory.setKeyStorePassword(myKeystorePassword); 

      Server server = new Server(new InetSocketAddress(jettyHost, 8080)); 
      ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), 
        new HttpConnectionFactory(httpsConfig)); 
      sslConnector.setPort(jettyPort); 
      server.setConnectors(new Connector[] { sslConnector }); 
      JettyConfigurationMapper mappedFile = readJettyAccessConfigurationMapper(); 
      InetAccessHandler inetAccessHandler = buildInetAccessHandler(mappedFile); 
      server.setHandler(inetAccessHandler); 
      inetAccessHandler.setHandler(jettyWebAppContext()); 

      return server; 
    } 

Answer 1

Je résolu le problème en utilisant le connecteur du serveur au lieu du constructeur du serveur. Cela fonctionne très bien avec Https.

De

Server server = new Server(new InetSocketAddress(jettyHost, 8080)); 
ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), 
new HttpConnectionFactory(httpsConfig)); 
sslConnector.setPort(jettyPort); 

Pour:

Server server = new Server(); 
ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), 
new HttpConnectionFactory(httpsConfig)); 
sslConnector.setPort(jettyPort); 
sslConnector.setHost(jettyHost);