extends the functionality of oauth in Stirling PDF 2.

2024-05-18 23:47:05 +02:00
parent b904a46bca
commit ffec5f7b54
52 changed files with 1055 additions and 786 deletions
--- a/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2AuthenticationFailureHandler.java
+++ b/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2AuthenticationFailureHandler.java
@@ -2,22 +2,24 @@ package stirling.software.SPDF.config.security.oauth2;

 import java.io.IOException;

+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
 import org.springframework.security.oauth2.core.OAuth2Error;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
-import org.springframework.stereotype.Component;

 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;

-@Component
 public class CustomOAuth2AuthenticationFailureHandler
        extends SimpleUrlAuthenticationFailureHandler {

+    private static final Logger logger =
+            LoggerFactory.getLogger(CustomOAuth2AuthenticationFailureHandler.class);
+
    @Override
    public void onAuthenticationFailure(
            HttpServletRequest request,
@@ -26,14 +28,21 @@ public class CustomOAuth2AuthenticationFailureHandler
            throws IOException, ServletException {
        if (exception instanceof OAuth2AuthenticationException) {
            OAuth2Error error = ((OAuth2AuthenticationException) exception).getError();
+
+            String errorCode = error.getErrorCode();
+
+            if (error.getErrorCode().equals("Password must not be null")) {
+                errorCode = "userAlreadyExistsWeb";
+            }
+            logger.error("OAuth2 Authentication error: " + errorCode);
            getRedirectStrategy()
-                    .sendRedirect(request, response, "/login?error=oAuth::" + error.getErrorCode());
+                    .sendRedirect(request, response, "/logout?erroroauth=" + errorCode);
+            return;
        } else if (exception instanceof LockedException) {
-            getRedirectStrategy().sendRedirect(request, response, "/login?error=locked");
-        } else if (exception instanceof UsernameNotFoundException) {
-            getRedirectStrategy()
-                    .sendRedirect(request, response, "/login?error=oauth2AuthenticationError");
+            logger.error("Account locked: ", exception);
+            getRedirectStrategy().sendRedirect(request, response, "/logout?error=locked");
        } else {
+            logger.error("Unhandled authentication exception", exception);
            super.onAuthenticationFailure(request, response, exception);
        }
    }
--- a/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2AuthenticationSuccessHandler.java
+++ b/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2AuthenticationSuccessHandler.java
@@ -2,33 +2,43 @@ package stirling.software.SPDF.config.security.oauth2;

 import java.io.IOException;

+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
 import org.springframework.security.web.savedrequest.SavedRequest;
-import org.springframework.stereotype.Component;

 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
+import stirling.software.SPDF.config.security.LoginAttemptService;
 import stirling.software.SPDF.config.security.UserService;
 import stirling.software.SPDF.model.ApplicationProperties;
 import stirling.software.SPDF.model.ApplicationProperties.Security.OAUTH2;
 import stirling.software.SPDF.model.AuthenticationType;
 import stirling.software.SPDF.utils.RequestUriUtils;

-@Component
 public class CustomOAuth2AuthenticationSuccessHandler
        extends SavedRequestAwareAuthenticationSuccessHandler {

-    ApplicationProperties applicationProperties;
-    UserService userService;
+    private LoginAttemptService loginAttemptService;
+
+    private static final Logger logger =
+            LoggerFactory.getLogger(CustomOAuth2AuthenticationSuccessHandler.class);
+
+    private ApplicationProperties applicationProperties;
+    private UserService userService;

    public CustomOAuth2AuthenticationSuccessHandler(
-            ApplicationProperties applicationProperties, UserService userService) {
+            final LoginAttemptService loginAttemptService,
+            ApplicationProperties applicationProperties,
+            UserService userService) {
        this.applicationProperties = applicationProperties;
        this.userService = userService;
+        this.loginAttemptService = loginAttemptService;
    }

    @Override
@@ -36,28 +46,37 @@ public class CustomOAuth2AuthenticationSuccessHandler
            HttpServletRequest request, HttpServletResponse response, Authentication authentication)
            throws ServletException, IOException {

-        OAuth2User oauthUser = (OAuth2User) authentication.getPrincipal();
-
        // Get the saved request
        HttpSession session = request.getSession(false);
        SavedRequest savedRequest =
-                session != null
+                (session != null)
                        ? (SavedRequest) session.getAttribute("SPRING_SECURITY_SAVED_REQUEST")
                        : null;
+
        if (savedRequest != null
                && !RequestUriUtils.isStaticResource(savedRequest.getRedirectUrl())) {
            // Redirect to the original destination
            super.onAuthenticationSuccess(request, response, authentication);
        } else {
+            OAuth2User oauthUser = (OAuth2User) authentication.getPrincipal();
            OAUTH2 oAuth = applicationProperties.getSecurity().getOAUTH2();
-            String username = oauthUser.getAttribute(oAuth.getUseAsUsername());
+
+            String username = oauthUser.getName();
+
+            if (loginAttemptService.isBlocked(username)) {
+                if (session != null) {
+                    session.removeAttribute("SPRING_SECURITY_SAVED_REQUEST");
+                }
+                throw new LockedException(
+                        "Your account has been locked due to too many failed login attempts.");
+            }
            if (userService.usernameExistsIgnoreCase(username)
                    && userService.hasPassword(username)
                    && !userService.isAuthenticationTypeByUsername(
                            username, AuthenticationType.OAUTH2)
                    && oAuth.getAutoCreateUser()) {
                response.sendRedirect(
-                        request.getContextPath() + "/logout?oauth2AuthenticationError=true");
+                        request.getContextPath() + "/logout?oauth2AuthenticationErrorWeb=true");
                return;
            } else {
                try {
--- a/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2LogoutSuccessHandler.java
+++ b/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2LogoutSuccessHandler.java
@@ -2,13 +2,11 @@ package stirling.software.SPDF.config.security.oauth2;

 import java.io.IOException;

-import org.springframework.beans.factory.annotation.Autowired;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.session.SessionRegistry;
-import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
-import org.springframework.stereotype.Component;

 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
@@ -17,14 +15,17 @@ import jakarta.servlet.http.HttpSession;
 import stirling.software.SPDF.model.ApplicationProperties;
 import stirling.software.SPDF.model.ApplicationProperties.Security.OAUTH2;

-@Component
 public class CustomOAuth2LogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {

-    @Autowired SessionRegistry sessionRegistry;
+    private static final Logger logger =
+            LoggerFactory.getLogger(CustomOAuth2LogoutSuccessHandler.class);

-    private ApplicationProperties applicationProperties;
+    private final SessionRegistry sessionRegistry;
+    private final ApplicationProperties applicationProperties;

-    public CustomOAuth2LogoutSuccessHandler(ApplicationProperties applicationProperties) {
+    public CustomOAuth2LogoutSuccessHandler(
+            ApplicationProperties applicationProperties, SessionRegistry sessionRegistry) {
+        this.sessionRegistry = sessionRegistry;
        this.applicationProperties = applicationProperties;
    }

@@ -33,32 +34,27 @@ public class CustomOAuth2LogoutSuccessHandler extends SimpleUrlLogoutSuccessHand
            HttpServletRequest request, HttpServletResponse response, Authentication authentication)
            throws IOException, ServletException {

-        boolean isOAuthUser = true;
        String param = "logout=true";
-        if (authentication == null) {
-            response.sendRedirect("/");
-            return;
-        }
-        Object pri = authentication.getPrincipal();
-        if (pri instanceof UserDetails) {
-            UserDetails userDetails = (UserDetails) pri;
-            isOAuthUser = userDetails.getPassword() == null;
-        } else if (pri instanceof OAuth2User) {
-            isOAuthUser = true;
-        }

        OAUTH2 oauth = applicationProperties.getSecurity().getOAUTH2();
-        String provider = oauth.getProvider() != null && isOAuthUser ? oauth.getProvider() : "";
+        String provider = oauth.getProvider() != null ? oauth.getProvider() : "";

-        if (request.getParameter("oauth2AuthenticationError") != null) {
-            param = "error=oauth2AuthenticationError";
-        } else if (request.getParameter("invalidUsername") != null) {
-            param = "error=invalidUsername";
+        if (request.getParameter("oauth2AuthenticationErrorWeb") != null) {
+            param = "erroroauth=oauth2AuthenticationErrorWeb";
+        } else if (request.getParameter("error") != null) {
+            param = "error=" + request.getParameter("error");
+        } else if (request.getParameter("erroroauth") != null) {
+            param = "erroroauth=" + request.getParameter("erroroauth");
+        } else if (request.getParameter("oauth2AutoCreateDisabled") != null) {
+            param = "error=oauth2AutoCreateDisabled";
        }
+
        HttpSession session = request.getSession(false);
        if (session != null) {
            String sessionId = session.getId();
            sessionRegistry.removeSessionInformation(sessionId);
+            session.invalidate();
+            logger.debug("Session invalidated: " + sessionId);
        }

        switch (provider) {
@@ -70,17 +66,20 @@ public class CustomOAuth2LogoutSuccessHandler extends SimpleUrlLogoutSuccessHand
                                + oauth.getClientId()
                                + "&post_logout_redirect_uri="
                                + response.encodeRedirectURL(
-                                        "http://" + request.getHeader("host") + "/login?" + param);
+                                        request.getScheme()
+                                                + "://"
+                                                + request.getHeader("host")
+                                                + "/login?"
+                                                + param);
+                logger.debug("Redirecting to Keycloak logout URL: " + logoutUrl);
                response.sendRedirect(logoutUrl);
                break;
            case "google":
+                // Add Google specific logout URL if needed
            default:
-                if (request.getParameter("oauth2AutoCreateDisabled") != null) {
-                    response.sendRedirect(
-                            request.getContextPath() + "/login?error=oauth2AutoCreateDisabled");
-                } else {
-                    response.sendRedirect(request.getContextPath() + "/login?logout=true");
-                }
+                String redirectUrl = request.getContextPath() + "/login?" + param;
+                logger.debug("Redirecting to default logout URL: " + redirectUrl);
+                response.sendRedirect(redirectUrl);
                break;
        }
    }
--- a/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2UserService.java
+++ b/src/main/java/stirling/software/SPDF/config/security/oauth2/CustomOAuth2UserService.java
@@ -1,8 +1,10 @@
 package stirling.software.SPDF.config.security.oauth2;

-import java.util.HashMap;
-import java.util.Map;
+import java.util.Optional;

+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.authentication.LockedException;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
 import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
@@ -11,16 +13,30 @@ import org.springframework.security.oauth2.core.OAuth2Error;
 import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
 import org.springframework.security.oauth2.core.oidc.user.OidcUser;

+import stirling.software.SPDF.config.security.LoginAttemptService;
+import stirling.software.SPDF.config.security.UserService;
 import stirling.software.SPDF.model.ApplicationProperties;
+import stirling.software.SPDF.model.User;

 public class CustomOAuth2UserService implements OAuth2UserService<OidcUserRequest, OidcUser> {

    private final OidcUserService delegate = new OidcUserService();

+    private UserService userService;
+
+    private LoginAttemptService loginAttemptService;
+
    private ApplicationProperties applicationProperties;

-    public CustomOAuth2UserService(ApplicationProperties applicationProperties) {
+    private static final Logger logger = LoggerFactory.getLogger(CustomOAuth2UserService.class);
+
+    public CustomOAuth2UserService(
+            ApplicationProperties applicationProperties,
+            UserService userService,
+            LoginAttemptService loginAttemptService) {
        this.applicationProperties = applicationProperties;
+        this.userService = userService;
+        this.loginAttemptService = loginAttemptService;
    }

    @Override
@@ -28,16 +44,18 @@ public class CustomOAuth2UserService implements OAuth2UserService<OidcUserReques
        String usernameAttribute =
                applicationProperties.getSecurity().getOAUTH2().getUseAsUsername();
        try {
-
            OidcUser user = delegate.loadUser(userRequest);
-            Map<String, Object> attributes = new HashMap<>(user.getAttributes());
-
-            // Ensure the preferred username attribute is present
-            if (!attributes.containsKey(usernameAttribute)) {
-                attributes.put(usernameAttribute, attributes.getOrDefault("email", ""));
-                usernameAttribute = "email";
+            String username = user.getUserInfo().getClaimAsString(usernameAttribute);
+            Optional<User> duser = userService.findByUsernameIgnoreCase(username);
+            if (duser.isPresent()) {
+                if (loginAttemptService.isBlocked(username)) {
+                    throw new LockedException(
+                            "Your account has been locked due to too many failed login attempts.");
+                }
+                if (userService.hasPassword(username)) {
+                    throw new IllegalArgumentException("Password must not be null");
+                }
            }
-
            // Return a new OidcUser with adjusted attributes
            return new DefaultOidcUser(
                    user.getAuthorities(),
@@ -45,8 +63,11 @@ public class CustomOAuth2UserService implements OAuth2UserService<OidcUserReques
                    user.getUserInfo(),
                    usernameAttribute);
        } catch (java.lang.IllegalArgumentException e) {
-            throw new OAuth2AuthenticationException(
-                    new OAuth2Error(e.getMessage()), e.getMessage(), e);
+            logger.error("Error loading OIDC user: {}", e.getMessage());
+            throw new OAuth2AuthenticationException(new OAuth2Error(e.getMessage()), e);
+        } catch (Exception e) {
+            logger.error("Unexpected error loading OIDC user", e);
+            throw new OAuth2AuthenticationException("Unexpected error during authentication");
        }
    }
 }