Showing
6 changed files
with
3 additions
and
230 deletions
... | ... | @@ -207,7 +207,7 @@ public class ThingsboardSecurityConfiguration extends WebSecurityConfigurerAdapt |
207 | 207 | .addFilterBefore(buildRefreshTokenProcessingFilter(), UsernamePasswordAuthenticationFilter.class) |
208 | 208 | .addFilterBefore(buildWsJwtTokenAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class) |
209 | 209 | .addFilterAfter(rateLimitProcessingFilter, UsernamePasswordAuthenticationFilter.class); |
210 | - if (oauth2Configuration != null && oauth2Configuration.isEnabled()) { | |
210 | + if (oauth2Configuration != null) { | |
211 | 211 | http.oauth2Login() |
212 | 212 | .loginPage("/oauth2Login") |
213 | 213 | .loginProcessingUrl(oauth2Configuration.getLoginProcessingUrl()) | ... | ... |
... | ... | @@ -107,62 +107,8 @@ security: |
107 | 107 | basic: |
108 | 108 | enabled: "${SECURITY_BASIC_ENABLED:false}" |
109 | 109 | oauth2: |
110 | - # Enable/disable OAuth 2 login functionality | |
111 | - # For details please refer to https://thingsboard.io/docs/user-guide/oauth-2-support/ | |
112 | - enabled: "${SECURITY_OAUTH2_ENABLED:false}" | |
113 | 110 | # Redirect URL where access code from external user management system will be processed |
114 | 111 | loginProcessingUrl: "${SECURITY_OAUTH2_LOGIN_PROCESSING_URL:/login/oauth2/code/}" |
115 | - # List of SSO clients | |
116 | - clients: | |
117 | - default: | |
118 | - # Label that going to be show on login button - 'Login with {loginButtonLabel}' | |
119 | - loginButtonLabel: "${SECURITY_OAUTH2_DEFAULT_LOGIN_BUTTON_LABEL:Default}" | |
120 | - # Icon that going to be show on login button. Material design icon ID (https://material.angularjs.org/latest/api/directive/mdIcon) | |
121 | - loginButtonIcon: "${SECURITY_OAUTH2_DEFAULT_LOGIN_BUTTON_ICON:}" | |
122 | - clientName: "${SECURITY_OAUTH2_DEFAULT_CLIENT_NAME:ClientName}" | |
123 | - clientId: "${SECURITY_OAUTH2_DEFAULT_CLIENT_ID:}" | |
124 | - clientSecret: "${SECURITY_OAUTH2_DEFAULT_CLIENT_SECRET:}" | |
125 | - accessTokenUri: "${SECURITY_OAUTH2_DEFAULT_ACCESS_TOKEN_URI:}" | |
126 | - authorizationUri: "${SECURITY_OAUTH2_DEFAULT_AUTHORIZATION_URI:}" | |
127 | - scope: "${SECURITY_OAUTH2_DEFAULT_SCOPE:}" | |
128 | - # Redirect URL that must be in sync with 'security.oauth2.loginProcessingUrl', but domain name added | |
129 | - redirectUriTemplate: "${SECURITY_OAUTH2_DEFAULT_REDIRECT_URI_TEMPLATE:http://localhost:8080/login/oauth2/code/}" | |
130 | - jwkSetUri: "${SECURITY_OAUTH2_DEFAULT_JWK_SET_URI:}" | |
131 | - # 'authorization_code', 'implicit', 'refresh_token' or 'client_credentials' | |
132 | - authorizationGrantType: "${SECURITY_OAUTH2_DEFAULT_AUTHORIZATION_GRANT_TYPE:authorization_code}" | |
133 | - clientAuthenticationMethod: "${SECURITY_OAUTH2_DEFAULT_CLIENT_AUTHENTICATION_METHOD:post}" # basic or post | |
134 | - userInfoUri: "${SECURITY_OAUTH2_DEFAULT_USER_INFO_URI:}" | |
135 | - userNameAttributeName: "${SECURITY_OAUTH2_DEFAULT_USER_NAME_ATTRIBUTE_NAME:email}" | |
136 | - mapperConfig: | |
137 | - # Allows to create user if it not exists | |
138 | - allowUserCreation: "${SECURITY_OAUTH2_DEFAULT_MAPPER_ALLOW_USER_CREATION:true}" | |
139 | - # Allows user to setup ThingsBoard internal password and login over default Login window | |
140 | - activateUser: "${SECURITY_OAUTH2_DEFAULT_MAPPER_ACTIVATE_USER:false}" | |
141 | - # Mapper type of converter from external user into internal - 'basic' or 'custom' | |
142 | - type: "${SECURITY_OAUTH2_DEFAULT_MAPPER_TYPE:basic}" | |
143 | - basic: | |
144 | - # Key from attributes of external user object to use as email | |
145 | - emailAttributeKey: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_EMAIL_ATTRIBUTE_KEY:email}" | |
146 | - firstNameAttributeKey: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_FIRST_NAME_ATTRIBUTE_KEY:}" | |
147 | - lastNameAttributeKey: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_LAST_NAME_ATTRIBUTE_KEY:}" | |
148 | - # Strategy for generating Tenant from external user object - 'domain', 'email' or 'custom' | |
149 | - # 'domain' - name of the Tenant will be extracted as domain from the email of the user | |
150 | - # 'email' - name of the Tenant will email of the user | |
151 | - # 'custom' - please configure 'tenantNamePattern' for custom mapping | |
152 | - tenantNameStrategy: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_TENANT_NAME_STRATEGY:domain}" | |
153 | - # %{attribute_key} as placeholder for attribute value of attributes of external user object | |
154 | - tenantNamePattern: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_TENANT_NAME_PATTERN:}" | |
155 | - # If this field is not empty, user will be created as a user under defined Customer | |
156 | - # %{attribute_key} as placeholder for attribute value of attributes of external user object | |
157 | - customerNamePattern: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_CUSTOMER_NAME_PATTERN:}" | |
158 | - # If this field is not empty, user will be created with default defined Dashboard | |
159 | - defaultDashboardName: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_DEFAULT_DASHBOARD_NAME:}" | |
160 | - # If this field is set 'true' along with non-empty 'defaultDashboardName', user will start from the defined Dashboard in fullscreen mode | |
161 | - alwaysFullScreen: "${SECURITY_OAUTH2_DEFAULT_MAPPER_BASIC_ALWAYS_FULL_SCREEN:false}" | |
162 | - custom: | |
163 | - url: "${SECURITY_OAUTH2_DEFAULT_MAPPER_CUSTOM_URL:}" | |
164 | - username: "${SECURITY_OAUTH2_DEFAULT_MAPPER_CUSTOM_USERNAME:}" | |
165 | - password: "${SECURITY_OAUTH2_DEFAULT_MAPPER_CUSTOM_PASSWORD:}" | |
166 | 112 | |
167 | 113 | # Dashboard parameters |
168 | 114 | dashboard: | ... | ... |
dao/src/main/java/org/thingsboard/server/dao/oauth2/OAuth2Client.java
deleted
100644 → 0
1 | -/** | |
2 | - * Copyright © 2016-2020 The Thingsboard Authors | |
3 | - * | |
4 | - * Licensed under the Apache License, Version 2.0 (the "License"); | |
5 | - * you may not use this file except in compliance with the License. | |
6 | - * You may obtain a copy of the License at | |
7 | - * | |
8 | - * http://www.apache.org/licenses/LICENSE-2.0 | |
9 | - * | |
10 | - * Unless required by applicable law or agreed to in writing, software | |
11 | - * distributed under the License is distributed on an "AS IS" BASIS, | |
12 | - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
13 | - * See the License for the specific language governing permissions and | |
14 | - * limitations under the License. | |
15 | - */ | |
16 | -package org.thingsboard.server.dao.oauth2; | |
17 | - | |
18 | -import lombok.Data; | |
19 | - | |
20 | -@Data | |
21 | -public class OAuth2Client { | |
22 | - | |
23 | - private String loginButtonLabel; | |
24 | - private String loginButtonIcon; | |
25 | - private String clientName; | |
26 | - private String clientId; | |
27 | - private String clientSecret; | |
28 | - private String accessTokenUri; | |
29 | - private String authorizationUri; | |
30 | - private String scope; | |
31 | - private String redirectUriTemplate; | |
32 | - private String jwkSetUri; | |
33 | - private String authorizationGrantType; | |
34 | - private String clientAuthenticationMethod; | |
35 | - private String userInfoUri; | |
36 | - private String userNameAttributeName; | |
37 | - private OAuth2ClientMapperConfig mapperConfig; | |
38 | - | |
39 | -} |
dao/src/main/java/org/thingsboard/server/dao/oauth2/OAuth2ClientMapperConfig.java
deleted
100644 → 0
1 | -/** | |
2 | - * Copyright © 2016-2020 The Thingsboard Authors | |
3 | - * | |
4 | - * Licensed under the Apache License, Version 2.0 (the "License"); | |
5 | - * you may not use this file except in compliance with the License. | |
6 | - * You may obtain a copy of the License at | |
7 | - * | |
8 | - * http://www.apache.org/licenses/LICENSE-2.0 | |
9 | - * | |
10 | - * Unless required by applicable law or agreed to in writing, software | |
11 | - * distributed under the License is distributed on an "AS IS" BASIS, | |
12 | - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
13 | - * See the License for the specific language governing permissions and | |
14 | - * limitations under the License. | |
15 | - */ | |
16 | -package org.thingsboard.server.dao.oauth2; | |
17 | - | |
18 | -import lombok.Data; | |
19 | - | |
20 | -@Data | |
21 | -public class OAuth2ClientMapperConfig { | |
22 | - | |
23 | - private boolean allowUserCreation; | |
24 | - private boolean activateUser; | |
25 | - private String type; | |
26 | - private BasicOAuth2ClientMapperConfig basic; | |
27 | - private CustomOAuth2ClientMapperConfig custom; | |
28 | - | |
29 | - @Data | |
30 | - public static class BasicOAuth2ClientMapperConfig { | |
31 | - private String emailAttributeKey; | |
32 | - private String firstNameAttributeKey; | |
33 | - private String lastNameAttributeKey; | |
34 | - private String tenantNameStrategy; | |
35 | - private String tenantNamePattern; | |
36 | - private String customerNamePattern; | |
37 | - private boolean alwaysFullScreen; | |
38 | - private String defaultDashboardName; | |
39 | - } | |
40 | - | |
41 | - @Data | |
42 | - public static class CustomOAuth2ClientMapperConfig { | |
43 | - private String url; | |
44 | - private String username; | |
45 | - private String password; | |
46 | - } | |
47 | -} |
... | ... | @@ -17,29 +17,13 @@ package org.thingsboard.server.dao.oauth2; |
17 | 17 | |
18 | 18 | import lombok.Data; |
19 | 19 | import lombok.extern.slf4j.Slf4j; |
20 | -import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; | |
21 | 20 | import org.springframework.boot.context.properties.ConfigurationProperties; |
22 | -import org.springframework.context.annotation.Bean; | |
23 | 21 | import org.springframework.context.annotation.Configuration; |
24 | -import org.springframework.security.oauth2.client.registration.ClientRegistration; | |
25 | -import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository; | |
26 | -import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository; | |
27 | -import org.springframework.security.oauth2.core.AuthorizationGrantType; | |
28 | -import org.springframework.security.oauth2.core.ClientAuthenticationMethod; | |
29 | - | |
30 | -import java.util.ArrayList; | |
31 | -import java.util.HashMap; | |
32 | -import java.util.List; | |
33 | -import java.util.Map; | |
34 | 22 | |
35 | 23 | @Configuration |
36 | -@ConditionalOnProperty(prefix = "security.oauth2", value = "enabled", havingValue = "true") | |
37 | 24 | @ConfigurationProperties(prefix = "security.oauth2") |
38 | 25 | @Data |
39 | 26 | @Slf4j |
40 | 27 | public class OAuth2Configuration { |
41 | - | |
42 | - private boolean enabled; | |
43 | 28 | private String loginProcessingUrl; |
44 | - private Map<String, OAuth2Client> clients = new HashMap<>(); | |
45 | 29 | } | ... | ... |
... | ... | @@ -39,20 +39,7 @@ public class OAuth2ServiceImpl implements OAuth2Service { |
39 | 39 | |
40 | 40 | @Override |
41 | 41 | public List<OAuth2ClientInfo> getOAuth2Clients() { |
42 | - if (oauth2Configuration == null || !oauth2Configuration.isEnabled()) { | |
43 | - return Collections.emptyList(); | |
44 | - } | |
45 | - | |
46 | - Stream<OAuth2ClientInfo> startUpConfiguration = oauth2Configuration.getClients().entrySet().stream() | |
47 | - .map(entry -> { | |
48 | - OAuth2ClientInfo client = new OAuth2ClientInfo(); | |
49 | - client.setName(entry.getValue().getLoginButtonLabel()); | |
50 | - client.setUrl(String.format(OAUTH2_AUTHORIZATION_PATH_TEMPLATE, entry.getKey())); | |
51 | - client.setIcon(entry.getValue().getLoginButtonIcon()); | |
52 | - return client; | |
53 | - }); | |
54 | - | |
55 | - return startUpConfiguration.collect(Collectors.toList()); | |
42 | + return Collections.emptyList(); | |
56 | 43 | } |
57 | 44 | |
58 | 45 | @Override |
... | ... | @@ -102,64 +89,6 @@ public class OAuth2ServiceImpl implements OAuth2Service { |
102 | 89 | |
103 | 90 | @Override |
104 | 91 | public OAuth2ClientRegistration getClientRegistration(String registrationId) { |
105 | - if (oauth2Configuration == null || !oauth2Configuration.isEnabled()) return null; | |
106 | - OAuth2Client oAuth2Client = oauth2Configuration.getClients() == null ? null : oauth2Configuration.getClients().get(registrationId); | |
107 | - if (oAuth2Client != null){ | |
108 | - return toClientRegistration(registrationId, oAuth2Client); | |
109 | - } else { | |
110 | - return null; | |
111 | - } | |
112 | - } | |
113 | - | |
114 | - private OAuth2ClientRegistration toClientRegistration(String registrationId, OAuth2Client oAuth2Client) { | |
115 | - OAuth2ClientMapperConfig mapperConfig = oAuth2Client.getMapperConfig(); | |
116 | - OAuth2ClientMapperConfig.BasicOAuth2ClientMapperConfig basicConfig = mapperConfig.getBasic(); | |
117 | - OAuth2ClientMapperConfig.CustomOAuth2ClientMapperConfig customConfig = mapperConfig.getCustom(); | |
118 | - | |
119 | - return OAuth2ClientRegistration.builder() | |
120 | - .registrationId(registrationId) | |
121 | - .mapperConfig(OAuth2MapperConfig.builder() | |
122 | - .allowUserCreation(mapperConfig.isAllowUserCreation()) | |
123 | - .activateUser(mapperConfig.isActivateUser()) | |
124 | - .type(MapperType.valueOf( | |
125 | - mapperConfig.getType().toUpperCase() | |
126 | - )) | |
127 | - .basicConfig( | |
128 | - OAuth2BasicMapperConfig.builder() | |
129 | - .emailAttributeKey(basicConfig.getEmailAttributeKey()) | |
130 | - .firstNameAttributeKey(basicConfig.getFirstNameAttributeKey()) | |
131 | - .lastNameAttributeKey(basicConfig.getLastNameAttributeKey()) | |
132 | - .tenantNameStrategy(TenantNameStrategyType.valueOf( | |
133 | - basicConfig.getTenantNameStrategy().toUpperCase() | |
134 | - )) | |
135 | - .tenantNamePattern(basicConfig.getTenantNamePattern()) | |
136 | - .customerNamePattern(basicConfig.getCustomerNamePattern()) | |
137 | - .defaultDashboardName(basicConfig.getDefaultDashboardName()) | |
138 | - .alwaysFullScreen(basicConfig.isAlwaysFullScreen()) | |
139 | - .build() | |
140 | - ) | |
141 | - .customConfig( | |
142 | - OAuth2CustomMapperConfig.builder() | |
143 | - .url(customConfig.getUrl()) | |
144 | - .username(customConfig.getUsername()) | |
145 | - .password(customConfig.getPassword()) | |
146 | - .build() | |
147 | - ) | |
148 | - .build()) | |
149 | - .clientId(oAuth2Client.getClientId()) | |
150 | - .clientSecret(oAuth2Client.getClientSecret()) | |
151 | - .authorizationUri(oAuth2Client.getAuthorizationUri()) | |
152 | - .tokenUri(oAuth2Client.getAccessTokenUri()) | |
153 | - .redirectUriTemplate(oAuth2Client.getRedirectUriTemplate()) | |
154 | - .scope(oAuth2Client.getScope()) | |
155 | - .authorizationGrantType(oAuth2Client.getAuthorizationGrantType()) | |
156 | - .userInfoUri(oAuth2Client.getUserInfoUri()) | |
157 | - .userNameAttributeName(oAuth2Client.getUserNameAttributeName()) | |
158 | - .jwkSetUri(oAuth2Client.getJwkSetUri()) | |
159 | - .clientAuthenticationMethod(oAuth2Client.getClientAuthenticationMethod()) | |
160 | - .clientName(oAuth2Client.getClientName()) | |
161 | - .loginButtonLabel(oAuth2Client.getLoginButtonLabel()) | |
162 | - .loginButtonIcon(oAuth2Client.getLoginButtonIcon()) | |
163 | - .build(); | |
92 | + return null; | |
164 | 93 | } |
165 | 94 | } | ... | ... |