tenant to store the tenant name submitted by the end
47 | * user.
48 | *
49 | * @param username
50 | * @param password
51 | * @param authorities
52 | * @param tenant
53 | */
54 | public CustomUserDetails(String username, String password, Collection authorities,
55 | String tenant) {
56 | super(username, password, authorities);
57 | this.tenant = tenant;
58 | }
59 |
60 | // Getters and Setters
61 | public String getTenant() {
62 | return tenant;
63 | }
64 |
65 | public void setTenant(String tenant) {
66 | this.tenant = tenant;
67 | }
68 |
69 | }
70 |
--------------------------------------------------------------------------------
/src/main/java/com/example/model/Employee.java:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright 2018 onwards - Sunit Katkar (sunitkatkar@gmail.com)
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example.model;
18 |
19 | import javax.persistence.Column;
20 | import javax.persistence.Entity;
21 | import javax.persistence.GeneratedValue;
22 | import javax.persistence.GenerationType;
23 | import javax.persistence.Id;
24 | import javax.persistence.Table;
25 |
26 | /**
27 | * Just a regular entity which will be stored in all tenant databases.
28 | *
29 | * @author Sunit Katkar
30 | * @version 1.0
31 | * @since 1.0 (April 2018)
32 | */
33 | @Entity
34 | @Table(name = "employee")
35 | public class Employee {
36 |
37 | @Id
38 | @GeneratedValue(strategy = GenerationType.AUTO)
39 | @Column(name = "id", nullable = false, unique = true)
40 | private Long id;
41 |
42 | @Column(name = "first_name")
43 | private String firstName;
44 |
45 | @Column(name = "last_name")
46 | private String lastName;
47 |
48 | @Column(name = "department")
49 | private String department;
50 |
51 | private String office;
52 |
53 | public Long getId() {
54 | return id;
55 | }
56 |
57 | public void setId(Long id) {
58 | this.id = id;
59 | }
60 |
61 | public String getFirstName() {
62 | return firstName;
63 | }
64 |
65 | public void setFirstName(String firstName) {
66 | this.firstName = firstName;
67 | }
68 |
69 | public String getLastName() {
70 | return lastName;
71 | }
72 |
73 | public void setLastName(String lastName) {
74 | this.lastName = lastName;
75 | }
76 |
77 | public String getDepartment() {
78 | return department;
79 | }
80 |
81 | public void setDepartment(String department) {
82 | this.department = department;
83 | }
84 |
85 | public String getOffice() {
86 | return office;
87 | }
88 |
89 | public void setOffice(String office) {
90 | this.office = office;
91 | }
92 |
93 | @Override
94 | public int hashCode() {
95 | final int prime = 31;
96 | int result = 1;
97 | result = prime * result + ((department == null) ? 0 : department.hashCode());
98 | result = prime * result + ((firstName == null) ? 0 : firstName.hashCode());
99 | result = prime * result + ((id == null) ? 0 : id.hashCode());
100 | result = prime * result + ((lastName == null) ? 0 : lastName.hashCode());
101 | result = prime * result + ((office == null) ? 0 : office.hashCode());
102 | return result;
103 | }
104 |
105 | @Override
106 | public boolean equals(Object obj) {
107 | if (this == obj)
108 | return true;
109 | if (obj == null)
110 | return false;
111 | if (getClass() != obj.getClass())
112 | return false;
113 | Employee other = (Employee) obj;
114 | if (department == null) {
115 | if (other.department != null)
116 | return false;
117 | } else if (!department.equals(other.department))
118 | return false;
119 | if (firstName == null) {
120 | if (other.firstName != null)
121 | return false;
122 | } else if (!firstName.equals(other.firstName))
123 | return false;
124 | if (id == null) {
125 | if (other.id != null)
126 | return false;
127 | } else if (!id.equals(other.id))
128 | return false;
129 | if (lastName == null) {
130 | if (other.lastName != null)
131 | return false;
132 | } else if (!lastName.equals(other.lastName))
133 | return false;
134 | if (office == null) {
135 | if (other.office != null)
136 | return false;
137 | } else if (!office.equals(other.office))
138 | return false;
139 | return true;
140 | }
141 |
142 | /*
143 | * (non-Javadoc)
144 | *
145 | * @see java.lang.Object#toString()
146 | */
147 | @Override
148 | public String toString() {
149 | StringBuilder builder = new StringBuilder();
150 | builder.append("Employee [id=").append(id).append(", firstName=").append(firstName).append(", lastName=")
151 | .append(lastName).append(", department=").append(department).append(", office=").append(office)
152 | .append("]");
153 | return builder.toString();
154 | }
155 |
156 | }
157 |
--------------------------------------------------------------------------------
/src/main/java/com/example/model/Role.java:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright 2018 onwards - Sunit Katkar (sunitkatkar@gmail.com)
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example.model;
18 |
19 | import java.io.Serializable;
20 | import java.util.Set;
21 |
22 | import javax.persistence.Column;
23 | import javax.persistence.Entity;
24 | import javax.persistence.FetchType;
25 | import javax.persistence.GeneratedValue;
26 | import javax.persistence.GenerationType;
27 | import javax.persistence.Id;
28 | import javax.persistence.ManyToMany;
29 | import javax.persistence.Table;
30 |
31 | /**
32 | * Role entity to represent a ROLE of the {@link User} in the system.
33 | *
34 | * The JPA definitions of {@link User} and {@link Role} will cause the following
35 | * 3 tables to be created:
36 | * multitenancy.mtapp node from
26 | * application.yml file and populates a list of
27 | * {@link org.springframework.boot.autoconfigure.jdbc.DataSourceProperties}
28 | * objects, with each instance containing the data source details about the
29 | * database like url, username, password etc
30 | *
31 | * @author Sunit Katkar
32 | * @version 1.0
33 | * @since 1.0 (April 2018)
34 | */
35 | @Configuration
36 | @ConfigurationProperties("multitenancy.mtapp")
37 | public class MultitenancyProperties {
38 |
39 | private Listtenant field
28 | * extracted by the {@link CustomAuthenticationFilter} from the user submitted
29 | * login form.
30 | *
31 | * @author Sunit Katkar
32 | * @version 1.0
33 | * @since 1.0 (April 2018)
34 | */
35 | public class CustomAuthenticationToken extends UsernamePasswordAuthenticationToken {
36 |
37 | private static final long serialVersionUID = 1L;
38 |
39 | /**
40 | * The tenant i.e. database identifier
41 | */
42 | private String tenant;
43 |
44 | /**
45 | * @param principal
46 | * @param credentials
47 | * @param tenant
48 | */
49 | public CustomAuthenticationToken(Object principal, Object credentials, String tenant) {
50 | super(principal, credentials);
51 | this.tenant = tenant;
52 | super.setAuthenticated(false);
53 | }
54 |
55 | /**
56 | * @param principal
57 | * @param credentials
58 | * @param tenant
59 | * @param authorities
60 | */
61 | public CustomAuthenticationToken(Object principal, Object credentials, String tenant,
62 | Collection authorities) {
63 | super(principal, credentials, authorities);
64 | this.tenant = tenant;
65 | super.setAuthenticated(true); // must use super, as we override
66 | }
67 |
68 | public String getTenant() {
69 | return this.tenant;
70 | }
71 | }
--------------------------------------------------------------------------------
/src/main/java/com/example/security/CustomSecurityConfig.java:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright 2018 onwards - Sunit Katkar (sunitkatkar@gmail.com)
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example.security;
18 |
19 | import org.springframework.beans.factory.annotation.Autowired;
20 | import org.springframework.context.annotation.Bean;
21 | import org.springframework.context.annotation.Configuration;
22 | import org.springframework.security.authentication.AuthenticationProvider;
23 | import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
24 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
25 | import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
26 | import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
27 | import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
28 | import org.springframework.security.crypto.password.PasswordEncoder;
29 | import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
30 | import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
31 | import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
32 |
33 | /**
34 | * Configuration of security related beans and methods. The access to different
35 | * urls within the application is defined here.
36 | *
37 | * @author Sunit Katkar
38 | * @version 1.0
39 | * @since 1.0 (April 2018)
40 | *
41 | */
42 | @Configuration
43 | @EnableWebSecurity
44 | public class CustomSecurityConfig extends WebSecurityConfigurerAdapter {
45 |
46 | @Autowired
47 | private CustomUserDetailsService userDetailsService;
48 |
49 | /**
50 | * This is where access to various resources (urls) in the application is
51 | * defined
52 | */
53 | @Override
54 | protected void configure(HttpSecurity http) throws Exception {
55 | //@formatter:off
56 | http
57 | .addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class)
58 | .authorizeRequests()
59 | .antMatchers("/css/**", "/index").permitAll()
60 | .antMatchers("/user/**").authenticated()
61 | .and()
62 | .formLogin().loginPage("/login")
63 | .and()
64 | .logout()
65 | .logoutUrl("/logout");
66 | //@formatter:on
67 | }
68 |
69 | /**
70 | * Create an instance of the custom authentication filter which intercepts and
71 | * processes the end user's login form submission for further authentication
72 | * processing. This filter is added before other filters so that it can
73 | * intercept the user login form submission and extract the the additional
74 | * 'tenant' field
75 | *
76 | * @return
77 | * @throws Exception
78 | */
79 | public CustomAuthenticationFilter authenticationFilter() throws Exception {
80 | CustomAuthenticationFilter filter = new CustomAuthenticationFilter();
81 | filter.setAuthenticationManager(authenticationManagerBean());
82 | filter.setAuthenticationFailureHandler(failureHandler());
83 | filter.setAuthenticationSuccessHandler(successHandler());
84 | return filter;
85 | }
86 |
87 | @Autowired
88 | public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
89 | auth.authenticationProvider(authProvider());
90 | }
91 |
92 | /**
93 | * Authentication provider which provides the logged in user's credentials for
94 | * verification and authentication if they are coeect
95 | *
96 | * @return
97 | */
98 | public AuthenticationProvider authProvider() {
99 | // The custom authentication provider defined for this app
100 | CustomUserDetailsAuthenticationProvider provider = new CustomUserDetailsAuthenticationProvider(
101 | passwordEncoder(), userDetailsService);
102 | return provider;
103 | }
104 |
105 | /**
106 | * The page to show if authentication fails
107 | *
108 | * @return
109 | */
110 | public SimpleUrlAuthenticationFailureHandler failureHandler() {
111 | return new SimpleUrlAuthenticationFailureHandler("/login?error=true");
112 | }
113 |
114 | public SimpleUrlAuthenticationSuccessHandler successHandler() {
115 | return new SimpleUrlAuthenticationSuccessHandler("/user/index");
116 | }
117 |
118 | @Bean(name = "passwordEncoder")
119 | public PasswordEncoder passwordEncoder() {
120 | return new BCryptPasswordEncoder();
121 | }
122 |
123 | }
124 |
--------------------------------------------------------------------------------
/src/main/java/com/example/security/CustomUserDetailsAuthenticationProvider.java:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright 2018 onwards - Sunit Katkar (sunitkatkar@gmail.com)
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example.security;
18 |
19 | import org.springframework.security.authentication.BadCredentialsException;
20 | import org.springframework.security.authentication.InternalAuthenticationServiceException;
21 | import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
22 | import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider;
23 | import org.springframework.security.core.AuthenticationException;
24 | import org.springframework.security.core.userdetails.UserDetails;
25 | import org.springframework.security.core.userdetails.UsernameNotFoundException;
26 | import org.springframework.security.crypto.password.PasswordEncoder;
27 | import org.springframework.util.Assert;
28 |
29 | /**
30 | * {@link CustomUserDetailsAuthenticationProvider} extends
31 | * {@link AbstractUserDetailsAuthenticationProvider} and delegates to the
32 | * {@link CustomUserDetailService} to retrieve the User. The most important
33 | * feature of this class is the implementation of the retrieveUser
34 | * method.
35 | *
36 | * Note that the authentication token must be cast to CustomAuthenticationToken
37 | * to access the custom field - tenant
38 | *
39 | *
40 | * @author Sunit Katkar
41 | * @version 1.0
42 | * @since 1.0 (April 2018)
43 | */
44 | public class CustomUserDetailsAuthenticationProvider
45 | extends AbstractUserDetailsAuthenticationProvider {
46 |
47 | /**
48 | * The plaintext password used to perform PasswordEncoder#matches(CharSequence,
49 | * String)} on when the user is not found to avoid SEC-2056
50 | * (https://github.com/spring-projects/spring-security/issues/2280).
51 | */
52 | private static final String USER_NOT_FOUND_PASSWORD = "userNotFoundPassword";
53 |
54 | /**
55 | * For encoding and/or matching the encrypted password stored in the database
56 | * with the user submitted password
57 | */
58 | private PasswordEncoder passwordEncoder;
59 |
60 | private CustomUserDetailsService userDetailsService;
61 |
62 | /**
63 | * The password used to perform
64 | * {@link PasswordEncoder#matches(CharSequence, String)} on when the user is not
65 | * found to avoid SEC-2056. This is necessary, because some
66 | * {@link PasswordEncoder} implementations will short circuit if the password is
67 | * not in a valid format.
68 | */
69 | private String userNotFoundEncodedPassword;
70 |
71 | public CustomUserDetailsAuthenticationProvider(PasswordEncoder passwordEncoder,
72 | CustomUserDetailsService userDetailsService) {
73 | this.passwordEncoder = passwordEncoder;
74 | this.userDetailsService = userDetailsService;
75 | }
76 |
77 | /*
78 | * (non-Javadoc)
79 | *
80 | * @see org.springframework.security.authentication.dao.
81 | * AbstractUserDetailsAuthenticationProvider#additionalAuthenticationChecks(org.
82 | * springframework.security.core.userdetails.UserDetails,
83 | * org.springframework.security.authentication.
84 | * UsernamePasswordAuthenticationToken)
85 | */
86 | @Override
87 | protected void additionalAuthenticationChecks(UserDetails userDetails,
88 | UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
89 |
90 | if (authentication.getCredentials() == null) {
91 | logger.debug("Authentication failed: no credentials provided");
92 | throw new BadCredentialsException(
93 | messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials",
94 | "Bad credentials"));
95 | }
96 | // Get the password submitted by the end user
97 | String presentedPassword = authentication.getCredentials().toString();
98 |
99 | // If the password stored in the database and the user submitted password do not
100 | // match, then signal a login error
101 | if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
102 | logger.debug("Authentication failed: password does not match stored value");
103 | throw new BadCredentialsException(
104 | messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials",
105 | "Bad credentials"));
106 | }
107 | }
108 |
109 | @Override
110 | protected void doAfterPropertiesSet() throws Exception {
111 | Assert.notNull(this.userDetailsService, "A UserDetailsService must be set");
112 | this.userNotFoundEncodedPassword = this.passwordEncoder.encode(USER_NOT_FOUND_PASSWORD);
113 | }
114 |
115 | /*
116 | * (non-Javadoc)
117 | *
118 | * @see org.springframework.security.authentication.dao.
119 | * AbstractUserDetailsAuthenticationProvider#retrieveUser(java.lang.String,
120 | * org.springframework.security.authentication.
121 | * UsernamePasswordAuthenticationToken)
122 | */
123 | @Override
124 | protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
125 | throws AuthenticationException {
126 | CustomAuthenticationToken auth = (CustomAuthenticationToken) authentication;
127 | UserDetails loadedUser;
128 |
129 | try {
130 | loadedUser = this.userDetailsService
131 | .loadUserByUsernameAndTenantname(auth.getPrincipal().toString(),
132 | auth.getTenant());
133 | } catch (UsernameNotFoundException notFound) {
134 | if (authentication.getCredentials() != null) {
135 | String presentedPassword = authentication.getCredentials().toString();
136 | passwordEncoder.matches(presentedPassword, userNotFoundEncodedPassword);
137 | }
138 | throw notFound;
139 | } catch (Exception repositoryProblem) {
140 | throw new InternalAuthenticationServiceException(repositoryProblem.getMessage(),
141 | repositoryProblem);
142 | }
143 |
144 | if (loadedUser == null) {
145 | throw new InternalAuthenticationServiceException(
146 | "UserDetailsService returned null, "
147 | + "which is an interface contract violation");
148 | }
149 | return loadedUser;
150 | }
151 | }
--------------------------------------------------------------------------------
/src/main/java/com/example/security/CustomUserDetailsService.java:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright 2018 onwards - Sunit Katkar (sunitkatkar@gmail.com)
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example.security;
18 |
19 | import org.springframework.security.core.userdetails.UserDetails;
20 | import org.springframework.security.core.userdetails.UsernameNotFoundException;
21 |
22 | /**
23 | * @author Sunit Katkar
24 | * @version 1.0
25 | * @since 1.0 (April 2018)
26 | *
27 | */
28 | public interface CustomUserDetailsService {
29 |
30 | UserDetails loadUserByUsernameAndTenantname(String username, String tenantName) throws UsernameNotFoundException;
31 | }
32 |
--------------------------------------------------------------------------------
/src/main/java/com/example/security/CustomUserDetailsServiceImpl.java:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright 2018 onwards - Sunit Katkar (sunitkatkar@gmail.com)
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package com.example.security;
18 |
19 | import java.util.HashSet;
20 | import java.util.Set;
21 |
22 | import org.apache.commons.lang3.StringUtils;
23 | import org.springframework.beans.factory.annotation.Autowired;
24 | import org.springframework.security.core.GrantedAuthority;
25 | import org.springframework.security.core.authority.SimpleGrantedAuthority;
26 | import org.springframework.security.core.userdetails.UserDetails;
27 | import org.springframework.security.core.userdetails.UsernameNotFoundException;
28 | import org.springframework.stereotype.Service;
29 |
30 | import com.example.model.CustomUserDetails;
31 | import com.example.model.Role;
32 | import com.example.model.User;
33 | import com.example.service.UserService;
34 |
35 | /**
36 | * {@link CustomUserDetailsService} contract defines a single method called
37 | * loadUserByUsernameAndTenantname.
38 | *
39 | * The {@link CustomUserDetailsServiceImpl} class simply implements the contract
40 | * and delegates to {@link UserService} to get the
41 | * {@link com.example.model.User} from the database so that it can be compared
42 | * with the {@link org.springframework.security.core.userdetails.User} for
43 | * authentication. Authentication occurs via the
44 | * {@link CustomUserDetailsAuthenticationProvider}.
45 | *
46 | * @author Sunit Katkar
47 | * @version 1.0
48 | * @since 1.0 (April 2018)
49 | *
50 | */
51 | @Service("userDetailsService")
52 | public class CustomUserDetailsServiceImpl implements CustomUserDetailsService {
53 |
54 | @Autowired
55 | private UserService userService;
56 |
57 | @Override
58 | public UserDetails loadUserByUsernameAndTenantname(String username, String tenant)
59 | throws UsernameNotFoundException {
60 | if (StringUtils.isAnyBlank(username, tenant)) {
61 | throw new UsernameNotFoundException("Username and domain must be provided");
62 | }
63 | // Look for the user based on the username and tenant by accessing the
64 | // UserRepository via the UserService
65 | User user = userService.findByUsernameAndTenantname(username, tenant);
66 |
67 | if (user == null) {
68 | throw new UsernameNotFoundException(
69 | String.format("Username not found for domain, "
70 | + "username=%s, tenant=%s", username, tenant));
71 | }
72 |
73 | SetLogged in: Username | | Some Domain 18 |
19 |This is an unsecured page, but you can access the secured pages after authenticating.
28 |