Commit dafbe33f authored by Brian Long's avatar Brian Long
Browse files

Merge branch 'develop' into stable

parents 514ba6ba 3983fcab

README.md

+2 −1
Original line number Diff line number Diff line
@@ -41,7 +41,8 @@ This extension requires the [`multiext-activiti-app-ext`](https://git.inteligr8. 
| --------------------------------------- | --------------- |

| `keycloak-activiti-app-ext` v1.0 - v1.2 | v1.11.x         |

| `keycloak-activiti-app-ext` v1.3 - v1.4 | v1.11.x - v2.x  |

| `auth-activiti-app-ext` v2.0+           | v24.x+          |

| `auth-activiti-app-ext` v2.0            | v24.x - v25.x   |

| `auth-activiti-app-ext` v2.1+           | v26.x+          |



## Configuration

pom.xml

+3 −3
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 


	<groupId>com.inteligr8.activiti</groupId>

	<artifactId>auth-activiti-app-ext</artifactId>

	<version>2.1.2</version>

	<version>2.2.0</version>



	<name>Authentication &amp; Authorization for APS</name>

	<description>An Alfresco Process Service App extension providing improved authentication and authorization support.</description>
@@ -41,10 +41,10 @@ 
		<maven.compiler.target>17</maven.compiler.target>

		<maven.compiler.release>17</maven.compiler.release>



		<aps.version>25.1.1</aps.version>

		<aps.version>26.1.0</aps.version>

		

		<!-- for RAD -->

		<tomcat-rad.version>10-2.2</tomcat-rad.version>

		<tomcat-rad.version>2.3-tomcat-11.0.20</tomcat-rad.version>

		<aps.hotswap.enabled>false</aps.hotswap.enabled>

		<aps.tomcat.opts.base>-Dspring.main.allow-circular-references=true \

			-Dhibernate.dialect=org.hibernate.dialect.PostgreSQLDialect \

src/main/java/com/inteligr8/activiti/auth/oauth/IdentityServiceConfigurationOverride.java

+8 −8
Original line number Diff line number Diff line 
package com.inteligr8.activiti.auth.oauth;



import static org.springframework.security.config.Customizer.withDefaults;

import static org.springframework.security.web.util.matcher.AntPathRequestMatcher.antMatcher;



import org.apache.commons.lang3.StringUtils;

import org.slf4j.Logger;
@@ -20,6 +19,7 @@ import org.springframework.security.oauth2.client.registration.ClientRegistratio 
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;

import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;

import org.springframework.security.web.SecurityFilterChain;

import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;

import org.springframework.security.web.util.matcher.AndRequestMatcher;

import org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher;
@@ -103,11 +103,11 @@ public class IdentityServiceConfigurationOverride { 
            .securityMatchers(matchers -> {

                matchers.requestMatchers(

                        // same as OOTB

                        antMatcher(ProtectedPaths.API_URL_PATH + "/**"),

                        PathPatternRequestMatcher.pathPattern(ProtectedPaths.API_URL_PATH + "/**"),



                        // want to also allow non-UI access to the the protected API

                        // we do this for anything with an `Authorization` header, as the UI uses session-based authorization

                        new AndRequestMatcher(new RequestHeaderRequestMatcher("Authorization"), antMatcher(ProtectedPaths.APP_URL_PATH + "/rest/**"))

                        new AndRequestMatcher(new RequestHeaderRequestMatcher("Authorization"), PathPatternRequestMatcher.pathPattern(ProtectedPaths.APP_URL_PATH + "/rest/**"))

                );

            })

            .csrf(csrf -> {
@@ -124,18 +124,18 @@ public class IdentityServiceConfigurationOverride { 
            .authorizeHttpRequests(request ->

                request

                    // same as OOTB

                    .requestMatchers(antMatcher(ProtectedPaths.API_URL_PATH + "/enterprise/**"))

                    .requestMatchers(PathPatternRequestMatcher.pathPattern(ProtectedPaths.API_URL_PATH + "/enterprise/**"))

                    .access(this.appRequestHeaderService)

                    .requestMatchers(antMatcher(ProtectedPaths.API_URL_PATH + "/**"))

                    .requestMatchers(PathPatternRequestMatcher.pathPattern(ProtectedPaths.API_URL_PATH + "/**"))

                    .access(this.restAuthorizationService)

                    

                    // borrowed from OOTB /app/rest security

                    .requestMatchers(antMatcher(ProtectedPaths.APP_URL_PATH + "/rest/reporting/**"))

                    .requestMatchers(PathPatternRequestMatcher.pathPattern(ProtectedPaths.APP_URL_PATH + "/rest/reporting/**"))

                    .hasAuthority(Capabilities.ACCESS_REPORTS)

                    

                    .requestMatchers(

                            antMatcher(ProtectedPaths.API_URL_PATH + "/**"),

                            antMatcher(ProtectedPaths.APP_URL_PATH + "/rest/**")

                            PathPatternRequestMatcher.pathPattern(ProtectedPaths.API_URL_PATH + "/**"),

                            PathPatternRequestMatcher.pathPattern(ProtectedPaths.APP_URL_PATH + "/rest/**")

                    )

                    .authenticated()

            );