dcoraboeuf#285 Isolating the GUI security in a configuration

cpf · Nov 29, 2013 · 12912d8 · 12912d8
1 parent 9758797
commit 12912d8
Showing 1 changed file with 23 additions and 16 deletions.
diff --git a/ontrack-web/src/main/java/net/ontrack/web/config/WebSecurityConfig.java b/ontrack-web/src/main/java/net/ontrack/web/config/WebSecurityConfig.java
@@ -2,6 +2,7 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -13,9 +14,6 @@
 @EnableWebSecurity
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
-    @Autowired
-    private AuthenticationSuccessHandler authenticationSuccessHandler;
-
     @Autowired
     private AuthenticationManager authenticationManager;
 
@@ -24,18 +22,27 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
         auth.parentAuthenticationManager(authenticationManager);
     }
 
-    @Override
-    protected void configure(HttpSecurity http) throws Exception {
-        http
-                // FIXME ui/login protection for UI access in a separate configuration
-                // http.antMatcher("/ui/login")
-                //         .httpBasic().realmName("ontrack").and()
-                //         .authorizeRequests().antMatchers("/ui/login").hasAnyRole(SecurityRoles.ALL);
-                // FIXME Reenable CSRF protection (depends on the client)
-                // See http://docs.spring.io/spring-security/site/docs/3.2.0.RC2/reference/htmlsingle/#csrf-using
-                .csrf().disable()
-                .formLogin().loginPage("/login").successHandler(authenticationSuccessHandler).and()
-                .logout().logoutUrl("/logout").logoutSuccessUrl("/").and()
-                .authorizeRequests().anyRequest().permitAll();
+    @Configuration
+    @Order(10)
+    public static class GUIHTTPSecurityConfig extends WebSecurityConfigurerAdapter {
+
+        @Autowired
+        private AuthenticationSuccessHandler authenticationSuccessHandler;
+
+        @Override
+        protected void configure(HttpSecurity http) throws Exception {
+            http
+                    // FIXME ui/login protection for UI access in a separate configuration
+                    // http.antMatcher("/ui/login")
+                    //         .httpBasic().realmName("ontrack").and()
+                    //         .authorizeRequests().antMatchers("/ui/login").hasAnyRole(SecurityRoles.ALL);
+                    // FIXME Reenable CSRF protection (depends on the client)
+                    // See http://docs.spring.io/spring-security/site/docs/3.2.0.RC2/reference/htmlsingle/#csrf-using
+                    .csrf().disable()
+                    .formLogin().loginPage("/login").successHandler(authenticationSuccessHandler).and()
+                    .logout().logoutUrl("/logout").logoutSuccessUrl("/").and()
+                    .authorizeRequests().anyRequest().permitAll();
+        }
+
     }
 }