Prometheus

1ts=2022-02-02T03:54:46.210Z
2caller=scrape.go:1292
3level=debug
4component="scrape manager"
5scrape_pool=spring-actuator
6target=https://127.0.0.1:8443/actuator/prometheus/
7msg="Scrape failed"
8err="Get \"https://127.0.0.1:8443/actuator/prometheus/\": dial tcp 127.0.0.1:8443: connect: connection refused"
9keytool
10  -genkey
11  -alias <alias>
12  -dname <dname>
13  -keyalg RSA
14  -keysize 4096
15  -storetype PKCS12
16  -keystore <path_to_keystore>
17  -validity 3650
18  -storepass <keystore_pass>
19openssl pkcs12 -in cert.p12 -out cert.pem -nodes -passin pass:<pass>
20tls_server_config:
21  cert_file: /path/to/cert.crt
22  key_file: /path/to/cert.key
23- job_name: 'spring-actuator'
24metrics_path: '/actuator/prometheus/'
25scrape_interval: 60s
26scheme: https
27static_configs:
28  - targets: [ '127.0.0.1:8443' ]
29tls_config:
30  insecure_skip_verify: true
31- job_name: 'spring-actuator'
32metrics_path: '/actuator/prometheus/'
33scrape_interval: 60s
34scheme: https
35static_configs:
36  - targets: [ 'backend:8443' ]
37tls_config:
38  cert_file: /path/to/cert.crt
39  key_file: /path/to/cert.key
40  insecure_skip_verify: true
41

1apiVersion: aps.dp.com/v1alpha1
2kind: Edtack
3metadata:
4  name: ed01
5  namespace: ctr
6spec:
7  intRef:
8    name: evr
9  stack:
10  - name: vectnt
11    namespace: aps
12    path: https://packages.timber.io/helm/latest/vect-0.11.0.tgz
13    valuesRef:
14      name: vecvalues
15  - name: ek
16    namespace: lg
17    path: rescharts/bing
18  - name: apigw-gloo-ee
19    namespace: apw
20    path: https://common.cdn.repositories.cloud.sap/api-gateway/apigw-gloo-ee/apigw-gloo-ee-0.3.0.tgz
21    pullSecretRef:
22      name: svr-secret
23    valuesSecretRef:
24      name: apis
25  - name: kuback
26    namespace: kube-prom
27    path: https://github.com/prometheus-community/helm-charts/releases/download/kube-prometheus-stack-16.12.0/kube-prometheus-stack-16.12.0.tgz
28    valuesSecretRef:
29      name: kubes
30package main
31
32import (
33    "context"
34    "flag"
35    "log"
36    "path/filepath"
37
38    "github.com/pytimer/k8sutil/apply"
39
40    "k8s.io/client-go/discovery"
41    "k8s.io/client-go/dynamic"
42    "k8s.io/client-go/tools/clientcmd"
43    "k8s.io/client-go/util/homedir"
44)
45
46const applyStr = `
47apiVersion: apps/v1
48kind: Deployment
49metadata:
50  name: nginx
51spec:
52  replicas: 1
53  selector:
54    matchLabels:
55      app: nginx
56  template:
57    metadata:
58      labels:
59        app: nginx
60    spec:
61      containers:
62      - name: nginx
63        image: nginx
64---
65apiVersion: v1
66kind: Service
67metadata:
68  name: nginx-svc
69spec:
70  ports:
71  - name: web
72    port: 80
73    protocol: TCP
74    targetPort: 80
75  selector:
76    app: nginx
77  type: ClusterIP
78`
79
80func main() {
81    var kubeconfig *string
82    if home := homedir.HomeDir(); home != "" {
83        kubeconfig = flag.String("kubeconfig", filepath.Join(home, ".kube", "config"), "(optional) absolute path to the kubeconfig file")
84    } else {
85        kubeconfig = flag.String("kubeconfig", "", "absolute path to the kubeconfig file")
86    }
87    flag.Parse()
88
89    // use the current context in kubeconfig
90    config, err := clientcmd.BuildConfigFromFlags("", *kubeconfig)
91    if err != nil {
92        panic(err.Error())
93    }
94
95    dynamicClient, err := dynamic.NewForConfig(config)
96    if err != nil {
97        panic(err.Error())
98    }
99    discoveryClient, err := discovery.NewDiscoveryClientForConfig(config)
100    if err != nil {
101        panic(err.Error())
102    }
103
104    applyOptions := apply.NewApplyOptions(dynamicClient, discoveryClient)
105    if err := applyOptions.Apply(context.TODO(), []byte(applyStr)); err != nil {
106        log.Fatalf("apply error: %v", err)
107    }
108}
109

1type BookAPI =
2  "books" :> Get '[JSON] (Map Text Text)
3    :<|> "book" :> Capture "Name" Text :> ReqBody '[JSON] (Text) :> Post '[JSON] (Text)
4λ:T.putStrLn $ layout (Proxy :: Proxy BookAPI)
5/
6├─ book/
7│  └─ <capture>/
8│     └─•
9└─ books/
10   └─•
11prometheusMiddlware = instrumentHandlerValue (T.intercalate "\\" . pathInfo)
12import Data.Text 
13import Control.Monad.State.Strict
14import Control.Applicative
15
16type PathParser = StateT ([Text],[Text]) Maybe ()
17

1type BookAPI =
2  "books" :> Get '[JSON] (Map Text Text)
3    :<|> "book" :> Capture "Name" Text :> ReqBody '[JSON] (Text) :> Post '[JSON] (Text)
4λ:T.putStrLn $ layout (Proxy :: Proxy BookAPI)
5/
6├─ book/
7│  └─ <capture>/
8│     └─•
9└─ books/
10   └─•
11prometheusMiddlware = instrumentHandlerValue (T.intercalate "\\" . pathInfo)
12import Data.Text 
13import Control.Monad.State.Strict
14import Control.Applicative
15
16type PathParser = StateT ([Text],[Text]) Maybe ()
17{-# LANGUAGE KindSignatures #-}
18{-# LANGUAGE PolyKinds #-}
19{-# LANGUAGE DataKinds #-}
20{-# LANGUAGE FlexibleInstances #-}
21{-# LANGUAGE TypeApplications #-}
22{-# LANGUAGE ScopedTypeVariables #-}
23{-# LANGUAGE TypeOperators #-}
24{-# LANGUAGE OverloadedStrings #-}
25import Data.Data ( Proxy )
26import GHC.TypeLits
27
28class HasPathParser (x :: k) where
29    pathParser :: Proxy x -> PathParser
30

1type BookAPI =
2  "books" :> Get '[JSON] (Map Text Text)
3    :<|> "book" :> Capture "Name" Text :> ReqBody '[JSON] (Text) :> Post '[JSON] (Text)
4λ:T.putStrLn $ layout (Proxy :: Proxy BookAPI)
5/
6├─ book/
7│  └─ <capture>/
8│     └─•
9└─ books/
10   └─•
11prometheusMiddlware = instrumentHandlerValue (T.intercalate "\\" . pathInfo)
12import Data.Text 
13import Control.Monad.State.Strict
14import Control.Applicative
15
16type PathParser = StateT ([Text],[Text]) Maybe ()
17{-# LANGUAGE KindSignatures #-}
18{-# LANGUAGE PolyKinds #-}
19{-# LANGUAGE DataKinds #-}
20{-# LANGUAGE FlexibleInstances #-}
21{-# LANGUAGE TypeApplications #-}
22{-# LANGUAGE ScopedTypeVariables #-}
23{-# LANGUAGE TypeOperators #-}
24{-# LANGUAGE OverloadedStrings #-}
25import Data.Data ( Proxy )
26import GHC.TypeLits
27
28class HasPathParser (x :: k) where
29    pathParser :: Proxy x -> PathParser
30instance KnownSymbol piece => HasPathParser (piece :: Symbol) where
31  pathParser _ = do
32      (piece : rest, found) <- get -- we are using MonadFail here
33      guard (piece == Data.Text.pack (symbolVal (Proxy @piece)))
34      put (rest, piece : found)
35

1type BookAPI =
2  "books" :> Get '[JSON] (Map Text Text)
3    :<|> "book" :> Capture "Name" Text :> ReqBody '[JSON] (Text) :> Post '[JSON] (Text)
4λ:T.putStrLn $ layout (Proxy :: Proxy BookAPI)
5/
6├─ book/
7│  └─ <capture>/
8│     └─•
9└─ books/
10   └─•
11prometheusMiddlware = instrumentHandlerValue (T.intercalate "\\" . pathInfo)
12import Data.Text 
13import Control.Monad.State.Strict
14import Control.Applicative
15
16type PathParser = StateT ([Text],[Text]) Maybe ()
17{-# LANGUAGE KindSignatures #-}
18{-# LANGUAGE PolyKinds #-}
19{-# LANGUAGE DataKinds #-}
20{-# LANGUAGE FlexibleInstances #-}
21{-# LANGUAGE TypeApplications #-}
22{-# LANGUAGE ScopedTypeVariables #-}
23{-# LANGUAGE TypeOperators #-}
24{-# LANGUAGE OverloadedStrings #-}
25import Data.Data ( Proxy )
26import GHC.TypeLits
27
28class HasPathParser (x :: k) where
29    pathParser :: Proxy x -> PathParser
30instance KnownSymbol piece => HasPathParser (piece :: Symbol) where
31  pathParser _ = do
32      (piece : rest, found) <- get -- we are using MonadFail here
33      guard (piece == Data.Text.pack (symbolVal (Proxy @piece)))
34      put (rest, piece : found)
35instance KnownSymbol name => HasPathParser (Capture name x) where
36  pathParser _ = do
37      (_ : rest, found) <- get  -- we are using MonadFail here
38      put (rest, Data.Text.pack (symbolVal (Proxy @name)) : found)
39

1type BookAPI =
2  "books" :> Get '[JSON] (Map Text Text)
3    :<|> "book" :> Capture "Name" Text :> ReqBody '[JSON] (Text) :> Post '[JSON] (Text)
4λ:T.putStrLn $ layout (Proxy :: Proxy BookAPI)
5/
6├─ book/
7│  └─ <capture>/
8│     └─•
9└─ books/
10   └─•
11prometheusMiddlware = instrumentHandlerValue (T.intercalate "\\" . pathInfo)
12import Data.Text 
13import Control.Monad.State.Strict
14import Control.Applicative
15
16type PathParser = StateT ([Text],[Text]) Maybe ()
17{-# LANGUAGE KindSignatures #-}
18{-# LANGUAGE PolyKinds #-}
19{-# LANGUAGE DataKinds #-}
20{-# LANGUAGE FlexibleInstances #-}
21{-# LANGUAGE TypeApplications #-}
22{-# LANGUAGE ScopedTypeVariables #-}
23{-# LANGUAGE TypeOperators #-}
24{-# LANGUAGE OverloadedStrings #-}
25import Data.Data ( Proxy )
26import GHC.TypeLits
27
28class HasPathParser (x :: k) where
29    pathParser :: Proxy x -> PathParser
30instance KnownSymbol piece => HasPathParser (piece :: Symbol) where
31  pathParser _ = do
32      (piece : rest, found) <- get -- we are using MonadFail here
33      guard (piece == Data.Text.pack (symbolVal (Proxy @piece)))
34      put (rest, piece : found)
35instance KnownSymbol name => HasPathParser (Capture name x) where
36  pathParser _ = do
37      (_ : rest, found) <- get  -- we are using MonadFail here
38      put (rest, Data.Text.pack (symbolVal (Proxy @name)) : found)
39instance HasPathParser (Verb method statusCode contextTypes a) where
40  pathParser _ = do
41      ([], found) <- get -- we are using MonadFail here
42      put ([], found)
43

1type BookAPI =
2  "books" :> Get '[JSON] (Map Text Text)
3    :<|> "book" :> Capture "Name" Text :> ReqBody '[JSON] (Text) :> Post '[JSON] (Text)
4λ:T.putStrLn $ layout (Proxy :: Proxy BookAPI)
5/
6├─ book/
7│  └─ <capture>/
8│     └─•
9└─ books/
10   └─•
11prometheusMiddlware = instrumentHandlerValue (T.intercalate "\\" . pathInfo)
12import Data.Text 
13import Control.Monad.State.Strict
14import Control.Applicative
15
16type PathParser = StateT ([Text],[Text]) Maybe ()
17{-# LANGUAGE KindSignatures #-}
18{-# LANGUAGE PolyKinds #-}
19{-# LANGUAGE DataKinds #-}
20{-# LANGUAGE FlexibleInstances #-}
21{-# LANGUAGE TypeApplications #-}
22{-# LANGUAGE ScopedTypeVariables #-}
23{-# LANGUAGE TypeOperators #-}
24{-# LANGUAGE OverloadedStrings #-}
25import Data.Data ( Proxy )
26import GHC.TypeLits
27
28class HasPathParser (x :: k) where
29    pathParser :: Proxy x -> PathParser
30instance KnownSymbol piece => HasPathParser (piece :: Symbol) where
31  pathParser _ = do
32      (piece : rest, found) <- get -- we are using MonadFail here
33      guard (piece == Data.Text.pack (symbolVal (Proxy @piece)))
34      put (rest, piece : found)
35instance KnownSymbol name => HasPathParser (Capture name x) where
36  pathParser _ = do
37      (_ : rest, found) <- get  -- we are using MonadFail here
38      put (rest, Data.Text.pack (symbolVal (Proxy @name)) : found)
39instance HasPathParser (Verb method statusCode contextTypes a) where
40  pathParser _ = do
41      ([], found) <- get -- we are using MonadFail here
42      put ([], found)
43instance HasPathParser (ReqBody x y) where
44  pathParser _ = pure ()
45
46instance (HasPathParser a, HasPathParser b) => HasPathParser (a :> b) where
47  pathParser _ = pathParser (Proxy @a) *> pathParser (Proxy @b)
48
49instance (HasPathParser a, HasPathParser b) => HasPathParser (a :<|> b) where
50  pathParser _ = pathParser (Proxy @a) <|> pathParser (Proxy @b)
51

1type BookAPI =
2  "books" :> Get '[JSON] (Map Text Text)
3    :<|> "book" :> Capture "Name" Text :> ReqBody '[JSON] (Text) :> Post '[JSON] (Text)
4λ:T.putStrLn $ layout (Proxy :: Proxy BookAPI)
5/
6├─ book/
7│  └─ <capture>/
8│     └─•
9└─ books/
10   └─•
11prometheusMiddlware = instrumentHandlerValue (T.intercalate "\\" . pathInfo)
12import Data.Text 
13import Control.Monad.State.Strict
14import Control.Applicative
15
16type PathParser = StateT ([Text],[Text]) Maybe ()
17{-# LANGUAGE KindSignatures #-}
18{-# LANGUAGE PolyKinds #-}
19{-# LANGUAGE DataKinds #-}
20{-# LANGUAGE FlexibleInstances #-}
21{-# LANGUAGE TypeApplications #-}
22{-# LANGUAGE ScopedTypeVariables #-}
23{-# LANGUAGE TypeOperators #-}
24{-# LANGUAGE OverloadedStrings #-}
25import Data.Data ( Proxy )
26import GHC.TypeLits
27
28class HasPathParser (x :: k) where
29    pathParser :: Proxy x -> PathParser
30instance KnownSymbol piece => HasPathParser (piece :: Symbol) where
31  pathParser _ = do
32      (piece : rest, found) <- get -- we are using MonadFail here
33      guard (piece == Data.Text.pack (symbolVal (Proxy @piece)))
34      put (rest, piece : found)
35instance KnownSymbol name => HasPathParser (Capture name x) where
36  pathParser _ = do
37      (_ : rest, found) <- get  -- we are using MonadFail here
38      put (rest, Data.Text.pack (symbolVal (Proxy @name)) : found)
39instance HasPathParser (Verb method statusCode contextTypes a) where
40  pathParser _ = do
41      ([], found) <- get -- we are using MonadFail here
42      put ([], found)
43instance HasPathParser (ReqBody x y) where
44  pathParser _ = pure ()
45
46instance (HasPathParser a, HasPathParser b) => HasPathParser (a :> b) where
47  pathParser _ = pathParser (Proxy @a) *> pathParser (Proxy @b)
48
49instance (HasPathParser a, HasPathParser b) => HasPathParser (a :<|> b) where
50  pathParser _ = pathParser (Proxy @a) <|> pathParser (Proxy @b)
51main :: IO ()
52main = do
53    do let Just ([], result) = execStateT (pathParser (Proxy @BookAPI)) (["books"],[])
54       print result
55       -- ["books"]
56    do let Just ([], result) = execStateT (pathParser (Proxy @BookAPI)) (["book", "somebookid"],[])
57       print result
58       -- ["Name","book"]
59

1  @Component
2  public class CustomOAuth2UserService extends DefaultOAuth2UserService {
3
4     private UserRepository userRepository;
5
6     @Autowired
7     public void setUserRepository(UserRepository userRepository) {
8        this.userRepository = userRepository;
9     }
10
11    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
12        ...
13    }
14 }
15@EnableWebSecurity
16@Import(SecurityProblemSupport.class)
17@ConditionalOnProperty(
18        value = "myapp.authentication.type",
19        havingValue = "oauth",
20        matchIfMissing = true
21)
22public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
23  private final CustomOAuth2UserService customOAuth2UserService;
24    
25  public SecurityConfiguration(CustomOAuth2UserService customOAuth2UserService) {
26    this.customOAuth2UserService = customOAuth2UserService;
27  }
28
29  @Override
30  public void configure(WebSecurity web) {
31    web.ignoring()
32        .antMatchers(HttpMethod.OPTIONS, "/**")
33        .antMatchers("/app/**/*.{js,html}")
34        .antMatchers("/bundle.js")
35        .antMatchers("/slds-icons/**")
36        .antMatchers("/assets/**")
37        .antMatchers("/i18n/**")
38        .antMatchers("/content/**")
39        .antMatchers("/swagger-ui/**")
40        .antMatchers("/swagger-resources")
41        .antMatchers("/v2/api-docs")
42        .antMatchers("/api/redirectToHome")
43        .antMatchers("/test/**");
44  }
45
46  public void configure(HttpSecurity http) throws Exception {
47    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
48      private RegexRequestMatcher requestMatcher =
49          new RegexRequestMatcher("/api/", null);
50
51      @Override
52      public boolean matches(HttpServletRequest request) {
53        return requestMatcher.matches(request);
54      }
55    };
56
57    http.csrf()
58        .requireCsrfProtectionMatcher(csrfRequestMatcher)
59        .and()
60        .authorizeRequests()
61        .antMatchers("/login**").permitAll()
62        .antMatchers("/manage/**").permitAll()
63        .antMatchers("/api/auth-info").permitAll()
64        .antMatchers("/api/**").authenticated()
65        .antMatchers("/management/health").permitAll()
66        .antMatchers("/management/info").permitAll()
67        .antMatchers("/management/prometheus").permitAll()
68        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
69        .anyRequest().authenticated()//.and().oauth2ResourceServer().jwt()
70        .and()
71        .oauth2Login()
72        .redirectionEndpoint()
73        .baseUri("/oauth2**")
74        .and()
75        .failureUrl("/api/redirectToHome")
76        .userInfoEndpoint().userService(oauth2UserService())
77    ;
78    http.cors().disable();
79  }
80
81
82  private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
83    return customOAuth2UserService;
84  }
85}
86spring.security.oauth2.client.registration.keycloak.client-id=abcd
87spring.security.oauth2.client.registration.keycloak.client-name=Auth Server
88spring.security.oauth2.client.registration.keycloak.scope=api
89spring.security.oauth2.client.registration.keycloak.provider=keycloak
90spring.security.oauth2.client.registration.keycloak.client-authentication-method=basic
91spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
92myapp.oauth2.path=https://internal.authprovider.com/oauth2/
93spring.security.oauth2.client.provider.keycloak.token-uri=${myapp.oauth2.path}token
94spring.security.oauth2.client.provider.keycloak.authorization-uri=${myapp.oauth2.path}authorize
95spring.security.oauth2.client.provider.keycloak.user-info-uri=${myapp.oauth2.path}userinfo
96spring.security.oauth2.client.provider.keycloak.user-name-attribute=name
97myapp.authentication.type=oauth
98@Controller
99public class Tenant1HomeController {
100
101    @GetMapping("/tenant1/home")
102    public String home() {
103        return "tenant1Home";
104    }
105
106}
107

1  @Component
2  public class CustomOAuth2UserService extends DefaultOAuth2UserService {
3
4     private UserRepository userRepository;
5
6     @Autowired
7     public void setUserRepository(UserRepository userRepository) {
8        this.userRepository = userRepository;
9     }
10
11    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
12        ...
13    }
14 }
15@EnableWebSecurity
16@Import(SecurityProblemSupport.class)
17@ConditionalOnProperty(
18        value = "myapp.authentication.type",
19        havingValue = "oauth",
20        matchIfMissing = true
21)
22public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
23  private final CustomOAuth2UserService customOAuth2UserService;
24    
25  public SecurityConfiguration(CustomOAuth2UserService customOAuth2UserService) {
26    this.customOAuth2UserService = customOAuth2UserService;
27  }
28
29  @Override
30  public void configure(WebSecurity web) {
31    web.ignoring()
32        .antMatchers(HttpMethod.OPTIONS, "/**")
33        .antMatchers("/app/**/*.{js,html}")
34        .antMatchers("/bundle.js")
35        .antMatchers("/slds-icons/**")
36        .antMatchers("/assets/**")
37        .antMatchers("/i18n/**")
38        .antMatchers("/content/**")
39        .antMatchers("/swagger-ui/**")
40        .antMatchers("/swagger-resources")
41        .antMatchers("/v2/api-docs")
42        .antMatchers("/api/redirectToHome")
43        .antMatchers("/test/**");
44  }
45
46  public void configure(HttpSecurity http) throws Exception {
47    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
48      private RegexRequestMatcher requestMatcher =
49          new RegexRequestMatcher("/api/", null);
50
51      @Override
52      public boolean matches(HttpServletRequest request) {
53        return requestMatcher.matches(request);
54      }
55    };
56
57    http.csrf()
58        .requireCsrfProtectionMatcher(csrfRequestMatcher)
59        .and()
60        .authorizeRequests()
61        .antMatchers("/login**").permitAll()
62        .antMatchers("/manage/**").permitAll()
63        .antMatchers("/api/auth-info").permitAll()
64        .antMatchers("/api/**").authenticated()
65        .antMatchers("/management/health").permitAll()
66        .antMatchers("/management/info").permitAll()
67        .antMatchers("/management/prometheus").permitAll()
68        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
69        .anyRequest().authenticated()//.and().oauth2ResourceServer().jwt()
70        .and()
71        .oauth2Login()
72        .redirectionEndpoint()
73        .baseUri("/oauth2**")
74        .and()
75        .failureUrl("/api/redirectToHome")
76        .userInfoEndpoint().userService(oauth2UserService())
77    ;
78    http.cors().disable();
79  }
80
81
82  private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
83    return customOAuth2UserService;
84  }
85}
86spring.security.oauth2.client.registration.keycloak.client-id=abcd
87spring.security.oauth2.client.registration.keycloak.client-name=Auth Server
88spring.security.oauth2.client.registration.keycloak.scope=api
89spring.security.oauth2.client.registration.keycloak.provider=keycloak
90spring.security.oauth2.client.registration.keycloak.client-authentication-method=basic
91spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
92myapp.oauth2.path=https://internal.authprovider.com/oauth2/
93spring.security.oauth2.client.provider.keycloak.token-uri=${myapp.oauth2.path}token
94spring.security.oauth2.client.provider.keycloak.authorization-uri=${myapp.oauth2.path}authorize
95spring.security.oauth2.client.provider.keycloak.user-info-uri=${myapp.oauth2.path}userinfo
96spring.security.oauth2.client.provider.keycloak.user-name-attribute=name
97myapp.authentication.type=oauth
98@Controller
99public class Tenant1HomeController {
100
101    @GetMapping("/tenant1/home")
102    public String home() {
103        return "tenant1Home";
104    }
105
106}
107@Controller
108public class Tenant2HomeController {
109
110    @GetMapping("/tenant2/home")
111    public String home() {
112        return "tenant2Home";
113    }
114
115}
116

1  @Component
2  public class CustomOAuth2UserService extends DefaultOAuth2UserService {
3
4     private UserRepository userRepository;
5
6     @Autowired
7     public void setUserRepository(UserRepository userRepository) {
8        this.userRepository = userRepository;
9     }
10
11    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
12        ...
13    }
14 }
15@EnableWebSecurity
16@Import(SecurityProblemSupport.class)
17@ConditionalOnProperty(
18        value = "myapp.authentication.type",
19        havingValue = "oauth",
20        matchIfMissing = true
21)
22public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
23  private final CustomOAuth2UserService customOAuth2UserService;
24    
25  public SecurityConfiguration(CustomOAuth2UserService customOAuth2UserService) {
26    this.customOAuth2UserService = customOAuth2UserService;
27  }
28
29  @Override
30  public void configure(WebSecurity web) {
31    web.ignoring()
32        .antMatchers(HttpMethod.OPTIONS, "/**")
33        .antMatchers("/app/**/*.{js,html}")
34        .antMatchers("/bundle.js")
35        .antMatchers("/slds-icons/**")
36        .antMatchers("/assets/**")
37        .antMatchers("/i18n/**")
38        .antMatchers("/content/**")
39        .antMatchers("/swagger-ui/**")
40        .antMatchers("/swagger-resources")
41        .antMatchers("/v2/api-docs")
42        .antMatchers("/api/redirectToHome")
43        .antMatchers("/test/**");
44  }
45
46  public void configure(HttpSecurity http) throws Exception {
47    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
48      private RegexRequestMatcher requestMatcher =
49          new RegexRequestMatcher("/api/", null);
50
51      @Override
52      public boolean matches(HttpServletRequest request) {
53        return requestMatcher.matches(request);
54      }
55    };
56
57    http.csrf()
58        .requireCsrfProtectionMatcher(csrfRequestMatcher)
59        .and()
60        .authorizeRequests()
61        .antMatchers("/login**").permitAll()
62        .antMatchers("/manage/**").permitAll()
63        .antMatchers("/api/auth-info").permitAll()
64        .antMatchers("/api/**").authenticated()
65        .antMatchers("/management/health").permitAll()
66        .antMatchers("/management/info").permitAll()
67        .antMatchers("/management/prometheus").permitAll()
68        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
69        .anyRequest().authenticated()//.and().oauth2ResourceServer().jwt()
70        .and()
71        .oauth2Login()
72        .redirectionEndpoint()
73        .baseUri("/oauth2**")
74        .and()
75        .failureUrl("/api/redirectToHome")
76        .userInfoEndpoint().userService(oauth2UserService())
77    ;
78    http.cors().disable();
79  }
80
81
82  private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
83    return customOAuth2UserService;
84  }
85}
86spring.security.oauth2.client.registration.keycloak.client-id=abcd
87spring.security.oauth2.client.registration.keycloak.client-name=Auth Server
88spring.security.oauth2.client.registration.keycloak.scope=api
89spring.security.oauth2.client.registration.keycloak.provider=keycloak
90spring.security.oauth2.client.registration.keycloak.client-authentication-method=basic
91spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
92myapp.oauth2.path=https://internal.authprovider.com/oauth2/
93spring.security.oauth2.client.provider.keycloak.token-uri=${myapp.oauth2.path}token
94spring.security.oauth2.client.provider.keycloak.authorization-uri=${myapp.oauth2.path}authorize
95spring.security.oauth2.client.provider.keycloak.user-info-uri=${myapp.oauth2.path}userinfo
96spring.security.oauth2.client.provider.keycloak.user-name-attribute=name
97myapp.authentication.type=oauth
98@Controller
99public class Tenant1HomeController {
100
101    @GetMapping("/tenant1/home")
102    public String home() {
103        return "tenant1Home";
104    }
105
106}
107@Controller
108public class Tenant2HomeController {
109
110    @GetMapping("/tenant2/home")
111    public String home() {
112        return "tenant2Home";
113    }
114
115}
116@Configuration
117public class Tenant1SecurityConfiguration extends WebSecurityConfigurerAdapter {
118
119    @Override
120    protected void configure(HttpSecurity http) throws Exception {
121        http
122                .csrf().disable()
123                .authorizeRequests()
124                .antMatchers("/login**").permitAll()
125                .antMatchers("/manage/**").permitAll()
126                .antMatchers("/api/auth-info").permitAll()
127                .antMatchers("/api/**").authenticated()
128                .antMatchers("/management/health").permitAll()
129                .antMatchers("/management/info").permitAll()
130                .antMatchers("/management/prometheus").permitAll()
131                .antMatchers("/management/**").hasAuthority("ADMIN")
132                .antMatchers("/tenant1/**").authenticated()
133                .and()
134                .oauth2Login()
135                .and()
136                .cors()
137                .disable();
138    }
139}
140

1  @Component
2  public class CustomOAuth2UserService extends DefaultOAuth2UserService {
3
4     private UserRepository userRepository;
5
6     @Autowired
7     public void setUserRepository(UserRepository userRepository) {
8        this.userRepository = userRepository;
9     }
10
11    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
12        ...
13    }
14 }
15@EnableWebSecurity
16@Import(SecurityProblemSupport.class)
17@ConditionalOnProperty(
18        value = "myapp.authentication.type",
19        havingValue = "oauth",
20        matchIfMissing = true
21)
22public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
23  private final CustomOAuth2UserService customOAuth2UserService;
24    
25  public SecurityConfiguration(CustomOAuth2UserService customOAuth2UserService) {
26    this.customOAuth2UserService = customOAuth2UserService;
27  }
28
29  @Override
30  public void configure(WebSecurity web) {
31    web.ignoring()
32        .antMatchers(HttpMethod.OPTIONS, "/**")
33        .antMatchers("/app/**/*.{js,html}")
34        .antMatchers("/bundle.js")
35        .antMatchers("/slds-icons/**")
36        .antMatchers("/assets/**")
37        .antMatchers("/i18n/**")
38        .antMatchers("/content/**")
39        .antMatchers("/swagger-ui/**")
40        .antMatchers("/swagger-resources")
41        .antMatchers("/v2/api-docs")
42        .antMatchers("/api/redirectToHome")
43        .antMatchers("/test/**");
44  }
45
46  public void configure(HttpSecurity http) throws Exception {
47    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
48      private RegexRequestMatcher requestMatcher =
49          new RegexRequestMatcher("/api/", null);
50
51      @Override
52      public boolean matches(HttpServletRequest request) {
53        return requestMatcher.matches(request);
54      }
55    };
56
57    http.csrf()
58        .requireCsrfProtectionMatcher(csrfRequestMatcher)
59        .and()
60        .authorizeRequests()
61        .antMatchers("/login**").permitAll()
62        .antMatchers("/manage/**").permitAll()
63        .antMatchers("/api/auth-info").permitAll()
64        .antMatchers("/api/**").authenticated()
65        .antMatchers("/management/health").permitAll()
66        .antMatchers("/management/info").permitAll()
67        .antMatchers("/management/prometheus").permitAll()
68        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
69        .anyRequest().authenticated()//.and().oauth2ResourceServer().jwt()
70        .and()
71        .oauth2Login()
72        .redirectionEndpoint()
73        .baseUri("/oauth2**")
74        .and()
75        .failureUrl("/api/redirectToHome")
76        .userInfoEndpoint().userService(oauth2UserService())
77    ;
78    http.cors().disable();
79  }
80
81
82  private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
83    return customOAuth2UserService;
84  }
85}
86spring.security.oauth2.client.registration.keycloak.client-id=abcd
87spring.security.oauth2.client.registration.keycloak.client-name=Auth Server
88spring.security.oauth2.client.registration.keycloak.scope=api
89spring.security.oauth2.client.registration.keycloak.provider=keycloak
90spring.security.oauth2.client.registration.keycloak.client-authentication-method=basic
91spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
92myapp.oauth2.path=https://internal.authprovider.com/oauth2/
93spring.security.oauth2.client.provider.keycloak.token-uri=${myapp.oauth2.path}token
94spring.security.oauth2.client.provider.keycloak.authorization-uri=${myapp.oauth2.path}authorize
95spring.security.oauth2.client.provider.keycloak.user-info-uri=${myapp.oauth2.path}userinfo
96spring.security.oauth2.client.provider.keycloak.user-name-attribute=name
97myapp.authentication.type=oauth
98@Controller
99public class Tenant1HomeController {
100
101    @GetMapping("/tenant1/home")
102    public String home() {
103        return "tenant1Home";
104    }
105
106}
107@Controller
108public class Tenant2HomeController {
109
110    @GetMapping("/tenant2/home")
111    public String home() {
112        return "tenant2Home";
113    }
114
115}
116@Configuration
117public class Tenant1SecurityConfiguration extends WebSecurityConfigurerAdapter {
118
119    @Override
120    protected void configure(HttpSecurity http) throws Exception {
121        http
122                .csrf().disable()
123                .authorizeRequests()
124                .antMatchers("/login**").permitAll()
125                .antMatchers("/manage/**").permitAll()
126                .antMatchers("/api/auth-info").permitAll()
127                .antMatchers("/api/**").authenticated()
128                .antMatchers("/management/health").permitAll()
129                .antMatchers("/management/info").permitAll()
130                .antMatchers("/management/prometheus").permitAll()
131                .antMatchers("/management/**").hasAuthority("ADMIN")
132                .antMatchers("/tenant1/**").authenticated()
133                .and()
134                .oauth2Login()
135                .and()
136                .cors()
137                .disable();
138    }
139}
140@Order(90)
141@Configuration
142public class Tenant2SecurityConfiguration extends WebSecurityConfigurerAdapter {
143
144    @Override
145    protected void configure(HttpSecurity http) throws Exception {
146        http.requestMatcher(new AntPathRequestMatcher("/tenant2/**"))
147                .csrf()
148                .disable()
149                .authorizeRequests()
150                .antMatchers("/tenant2/**").hasAuthority("BASIC_USER")
151                .and()
152                .httpBasic();
153        http.cors().disable();
154    }
155
156    @Override
157    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
158        auth.inMemoryAuthentication()
159                .withUser("user")
160                .password("{noop}password")
161                .roles("BASIC_USER");
162    }
163}
164

1  @Component
2  public class CustomOAuth2UserService extends DefaultOAuth2UserService {
3
4     private UserRepository userRepository;
5
6     @Autowired
7     public void setUserRepository(UserRepository userRepository) {
8        this.userRepository = userRepository;
9     }
10
11    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
12        ...
13    }
14 }
15@EnableWebSecurity
16@Import(SecurityProblemSupport.class)
17@ConditionalOnProperty(
18        value = "myapp.authentication.type",
19        havingValue = "oauth",
20        matchIfMissing = true
21)
22public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
23  private final CustomOAuth2UserService customOAuth2UserService;
24    
25  public SecurityConfiguration(CustomOAuth2UserService customOAuth2UserService) {
26    this.customOAuth2UserService = customOAuth2UserService;
27  }
28
29  @Override
30  public void configure(WebSecurity web) {
31    web.ignoring()
32        .antMatchers(HttpMethod.OPTIONS, "/**")
33        .antMatchers("/app/**/*.{js,html}")
34        .antMatchers("/bundle.js")
35        .antMatchers("/slds-icons/**")
36        .antMatchers("/assets/**")
37        .antMatchers("/i18n/**")
38        .antMatchers("/content/**")
39        .antMatchers("/swagger-ui/**")
40        .antMatchers("/swagger-resources")
41        .antMatchers("/v2/api-docs")
42        .antMatchers("/api/redirectToHome")
43        .antMatchers("/test/**");
44  }
45
46  public void configure(HttpSecurity http) throws Exception {
47    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
48      private RegexRequestMatcher requestMatcher =
49          new RegexRequestMatcher("/api/", null);
50
51      @Override
52      public boolean matches(HttpServletRequest request) {
53        return requestMatcher.matches(request);
54      }
55    };
56
57    http.csrf()
58        .requireCsrfProtectionMatcher(csrfRequestMatcher)
59        .and()
60        .authorizeRequests()
61        .antMatchers("/login**").permitAll()
62        .antMatchers("/manage/**").permitAll()
63        .antMatchers("/api/auth-info").permitAll()
64        .antMatchers("/api/**").authenticated()
65        .antMatchers("/management/health").permitAll()
66        .antMatchers("/management/info").permitAll()
67        .antMatchers("/management/prometheus").permitAll()
68        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
69        .anyRequest().authenticated()//.and().oauth2ResourceServer().jwt()
70        .and()
71        .oauth2Login()
72        .redirectionEndpoint()
73        .baseUri("/oauth2**")
74        .and()
75        .failureUrl("/api/redirectToHome")
76        .userInfoEndpoint().userService(oauth2UserService())
77    ;
78    http.cors().disable();
79  }
80
81
82  private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
83    return customOAuth2UserService;
84  }
85}
86spring.security.oauth2.client.registration.keycloak.client-id=abcd
87spring.security.oauth2.client.registration.keycloak.client-name=Auth Server
88spring.security.oauth2.client.registration.keycloak.scope=api
89spring.security.oauth2.client.registration.keycloak.provider=keycloak
90spring.security.oauth2.client.registration.keycloak.client-authentication-method=basic
91spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
92myapp.oauth2.path=https://internal.authprovider.com/oauth2/
93spring.security.oauth2.client.provider.keycloak.token-uri=${myapp.oauth2.path}token
94spring.security.oauth2.client.provider.keycloak.authorization-uri=${myapp.oauth2.path}authorize
95spring.security.oauth2.client.provider.keycloak.user-info-uri=${myapp.oauth2.path}userinfo
96spring.security.oauth2.client.provider.keycloak.user-name-attribute=name
97myapp.authentication.type=oauth
98@Controller
99public class Tenant1HomeController {
100
101    @GetMapping("/tenant1/home")
102    public String home() {
103        return "tenant1Home";
104    }
105
106}
107@Controller
108public class Tenant2HomeController {
109
110    @GetMapping("/tenant2/home")
111    public String home() {
112        return "tenant2Home";
113    }
114
115}
116@Configuration
117public class Tenant1SecurityConfiguration extends WebSecurityConfigurerAdapter {
118
119    @Override
120    protected void configure(HttpSecurity http) throws Exception {
121        http
122                .csrf().disable()
123                .authorizeRequests()
124                .antMatchers("/login**").permitAll()
125                .antMatchers("/manage/**").permitAll()
126                .antMatchers("/api/auth-info").permitAll()
127                .antMatchers("/api/**").authenticated()
128                .antMatchers("/management/health").permitAll()
129                .antMatchers("/management/info").permitAll()
130                .antMatchers("/management/prometheus").permitAll()
131                .antMatchers("/management/**").hasAuthority("ADMIN")
132                .antMatchers("/tenant1/**").authenticated()
133                .and()
134                .oauth2Login()
135                .and()
136                .cors()
137                .disable();
138    }
139}
140@Order(90)
141@Configuration
142public class Tenant2SecurityConfiguration extends WebSecurityConfigurerAdapter {
143
144    @Override
145    protected void configure(HttpSecurity http) throws Exception {
146        http.requestMatcher(new AntPathRequestMatcher("/tenant2/**"))
147                .csrf()
148                .disable()
149                .authorizeRequests()
150                .antMatchers("/tenant2/**").hasAuthority("BASIC_USER")
151                .and()
152                .httpBasic();
153        http.cors().disable();
154    }
155
156    @Override
157    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
158        auth.inMemoryAuthentication()
159                .withUser("user")
160                .password("{noop}password")
161                .roles("BASIC_USER");
162    }
163}
164spring:
165  security:
166    oauth2:
167      client:
168        registration:
169          keycloak:
170            client-id: myclient
171            client-secret: c6dce03e-ea13-4b76-8aab-c876f5c2c1d9
172        provider:
173          keycloak:
174            issuer-uri: http://localhost:8180/auth/realms/myrealm
175

1  @Component
2  public class CustomOAuth2UserService extends DefaultOAuth2UserService {
3
4     private UserRepository userRepository;
5
6     @Autowired
7     public void setUserRepository(UserRepository userRepository) {
8        this.userRepository = userRepository;
9     }
10
11    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
12        ...
13    }
14 }
15@EnableWebSecurity
16@Import(SecurityProblemSupport.class)
17@ConditionalOnProperty(
18        value = "myapp.authentication.type",
19        havingValue = "oauth",
20        matchIfMissing = true
21)
22public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
23  private final CustomOAuth2UserService customOAuth2UserService;
24    
25  public SecurityConfiguration(CustomOAuth2UserService customOAuth2UserService) {
26    this.customOAuth2UserService = customOAuth2UserService;
27  }
28
29  @Override
30  public void configure(WebSecurity web) {
31    web.ignoring()
32        .antMatchers(HttpMethod.OPTIONS, "/**")
33        .antMatchers("/app/**/*.{js,html}")
34        .antMatchers("/bundle.js")
35        .antMatchers("/slds-icons/**")
36        .antMatchers("/assets/**")
37        .antMatchers("/i18n/**")
38        .antMatchers("/content/**")
39        .antMatchers("/swagger-ui/**")
40        .antMatchers("/swagger-resources")
41        .antMatchers("/v2/api-docs")
42        .antMatchers("/api/redirectToHome")
43        .antMatchers("/test/**");
44  }
45
46  public void configure(HttpSecurity http) throws Exception {
47    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
48      private RegexRequestMatcher requestMatcher =
49          new RegexRequestMatcher("/api/", null);
50
51      @Override
52      public boolean matches(HttpServletRequest request) {
53        return requestMatcher.matches(request);
54      }
55    };
56
57    http.csrf()
58        .requireCsrfProtectionMatcher(csrfRequestMatcher)
59        .and()
60        .authorizeRequests()
61        .antMatchers("/login**").permitAll()
62        .antMatchers("/manage/**").permitAll()
63        .antMatchers("/api/auth-info").permitAll()
64        .antMatchers("/api/**").authenticated()
65        .antMatchers("/management/health").permitAll()
66        .antMatchers("/management/info").permitAll()
67        .antMatchers("/management/prometheus").permitAll()
68        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
69        .anyRequest().authenticated()//.and().oauth2ResourceServer().jwt()
70        .and()
71        .oauth2Login()
72        .redirectionEndpoint()
73        .baseUri("/oauth2**")
74        .and()
75        .failureUrl("/api/redirectToHome")
76        .userInfoEndpoint().userService(oauth2UserService())
77    ;
78    http.cors().disable();
79  }
80
81
82  private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
83    return customOAuth2UserService;
84  }
85}
86spring.security.oauth2.client.registration.keycloak.client-id=abcd
87spring.security.oauth2.client.registration.keycloak.client-name=Auth Server
88spring.security.oauth2.client.registration.keycloak.scope=api
89spring.security.oauth2.client.registration.keycloak.provider=keycloak
90spring.security.oauth2.client.registration.keycloak.client-authentication-method=basic
91spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
92myapp.oauth2.path=https://internal.authprovider.com/oauth2/
93spring.security.oauth2.client.provider.keycloak.token-uri=${myapp.oauth2.path}token
94spring.security.oauth2.client.provider.keycloak.authorization-uri=${myapp.oauth2.path}authorize
95spring.security.oauth2.client.provider.keycloak.user-info-uri=${myapp.oauth2.path}userinfo
96spring.security.oauth2.client.provider.keycloak.user-name-attribute=name
97myapp.authentication.type=oauth
98@Controller
99public class Tenant1HomeController {
100
101    @GetMapping("/tenant1/home")
102    public String home() {
103        return "tenant1Home";
104    }
105
106}
107@Controller
108public class Tenant2HomeController {
109
110    @GetMapping("/tenant2/home")
111    public String home() {
112        return "tenant2Home";
113    }
114
115}
116@Configuration
117public class Tenant1SecurityConfiguration extends WebSecurityConfigurerAdapter {
118
119    @Override
120    protected void configure(HttpSecurity http) throws Exception {
121        http
122                .csrf().disable()
123                .authorizeRequests()
124                .antMatchers("/login**").permitAll()
125                .antMatchers("/manage/**").permitAll()
126                .antMatchers("/api/auth-info").permitAll()
127                .antMatchers("/api/**").authenticated()
128                .antMatchers("/management/health").permitAll()
129                .antMatchers("/management/info").permitAll()
130                .antMatchers("/management/prometheus").permitAll()
131                .antMatchers("/management/**").hasAuthority("ADMIN")
132                .antMatchers("/tenant1/**").authenticated()
133                .and()
134                .oauth2Login()
135                .and()
136                .cors()
137                .disable();
138    }
139}
140@Order(90)
141@Configuration
142public class Tenant2SecurityConfiguration extends WebSecurityConfigurerAdapter {
143
144    @Override
145    protected void configure(HttpSecurity http) throws Exception {
146        http.requestMatcher(new AntPathRequestMatcher("/tenant2/**"))
147                .csrf()
148                .disable()
149                .authorizeRequests()
150                .antMatchers("/tenant2/**").hasAuthority("BASIC_USER")
151                .and()
152                .httpBasic();
153        http.cors().disable();
154    }
155
156    @Override
157    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
158        auth.inMemoryAuthentication()
159                .withUser("user")
160                .password("{noop}password")
161                .roles("BASIC_USER");
162    }
163}
164spring:
165  security:
166    oauth2:
167      client:
168        registration:
169          keycloak:
170            client-id: myclient
171            client-secret: c6dce03e-ea13-4b76-8aab-c876f5c2c1d9
172        provider:
173          keycloak:
174            issuer-uri: http://localhost:8180/auth/realms/myrealm
175@Configuration
176public class Tenant1SecurityConfiguration extends WebSecurityConfigurerAdapter {
177
178    @Override
179    protected void configure(HttpSecurity http) throws Exception {
180        http.
181            ...
182            .and()
183            .oauth2Login()
184            .and()
185            ...
186            
187

1  @Component
2  public class CustomOAuth2UserService extends DefaultOAuth2UserService {
3
4     private UserRepository userRepository;
5
6     @Autowired
7     public void setUserRepository(UserRepository userRepository) {
8        this.userRepository = userRepository;
9     }
10
11    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
12        ...
13    }
14 }
15@EnableWebSecurity
16@Import(SecurityProblemSupport.class)
17@ConditionalOnProperty(
18        value = "myapp.authentication.type",
19        havingValue = "oauth",
20        matchIfMissing = true
21)
22public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
23  private final CustomOAuth2UserService customOAuth2UserService;
24    
25  public SecurityConfiguration(CustomOAuth2UserService customOAuth2UserService) {
26    this.customOAuth2UserService = customOAuth2UserService;
27  }
28
29  @Override
30  public void configure(WebSecurity web) {
31    web.ignoring()
32        .antMatchers(HttpMethod.OPTIONS, "/**")
33        .antMatchers("/app/**/*.{js,html}")
34        .antMatchers("/bundle.js")
35        .antMatchers("/slds-icons/**")
36        .antMatchers("/assets/**")
37        .antMatchers("/i18n/**")
38        .antMatchers("/content/**")
39        .antMatchers("/swagger-ui/**")
40        .antMatchers("/swagger-resources")
41        .antMatchers("/v2/api-docs")
42        .antMatchers("/api/redirectToHome")
43        .antMatchers("/test/**");
44  }
45
46  public void configure(HttpSecurity http) throws Exception {
47    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
48      private RegexRequestMatcher requestMatcher =
49          new RegexRequestMatcher("/api/", null);
50
51      @Override
52      public boolean matches(HttpServletRequest request) {
53        return requestMatcher.matches(request);
54      }
55    };
56
57    http.csrf()
58        .requireCsrfProtectionMatcher(csrfRequestMatcher)
59        .and()
60        .authorizeRequests()
61        .antMatchers("/login**").permitAll()
62        .antMatchers("/manage/**").permitAll()
63        .antMatchers("/api/auth-info").permitAll()
64        .antMatchers("/api/**").authenticated()
65        .antMatchers("/management/health").permitAll()
66        .antMatchers("/management/info").permitAll()
67        .antMatchers("/management/prometheus").permitAll()
68        .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
69        .anyRequest().authenticated()//.and().oauth2ResourceServer().jwt()
70        .and()
71        .oauth2Login()
72        .redirectionEndpoint()
73        .baseUri("/oauth2**")
74        .and()
75        .failureUrl("/api/redirectToHome")
76        .userInfoEndpoint().userService(oauth2UserService())
77    ;
78    http.cors().disable();
79  }
80
81
82  private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
83    return customOAuth2UserService;
84  }
85}
86spring.security.oauth2.client.registration.keycloak.client-id=abcd
87spring.security.oauth2.client.registration.keycloak.client-name=Auth Server
88spring.security.oauth2.client.registration.keycloak.scope=api
89spring.security.oauth2.client.registration.keycloak.provider=keycloak
90spring.security.oauth2.client.registration.keycloak.client-authentication-method=basic
91spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
92myapp.oauth2.path=https://internal.authprovider.com/oauth2/
93spring.security.oauth2.client.provider.keycloak.token-uri=${myapp.oauth2.path}token
94spring.security.oauth2.client.provider.keycloak.authorization-uri=${myapp.oauth2.path}authorize
95spring.security.oauth2.client.provider.keycloak.user-info-uri=${myapp.oauth2.path}userinfo
96spring.security.oauth2.client.provider.keycloak.user-name-attribute=name
97myapp.authentication.type=oauth
98@Controller
99public class Tenant1HomeController {
100
101    @GetMapping("/tenant1/home")
102    public String home() {
103        return "tenant1Home";
104    }
105
106}
107@Controller
108public class Tenant2HomeController {
109
110    @GetMapping("/tenant2/home")
111    public String home() {
112        return "tenant2Home";
113    }
114
115}
116@Configuration
117public class Tenant1SecurityConfiguration extends WebSecurityConfigurerAdapter {
118
119    @Override
120    protected void configure(HttpSecurity http) throws Exception {
121        http
122                .csrf().disable()
123                .authorizeRequests()
124                .antMatchers("/login**").permitAll()
125                .antMatchers("/manage/**").permitAll()
126                .antMatchers("/api/auth-info").permitAll()
127                .antMatchers("/api/**").authenticated()
128                .antMatchers("/management/health").permitAll()
129                .antMatchers("/management/info").permitAll()
130                .antMatchers("/management/prometheus").permitAll()
131                .antMatchers("/management/**").hasAuthority("ADMIN")
132                .antMatchers("/tenant1/**").authenticated()
133                .and()
134                .oauth2Login()
135                .and()
136                .cors()
137                .disable();
138    }
139}
140@Order(90)
141@Configuration
142public class Tenant2SecurityConfiguration extends WebSecurityConfigurerAdapter {
143
144    @Override
145    protected void configure(HttpSecurity http) throws Exception {
146        http.requestMatcher(new AntPathRequestMatcher("/tenant2/**"))
147                .csrf()
148                .disable()
149                .authorizeRequests()
150                .antMatchers("/tenant2/**").hasAuthority("BASIC_USER")
151                .and()
152                .httpBasic();
153        http.cors().disable();
154    }
155
156    @Override
157    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
158        auth.inMemoryAuthentication()
159                .withUser("user")
160                .password("{noop}password")
161                .roles("BASIC_USER");
162    }
163}
164spring:
165  security:
166    oauth2:
167      client:
168        registration:
169          keycloak:
170            client-id: myclient
171            client-secret: c6dce03e-ea13-4b76-8aab-c876f5c2c1d9
172        provider:
173          keycloak:
174            issuer-uri: http://localhost:8180/auth/realms/myrealm
175@Configuration
176public class Tenant1SecurityConfiguration extends WebSecurityConfigurerAdapter {
177
178    @Override
179    protected void configure(HttpSecurity http) throws Exception {
180        http.
181            ...
182            .and()
183            .oauth2Login()
184            .and()
185            ...
186            
187@Order(90)
188@Configuration
189public class Tenant2SecurityConfiguration extends WebSecurityConfigurerAdapter {
190
191    @Override
192    protected void configure(HttpSecurity http) throws Exception {
193        ...
194    }
195
196    @Override
197    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
198        auth.userDetailsService(XXX)
199

1(
2kube_pod_info{namespace="test"}
3)
4   + on(namespace) group_left(label_source)
5(
6   0 * kube_pod_labels
7)
8