Jetty eingebettet + Spring MVC + Spring Security + Https

Question

Ich bin ein System mit diesen Anforderungen zu konfigurieren:

• Spring MVC
• Jetty 9 eingebettet
• Spring Security über Https

Frühling Boot könnte ein guter Ausgangspunkt sein, aber es funktioniert nicht wegen unserer alten Hardware. Wir müssen Spring nur mit diesen Teilen konfigurieren.

Ich habe einen funktionierenden Code mit Spring MVC, Jetty und Spring Security aber über Http:

Spring Security:

@Configuration 
@EnableWebSecurity 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Value("${web.security.http.username1}") private String webUser1; 
    @Value("${web.security.http.password1}") private String webPassword1; 

    private static String REALM = "MY_TEST_REALM"; 

    @Autowired 
    protected void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception, BadCredentialsException { 

     auth.inMemoryAuthentication() 
      .withUser(webUser1).password(webPassword1).roles("USER"); 
    } 

    /** 
    * Ignored resources 
    */ 
    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web 
     .ignoring().antMatchers("/css/**", "/js/**", "/webjars/**") 
     .and() 
     .ignoring().antMatchers(HttpMethod.OPTIONS, "/**"); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 

     http  
     .authorizeRequests() 
     .antMatchers("/**").hasRole("USER") 
     .and() 
      .csrf()   
     .and() 
      .httpBasic().authenticationEntryPoint(entryPoint()) 
     .and() 
      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).sessionFixation().none() 
     .and() 
      .headers() 
       .xssProtection() 
      .and() 
       .frameOptions() 
      .and() 
       .httpStrictTransportSecurity() 
       .includeSubDomains(true) 
       .maxAgeInSeconds(60 * 60)    
      .and() 
       .contentTypeOptions() 
      .and() 
       .contentSecurityPolicy("" 
          + "default-src 'self'; " 
          + "script-src 'self'; " 
          + "connect-src 'self'; " 
          + "img-src 'self'; " 
          + "font-src 'self'; " 
          + "frame-ancestors 'none'; " 
          + "base-uri 'self'; " 
          + "form-action 'self'; " 
          + "style-src 'self' 'unsafe-inline' 'unsafe-eval'; ") 
      .and() 
       // internet explorer 
       .addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy","sandbox")); 
    } 

    @Bean 
    public BasicAuthenticationEntryPoint entryPoint() { 
     BasicAuthenticationEntryPoint entryPoint = new BasicAuthenticationEntryPoint(); 
     entryPoint.setRealmName(REALM); 
     return entryPoint; 
    } 
} 

Jetty Konfiguration:

@Bean 
    public WebAppContext jettyWebAppContext() throws IOException { 

     WebAppContext webUiContext = new WebAppContext(); 
     webUiContext.setContextPath(jettyContextPath); 
     webUiContext.setWar(new ClassPathResource("webapp").getURI().toString()); 
     webUiContext.setInitParameter("dirAllowed", "false"); 
     webUiContext.setParentLoaderPriority(true); 

     GenericWebApplicationContext webApplicationContext = new GenericWebApplicationContext(); 
     webApplicationContext.setParent(applicationContext); 
     webApplicationContext.refresh(); 
     webUiContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, webApplicationContext); 
     webUiContext.addEventListener(new WebMvcContextInit()); 
     webUiContext.addFilter(
      new FilterHolder(new DelegatingFilterProxy( 
        AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)), 
        "/*", EnumSet.allOf(DispatcherType.class) 
     ); 

     return webUiContext; 
    } 



@Bean(initMethod = "start", destroyMethod = "stop") 
    public Server jettyServer() throws IOException { 

JettyConfigurationMapper mappedFile = readJettyAccessConfigurationMapper(); 
      Server server = new Server(new InetSocketAddress(jettyHost, jettyPort)); 
      InetAccessHandler inetAccessHandler = buildInetAccessHandler(mappedFile); 
      server.setHandler(inetAccessHandler); 
      inetAccessHandler.setHandler(jettyWebAppContext()); 
      return server; 
} 

Wenn Ich ändere Jetty-Konfiguration zu https mit dem folgenden Code, ich sehe nur 403 Forbidden im Browser, mit jedem Sicherheitsformular (http Grund Auth):

@Bean(initMethod = "start", destroyMethod = "stop") 
    public Server jettyServer() throws IOException { 

     System.setProperty("jsse.enableSNIExtension", "false"); 

      HttpConfiguration httpConfig = new HttpConfiguration();   
      httpConfig.setSecureScheme("https"); 
      httpConfig.setSecurePort(jettyPort); 

      HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig); 
      httpsConfig.addCustomizer(new SecureRequestCustomizer()); 

      Resource jksFile = resourceLoader.getResource("classpath:" + myKeystoreJks); 
      SslContextFactory sslContextFactory = new SslContextFactory(); 
      sslContextFactory.setKeyStorePath(jksFile.getURL().toExternalForm()); 
      sslContextFactory.setKeyStorePassword(myKeystorePassword); 

      Server server = new Server(new InetSocketAddress(jettyHost, 8080)); 
      ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), 
        new HttpConnectionFactory(httpsConfig)); 
      sslConnector.setPort(jettyPort); 
      server.setConnectors(new Connector[] { sslConnector }); 
      JettyConfigurationMapper mappedFile = readJettyAccessConfigurationMapper(); 
      InetAccessHandler inetAccessHandler = buildInetAccessHandler(mappedFile); 
      server.setHandler(inetAccessHandler); 
      inetAccessHandler.setHandler(jettyWebAppContext()); 

      return server; 
    } 

Answer 1

löste ich das Problem der Server-Anschluss anstelle des Server-Konstruktor. Dies funktioniert gut mit Https.

Von

Server server = new Server(new InetSocketAddress(jettyHost, 8080)); 
ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), 
new HttpConnectionFactory(httpsConfig)); 
sslConnector.setPort(jettyPort); 

An:

Server server = new Server(); 
ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), 
new HttpConnectionFactory(httpsConfig)); 
sslConnector.setPort(jettyPort); 
sslConnector.setHost(jettyHost);