Lukas Weiss
DBE_Hackathon_

Repository

git clone --recurse-submodules https://github.com/hornerj94/microservices.git
mvnw spring-boot:run
mvnw.cmd spring-boot:run
git submodule foreach git pull origin master
spring:
  application:
    name: api-gateway # Identifier of this application

server:
  port: 2222

eureka:
  client:
    registryFetchIntervalSeconds: 5
    serviceUrl:
      defaultZone: http://localhost:8761/eureka/ # URL of the eureka server for registration

zuul:
  ignoredPatterns: /login/** # The login path is served by the api-gateway directly
  ignored-services: "*"
  routes: # Forwardings of requests
    dummy-service:
      path: /**
      service-id: dummy-service
    auth-service:
      path: /auth/**
      service-id: auth-service
      strip-prefix: false # Forward the request all together with the auth path
      sensitive-headers: Cookie, Set-Cookie # Avoid to send internal cookies to external entities
test-service:
  path: /test/**
  service-id: test-service
/*
 * Copyright 2019 (C) by Julian Horner.
 * All Rights Reserved.
 */

package de.rtuni.ms.apig.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import de.rtuni.ms.apig.filter.JWTAuthenticationFilter;

/**
 * Class that handles several security configurations.
 *
 * @author Julian
 */
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    //---------------------------------------------------------------------------------------------

    /** The <code>JwtConfiguration</code>. */
    @Autowired
    private JWTConfiguration jwtConfiguration;

    //---------------------------------------------------------------------------------------------

    /**
     * Get a new <code>JwtConfiguration</code>.
     *
     * @return The stated JWT configuration
     */
    @Bean
    public JWTConfiguration jwtConfig() { return new JWTConfiguration(); }

    //---------------------------------------------------------------------------------------------

    /**
     * Configure custom security configurations.
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
        // Use stateless sessions.
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()

        // Add filter to validate tokens with every request.
        .addFilterAfter(new JWTAuthenticationFilter(jwtConfiguration),
                UsernamePasswordAuthenticationFilter.class)

        .authorizeRequests()
        // Permit only users with ADMIN role.
        .antMatchers("/securedPage/**").hasRole("ADMIN")
        // Permit auth and login path for sending credentials.
        .antMatchers("/auth/**", "/login").permitAll().and()
        // Configures where to forward if authentication is required.
        .formLogin().loginPage("/login");
    }

    //---------------------------------------------------------------------------------------------
}
        .antMatchers("/testPfad/**").hasRole("TESTER")