D-Net

package eu.dnetlib.organizations;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.crypto.factory.PasswordEncoderFactories;

import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration

@EnableWebSecurity

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired

	private DataSource dataSource;

	@Override

	protected void configure(final HttpSecurity http) throws Exception {

		http.authorizeRequests()

				.antMatchers("/", "/swagger-ui.html", "/resources/**", "/messages/**").permitAll()

				.antMatchers("/api/**").fullyAuthenticated()

				.and()

				.httpBasic()

				.and()

				.logout()

				.logoutSuccessUrl("/messages/logout.html").permitAll()

				.deleteCookies("auth_code", "JSESSIONID")

				.clearAuthentication(true)

				.invalidateHttpSession(true)

				.and()

				.csrf().disable();

	}

	@Autowired

	public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {

		auth.jdbcAuthentication()

				.dataSource(dataSource)

				.usersByUsernameQuery("select email, password, valid from users where email=? and valid=true")

				.authoritiesByUsernameQuery("select email, 'ROLE_'||role from users where email=? and valid=true");

	}

	@Bean

	public PasswordEncoder passwordEncoder() {

		return PasswordEncoderFactories.createDelegatingPasswordEncoder();

	}

}