How to plug in your custom HTTP Security authorization logic

# Custom authorization sample configuration profile #

# Custom authorization profile configuration.
# This profile must be combined with the "fusion.single" & "fusion.development" profiles as active profile. For example, by using a vm property:
#   -Dspring.profiles.active=fusion.single,fusion.development,authorization
# or a program argument:
#   --spring.profiles.active=fusion.single,fusion.development,authorization

# This Configuration defines authorization configuration properties picked up by spring security.
fusion.samples.custom.security:
  # Endpoint for logging the user into LuciadFusion server.
  loginUrl: /studio/service/login
  # Endpoint for logging the user out of LuciadFusion server.
  logoutUrl: /studio/service/logout
  # This section defines endpoints that need protection & need authorization.
  authenticatedUrlList:
    # Endpoint used to check whether there is a user currently logged in.
    - /studio/service/api/app-user/current
    # Used to access the specific actuator endpoint.
    - /actuators/configurationInfo
  # This section defines endpoints that are open to access for anyone without authentication/authorization.
  permittedUrlList:
    # Endpoint for obtaining a list of properties that can be used to query Data.
    - /api/data/queryable-properties
    # Endpoint for obtaining a list of Products with an optional search and sort criteria.
    - /api/products
    # Endpoint for obtaining a list of Service types supported by this server.
    - /api/services/types
  # Sample implementation for granting access to actuator endpoints to users having an 'ADMIN' role.
  roleBasedAccessUrlList:
    # Endpoint used to access the available actuators. This endpoint pattern is accessible to authenticated users with 'ADMIN' roles only
    - endpointPattern: /actuators/**
      roles:
        - ADMIN

/**
 * A bean class exposing the properties defined in {@code application-authorization.yml}.
 * The properties are injected into the fields of this class by the spring container.
 */
@Component
@ConfigurationProperties(prefix = "fusion.samples.custom.security")
public class CustomHttpSecurityEndpointProperties {

  private static final ILcdLogger LOGGER = TLcdLoggerFactory.getLogger(CustomHttpSecurityEndpointProperties.class);

  private String fLoginUrl;
  private String fLogoutUrl;
  private List<String> fAuthenticatedUrlList;
  private List<String> fPermittedUrlList;
  private String fLoginPage;
  private Set<RoleBasedAccessibleEndpoints> fRoleBasedAccessUrlList;


  public static final class RoleBasedAccessibleEndpoints {
    private String fEndpointPattern;
    private Set<String> fRoles;

    public String getEndpointPattern() {
      return fEndpointPattern;
    }

    public void setEndpointPattern(String aEndpointPattern) {
      fEndpointPattern = aEndpointPattern;
    }

    public Set<String> getRoles() {
      return fRoles;
    }

    public void setRoles(Set<String> aRoles) {
      fRoles = aRoles;
    }

    @Override
    public boolean equals(Object aO) {
      if (this == aO) {
        return true;
      }
      if (aO == null || getClass() != aO.getClass()) {
        return false;
      }
      RoleBasedAccessibleEndpoints that = (RoleBasedAccessibleEndpoints) aO;
      return Objects.equals(fEndpointPattern, that.fEndpointPattern) && Objects.equals(fRoles, that.fRoles);
    }

    @Override
    public int hashCode() {
      return Objects.hash(fEndpointPattern, fRoles);
    }
  }
}

AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry endpointConfigurer = aHttp
    .headers().cacheControl().disable()
    .and()
    // Spring security kicks in when it intercepts an incoming request matching the pattern "/**".
    .securityMatcher("/**")
    // Restricts open access and force mandatory authentication
    .authorizeHttpRequests()
    // URL list allowed to be accessed by anyone without needing to authenticate.
    .requestMatchers(fSecurityProperties.getPermittedUrlList()
                                        .stream()
                                        .map(aBuilder::pattern)
                                        .toArray(MvcRequestMatcher[]::new))
    .permitAll()
    // URL list allowed to be accessed by authenticated users.
    .requestMatchers(fSecurityProperties.getAuthenticatedUrlList()
                                        .stream()
                                        .map(aBuilder::pattern)
                                        .toArray(MvcRequestMatcher[]::new))
    .authenticated();
// Grant access to actuator endpoints to users having an 'ADMIN' role.
for (CustomHttpSecurityEndpointProperties.RoleBasedAccessibleEndpoints roleBasedAccessibleEndpoints : fSecurityProperties.getRoleBasedAccessUrlList()) {
  endpointConfigurer.requestMatchers(aBuilder.pattern(roleBasedAccessibleEndpoints.getEndpointPattern()))
                    .hasAnyRole(roleBasedAccessibleEndpoints.getRoles().toArray(new String[0]));
}
// Enables user login by accepting username and password provided through an HTML form.
endpointConfigurer
    .and()
    // Specifies including the Form based authentication support and provide associated configuration parameters.
    .formLogin()
    .loginProcessingUrl(fSecurityProperties.getLoginUrl())
    .successHandler(successHandler)
    .permitAll()
    .and()
    // Specifies including the logout support and provide associated configuration parameters like logout url, session invalidation etc.
    .logout()
    .invalidateHttpSession(true)
    .logoutUrl(fSecurityProperties.getLogoutUrl())
    .permitAll()
    .and()
    // Configures the CORS filter and associated parameters.
    .cors().configurationSource(getCorsConfigurationSource())
    .and()
    // Adds CSRF support by default. Needs to be explicitly disabled.
    .csrf().disable();