Improve integration with Spring Security

[grgrzybek]

Currently, integration with Spring Security in io.hawt.web.auth.AuthenticationFilter looks roughly like this:

• check for existence of org.springframework.security.core.SpringSecurityCoreVersion class (Spring Security available)
• check jakarta.servlet.http.HttpServletRequest#getRemoteUser() - this, when Spring Security is configured, delegates to org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestWrapper#getRemoteUser(), which uses org.springframework.security.core.context.SecurityContext#getAuthentication() which is populated by entire Spring Security infrastructure (org.springframework.security.web.FilterChainProxy)
• remote user is simply put (together with empty javax.security.auth.Subject) into session.

However, Spring Security's org.springframework.security.core.Authentication is much more than just user name. For example in (examples/springboot-security) we have:

result = {org.springframework.security.authentication.UsernamePasswordAuthenticationToken@11076} "UsernamePasswordAuthenticationToken [Principal=org.springframework.security.core.userdetails.User [Username=hawtio, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_admin, ROLE_viewer]], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=VGRiZ4T__XDL5esYEOzG43rVi_uECFT3_9j5H4V4], Granted Authorities=[ROLE_admin, ROLE_viewer]]"
 authenticated: boolean  = true
 authorities: java.util.Collection  = {java.util.Collections$UnmodifiableRandomAccessList@11078}  size = 2
  0 = {org.springframework.security.core.authority.SimpleGrantedAuthority@11083} "ROLE_admin"
  1 = {org.springframework.security.core.authority.SimpleGrantedAuthority@11084} "ROLE_viewer"
 credentials: java.lang.Object  = null
 details: java.lang.Object  = {org.springframework.security.web.authentication.WebAuthenticationDetails@11079} "WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=VGRiZ4T__XDL5esYEOzG43rVi_uECFT3_9j5H4V4]"
 principal: java.lang.Object  = {org.springframework.security.core.userdetails.User@11077} "org.springframework.security.core.userdetails.User [Username=hawtio, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_admin, ROLE_viewer]]"
  accountNonExpired: boolean  = true
  accountNonLocked: boolean  = true
  authorities: java.util.Set  = {java.util.Collections$UnmodifiableSet@11088}  size = 2
   0 = {org.springframework.security.core.authority.SimpleGrantedAuthority@11083} "ROLE_admin"
   1 = {org.springframework.security.core.authority.SimpleGrantedAuthority@11084} "ROLE_viewer"
  credentialsNonExpired: boolean  = true
  enabled: boolean  = true
  password: java.lang.String  = null
  username: java.lang.String  = {@11087} "hawtio"

While Spring Security has documentation section about JAAS, there's one nice class which isn't mentioned there: org.springframework.security.authentication.jaas.SecurityContextLoginModule.

With this, we can login using JAAS (we already do JAAS login in io.hawt.system.Authenticator#doAuthenticate()) using this module and what we'll get is kind of transparent translation of Spring Security token into JAAS subject.

[tadayosi]

@grgrzybek Looks nice, but is it something we can do anything for at hawtio/react? This area/spring-boot label is mainly for the client side Spring Boot plugin and not related to the Spring Boot backend runtime.

[grgrzybek]

Oops, I meant to create it in hawtio/hawtio ;)

[grgrzybek]

Connecting to self (http://localhost:10001/actuator/jolokia) from Hawtio with Spring Security doesn't work (yet).

• examples/springboot - connections work
• examples/springboot-authentication - connections work
• examples/springboot-security - connections don't work (checking while working on this issue, because it's related)