diff --git a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/config/OAuth2ResourceServerConfig.java b/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/config/OAuth2ResourceServerConfig.java index 8fe4cda6a1..7809278ad8 100644 --- a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/config/OAuth2ResourceServerConfig.java +++ b/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/config/OAuth2ResourceServerConfig.java @@ -29,15 +29,13 @@ public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter http .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) .and() - .requestMatchers().antMatchers("/foos/**","/bars/**","/bazes/**") + .requestMatchers().antMatchers("/foos/**","/bars/**") .and() .authorizeRequests() .antMatchers(HttpMethod.GET,"/foos/**").access("#oauth2.hasScope('foo') and #oauth2.hasScope('read')") .antMatchers(HttpMethod.POST,"/foos/**").access("#oauth2.hasScope('foo') and #oauth2.hasScope('write')") .antMatchers(HttpMethod.GET,"/bars/**").access("#oauth2.hasScope('bar') and #oauth2.hasScope('read')") - .antMatchers(HttpMethod.POST,"/bars/**").access("#oauth2.hasScope('bar') and #oauth2.hasScope('write')") - .antMatchers(HttpMethod.GET,"/bazes/**").access("#oauth2.hasScope('read') and hasRole('ROLE_ADMIN')") - .antMatchers(HttpMethod.POST,"/bazes/**").access("#oauth2.hasScope('write') and hasRole('ROLE_ADMIN')") + .antMatchers(HttpMethod.POST,"/bars/**").access("#oauth2.hasScope('bar') and #oauth2.hasScope('write') and hasRole('ROLE_ADMIN')") ; // @formatter:on } diff --git a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BarController.java b/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BarController.java index 938cf18129..72163ff9ff 100644 --- a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BarController.java +++ b/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BarController.java @@ -29,7 +29,7 @@ public class BarController { } // API - write - // @PreAuthorize("#oauth2.hasScope('bar') and #oauth2.hasScope('write')") + // @PreAuthorize("#oauth2.hasScope('bar') and #oauth2.hasScope('write') and hasRole('ROLE_ADMIN')") @RequestMapping(method = RequestMethod.POST, value = "/bars") @ResponseStatus(HttpStatus.CREATED) @ResponseBody diff --git a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BazController.java b/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BazController.java deleted file mode 100644 index 880f41de07..0000000000 --- a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/controller/BazController.java +++ /dev/null @@ -1,41 +0,0 @@ -package org.baeldung.web.controller; - -import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic; -import static org.apache.commons.lang3.RandomStringUtils.randomNumeric; - -import org.baeldung.web.dto.Baz; -import org.springframework.http.HttpStatus; -import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.RequestBody; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.ResponseBody; -import org.springframework.web.bind.annotation.ResponseStatus; - -@Controller -public class BazController { - - public BazController() { - super(); - } - - // API - read - // @PreAuthorize("#oauth2.hasScope('read') and hasRole('ROLE_ADMIN')") - @RequestMapping(method = RequestMethod.GET, value = "/bazes/{id}") - @ResponseBody - public Baz findById(@PathVariable final long id) { - return new Baz(Long.parseLong(randomNumeric(2)), randomAlphabetic(4)); - } - - // API - write - // @PreAuthorize("#oauth2.hasScope('write') and hasRole('ROLE_ADMIN')") - @RequestMapping(method = RequestMethod.POST, value = "/bazes") - @ResponseStatus(HttpStatus.CREATED) - @ResponseBody - public Baz create(@RequestBody final Baz baz) { - baz.setId(Long.parseLong(randomNumeric(2))); - return baz; - } - -} diff --git a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/dto/Baz.java b/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/dto/Baz.java deleted file mode 100644 index 69a6bf2e6a..0000000000 --- a/spring-security-oauth/spring-security-oauth-resource/src/main/java/org/baeldung/web/dto/Baz.java +++ /dev/null @@ -1,36 +0,0 @@ -package org.baeldung.web.dto; - -public class Baz { - private long id; - private String name; - - public Baz() { - super(); - } - - public Baz(final long id, final String name) { - super(); - - this.id = id; - this.name = name; - } - - // - - public long getId() { - return id; - } - - public void setId(final long id) { - this.id = id; - } - - public String getName() { - return name; - } - - public void setName(final String name) { - this.name = name; - } - -} \ No newline at end of file diff --git a/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/header.html b/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/header.html index d3cf521c0a..aa891bc289 100644 --- a/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/header.html +++ b/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/header.html @@ -94,25 +94,6 @@ app.controller('mainCtrl', function($scope,$resource,$http,$rootScope) { }); } - // baz - $scope.baz = {id:0 , name:"sample baz"}; - $scope.bazes = $resource("http://localhost:8081/spring-security-oauth-resource/bazes/:bazId",{bazId:'@id'}); - - $scope.getBaz = function(){ - $scope.baz = $scope.bazes.get({bazId:$scope.baz.id}); - } - - $scope.createBaz = function(){ - if($scope.baz.name.length==0) - { - $rootScope.message = "Baz name can not be empty"; - return; - } - $scope.baz.id = null; - $scope.baz = $scope.bazes.save($scope.baz, function(){ - $rootScope.message = "Baz Created Successfully"; - }); - } }); /*]]>*/ diff --git a/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/index.html b/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/index.html index 0b4c7563ce..2996af04f0 100755 --- a/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/index.html +++ b/spring-security-oauth/spring-security-oauth-ui-implicit/src/main/resources/templates/index.html @@ -51,28 +51,6 @@ Create Bar -
-
-
-
-
-

Baz Details

-
-
- - -
- -
- - -
- -
-Get Baz -Create Baz -
-
diff --git a/spring-security-oauth/spring-security-oauth-ui-password/src/test/java/org/baeldung/live/AuthorizationLiveTest.java b/spring-security-oauth/spring-security-oauth-ui-password/src/test/java/org/baeldung/live/AuthorizationLiveTest.java index 5827be548b..e5e9d8428f 100644 --- a/spring-security-oauth/spring-security-oauth-ui-password/src/test/java/org/baeldung/live/AuthorizationLiveTest.java +++ b/spring-security-oauth/spring-security-oauth-ui-password/src/test/java/org/baeldung/live/AuthorizationLiveTest.java @@ -7,6 +7,7 @@ import java.util.HashMap; import java.util.Map; import org.junit.Test; +import org.springframework.http.MediaType; import com.jayway.restassured.RestAssured; import com.jayway.restassured.response.Response; @@ -33,56 +34,37 @@ public class AuthorizationLiveTest { final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1"); assertEquals(403, barResponse.getStatusCode()); - - final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1"); - assertEquals(403, bazResponse.getStatusCode()); } @Test - public void givenUser_whenUseBarClient_thenOkForBarResourceOnly() { + public void givenUser_whenUseBarClient_thenOkForBarResourceReadOnly() { final String accessToken = obtainAccessToken("barClientIdPassword", "john", "123"); - final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1"); - assertEquals(200, barResponse.getStatusCode()); - assertNotNull(barResponse.jsonPath().get("name")); - final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1"); assertEquals(403, fooResponse.getStatusCode()); - final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1"); - assertEquals(403, bazResponse.getStatusCode()); + final Response barReadResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1"); + assertEquals(200, barReadResponse.getStatusCode()); + assertNotNull(barReadResponse.jsonPath().get("name")); + + final Response barWritResponse = RestAssured.given().contentType(MediaType.APPLICATION_JSON_VALUE).header("Authorization", "Bearer " + accessToken).body("{\"id\":1,\"name\":\"MyBar\"}").post("http://localhost:8081/spring-security-oauth-resource/bars"); + assertEquals(403, barWritResponse.getStatusCode()); } @Test - public void givenAdmin_whenUseFooClient_thenOkForFooAndBazResourceOnly() { - final String accessToken = obtainAccessToken("fooClientIdPassword", "tom", "111"); - - final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1"); - assertEquals(200, fooResponse.getStatusCode()); - assertNotNull(fooResponse.jsonPath().get("name")); - - final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1"); - assertEquals(200, bazResponse.getStatusCode()); - assertNotNull(bazResponse.jsonPath().get("name")); - - final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1"); - assertEquals(403, barResponse.getStatusCode()); - } - - @Test - public void givenAdmin_whenUseBarClient_thenOkForBarAndBazResourceOnly() { + public void givenAdmin_whenUseBarClient_thenOkForBarResourceReadWrite() { final String accessToken = obtainAccessToken("barClientIdPassword", "tom", "111"); + final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1"); + assertEquals(403, fooResponse.getStatusCode()); + final Response barResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bars/1"); assertEquals(200, barResponse.getStatusCode()); assertNotNull(barResponse.jsonPath().get("name")); - final Response bazResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/bazes/1"); - assertEquals(200, bazResponse.getStatusCode()); - assertNotNull(bazResponse.jsonPath().get("name")); - - final Response fooResponse = RestAssured.given().header("Authorization", "Bearer " + accessToken).get("http://localhost:8081/spring-security-oauth-resource/foos/1"); - assertEquals(403, fooResponse.getStatusCode()); + final Response barWritResponse = RestAssured.given().contentType(MediaType.APPLICATION_JSON_VALUE).header("Authorization", "Bearer " + accessToken).body("{\"id\":1,\"name\":\"MyBar\"}").post("http://localhost:8081/spring-security-oauth-resource/bars"); + assertEquals(201, barWritResponse.getStatusCode()); + assertEquals("MyBar", barWritResponse.jsonPath().get("name")); } }