Remove anonymous controller support (#2285)

It's not usable feature, and is error prone - someone could left anonymous enabled by mistake Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>
2025-02-17 17:17:49 +02:00
parent 59f2eed87b
commit cace8bd20e
9 changed files with 58 additions and 323 deletions
--- a/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerDownloadSecurityConfiguration.java
+++ b/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerDownloadSecurityConfiguration.java
@@ -13,12 +13,10 @@ import java.util.List;

 import lombok.extern.slf4j.Slf4j;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.ControllerTenantAwareAuthenticationDetailsSource;
-import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticateAnonymousDownloadFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticateSecurityTokenFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedGatewaySecurityTokenFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedSecurityHeaderFilter;
 import org.eclipse.hawkbit.ddi.rest.api.DdiRestConstants;
-import org.eclipse.hawkbit.im.authentication.SpPermission;
 import org.eclipse.hawkbit.repository.ControllerManagement;
 import org.eclipse.hawkbit.repository.TenantConfigurationManagement;
 import org.eclipse.hawkbit.rest.SecurityManagedConfiguration;
@@ -39,9 +37,7 @@ import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;

 /**
 * Security configuration for the hawkBit server DDI download interface.
@@ -93,8 +89,7 @@ class ControllerDownloadSecurityConfiguration {
    @Bean
    @Order(300) // higher priority than HawkBit DDI security, so that the DDI DL security is applied first
    protected SecurityFilterChain filterChainDDIDL(final HttpSecurity http) throws Exception {
-        final AuthenticationManager authenticationManager = ControllerSecurityConfiguration.setAuthenticationManager(
-                http, ddiSecurityConfiguration);
+        final AuthenticationManager authenticationManager = ControllerSecurityConfiguration.setAuthenticationManager(http, ddiSecurityConfiguration);

        http
                .securityMatcher(DDI_DL_ANT_MATCHER)
@@ -106,55 +101,35 @@ class ControllerDownloadSecurityConfiguration {

        final ControllerTenantAwareAuthenticationDetailsSource authenticationDetailsSource = new ControllerTenantAwareAuthenticationDetailsSource();

-        if (ddiSecurityConfiguration.getAuthentication().getAnonymous().isEnabled()) {
-            log.warn(
-                    SecurityManagedConfiguration.ANONYMOUS_CONTROLLER_SECURITY_ENABLED_SHOULD_ONLY_BE_USED_FOR_DEVELOPMENT_PURPOSES);
+        final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
+                ddiSecurityConfiguration.getRp().getCnHeader(),
+                ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
+                tenantAware, systemSecurityContext);
+        securityHeaderFilter.setAuthenticationManager(authenticationManager);
+        securityHeaderFilter.setCheckForPrincipalChanges(true);
+        securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);

-            final AnonymousAuthenticationFilter anonymousFilter = new AnonymousAuthenticationFilter(
-                    "controllerAnonymousFilter", "anonymous",
-                    List.of(new SimpleGrantedAuthority(SpPermission.SpringEvalExpressions.CONTROLLER_ROLE_ANONYMOUS)));
-            anonymousFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-            http
-                    .securityContext(AbstractHttpConfigurer::disable)
-                    .anonymous(configurer -> configurer.authenticationFilter(anonymousFilter));
-        } else {
-            final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
-                    ddiSecurityConfiguration.getRp().getCnHeader(),
-                    ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
-                    tenantAware, systemSecurityContext);
-            securityHeaderFilter.setAuthenticationManager(authenticationManager);
-            securityHeaderFilter.setCheckForPrincipalChanges(true);
-            securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+        final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
+        securityTokenFilter.setAuthenticationManager(authenticationManager);
+        securityTokenFilter.setCheckForPrincipalChanges(true);
+        securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);

-            final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
-            securityTokenFilter.setAuthenticationManager(authenticationManager);
-            securityTokenFilter.setCheckForPrincipalChanges(true);
-            securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+        final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, systemSecurityContext);
+        gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
+        gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
+        gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);

-            final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, systemSecurityContext);
-            gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
-            gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
-            gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            final HttpControllerPreAuthenticateAnonymousDownloadFilter controllerAnonymousDownloadFilter = new HttpControllerPreAuthenticateAnonymousDownloadFilter(
-                    tenantConfigurationManagement, tenantAware, systemSecurityContext);
-            controllerAnonymousDownloadFilter.setAuthenticationManager(authenticationManager);
-            controllerAnonymousDownloadFilter.setCheckForPrincipalChanges(true);
-            controllerAnonymousDownloadFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-
-            http
-                    .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
-                    .anonymous(AbstractHttpConfigurer::disable)
-                    .addFilter(securityHeaderFilter)
-                    .addFilter(securityTokenFilter)
-                    .addFilter(gatewaySecurityTokenFilter)
-                    .addFilter(controllerAnonymousDownloadFilter)
-                    .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
-                            (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
-                    .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
-        }
+        http
+                .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
+                .anonymous(AbstractHttpConfigurer::disable)
+                .addFilter(securityHeaderFilter)
+                .addFilter(securityTokenFilter)
+                .addFilter(gatewaySecurityTokenFilter)
+                .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
+                        (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
+                .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        MdcHandler.Filter.addMdcFilter(http);

--- a/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerSecurityConfiguration.java
+++ b/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/ControllerSecurityConfiguration.java
@@ -17,7 +17,6 @@ import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthentic
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedGatewaySecurityTokenFilter;
 import org.eclipse.hawkbit.autoconfigure.ddi.security.HttpControllerPreAuthenticatedSecurityHeaderFilter;
 import org.eclipse.hawkbit.ddi.rest.api.DdiRestConstants;
-import org.eclipse.hawkbit.im.authentication.SpPermission;
 import org.eclipse.hawkbit.repository.ControllerManagement;
 import org.eclipse.hawkbit.repository.TenantConfigurationManagement;
 import org.eclipse.hawkbit.rest.SecurityManagedConfiguration;
@@ -41,9 +40,7 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;

 /**
 * Security configuration for the hawkBit server DDI interface.
@@ -53,8 +50,7 @@ import org.springframework.security.web.authentication.AnonymousAuthenticationFi
@EnableWebSecurity
 class ControllerSecurityConfiguration {

-    private static final String[] DDI_ANT_MATCHERS = {
-            DdiRestConstants.BASE_V1_REQUEST_MAPPING + "/**" };
+    private static final String[] DDI_ANT_MATCHERS = { DdiRestConstants.BASE_V1_REQUEST_MAPPING + "/**" };

    private final ControllerManagement controllerManagement;
    private final TenantConfigurationManagement tenantConfigurationManagement;
@@ -108,47 +104,36 @@ class ControllerSecurityConfiguration {
        }

        final ControllerTenantAwareAuthenticationDetailsSource authenticationDetailsSource = new ControllerTenantAwareAuthenticationDetailsSource();
-        if (ddiSecurityConfiguration.getAuthentication().getAnonymous().isEnabled()) {
-            log.warn(SecurityManagedConfiguration.ANONYMOUS_CONTROLLER_SECURITY_ENABLED_SHOULD_ONLY_BE_USED_FOR_DEVELOPMENT_PURPOSES);

-            final AnonymousAuthenticationFilter anonymousFilter = new AnonymousAuthenticationFilter(
-                    "controllerAnonymousFilter", "anonymous",
-                    List.of(new SimpleGrantedAuthority(SpPermission.SpringEvalExpressions.CONTROLLER_ROLE_ANONYMOUS)));
-            anonymousFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
-            http
-                    .securityContext(AbstractHttpConfigurer::disable)
-                    .anonymous(configurer -> configurer.authenticationFilter(anonymousFilter));
-        } else {
-            final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
-                    ddiSecurityConfiguration.getRp().getCnHeader(),
-                    ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
-                    tenantAware, systemSecurityContext);
-            securityHeaderFilter.setAuthenticationManager(authenticationManager);
-            securityHeaderFilter.setCheckForPrincipalChanges(true);
-            securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+        final HttpControllerPreAuthenticatedSecurityHeaderFilter securityHeaderFilter = new HttpControllerPreAuthenticatedSecurityHeaderFilter(
+                ddiSecurityConfiguration.getRp().getCnHeader(),
+                ddiSecurityConfiguration.getRp().getSslIssuerHashHeader(), tenantConfigurationManagement,
+                tenantAware, systemSecurityContext);
+        securityHeaderFilter.setAuthenticationManager(authenticationManager);
+        securityHeaderFilter.setCheckForPrincipalChanges(true);
+        securityHeaderFilter.setAuthenticationDetailsSource(authenticationDetailsSource);

-            final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
-            securityTokenFilter.setAuthenticationManager(authenticationManager);
-            securityTokenFilter.setCheckForPrincipalChanges(true);
-            securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+        final HttpControllerPreAuthenticateSecurityTokenFilter securityTokenFilter = new HttpControllerPreAuthenticateSecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, controllerManagement, systemSecurityContext);
+        securityTokenFilter.setAuthenticationManager(authenticationManager);
+        securityTokenFilter.setCheckForPrincipalChanges(true);
+        securityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);

-            final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
-                    tenantConfigurationManagement, tenantAware, systemSecurityContext);
-            gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
-            gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
-            gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
+        final HttpControllerPreAuthenticatedGatewaySecurityTokenFilter gatewaySecurityTokenFilter = new HttpControllerPreAuthenticatedGatewaySecurityTokenFilter(
+                tenantConfigurationManagement, tenantAware, systemSecurityContext);
+        gatewaySecurityTokenFilter.setAuthenticationManager(authenticationManager);
+        gatewaySecurityTokenFilter.setCheckForPrincipalChanges(true);
+        gatewaySecurityTokenFilter.setAuthenticationDetailsSource(authenticationDetailsSource);

-            http
-                    .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
-                    .anonymous(AbstractHttpConfigurer::disable)
-                    .addFilter(securityHeaderFilter)
-                    .addFilter(securityTokenFilter)
-                    .addFilter(gatewaySecurityTokenFilter)
-                    .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
-                            (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
-                    .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
-        }
+        http
+                .authorizeHttpRequests(amrmRegistry -> amrmRegistry.anyRequest().authenticated())
+                .anonymous(AbstractHttpConfigurer::disable)
+                .addFilter(securityHeaderFilter)
+                .addFilter(securityTokenFilter)
+                .addFilter(gatewaySecurityTokenFilter)
+                .exceptionHandling(configurer -> configurer.authenticationEntryPoint(
+                        (request, response, authException) -> response.setStatus(HttpStatus.UNAUTHORIZED.value())))
+                .sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        MdcHandler.Filter.addMdcFilter(http);

--- a/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateAnonymousDownloadFilter.java
+++ b/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateAnonymousDownloadFilter.java
@@ -1,52 +0,0 @@
-/**
- * Copyright (c) 2015 Bosch Software Innovations GmbH and others
- *
- * This program and the accompanying materials are made
- * available under the terms of the Eclipse Public License 2.0
- * which is available at https://www.eclipse.org/legal/epl-2.0/
- *
- * SPDX-License-Identifier: EPL-2.0
- */
-package org.eclipse.hawkbit.autoconfigure.ddi.security;
-
-import lombok.extern.slf4j.Slf4j;
-import org.eclipse.hawkbit.im.authentication.SpPermission.SpringEvalExpressions;
-import org.eclipse.hawkbit.repository.TenantConfigurationManagement;
-import org.eclipse.hawkbit.security.SystemSecurityContext;
-import org.eclipse.hawkbit.security.controller.ControllerPreAuthenticatedAnonymousDownload;
-import org.eclipse.hawkbit.security.controller.PreAuthenticationFilter;
-import org.eclipse.hawkbit.tenancy.TenantAware;
-import org.slf4j.Logger;
-
-/**
- * An pre-authenticated processing filter which add the
- * {@link SpringEvalExpressions#CONTROLLER_DOWNLOAD_ROLE_ANONYMOUS} to the
- * security context in case the anonymous download is allowed through
- * configuration.
- */
-@Slf4j
-public class HttpControllerPreAuthenticateAnonymousDownloadFilter extends AbstractHttpControllerAuthenticationFilter {
-
-    /**
-     * Constructor.
-     *
-     * @param tenantConfigurationManagement the system management service to retrieve configuration properties
-     * @param tenantAware the tenant aware service to get configuration for the specific tenant
-     * @param systemSecurityContext the system security context
-     */
-    public HttpControllerPreAuthenticateAnonymousDownloadFilter(
-            final TenantConfigurationManagement tenantConfigurationManagement, final TenantAware tenantAware,
-            final SystemSecurityContext systemSecurityContext) {
-        super(tenantConfigurationManagement, tenantAware, systemSecurityContext);
-    }
-
-    @Override
-    protected PreAuthenticationFilter createControllerAuthenticationFilter() {
-        return new ControllerPreAuthenticatedAnonymousDownload(tenantConfigurationManagement, tenantAware, systemSecurityContext);
-    }
-
-    @Override
-    protected Logger log() {
-        return log;
-    }
-}
--- a/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateSecurityTokenFilter.java
+++ b/hawkbit-ddi/hawkbit-ddi-starter/src/main/java/org/eclipse/hawkbit/autoconfigure/ddi/security/HttpControllerPreAuthenticateSecurityTokenFilter.java
@@ -13,7 +13,7 @@ import lombok.extern.slf4j.Slf4j;
 import org.eclipse.hawkbit.repository.ControllerManagement;
 import org.eclipse.hawkbit.repository.TenantConfigurationManagement;
 import org.eclipse.hawkbit.security.SystemSecurityContext;
-import org.eclipse.hawkbit.security.controller.ControllerPreAuthenticateSecurityTokenFilter;
+import org.eclipse.hawkbit.security.controller.ControllerPreAuthenticatedSecurityTokenFilter;
 import org.eclipse.hawkbit.security.controller.PreAuthenticationFilter;
 import org.eclipse.hawkbit.tenancy.TenantAware;
 import org.slf4j.Logger;
@@ -56,7 +56,7 @@ public class HttpControllerPreAuthenticateSecurityTokenFilter extends AbstractHt

    @Override
    protected PreAuthenticationFilter createControllerAuthenticationFilter() {
-        return new ControllerPreAuthenticateSecurityTokenFilter(tenantConfigurationManagement, controllerManagement,
+        return new ControllerPreAuthenticatedSecurityTokenFilter(tenantConfigurationManagement, controllerManagement,
                tenantAware, systemSecurityContext);
    }