Spring Security の認証の基本の流れを理解しつつ API でログイン処理を行う

2023-02-05 10:25:15.888 INFO 1345 --- [ restartedMain] o.s.s.web.DefaultSecurityFilterChain : Will secure any request with [org.springframework.security.web.session.DisableEncodeUrlFilter@4f41a17d, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@ce554b5, org.springframework.security.web.context.SecurityContextPersistenceFilter@691957b3, org.springframework.security.web.header.HeaderWriterFilter@7fb71efd, org.springframework.security.web.csrf.CsrfFilter@401c3062, org.springframework.security.web.authentication.logout.LogoutFilter@58322336, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@199d2fe, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@2a1d950c, org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter@63979f4a, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@ac980a5, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@3bf6e581, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@19a7c48a, org.springframework.security.web.session.SessionManagementFilter@6f437b47, org.springframework.security.web.access.ExceptionTranslationFilter@193fa88, org.springframework.security.web.access.intercept.AuthorizationFilter@117a43bb]

org.springframework.security.web.session.DisableEncodeUrlFilter
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter
org.springframework.security.web.context.SecurityContextPersistenceFilter
org.springframework.security.web.header.HeaderWriterFilter
org.springframework.security.web.csrf.CsrfFilter
org.springframework.security.web.authentication.logout.LogoutFilter
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter
org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter
org.springframework.security.web.savedrequest.RequestCacheAwareFilter
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter
org.springframework.security.web.authentication.AnonymousAuthenticationFilter
org.springframework.security.web.session.SessionManagementFilter
org.springframework.security.web.access.ExceptionTranslationFilter
org.springframework.security.web.access.intercept.AuthorizationFilter

DROP TABLE IF EXISTS person;

create table person (
    id  VARCHAR(8)  PRIMARY KEY,
    username VARCHAR(255),
    password VARCHAR(255),
    email VARCHAR(255),
    age INTEGER,
    enabled BOOLEAN,
    roles VARCHAR(255)
 );

INSERT INTO person (id, username, password, email, age, enabled, roles) VALUES
    ('10000000', 'test1', '$2a$08$7563MWncbW/oenHWfZSKE.jWeMARqdO/WZajbstas2xUamOBXDWz6', 'test1@example.com', 30, 'true', 'ROLE_ADMIN,ROLE_GENERAL'),
    ('10000001', 'test2', '$2a$08$7563MWncbW/oenHWfZSKE.jWeMARqdO/WZajbstas2xUamOBXDWz6', 'test2@example.com', 16, 'true', 'ROLE_GENERAL'),
    ('10000002', 'test3', '$2a$08$7563MWncbW/oenHWfZSKE.jWeMARqdO/WZajbstas2xUamOBXDWz6', 'test3@example.com', 49, 'true', 'ROLE_ADMIN');

# H2 を利用する
spring.datasource.driver-class-name=org.h2.Driver

# データソースの場所 mem を指定するとインメモリになります。
# jdbc:h2:~/userdb などとすると、ファイルになります。
spring.datasource.url=jdbc:h2:mem:userdb
spring.datasource.username=
spring.datasource.password=

# 起動時に SQL 実行をします。以下が実行されます。
#   /src/main/resources/schema.sql
#   /src/main/resources/data.sql
spring.datasource.initialization-mode=always
# これを書かないと実行されません
spring.jpa.hibernate.ddl-auto=none

# h2 のコンソールが開けるように
# Spring boot 起動後、以下にアクセスするとコンソールを開くことができます。
# http://localhost:8080/h2-console
spring.h2.console.enabled=true

@Data
@Entity
public class Person {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;
    private String username;
    @JsonIgnore
    private String password;
    private String email;
    private Integer age;
    private Boolean enabled;
    private String roles;
}

@Repository
public interface PersonRepository extends JpaRepository<Person, String> {
    public Optional<Person> findByUsername(String username);
}

@Slf4j
public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    private final AuthenticationManager authenticationManager;

    public MyUsernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;

        // "/api/login" の場合に認証を行うよう設定
        setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/api/login", "POST"));

        // 成功した場合の処理, 今回は取得した person 情報を返しています。
        this.setAuthenticationSuccessHandler((req, res, ex) -> {
            res.setStatus(200);
            MyUserDetails user = (MyUserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
            res.getWriter().write((new ObjectMapper()).writeValueAsString(user.getPerson()));
        });
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) {
        try {
            // リクエストのデータを LoginForm として取り出す
            LoginForm principal = new ObjectMapper().readValue(request.getInputStream(), LoginForm.class);
            // 認証処理を実行する
            return authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(principal.getUsername(), principal.getPassword())
            );
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }
}

@Getter
@Setter
public class LoginForm {
    private String username;
    private String password;
}

@Slf4j
@Service
public class MyUserDetailsService implements UserDetailsService {
    private final PersonRepository repository;

    public MyUserDetailsService(PersonRepository repository) {
        this.repository = repository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Person person = repository.findByUsername(username).orElseThrow(
                () -> new UsernameNotFoundException("User not found"));
        return new MyUserDetails(person);
    }
}

@Getter
public class MyUserDetails extends User {

    private final Person person;

    public MyUserDetails(Person person) {
        super(person.getUsername(),
                person.getPassword(),
                Arrays.asList(person.getRoles().split(",")).stream().map(
                        role -> new SimpleGrantedAuthority((role))).toList());
        this.person = person;
    }
}

@EnableWebSecurity
@Configuration
public class MySecurityConfig {

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(authz -> authz
                // h2-console を利用する場合は必要
                // .antMatchers("/h2-console/**").permitAll()
                .antMatchers("/").permitAll()
                .antMatchers("/api/login").permitAll()
                .anyRequest().authenticated()
        );
        var authManager = authenticationManager(http.getSharedObject(AuthenticationConfiguration.class));
        http.addFilter(new MyUsernamePasswordAuthenticationFilter(authManager));

        // セッションを使用しないためステートレスに設定
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.csrf().disable();

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(8);
    }
}

 % curl -X POST --include -H "Content-Type: application/json" -d '{"username": "test1", "password": "hoge"}' localhost:8080/api/login
HTTP/1.1 200 
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 120
Date: Sun, 05 Feb 2023 06:44:54 GMT

{"id":10000000,"username":"test1","email":"test1@example.com","age":30,"enabled":true,"roles":"ROLE_ADMIN,ROLE_GENERAL"

% curl -X POST --include -H "Content-Type: application/json" -d '{"username": "test5", "password": "hoge"}' localhost:8080/api/login
HTTP/1.1 401 
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 0
Date: Sun, 05 Feb 2023 06:46:13 GMT