<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>

	<groupId>com.yo1000</groupId>
	<artifactId>kc4-boot2-resource-client</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<packaging>jar</packaging>

	<name>kc4-boot2-resource-client</name>
	<description>Demo project for Spring Boot</description>

	<parent>		<groupId>org.springframework.boot</groupId>		<artifactId>spring-boot-starter-parent</artifactId>		<version>2.0.3.RELEASE</version>		<relativePath/> <!-- lookup parent from repository -->	</parent>
	<properties>
		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
		<java.version>1.8</java.version>
		<kotlin.version>1.2.41</kotlin.version>
	</properties>

	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
		<dependency>
			<groupId>com.fasterxml.jackson.module</groupId>
			<artifactId>jackson-module-kotlin</artifactId>
		</dependency>
		<dependency>
			<groupId>org.jetbrains.kotlin</groupId>
			<artifactId>kotlin-stdlib-jdk8</artifactId>
		</dependency>
		<dependency>
			<groupId>org.jetbrains.kotlin</groupId>
			<artifactId>kotlin-reflect</artifactId>
		</dependency>

		<!-- https://mvnrepository.com/artifact/org.keycloak/keycloak-spring-boot-2-starter -->
		<dependency>			<groupId>org.keycloak</groupId>			<artifactId>keycloak-spring-boot-2-starter</artifactId>			<version>4.0.0.Final</version>		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-test</artifactId>
			<scope>test</scope>
		</dependency>
	</dependencies>

	<dependencyManagement>
		<dependencies>			<dependency>				<groupId>org.keycloak.bom</groupId>				<artifactId>keycloak-adapter-bom</artifactId>				<version>4.0.0.Final</version>				<type>pom</type>				<scope>import</scope>			</dependency>		</dependencies>	</dependencyManagement>

	<build>
		<sourceDirectory>${project.basedir}/src/main/kotlin</sourceDirectory>
		<testSourceDirectory>${project.basedir}/src/test/kotlin</testSourceDirectory>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
			<plugin>
				<artifactId>kotlin-maven-plugin</artifactId>
				<groupId>org.jetbrains.kotlin</groupId>
				<configuration>
					<args>
						<arg>-Xjsr305=strict</arg>
					</args>
					<compilerPlugins>
						<plugin>spring</plugin>
					</compilerPlugins>
				</configuration>
				<dependencies>
					<dependency>
						<groupId>org.jetbrains.kotlin</groupId>
						<artifactId>kotlin-maven-allopen</artifactId>
						<version>${kotlin.version}</version>
					</dependency>
				</dependencies>
			</plugin>
		</plugins>
	</build>
</project>

package com.yo1000.kc4boot2

import org.keycloak.adapters.AdapterDeploymentContext
import org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean
import org.keycloak.adapters.springsecurity.KeycloakConfiguration
import org.keycloak.adapters.springsecurity.client.KeycloakClientRequestFactory
import org.keycloak.adapters.springsecurity.client.KeycloakRestTemplate
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken
import org.springframework.beans.factory.config.ConfigurableBeanFactory
import org.springframework.boot.autoconfigure.SpringBootApplication
import org.springframework.boot.runApplication
import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Scope
import org.springframework.core.io.ClassPathResource
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper
import org.springframework.security.core.session.SessionRegistryImpl
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy
import org.springframework.web.bind.annotation.GetMapping
import org.springframework.web.bind.annotation.RestController
import org.springframework.web.client.RestTemplate

@SpringBootApplication
class ResourceClientApplication

fun main(args: Array<String>) {
    runApplication<ResourceClientApplication>(*args)
}

@KeycloakConfiguration
class SecurityConfig : KeycloakWebSecurityConfigurerAdapter() {
    // リソースサーバーにHTTPリクエストを送信するためのRestTemplateをDI登録する    // KeycloakRestTemplateはRestTemplateの派生クラスで認証情報等を連携してくれる    @Bean    @Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE)    fun restTemplate(factory: KeycloakClientRequestFactory): RestTemplate = KeycloakRestTemplate(factory)    // SSO基盤へのリダイレクトによってアプリケーションの認証を連携される場合は    // RegisterSessionAuthenticationStrategyを設定する    override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy = RegisterSessionAuthenticationStrategy(            SessionRegistryImpl())    // 先の手順でKeycloakから取得したkeycloak.jsonを    // クラスパスルートから取得できるように設定を変更する    // デフォルトではWEB-INF/keycloak.jsonから取得するようになっており都合が悪い    override fun adapterDeploymentContext(): AdapterDeploymentContext = AdapterDeploymentContextFactoryBean(            ClassPathResource("keycloak.json")).also { it.afterPropertiesSet() }.`object`!!    // Keycloakから連携されるロール名を大文字に変換する    override fun configure(auth: AuthenticationManagerBuilder?) {        auth!!.authenticationProvider(keycloakAuthenticationProvider().also {            it.setGrantedAuthoritiesMapper(SimpleAuthorityMapper().also {                it.setConvertToUpperCase(true)            })        })    }
    override fun configure(http: HttpSecurity) {
        super.configure(http)
        http.authorizeRequests()
                .antMatchers("/sso/login*").permitAll()
                .antMatchers("/customers*").hasAnyRole("USER")
                .antMatchers("/admin*").hasAnyRole("ADMIN")
                .anyRequest().permitAll()
        http.csrf().disable()
    }
}

@RestController
class Kc4Controller(
        val restTemplate: RestTemplate
) {
    @GetMapping("/customers")
    fun getCustomers(token: KeycloakAuthenticationToken): Any {
        val url = "http://localhost:8082/api/customers"
        val resp = restTemplate.getForObject(url, String::class.java)

        return """
            <h1>customers</h1>
            <p><code>
            ${token}
            </code></p>
            <ul>
            <li><code>${token.name}</code></li>
            <li><code>${token.account.keycloakSecurityContext.token.preferredUsername}</code></li>
            </ul>
            <h2>API Response</h2>
            <code>GET ${url}<code>
            <p><code>
            ${resp}
            </code></p>
            """.trimIndent()
    }

    @GetMapping("/admin")
    fun getAdmin(token: KeycloakAuthenticationToken): Any {
        val url = "http://localhost:8082/api/admin"
        val resp = restTemplate.getForObject(url, String::class.java)

        return """
            <h1>admin</h1>
            <p><code>
            ${token}
            </code></p>
            <ul>
            <li><code>${token.name}</code></li>
            <li><code>${token.account.keycloakSecurityContext.token.preferredUsername}</code></li>
            </ul>
            <h2>API Response</h2>
            <code>GET ${url}<code>
            <p><code>
            ${resp}
            </code></p>
            """.trimIndent()
    }
}

package com.yo1000.kc4boot2

import org.keycloak.adapters.AdapterDeploymentContext
import org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean
import org.keycloak.adapters.springsecurity.KeycloakConfiguration
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter
import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken
import org.springframework.boot.autoconfigure.SpringBootApplication
import org.springframework.boot.runApplication
import org.springframework.core.io.ClassPathResource
import org.springframework.http.HttpMethod
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper
import org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy
import org.springframework.web.bind.annotation.GetMapping
import org.springframework.web.bind.annotation.RequestMapping
import org.springframework.web.bind.annotation.RestController
import org.springframework.web.cors.CorsConfiguration
import org.springframework.web.cors.UrlBasedCorsConfigurationSource


@SpringBootApplication
class ResourceServerApplication

fun main(args: Array<String>) {
    runApplication<ResourceServerApplication>(*args)
}

@KeycloakConfiguration
class SecurityConfig : KeycloakWebSecurityConfigurerAdapter() {
    // すでに認証を受けた別のSSOクライアントからトークンによって認証を連携される場合は    // セッションを使用しないためNullAuthenticatedSessionStrategyを設定する    override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy = NullAuthenticatedSessionStrategy()    // 先の手順でKeycloakから取得したkeycloak.jsonを    // クラスパスルートから取得できるように設定を変更する    // デフォルトではWEB-INF/keycloak.jsonから取得するようになっており都合が悪い    override fun adapterDeploymentContext(): AdapterDeploymentContext = AdapterDeploymentContextFactoryBean(            ClassPathResource("keycloak.json")).also { it.afterPropertiesSet() }.`object`!!    // Keycloakから連携されるロール名を大文字に変換する    override fun configure(auth: AuthenticationManagerBuilder?) {        auth!!.authenticationProvider(keycloakAuthenticationProvider().also {            it.setGrantedAuthoritiesMapper(SimpleAuthorityMapper().also {                it.setConvertToUpperCase(true)            })        })    }
    override fun configure(http: HttpSecurity) {
        super.configure(http)
        http.authorizeRequests()
                .antMatchers("/sso/login*").permitAll()
                .antMatchers("/api/customers*").hasAnyRole("USER")
                .antMatchers("/api/admin*").hasAnyRole("ADMIN")
                .anyRequest().permitAll()
        http.csrf().disable()
        http.cors().configurationSource(
            UrlBasedCorsConfigurationSource().also {
                it.registerCorsConfiguration("/**", CorsConfiguration().also {
                    it.addAllowedHeader(CorsConfiguration.ALL)
                    it.addAllowedMethod(HttpMethod.GET.name)
                    it.addAllowedOrigin("http://localhost:8081")
                    it.allowCredentials = true
                })
            }
        )
    }
}

@RestController
@RequestMapping("/api")
class Kc4Controller {
    @GetMapping("/customers")
    fun getCustomers(token: KeycloakAuthenticationToken): Any = mapOf(
            "content" to "Customers content"
    )

    @GetMapping("/admin")
    fun getAdmin(token: KeycloakAuthenticationToken): Any = mapOf(
            "content" to "Admin content"
    )
}