Add default behavior, if no checkingkey aliases are defined, use sign…

…ingkey alias
RADAR-base · Jun 12, 2018 · fd6d488 · fd6d488
1 parent 24c31fd
commit fd6d488
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 19 deletions.
diff --git a/src/main/java/org/radarcns/management/config/OAuth2ServerConfiguration.java b/src/main/java/org/radarcns/management/config/OAuth2ServerConfiguration.java
@@ -212,21 +212,24 @@ public JwtAccessTokenConverter accessTokenConverter() {
             KeyPair keyPair = kf.getKeyPair(signKey);
             converter.setKeyPair(keyPair);
 
-            // get all public keys for verifying and set the converter's verifier to a MultiVerifier
-            List<SignatureVerifier> verifiers = managementPortalProperties.getOauth()
-                    .getCheckingKeyAliases().stream()
-                    .map(alias -> kf.getKeyPair(alias).getPublic())
-                    .filter(publicKey -> publicKey instanceof RSAPublicKey
-                            || publicKey instanceof ECPublicKey)
-                    .map(publicKey -> {
-                        if (publicKey instanceof RSAPublicKey) {
-                            return new RsaVerifier((RSAPublicKey) publicKey);
-                        } else {
-                            return new EcdsaVerifier((ECPublicKey) publicKey);
-                        }
-                    })
-                    .collect(Collectors.toList());
-            converter.setVerifier(new MultiVerifier(verifiers));
+            // if a list of checking keys is defined, use that for checking
+            if (managementPortalProperties.getOauth().getCheckingKeyAliases() != null
+                    && !managementPortalProperties.getOauth().getCheckingKeyAliases().isEmpty()) {
+                // get all public keys for verifying and set the converter's verifier
+                // to a MultiVerifier
+                List<SignatureVerifier> verifiers =
+                        managementPortalProperties.getOauth().getCheckingKeyAliases().stream()
+                                .map(alias -> kf.getKeyPair(alias).getPublic())
+                                .filter(publicKey -> publicKey instanceof RSAPublicKey
+                                        || publicKey instanceof ECPublicKey).map(publicKey -> {
+                            if (publicKey instanceof RSAPublicKey) {
+                                return new RsaVerifier((RSAPublicKey) publicKey);
+                            } else {
+                                return new EcdsaVerifier((ECPublicKey) publicKey);
+                            }
+                        }).collect(Collectors.toList());
+                converter.setVerifier(new MultiVerifier(verifiers));
+            }
 
             return converter;
         }

diff --git a/src/main/java/org/radarcns/management/config/SecurityConfiguration.java b/src/main/java/org/radarcns/management/config/SecurityConfiguration.java
@@ -28,6 +28,8 @@
 
 import javax.annotation.PostConstruct;
 import javax.servlet.Filter;
+import java.util.Collections;
+import java.util.List;
 
 @Configuration
 @EnableWebSecurity
@@ -138,8 +140,16 @@ public FilterRegistrationBean jwtAuthenticationFilterRegistration() {
     }
 
     public Filter jwtAuthenticationFilter() {
+        List<String> publicKeyAliases;
+        if (managementPortalProperties.getOauth().getCheckingKeyAliases() != null &&
+                !managementPortalProperties.getOauth().getCheckingKeyAliases().isEmpty()) {
+            publicKeyAliases = managementPortalProperties.getOauth().getCheckingKeyAliases();
+        } else {
+            publicKeyAliases = Collections.singletonList(managementPortalProperties.getOauth()
+                    .getSigningKeyAlias());
+        }
         return new JwtAuthenticationFilter(new TokenValidator(
                 new LocalKeystoreConfig(managementPortalProperties.getOauth().getKeyStorePassword(),
-                        managementPortalProperties.getOauth().getCheckingKeyAliases())));
+                        publicKeyAliases)));
     }
 }
diff --git a/src/main/resources/config/application.yml b/src/main/resources/config/application.yml
@@ -94,9 +94,6 @@ managementportal:
     oauth:
         keyStorePassword: radarbase
         signingKeyAlias: radarbase-managementportal-ec
-        checkingKeyAliases:
-            - radarbase-managementportal-ec
-            - radarbase-managementportal-rsa
 
 # ===================================================================
 # JHipster specific properties