/*
 * Copyright 2015-2016 EuregJUG.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package eu.euregjug.site.config;

import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;


/**
 * @author Michael J. Simons, 2015-12-27
 */
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
@SuppressWarnings({"squid:S1118"}) // This is not a utility class. It cannot have a private constructor.
public class SecurityConfig {

    @Configuration
    @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
    @ConditionalOnBean(SecurityConfig.class)
    protected static class ApplicationWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(final HttpSecurity http) throws Exception {
            http
                .httpBasic()
                    .and()
                .authorizeRequests()
                    .antMatchers("/**").permitAll()
                    .and()
                .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.NEVER)
                    .enableSessionUrlRewriting(false)
                    .and()
                .csrf()
                    .disable();
        }
    }
}

@@ -1248,259 +1248,2334 @@
 cy;%0A
-%0A%0A/**%0A * @author Michael J. Simons, 2015-12-27%0A */%0A@Configuration%0A@EnableGlobalMethodSecurity(prePostEnabled = true)%0A@SuppressWarnings(%7B%22squid:S1118%22%7D) // This is not a utility class. It cannot have a private constructor.%0Apublic class SecurityConfig %7B
+import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;%0Aimport org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;%0Aimport org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;%0A%0A%0A/**%0A * @author Michael J. Simons, 2015-12-27%0A */%0A@Configuration%0A@EnableGlobalMethodSecurity(prePostEnabled = true)%0A@SuppressWarnings(%7B%22squid:S1118%22%7D) // This is not a utility class. It cannot have a private constructor.%0Apublic class SecurityConfig %7B%0A%0A    @Configuration%0A    @EnableAuthorizationServer%0A    @ConditionalOnBean(SecurityConfig.class)%0A    static class AuthorizationServerConfig %7B%0A    %7D%0A%0A    @Configuration%0A    @EnableResourceServer%0A    @ConditionalOnBean(SecurityConfig.class)%0A    static class ResourceServerConfig extends ResourceServerConfigurerAdapter %7B%0A%0A        /**%0A         * The part of the api that needs protection is secured by method%0A         * level security. So all here the http security is matched on the /api/**%0A         * endpoints but permits all access by default. Secured resources are%0A         * then blacklisted on method level.%0A         * %3Cbr%3E%0A         * We must also take care of the actuator endpoints. An alternative%0A         * would be excluding them by using%0A         * %3Cpre%3Ehttp.regexMatcher(%22/api/(?!.*(system)).*%22)%3C/pre%3E as first matcher%0A         * but that would mean having to separate auth mechanism in place.%0A         * %3Cbr%3E%0A         * I prefer manually enabling the non sensitive ones.%0A         *%0A         * @param http%0A         * @throws Exception%0A         */%0A        @Override%0A        public void configure(final HttpSecurity http) throws Exception %7B%0A            http%0A                .antMatcher(%22/api/**%22)%0A                    .authorizeRequests()%0A                        .regexMatchers(%22/api/system/(?:info%7Chealth%7Cmetrics)%22).permitAll()%0A                        .antMatchers(%22/api/system/**%22).authenticated()%0A                        .antMatchers(%22/api/**%22).permitAll()%0A                .and()%0A                    .sessionManagement()%0A                    .sessionCreationPolicy(SessionCreationPolicy.NEVER)%0A                    .enableSessionUrlRewriting(false)%0A                .and()%0A                    .csrf()%0A                    .disable();%0A        %7D%0A    %7D
 %0A%0A  
@@ -3993,32 +3993,94 @@
 orizeRequests()%0A
+                    .antMatchers(%22/oauth/**%22).authenticated()%0A
                 

Enable authorization and resource server