Related Documents

Apache Fineract Getting Started Guide:

Getting Started Docs - Fineract - Apache Software Foundation

Not found

Muellners Github Fineract Fork:

https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Reportcwiki.apache.org

Apache Fineract Security Report:

https://github.com/muellners/fineract/blob/develop/fineract-provider/src/main/resources/META-INF/spring/securityContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--

    Licensed to the Apache Software Foundation (ASF) under one
    or more contributor license agreements. See the NOTICE file
    distributed with this work for additional information
    regarding copyright ownership. The ASF licenses this file
    to you under the Apache License, Version 2.0 (the
    "License"); you may not use this file except in compliance
    with the License. You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing,
    software distributed under the License is distributed on an
    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    KIND, either express or implied. See the License for the
    specific language governing permissions and limitations
    under the License.

-->

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
    xsi:schemaLocation="
   http://www.springframework.org/schema/beans
   https://www.springframework.org/schema/beans/spring-beans.xsd
   http://www.springframework.org/schema/security/oauth2
   https://www.springframework.org/schema/security/spring-security-oauth2.xsd
   http://www.springframework.org/schema/security
   https://www.springframework.org/schema/security/spring-security.xsd">

    <beans:beans profile="basicauth">
        <http create-session="stateless" use-expressions="true" pattern="/api/**"
            entry-point-ref="basicAuthenticationEntryPoint">
            <csrf disabled="true"/>
            <intercept-url pattern="/api/*/echo" access="permitAll" />
            <intercept-url pattern="/api/*/authentication" access="permitAll"
                method="POST" requires-channel="https" />
            <intercept-url pattern="/api/*/self/authentication" access="permitAll"
                method="POST" requires-channel="https" />
            <intercept-url pattern="/api/*/self/registration" access="permitAll"
                method="POST" requires-channel="https" />
            <intercept-url pattern="/api/*/self/registration/user" access="permitAll"
                method="POST" requires-channel="https" />
            <intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
                           method="GET" requires-channel="https" />
            <intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
                           method="POST" requires-channel="https" />
            <intercept-url pattern="/api/*/twofactor/validate" access="isFullyAuthenticated()"
                           method="POST" requires-channel="https" />
            <intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="GET" requires-channel="https" />
            <intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="POST" requires-channel="https" />
            <intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="PUT" requires-channel="https" />
            <intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="DELETE" requires-channel="https" />
            <intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="HEAD" requires-channel="https" />

            <custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />
            <custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
        </http>

        <beans:bean id="basicAuthenticationEntryPoint"
            class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
            <beans:property name="realmName" value="Fineract Platform API" />
        </beans:bean>

        <beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
                    factory-method="createDelegatingPasswordEncoder">
        </beans:bean>

        <beans:bean id="customAuthenticationProvider"
            class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
            <beans:property name="userDetailsService" ref="userDetailsService" />
            <beans:property name="passwordEncoder" ref="passwordEncoder" />
        </beans:bean>

        <authentication-manager alias="authenticationManager"
            erase-credentials="false">
            <authentication-provider ref="customAuthenticationProvider" />
        </authentication-manager>
    </beans:beans>
    <beans:beans profile="oauth">
        <http create-session="stateless" use-expressions="true" pattern="/api/v1/**"
            entry-point-ref="oauthAuthenticationEntryPoint"
            access-decision-manager-ref="accessDecisionManager">
            <csrf disabled="true"/>
            <anonymous enabled="false" />
            <intercept-url pattern="/api//v1/**" method="OPTIONS"
                    access="permitAll" requires-channel="https" />
            <intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
                           method="GET" requires-channel="https" />
            <intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
                           method="POST" requires-channel="https" />
            <intercept-url pattern="/api/*/twofactor/validate" access="isFullyAuthenticated()"
                           method="POST" requires-channel="https" />
            <intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="GET" requires-channel="https" />
            <intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="POST" requires-channel="https" />
            <intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="PUT" requires-channel="https" />
            <intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="DELETE" requires-channel="https" />
            <intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
                method="HEAD" requires-channel="https" />
            <custom-filter ref="tenantIdentifierProcessingFilter"
                position="FIRST" />
            <custom-filter before="PRE_AUTH_FILTER" ref="resourceServerFilter" />
            <custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
            <access-denied-handler ref="oauthAccessDeniedHandler" />
        </http>

        <http pattern="/api/oauth/token" create-session="stateless"
            entry-point-ref="oauthAuthenticationEntryPoint" use-expressions="true"
            authentication-manager-ref="clientAuthenticationManager">
            <csrf disabled="true"/>
            <intercept-url pattern="/api/oauth/token" method="OPTIONS"
                access="permitAll" requires-channel="https" />
            <intercept-url pattern="/api/oauth/token" method="POST"
                access="isFullyAuthenticated()" requires-channel="https" />
            <anonymous enabled="false" />

            <custom-filter ref="tenantIdentifierProcessingFilter"
                position="FIRST" />
            <custom-filter ref="clientCredentialsTokenEndpointFilter"
                before="BASIC_AUTH_FILTER" />
            <access-denied-handler ref="oauthAccessDeniedHandler" />
        </http>

        <beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
                    factory-method="createDelegatingPasswordEncoder">
        </beans:bean>

        <beans:bean id="oauthAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
            <beans:property name="realmName" value="Fineract Platform API" />
        </beans:bean>

        <beans:bean id="oauthAccessDeniedHandler"
            class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

        <beans:bean id="clientCredentialsTokenEndpointFilter"
            class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
            <beans:constructor-arg value="/api/oauth/token" />
            <beans:property name="authenticationManager" ref="clientAuthenticationManager" />
        </beans:bean>

        <beans:bean id="accessDecisionManager"
            class="org.springframework.security.access.vote.UnanimousBased">
            <beans:constructor-arg>
                <beans:list>
                    <beans:bean
                        class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
                    <beans:bean class="org.springframework.security.access.vote.RoleVoter" />
                    <beans:bean
                        class="org.springframework.security.access.vote.AuthenticatedVoter" />
                    <beans:bean
                        class="org.springframework.security.web.access.expression.WebExpressionVoter" />
                    <beans:bean
                        class="org.apache.fineract.infrastructure.security.vote.SelfServiceUserAccessVote" />
                </beans:list>
            </beans:constructor-arg>
        </beans:bean>

        <authentication-manager id="clientAuthenticationManager" erase-credentials="false">
            <authentication-provider user-service-ref="clientDetailsUserService" />
            <authentication-provider ref="customAuthenticationProvider" />
        </authentication-manager>

        <beans:bean id="clientDetailsUserService"
            class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
            <beans:constructor-arg ref="clientDetailsService" />
        </beans:bean>

        <beans:bean id="customAuthenticationProvider"
            class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
            <beans:property name="userDetailsService" ref="userDetailsService" />
            <beans:property name="passwordEncoder" ref="passwordEncoder" />
        </beans:bean>

        <beans:bean id="clientDetailsService"
            class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService">
            <beans:constructor-arg ref="routingDataSource" />
        </beans:bean>

        <beans:bean id="tokenStore"
            class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
            <beans:constructor-arg ref="routingDataSource" />
        </beans:bean>

        <beans:bean id="tokenServices"
            class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
            <beans:property name="tokenStore" ref="tokenStore" />
            <beans:property name="clientDetailsService" ref="clientDetailsService" />
            <beans:property name="supportRefreshToken" value="true" />
            <beans:property name="refreshTokenValiditySeconds"
                value="86400" />
            <beans:property name="accessTokenValiditySeconds"
                value="3600" />
        </beans:bean>

        <beans:bean id="userApprovalHandler"
            class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
            <beans:property name="tokenStore" ref="tokenStore" />
            <beans:property name="clientDetailsService" ref="clientDetailsService" />
            <beans:property name="requestFactory" ref="oAuth2RequestFactory" />
        </beans:bean>

        <beans:bean id="oAuth2RequestFactory"
            class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
            <beans:constructor-arg ref="clientDetailsService" />
        </beans:bean>

        <oauth:authorization-server
            client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"
            user-approval-handler-ref="userApprovalHandler" token-endpoint-url="/api/oauth/token"
            authorization-endpoint-url="/api/oauth/authorize">
            <oauth:refresh-token />
            <oauth:password />
        </oauth:authorization-server>

        <oauth:resource-server id="resourceServerFilter" stateless="false"
            token-services-ref="tokenServices" />
    </beans:beans>
</beans:beans>

Fineract OAuth 2.0 Security Repository

Apache Fineract WSO2 Case Study API Gateway: