es.um.jwt.secret=${ES_UM_JWT_SECRET}

# Bearer token
"Bearer tokenCifrado"

public class JwtAuthorizationFilter extends OncePerRequestFilter {

	private static final org.apache.logging.log4j.Logger log = org.apache.logging.log4j.LogManager
			.getLogger( JwtAuthorizationFilter.class );

	@Autowired
	private ExpedientesService expedientesService;

	@Override
	protected void doFilterInternal( HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse,
			FilterChain filterChain ) throws ServletException, IOException {

		if ( isPrivate( httpServletRequest ) ) {

			final String token = httpServletRequest.getHeader( AUTHORIZATION_HEADER );

			// En getSivaIdFromToken se obtienen los datos del token, lanzando las excepciones correspondientes 
			// si éste es incorrecto o ha expirado 
			final String sivaId = expedientesService.getSivaIdFromToken( token );
			// Si no hay sivaId o es -1, se lanza una excepción
			if ( ( sivaId == null ) || sivaId.contentEquals( "-1" ) ) {
				throw new UnauthorizedException();
			}
		}

		filterChain.doFilter( httpServletRequest, httpServletResponse );
	}

	private boolean isPrivate( HttpServletRequest httpServletRequest ) {
		final RequestMatcher privateUrl = new AntPathRequestMatcher( PRIVATE_PREFIX + "/**" );
		return privateUrl.matches( httpServletRequest );
	}
}

	/**
	 * Defino como Bean el authorization filter para que sea accedido desde los filtros ya que no estan en el mismo contexto
	 */
	@Bean
	public JwtAuthorizationFilter jwtAuthorizationFilterBean() {
		return new JwtAuthorizationFilter();
	}

	/**
	 * Proveedor de gestion de acceoss
	 */
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.sessionManagement().sessionCreationPolicy( SessionCreationPolicy.STATELESS ) // configuro politica de
		// sesion sin estado
		.and().cors() // Aniado configuracion CORS por defecto
		.and().csrf().disable()
		.addFilterBefore( jwtAuthorizationFilterBean(), BasicAuthenticationFilter.class );
	}

package es.um.atica.-----;


public final class Constants {

	private Constants() {}

	public static final String PUBLIC_PREFIX = "/public";
	public static final String PRIVATE_PREFIX = "/private";
	public static final String AUTHORIZATION_HEADER = "Authorization";
	public static final String TOKEN_BEARER_PREFIX = "Bearer";

}

@Component
public class JwtTokenUtil {

	private static final org.apache.logging.log4j.Logger log = org.apache.logging.log4j.LogManager
			.getLogger( JwtTokenUtil.class );

	@Value( "${es.um.jwt.secret}" )
	private String secret;

	/**
	 * Obtiene los claims del token. Si el token ha expirado, lanza una TokenExpiredException. Si el token no es válido,
	 * lanza una UnauthorizedException.
	 *
	 * @param token
	 * @return claims
	 */
	public Claims getClaim( String token ) {
		// Comprobamos que el token tiene contenido y empieza por "Bearer "
		if ( ( token == null ) || token.isEmpty() || !token.startsWith( TOKEN_BEARER_PREFIX ) ) {
			throw new UnauthorizedException();
		}
		token = token.replace( TOKEN_BEARER_PREFIX + " ", "" ); // Quitamos "Bearer" y el espacio en blanco

		try {
			// Obtenemos claims
			final Claims claims = Jwts.parser().setSigningKey( TextCodec.BASE64.encode( secret ) )
					.parseClaimsJws( token ).getBody();
			log.debug( "El claims es: " + claims.toString() );
			log.debug( "El subject es: " + claims.getSubject() );

			// Comprobamos si el token está expirado
			final Date expiration = claims.getExpiration();
			if ( Instant.now().isAfter( expiration.toInstant() ) ) {
				log.error( "Expiration Date: " + expiration.toString() );
				log.error( "Current Instant: " + Instant.now().toString() );
				log.error( "Error el token " + token + " está caducado" );
				throw new TokenExpiredException();
			}

			return claims;

		} catch ( final ExpiredJwtException e ) {
			log.error( "Error el token está caducado" );
			throw new TokenExpiredException();
		} catch ( final JwtException e ) {
			log.error( "Error filtering:" + e );
			throw new UnauthorizedException();
		}

	}
}

@Autowired
private JwtTokenUtil jwtTokenUtil;

...

Claims claims = jwtTokenUtil.getClaim(token);
String email = claims.getSubject();

	@GetMapping( PRIVATE_PREFIX + "/titulaciones" )
	public ResponseEntity getTitulaciones(
			@RequestHeader( value = AUTHORIZATION_HEADER, required = true ) String token ) {

		RestExpedientes.log.info( " ############################################### titulaciones: " );

		return new ResponseEntity<>( expedientesService.getTitulaciones( token ), HttpStatus.OK );
	}

/**
 * ServicioNotFoundException
 */
public class ServicioException extends RuntimeException {
 
	private static final long serialVersionUID = 1L;
 
	private static final HttpStatus status = HttpStatus.BAD_REQUEST;
 
	protected ServicioException( String msg ) {
		super( msg );
	}
 
	public HttpStatus getStatus() {
		return ServicioException.status;
	}
 
}

/**
 * ServicioNotFoundException
 */
public class TokenExpiredException extends ServicioException {
 
	private static final long serialVersionUID = 1L;
 
	private static final HttpStatus status = HttpStatus.UNAUTHORIZED;
 
	public TokenExpiredException() {
		super( "Token_expired" );
	}
 
	@Override
	public HttpStatus getStatus() {
		return TokenExpiredException.status;
	}
 
}

/**
 * ServicioNotFoundException
 */
public class UnauthorizedException extends ServicioException {
 
	private static final long serialVersionUID = 1L;
 
	private static final HttpStatus status = HttpStatus.UNAUTHORIZED;
 
	public UnauthorizedException() {
		super( "No tiene acceso para solicitar este servicio " );
	}
 
	@Override
	public HttpStatus getStatus() {
		return UnauthorizedException.status;
	}
 
}

  CREATE TABLE "PORTALFUNDEWEB"."CAS_TOKEN_SESSION" 
   (	"UUID" VARCHAR2(40 BYTE) NOT NULL ENABLE, 
	"LOGIN" VARCHAR2(60 BYTE) NOT NULL ENABLE, 
	"START_TIME" TIMESTAMP (6) NOT NULL ENABLE, 
	"LAST_REFRESH" TIMESTAMP (6) NOT NULL ENABLE, 
	"USER_AGENT" VARCHAR2(256 BYTE), 
	"PLACE" VARCHAR2(256 BYTE), 
	"LDAP_GROUPS" VARCHAR2(256 BYTE), 
	 CONSTRAINT "CAS_TOKEN_SESSION_PK" PRIMARY KEY ("UUID")
  USING INDEX PCTFREE 10 INITRANS 2 MAXTRANS 255 COMPUTE STATISTICS 
  STORAGE(INITIAL 65536 NEXT 1048576 MINEXTENTS 1 MAXEXTENTS 2147483645
  PCTINCREASE 0 FREELISTS 1 FREELIST GROUPS 1
  BUFFER_POOL DEFAULT FLASH_CACHE DEFAULT CELL_FLASH_CACHE DEFAULT)
  TABLESPACE "PORTALFUNDEWEB"  ENABLE
   ) SEGMENT CREATION IMMEDIATE 
  PCTFREE 10 PCTUSED 40 INITRANS 1 MAXTRANS 255 
 NOCOMPRESS LOGGING
  STORAGE(INITIAL 65536 NEXT 1048576 MINEXTENTS 1 MAXEXTENTS 2147483645
  PCTINCREASE 0 FREELISTS 1 FREELIST GROUPS 1
  BUFFER_POOL DEFAULT FLASH_CACHE DEFAULT CELL_FLASH_CACHE DEFAULT)
  TABLESPACE "PORTALFUNDEWEB" ;

        <!-- CAS -->
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>

		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-cas</artifactId>
		</dependency>

		<!-- JWT -->
		<dependency>
			<groupId>io.jsonwebtoken</groupId>
			<artifactId>jjwt</artifactId>
			<version>0.9.1</version>
		</dependency>

login.config.serviceurl=https://atica-67-165.atica.um.es:8080/api/entrada
login.config.sso.loginurl=https://sso.um.es/cas/login
login.config.sso.logouturl=https://sso.um.es/cas/logout
login.config.sso.serverurl=https://sso.um.es/cas/
es.um.jwt.secret=---
security.enable-csrf=false
es.um.token.session.expiration=1000
# Tiempo de vida del token (en minutos)
es.um.jwt.expires=15
server.servlet.session.persistent=false
# Entorno - Se comprobara si esta variable es "local" o "desarrollo"
es.um.p15s.environment=local

package es.um.atica.----;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSessionEvent;

import org.jasig.cas.client.session.SingleSignOutFilter;
import org.jasig.cas.client.session.SingleSignOutHttpSessionListener;
import org.jasig.cas.client.validation.Cas30ServiceTicketValidator;
import org.jasig.cas.client.validation.TicketValidator;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Primary;
import org.springframework.context.event.EventListener;
import org.springframework.security.cas.ServiceProperties;
import org.springframework.security.cas.authentication.CasAuthenticationProvider;
import org.springframework.security.cas.web.CasAuthenticationEntryPoint;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.web.client.RestTemplate;

import es.um.atica.----.cas.services.UsuarioService;

@SpringBootApplication
public class LogincasApplication {

	@Value( "${login.config.serviceurl}" )
	private String serviceurl;

	@Value( "${login.config.sso.loginurl}" )
	private String ssoLoginUrl;

	@Value( "${login.config.sso.logouturl}" )
	private String ssoLogoutUrl;

	@Value( "${login.config.sso.serverurl}" )
	private String ssoServerUrl;

	public static void main( String[] args ) {
		SpringApplication.run( LogincasApplication.class, args );
	}

	@Bean
	public RestTemplate restTemplate() {
		return new RestTemplate();
	}

	@Bean
	public ServiceProperties serviceProperties() {
		final ServiceProperties serviceProperties = new ServiceProperties();
		serviceProperties.setSendRenew( false );
		serviceProperties.setService( serviceurl );
		serviceProperties.setAuthenticateAllArtifacts( true );
		return serviceProperties;
	}

	@Bean
	@Primary
	public AuthenticationEntryPoint authenticationEntryPoint( ServiceProperties sP ) {
		final CasAuthenticationEntryPoint entryPoint = new CasAuthenticationEntryPoint() {

			@Override
			protected String createServiceUrl( final HttpServletRequest request, final HttpServletResponse response ) {
				String serviceUrl = serviceProperties().getService();
				final String callback = request.getParameter( "callback" );
				if ( callback != null ) {
					serviceUrl += "/" + callback;
				}
				return serviceUrl;
			}
		};
		entryPoint.setLoginUrl( ssoLoginUrl );
		entryPoint.setServiceProperties( sP );
		return entryPoint;
	}

	@Bean
	public TicketValidator ticketValidator() {
		return new Cas30ServiceTicketValidator( ssoServerUrl );
	}

	@Bean
	public UserDetailsService generateUserDetailsService() {
		return new UsuarioService();
	}

	@Bean
	public CasAuthenticationProvider casAuthenticationProvider() {
		final CasAuthenticationProvider provider = new CasAuthenticationProvider();
		provider.setServiceProperties( serviceProperties() );
		provider.setTicketValidator( ticketValidator() );
		provider.setUserDetailsService( generateUserDetailsService() );
		provider.setKey( "CAS_PROVIDER_P15S" );
		return provider;
	}

	@Bean
	public SecurityContextLogoutHandler securityContextLogoutHandler() {
		return new SecurityContextLogoutHandler();
	}

	@Bean
	public LogoutFilter logoutFilter() {
		final LogoutFilter logoutFilter = new LogoutFilter( ssoLogoutUrl, securityContextLogoutHandler() );
		logoutFilter.setFilterProcessesUrl( "/logout/cas" );
		return logoutFilter;
	}

	@Bean
	public SingleSignOutFilter singleSignOutFilter() {
		final SingleSignOutFilter singleSignOutFilter = new SingleSignOutFilter();
		// singleSignOutFilter.setCasServerUrlPrefix( ssoServerUrl );
		singleSignOutFilter.setIgnoreInitConfiguration( true );
		return singleSignOutFilter;
	}

	@EventListener
	public SingleSignOutHttpSessionListener singleSignOutHttpSessionListener( HttpSessionEvent event ) {
		return new SingleSignOutHttpSessionListener();
	}
}

package es.um.atica.----.cas.config;
 
import static es.um.atica.----.Constants.SESSION_TOKEN_HEADER;
import static es.um.atica.----.Constants.LOCAL_ENV;
 
import java.util.Arrays;
 
import javax.servlet.http.HttpServletRequest;
 
import org.jasig.cas.client.session.SingleSignOutFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.authentication.AuthenticationDetailsSource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.cas.ServiceProperties;
import org.springframework.security.cas.authentication.CasAuthenticationProvider;
import org.springframework.security.cas.web.CasAuthenticationFilter;
import org.springframework.security.cas.web.authentication.ServiceAuthenticationDetails;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
import es.um.atica.----.cas.handlers.CustomizedLogoutHandler;
import es.um.atica.----.cas.handlers.CustomizedUrlAuthenticationSuccessHandler;
 
@EnableWebSecurity
@EnableGlobalMethodSecurity( securedEnabled = true )
public class ConfiguracionSeguridad extends WebSecurityConfigurerAdapter {

	private static final org.apache.logging.log4j.Logger log = org.apache.logging.log4j.LogManager
			.getLogger( ConfiguracionSeguridad.class );
 
    private final AuthenticationProvider authenticationProvider;
    private final LogoutFilter logoutFilter;
    private final SingleSignOutFilter singleSignOutFilter;
    private final AuthenticationEntryPoint authenticationEntryPoint;
    private final ServiceProperties serviceProperties;
	@Value( "${es.um.p15s.environment}" )
	private String environment;
 
    @Autowired
    public ConfiguracionSeguridad ( AuthenticationEntryPoint aep, LogoutFilter lF, SingleSignOutFilter ssF,
            CasAuthenticationProvider casAuthenticationProvider, ServiceProperties sp ) {
        authenticationProvider = casAuthenticationProvider;
        logoutFilter = lF;
        singleSignOutFilter = ssF;
        authenticationEntryPoint = aep;
        serviceProperties = sp;
    }
 
    // Autenticacion básica con usuario autogenerado
    @Override
    protected void configure( HttpSecurity http ) throws Exception {
 
        http.cors().and().csrf().disable().addFilter( casAuthenticationFilter( serviceProperties ) ).authorizeRequests()
        .regexMatchers( "^/entrada(\\/)?(\\?.+)?$" ).authenticated().and().authorizeRequests()
        .regexMatchers( "/public/*", "/private/*" ).permitAll().and().httpBasic()
        .authenticationEntryPoint( authenticationEntryPoint ).and().logout()
        .logoutSuccessHandler( customizedLogoutHandler() ).deleteCookies( SESSION_TOKEN_HEADER ).and()
        .addFilterBefore( singleSignOutFilter, CasAuthenticationFilter.class )
        .addFilterBefore( logoutFilter, LogoutFilter.class );
    }
 
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOriginPatterns( Arrays.asList( "*" ) );
        configuration.setAllowedMethods( Arrays.asList( "*" ) );
        configuration.setAllowedHeaders( Arrays.asList( "*" ) );
        configuration.setAllowCredentials( true );
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration( "/**", configuration );
        return source;
    }
 
    @Bean
    public CustomizedLogoutHandler customizedLogoutHandler() {
        return new CustomizedLogoutHandler();
    }
 
    @Override
    protected void configure( AuthenticationManagerBuilder auth ) throws Exception {
        auth.authenticationProvider( authenticationProvider );
    }
 
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return new ProviderManager( Arrays.asList( authenticationProvider ) );
    }
 
    @Bean
    AuthenticationDetailsSource<HttpServletRequest, ServiceAuthenticationDetails> dynamicServiceResolver() {
        return ( HttpServletRequest context ) -> {
            String urlProtocol = "http:";
            if ( !LOCAL_ENV.equals( environment ) ) {
                urlProtocol = "https:";
            }
            final String url = context.getRequestURL().toString().replace( "http:", urlProtocol );
            log.error( "-- ORIGINAL Dynamic URL: " + context.getRequestURL().toString() + " ---" );
            return new ServiceAuthenticationDetails() {

                private static final long serialVersionUID = 1L;

                @Override
                public String getServiceUrl() {
                    log.error( "-- Dynamic URL: " + url + " ---" );
                    return url;
                }
            };
        };
    }
 
    @Bean
    public CasAuthenticationFilter casAuthenticationFilter( ServiceProperties sP ) throws Exception {
        final CasAuthenticationFilter filter = new CasAuthenticationFilter();
        filter.setServiceProperties( sP );
        filter.setAuthenticationManager( authenticationManager() );
        filter.setFilterProcessesUrl( "/entrada/*" );
        filter.setAuthenticationDetailsSource( dynamicServiceResolver() );
        filter.setAuthenticationSuccessHandler( new CustomizedUrlAuthenticationSuccessHandler() );
        return filter;
    }
 
}