{"id":18337563,"url":"https://github.com/sephiroth-j/spring-security-ltpa2-core","last_synced_at":"2025-04-06T05:31:35.718Z","repository":{"id":161182082,"uuid":"123800193","full_name":"sephiroth-j/spring-security-ltpa2-core","owner":"sephiroth-j","description":"Spring Security LTPA2","archived":false,"fork":false,"pushed_at":"2025-03-31T22:40:42.000Z","size":397,"stargazers_count":8,"open_issues_count":2,"forks_count":5,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-31T23:28:26.722Z","etag":null,"topics":["authentication","identity-provider","ltpa-token","spring-boot","spring-security","spring-security-ltpa2"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sephiroth-j.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-03-04T15:08:35.000Z","updated_at":"2025-03-31T22:39:49.000Z","dependencies_parsed_at":null,"dependency_job_id":"354faafe-b7fd-4d4d-b077-59f51f3ca266","html_url":"https://github.com/sephiroth-j/spring-security-ltpa2-core","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sephiroth-j%2Fspring-security-ltpa2-core","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sephiroth-j%2Fspring-security-ltpa2-core/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sephiroth-j%2Fspring-security-ltpa2-core/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sephiroth-j%2Fspring-security-ltpa2-core/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sephiroth-j","download_url":"https://codeload.github.com/sephiroth-j/spring-security-ltpa2-core/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247440339,"owners_count":20939221,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","identity-provider","ltpa-token","spring-boot","spring-security","spring-security-ltpa2"],"created_at":"2024-11-05T20:11:41.620Z","updated_at":"2025-04-06T05:31:35.308Z","avatar_url":"https://github.com/sephiroth-j.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Spring Security LTPA2\n\n[![Build Status](https://github.com/sephiroth-j/spring-security-ltpa2-core/workflows/CI%20build/badge.svg)](https://github.com/sephiroth-j/spring-security-ltpa2-core/actions?query=workflow%3A%22CI+build%22) [![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=de.sephiroth-j%3Aspring-security-ltpa2\u0026metric=alert_status)](https://sonarcloud.io/dashboard?id=de.sephiroth-j%3Aspring-security-ltpa2) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n\nAdd Spring Security support for user pre-authentication using IBM Lightweight Third Party Authentication (LTPA) v2. LTPA2 tokens can be created as well to consume other LTPA2-protected services or act as an LTPA2 authentication service.\n\nTokens are either taken from an HTTP header (default `Authorization` with prefix `LtpaToken2`) or a cookie (default `LtpaToken2`). Both names can be configured as needed, as well as the value prefix.\n\n**Examples**\n\n```bash\n# default header and value prefix\ncurl -i -H \"Authorization: LtpaToken2 \u003ctoken-value\u003e\" http://localhost:8080/hello\n# custom header name without value prefix\ncurl -i -H \"My-Auth-Header: \u003ctoken-value\u003e\" http://localhost:8080/hello\n# default cookie\ncurl -i -b \"LtpaToken2=\u003ctoken-value\u003e\" http://localhost:8080/hello\n# custom cookie name\ncurl -i -b \"My-Auth-Cookie=\u003ctoken-value\u003e\" http://localhost:8080/hello\n```\n\nAn absolute minimum requirement for configuration are the shared secret key needed for decrypting the token and, in order to verify its signature, the public key from the identity provider that created the token.\n\n## Version Compatibility Matrix\nSpring Security LTPA2 | Spring Security | Java\n--------------------- | --------------- | ----\n2.0.x (current) | 6.x | 17+\n1.1.x | 5.x | 8+\n\n## Usage\nCheckout the [servlet sample project](https://github.com/sephiroth-j/spring-security-ltpa2-sample) or [reactive sample project](https://github.com/sephiroth-j/spring-security-ltpa2-reactive-sample) for a complete example.\n\n### pom.xml\nAdd the library as an dependency together with your Spring Security dependencies.\n\n```xml\n\u003cdependencies\u003e\n\t\u003cdependency\u003e\n\t\t\u003cgroupId\u003eorg.springframework.boot\u003c/groupId\u003e\n\t\t\u003cartifactId\u003espring-boot-starter-security\u003c/artifactId\u003e\n\t\u003c/dependency\u003e\n\t\u003cdependency\u003e\n\t\t\u003cgroupId\u003eorg.springframework.security\u003c/groupId\u003e\n\t\t\u003cartifactId\u003espring-security-ldap\u003c/artifactId\u003e\n\t\u003c/dependency\u003e\n\t\u003cdependency\u003e\n\t\t\u003cgroupId\u003ede.sephiroth-j\u003c/groupId\u003e\n\t\t\u003cartifactId\u003espring-security-ltpa2\u003c/artifactId\u003e\n\t\t\u003cversion\u003e[2.0.0,)\u003c/version\u003e\n\t\u003c/dependency\u003e\n\u003c/dependencies\u003e\n\n\u003crepositories\u003e\n\t\u003crepository\u003e\n\t\t\u003cid\u003emrepo.sephiroth-j.de\u003c/id\u003e\n\t\t\u003curl\u003ehttps://mrepo.sephiroth-j.de/\u003c/url\u003e\n\t\u003c/repository\u003e\n\u003c/repositories\u003e\n```\n\n### Security Configuration for Web Servlet\nAdd the `Ltpa2Filter` using `Ltpa2Configurer`. It needs a `SecretKey` instance of the shared key that is used for the symmetric encryption of the LTPA2 token. In order to verify the provided token, it also needs the `PublicKey` from the identity provider (for example IBM Secure Gateway / DataPower) that sends the LTPA2 token.\n\nAs the user is pre-authenticated, **an instance of `UserDetailsService` is required** to setup the security context and populate it with the granted roles for the authenticated user. In this example we will simply use `InMemoryAuthentication` with a hard-coded list of users and their roles.\n\n```java\n@Configuration\n@EnableWebSecurity\npublic class WebSecurityConfig\n{\n\n\t@Bean\n\tpublic SecurityFilterChain ltpa2SecurityFilterChain(final HttpSecurity http, final UserDetailsService userDetailsService) throws Exception\n\t{\n\t\thttp\n\t\t\t.authorizeHttpRequests(authorize -\u003e authorize\n\t\t\t\t// all other require any authentication\n\t\t\t\t.anyRequest().authenticated()\n\t\t\t)\n\t\t\t// configure LTPA2 Support\n\t\t\t.apply(new Ltpa2Configurer())\n\t\t\t\t.sharedKey(sharedKey())\n\t\t\t\t.signerKey(signerKey())\n\t\t\t;\n\t\thttp.userDetailsService(userDetailsService);\n\t\treturn http.build();\n\t}\n\n\t@Bean\n\tpublic UserDetailsService userDetailsService()\n\t{\n\t\tfinal UserDetails user = User.builder()\n\t\t\t.username(\"user\")\n\t\t\t.password(\"{noop}password\")\n\t\t\t.roles(\"USER\")\n\t\t\t.build();\n\t\treturn new InMemoryUserDetailsManager(user);\n\t}\n}\n```\n\n### Security Configuration for Web Reactive\nAdd an `AuthenticationWebFilter` using `Ltpa2AuthManager` and the `Ltpa2AuthConverter`. The `Ltpa2AuthConverter` needs a `SecretKey` instance of the shared key that is used for the symmetric encryption of the LTPA2 token. In order to verify the provided token, it also needs the `PublicKey` from the identity provider (for example IBM Secure Gateway / DataPower) that sends the LTPA2 token.\n\nAs the user is pre-authenticated, **an instance of `ReactiveUserDetailsService` is required** to setup the security context and populate it with the granted roles for the authenticated user. In this example we will simply use `MapReactiveUserDetailsService` with a hard-coded list of users and their roles.\n\n```java\n@Configuration\n@EnableWebFluxSecurity\npublic class WebSecurityConfig\n{\n\n\t@Bean\n\tpublic SecurityWebFilterChain springSecurityFilterChain(final ServerHttpSecurity http, final AuthenticationWebFilter ltpa2AuthenticationWebFilter)\n\t{\n\t\thttp\n\t\t\t.csrf(CsrfSpec::disable)\n\t\t\t.httpBasic(HttpBasicSpec::disable)\n\t\t\t.authorizeExchange(authorize -\u003e authorize\n\t\t\t// all other require any authentication\n\t\t\t.anyExchange().authenticated())\n\t\t\t// apply ltpa2 authentication filter\n\t\t\t.addFilterAt(ltpa2AuthenticationWebFilter, SecurityWebFiltersOrder.AUTHENTICATION);\n\t\treturn http.build();\n\t}\n\n\t@Bean\n\tAuthenticationWebFilter ltpa2AuthenticationWebFilter(ReactiveUserDetailsService userDetailsService) throws GeneralSecurityException\n\t{\n\t\tfinal Ltpa2AuthConverter converter = new Ltpa2AuthConverter();\n\t\tconverter.setSharedKey(sharedKey());\n\t\tconverter.setSignerKey(signerKey());\n\n\t\tfinal AuthenticationWebFilter webfilter = new AuthenticationWebFilter(new Ltpa2AuthManager(userDetailsService));\n\t\twebfilter.setServerAuthenticationConverter(converter);\n\t\treturn webfilter;\n\t}\n\n\t@Bean\n\tpublic ReactiveUserDetailsService userDetailsService()\n\t{\n\t\tfinal UserDetails user = User.builder()\n\t\t\t.username(\"user\")\n\t\t\t.password(\"{noop}password\")\n\t\t\t.roles(\"USER\")\n\t\t\t.build();\n\t\treturn new MapReactiveUserDetailsService(user);\n\t}\n}\n```\n\n## Project info and Javadoc\n[Maven Site](https://www.sephiroth-j.de/java/spring-security-ltpa2/)\n\n[Javadoc](https://www.sephiroth-j.de/java/spring-security-ltpa2/apidocs/)\n\n## Changes\nPlease refer to [CHANGELOG.md](CHANGELOG.md) for a list of changes.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsephiroth-j%2Fspring-security-ltpa2-core","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsephiroth-j%2Fspring-security-ltpa2-core","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsephiroth-j%2Fspring-security-ltpa2-core/lists"}