Cloner le projet : https://github.com/desprez/spring-shop.git
Lancer un mvn package

  public interface CustomerService {

   /**
    * Create a new customer
    * @param customer the Customer to create
    * @return the created Customer
    */
   public Customer create(Customer customer);

   /**
    * Retrieve a customer according to the given identifier.
    * @param customerId the customer identifier
    * @return the retrieved Customer
    */
   public Customer findOne(String customerId);

  }

public interface ItemService {

 /**
  * Add Item to the catalog
  *
  * @param item the item to add
  * @return the new added item
  */
 public Item addItem(Item item);

 /**
  * Display items catalog
  *
  * @return a list of item entities
  */
 public List<Item> getAllItems();

}

  public interface OrderService {

   /**
    * Add new order according to the given customer id and items ids.
    *
    * @param CustomerId the customerId
    * @param itemIds    list of items ids
    * @return new order filled with the order SUM
    */
   public Order addOrder(String CustomerId, List<String> itemIds);

   /**
    * Get Order according to the given orderId
    *
    * @param orderId the order id
    * @return an Order
    */
   public Order findOne(String orderId);

   /**
    * Retrieve all orders for a customer according to the customer id.
    * @param customerId the customer id
    * @return a List of Orders
    */
   public List<Order> getOrdersForCustomer(String customerId);

  }

		<dependency>
			<groupId>io.springfox</groupId>
			<artifactId>springfox-swagger2</artifactId>
			<version>${springfox-version}</version>
		</dependency>
		<dependency>
			<groupId>io.springfox</groupId>
			<artifactId>springfox-swagger-ui</artifactId>
			<version>${springfox-version}</version>
		</dependency>

	<!-- springfox-swagger2 dependencies -->
	<dependency>
		<groupId>io.springfox</groupId>
		<artifactId>springfox-swagger2</artifactId>
	</dependency>
	<dependency>
		<groupId>io.springfox</groupId>
		<artifactId>springfox-swagger-ui</artifactId>
	</dependency>

import java.time.LocalDate;
import java.time.ZonedDateTime;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import springfox.documentation.builders.ApiInfoBuilder;
import springfox.documentation.builders.RequestHandlerSelectors;
import springfox.documentation.service.ApiInfo;
import springfox.documentation.service.Contact;
import springfox.documentation.spi.DocumentationType;
import springfox.documentation.spring.web.plugins.Docket;
import springfox.documentation.swagger2.annotations.EnableSwagger2;

@Configuration
@EnableSwagger2
public class SwaggerConfig {

	@Bean
	public Docket customImplementation() {

		return new Docket(DocumentationType.SWAGGER_2).select()
				.apis(RequestHandlerSelectors.basePackage("fr.training.samples.spring.shop.exposition")).build()
				.directModelSubstitute(LocalDate.class, java.sql.Date.class)//
				.directModelSubstitute(ZonedDateTime.class, java.util.Date.class) //
				.apiInfo(apiInfo());
	}

	ApiInfo apiInfo() {
		return new ApiInfoBuilder()//
				.title("Swagger spring-shop") //
				.description("No description provided") //
				.license("Apache 2.0") //
				.licenseUrl("http://www.apache.org/licenses/LICENSE-2.0.html") //
				.termsOfServiceUrl("") //
				.version("1.0") //
				.contact(new Contact("Some one", "http://localhost:8080", "SomeOne@training.org")) //
				.build();
	}
}



import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

/**
 * Resource redirection to swagger api documentation
 */
@Controller
public class SwaggerResource {

	private static final Logger LOG = LoggerFactory.getLogger(SwaggerResource.class);

	/**
	 * Default constructor
	 */
	public SwaggerResource() {
		super();
	}

	@RequestMapping(value = "/")
	public String index() {
		LOG.info("swagger-ui.html");
		return "redirect:swagger-ui.html";
	}

}

mvn clean install
cd exposition
mvn spring-boot:run

    	<!-- Spring security -->
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-security</artifactId>
	</dependency>

	<dependency>
		<groupId>io.jsonwebtoken</groupId>
		<artifactId>jjwt</artifactId>
		<version>0.9.1</version>
	</dependency>

	<!-- spring-security-test dependencies -->
	<dependency>
		<groupId>org.springframework.security</groupId>
		<artifactId>spring-security-test</artifactId>
		<scope>test</scope>
	</dependency>

	# used to verify this hash if you have the secret key.
	jwt:
	  secret: spring-shop

public enum RoleTypeEnum {
	ROLE_USER, ROLE_ADMIN
}

@ElementCollection
@Enumerated(EnumType.STRING)
Set<RoleTypeEnum> roles = new HashSet<>();

public void addRole(final RoleTypeEnum role) {
	roles.add(role);
}

	// Encode given password
	customer.setPassword(passwordEncoder.encode(customer.getPassword()));
	
	// New customer has user role by default
	customer.addRole(RoleTypeEnum.ROLE_USER);

import java.util.Collection;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import fr.training.samples.spring.shop.domain.customer.Customer;
import fr.training.samples.spring.shop.domain.customer.CustomerRepository;

@Service
@Transactional
public class  UserDetailsServiceImpl implements UserDetailsService {

	private static Logger logger = LoggerFactory.getLogger(UserDetailsServiceImpl.class);

	@Autowired
	private CustomerRepository customerRepository;

	// ici je transforme mes objets du domain en objets internes de Spring Security
	@Override
	public UserDetails loadUserByUsername(final String customerName) throws UsernameNotFoundException {

		final Customer customer = customerRepository.findByCustomerName(customerName);
		if (customer == null) {
			throw new UsernameNotFoundException("Email " + customerName + " not found");
		}
		logger.debug("Customer found with name {}", customerName);
		return new User(customer.getName(), customer.getPassword(), getAuthorities(customer));
	}

	private static Collection<? extends GrantedAuthority> getAuthorities(final Customer customer) {
		final String[] userRoles = customer.getRoles().stream().map((role) -> role.name()).toArray(String[]::new);
		logger.debug("With User Roles {}", userRoles);
		final Collection<GrantedAuthority> authorities = AuthorityUtils.createAuthorityList(userRoles);
		return authorities;
	}
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import fr.training.samples.spring.shop.config.security.jwt.JwtAuthenticationEntryPoint;
import fr.training.samples.spring.shop.config.security.jwt.JwtRequestFilter;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	private UserDetailsService userDetailsService;

	@Autowired
	private JwtRequestFilter jwtRequestFilter;

	@Autowired
	private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;

	@Override
	public void configure(final AuthenticationManagerBuilder auth) throws Exception {
		auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
	}

	@Bean
	public PasswordEncoder passwordEncoder() {
		return new BCryptPasswordEncoder();
	}

	@Bean
	@Override
	public AuthenticationManager authenticationManagerBean() throws Exception {
		return super.authenticationManagerBean();
	}

	@Override
	protected void configure(final HttpSecurity httpSecurity) throws Exception {
		// Add a filter to validate the tokens with every request
		httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);

		httpSecurity.csrf().disable()
		// dont authenticate this authentication request
		.authorizeRequests().antMatchers("/authenticate").permitAll()
		// and authorize swagger-ui
		.antMatchers("/v2/api-docs", "/configuration/**", "/swagger*/**", "/webjars/**").permitAll()
		// all other requests need to be authenticated
		.anyRequest().authenticated().and().
		// make sure we use stateless session; session won't be used to
		// store user's state.
		exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint) //
		.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
	}
}

INSERT INTO CUSTOMER (ID, NAME, PASSWORD,VERSION) VALUES ('bd20a450-dee7-4253-bf48-7fee4d0cebc6', 'Admin', '$2a$10$hKDVYxLefVHV/vtuPhWD3OigtRyOykRLDdUAp80Z1crSoS1lFqaFS',0);
INSERT INTO CUSTOMER_ROLES(CUSTOMER_ID, ROLES) VALUES ('bd20a450-dee7-4253-bf48-7fee4d0cebc6','ROLE_ADMIN');

@ExceptionHandler(AccessDeniedException.class)
@ResponseBody
public ResponseEntity<Object> accessDeniedExceptionHandler(final AccessDeniedException ex) {

	final ErrorModel apiError = ErrorModel.builder() //
			.message(ex.getLocalizedMessage()) //
			.description("You have'nt access privilege to this operation")//
			.build();

	LOG.debug(ex.getMessage());

	return new ResponseEntity<>(apiError, HttpStatus.FORBIDDEN);
}

			.securityContexts(Arrays.asList(securityContext())) //
			.securitySchemes(Arrays.asList(apiKey()));
			

    private ApiKey apiKey() {
	return new ApiKey("JWT", AUTHORIZATION_HEADER, "header");
}

private SecurityContext securityContext() {
	return SecurityContext.builder().securityReferences(defaultAuth()).build();
}

List<SecurityReference> defaultAuth() {
	final AuthorizationScope authorizationScope = new AuthorizationScope("global", "accessEverything");
	final AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
	authorizationScopes[0] = authorizationScope;
	return Arrays.asList(new SecurityReference("JWT", authorizationScopes));
}

	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-actuator</artifactId>
	</dependency>

#Monitoring endpoints   
management:
  endpoints:
    web:
      exposure:
	include: info, health, configprops, logfile, metrics, env, loggers

	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-aop</artifactId>
	</dependency>

import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.EnableAspectJAutoProxy;

@Configuration
@EnableAspectJAutoProxy
public class AOPConfiguration {
}