Skip to content

Commit 3fe6f86

Browse files
Steve Riesenbergjgrandja
Steve Riesenberg
authored and
jgrandja
committed
Federated Identity sample
Issue gh-538 Issue gh-499 Issue gh-106
1 parent ccf4a2d commit 3fe6f86

15 files changed

+1072
-3
lines changed

Diff for: ‎samples/README.adoc

+128-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,137 @@
1-
= Messages Sample
1+
= Samples
22

3-
This sample integrates `spring-security-oauth2-client` and `spring-security-oauth2-resource-server` with *Spring Authorization Server*.
3+
[[messages-sample]]
4+
== Messages Sample
5+
6+
The messages sample integrates `spring-security-oauth2-client` and `spring-security-oauth2-resource-server` with *Spring Authorization Server*.
47

58
The username is `user1` and the password is `password`.
69

7-
== Run the Sample
10+
[[run-messages-sample]]
11+
=== Run the Sample
812

913
* Run Authorization Server -> `./gradlew -b samples/default-authorizationserver/samples-default-authorizationserver.gradle bootRun`
1014
* Run Resource Server -> `./gradlew -b samples/messages-resource/samples-messages-resource.gradle bootRun`
1115
* Run Client -> `./gradlew -b samples/messages-client/samples-messages-client.gradle bootRun`
1216
* Go to `http://127.0.0.1:8080`
17+
18+
[[federated-identity-sample]]
19+
== Federated Identity Sample
20+
21+
The federated identity sample builds on the messages sample above, adding social login and federated identity features to *Spring Authorization Server* using custom configuration.
22+
23+
[[google-login]]
24+
=== Login with Google
25+
26+
This section shows how to configure Spring Security using Google as an Authentication Provider.
27+
28+
[[google-initial-setup]]
29+
==== Initial setup
30+
31+
To use Google's OAuth 2.0 authentication system for login, you must set up a project in the Google API Console to obtain OAuth 2.0 credentials.
32+
33+
NOTE: https://developers.google.com/identity/protocols/OpenIDConnect[Google's OAuth 2.0 implementation] for authentication conforms to the
34+
https://openid.net/connect/[OpenID Connect 1.0] specification and is https://openid.net/certification/[OpenID Certified].
35+
36+
Follow the instructions on the https://developers.google.com/identity/protocols/OpenIDConnect[OpenID Connect] page, starting in the section, "Setting up OAuth 2.0".
37+
38+
After completing the "Obtain OAuth 2.0 credentials" instructions, you should have a new OAuth Client with credentials consisting of a Client ID and a Client Secret.
39+
40+
[[google-redirect-uri]]
41+
==== Setting the redirect URI
42+
43+
The redirect URI is the path in the application that the end-user's user-agent is redirected back to after they have authenticated with Google
44+
and have granted access to the OAuth Client _(created in the previous step)_ on the Consent page.
45+
46+
In the "Set a redirect URI" sub-section, ensure that the *Authorized redirect URIs* field is set to `http://localhost:9000/login/oauth2/code/google-idp`.
47+
48+
TIP: The default redirect URI template is `{baseUrl}/login/oauth2/code/{registrationId}`.
49+
The *_registrationId_* is a unique identifier for the `ClientRegistration`.
50+
51+
[[google-application-config]]
52+
==== Configure application.yml
53+
54+
Now that you have a new OAuth Client with Google, you need to configure the application to use the OAuth Client for the _authentication flow_. To do so:
55+
56+
. Go to `application.yml` and set the following configuration:
57+
+
58+
[source,yaml]
59+
----
60+
spring:
61+
security:
62+
oauth2:
63+
client:
64+
registration: <1>
65+
google-idp: <2>
66+
provider: google
67+
client-id: google-client-id
68+
client-secret: google-client-secret
69+
----
70+
+
71+
.OAuth Client properties
72+
====
73+
<1> `spring.security.oauth2.client.registration` is the base property prefix for OAuth Client properties.
74+
<2> Following the base property prefix is the ID for the `ClientRegistration`, such as google-idp.
75+
====
76+
77+
. Replace the values in the `client-id` and `client-secret` property with the OAuth 2.0 credentials you created earlier.
78+
Alternatively, you can set the following environment variables in the Spring Boot application:
79+
* `GOOGLE_CLIENT_ID`
80+
* `GOOGLE_CLIENT_SECRET`
81+
82+
[[github-login]]
83+
=== Login with GitHub
84+
85+
This section shows how to configure Spring Security using Github as an Authentication Provider.
86+
87+
[[github-register-application]]
88+
==== Register OAuth application
89+
90+
To use GitHub's OAuth 2.0 authentication system for login, you must https://github.com/settings/applications/new[Register a new OAuth application].
91+
92+
When registering the OAuth application, ensure the *Authorization callback URL* is set to `http://localhost:9000/login/oauth2/code/github-idp`.
93+
94+
The Authorization callback URL (redirect URI) is the path in the application that the end-user's user-agent is redirected back to after they have authenticated with GitHub
95+
and have granted access to the OAuth application on the _Authorize application_ page.
96+
97+
TIP: The default redirect URI template is `{baseUrl}/login/oauth2/code/{registrationId}`.
98+
The *_registrationId_* is a unique identifier for the `ClientRegistration`.
99+
100+
[[github-application-config]]
101+
==== Configure application.yml
102+
103+
Now that you have a new OAuth application with GitHub, you need to configure the application to use the OAuth application for the _authentication flow_. To do so:
104+
105+
. Go to `application.yml` and set the following configuration:
106+
+
107+
[source,yaml]
108+
----
109+
spring:
110+
security:
111+
oauth2:
112+
client:
113+
registration: <1>
114+
github-idp: <2>
115+
provider: github
116+
client-id: github-client-id
117+
client-secret: github-client-secret
118+
----
119+
+
120+
.OAuth Client properties
121+
====
122+
<1> `spring.security.oauth2.client.registration` is the base property prefix for OAuth Client properties.
123+
<2> Following the base property prefix is the ID for the `ClientRegistration`, such as github-idp.
124+
====
125+
126+
. Replace the values in the `client-id` and `client-secret` property with the OAuth 2.0 credentials you created earlier.
127+
Alternatively, you can set the following environment variables in the Spring Boot application:
128+
* `GITHUB_CLIENT_ID`
129+
* `GITHUB_CLIENT_SECRET`
130+
131+
[[run-federated-identity-sample]]
132+
=== Run the Sample
133+
134+
* Run Authorization Server -> `./gradlew -b samples/federated-identity-authorizationserver/samples-federated-identity-authorizationserver.gradle bootRun`
135+
* Run Resource Server -> `./gradlew -b samples/messages-resource/samples-messages-resource.gradle bootRun`
136+
* Run Client -> `./gradlew -b samples/messages-client/samples-messages-client.gradle bootRun`
137+
* Go to `http://127.0.0.1:8080`

Diff for: ‎samples/federated-identity-authorizationserver/samples-federated-identity-authorizationserver.gradle

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apply plugin: 'io.spring.convention.spring-sample-boot'
2+
3+
dependencies {
4+
compile 'org.springframework.boot:spring-boot-starter-web'
5+
compile 'org.springframework.boot:spring-boot-starter-security'
6+
compile 'org.springframework.boot:spring-boot-starter-oauth2-client'
7+
compile 'org.springframework.boot:spring-boot-starter-thymeleaf'
8+
compile 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5'
9+
compile 'org.webjars:webjars-locator-core'
10+
compile 'org.webjars:bootstrap:3.4.1'
11+
compile 'org.webjars:jquery:3.4.1'
12+
compile 'org.springframework.boot:spring-boot-starter-jdbc'
13+
compile project(':spring-security-oauth2-authorization-server')
14+
runtimeOnly 'com.h2database:h2'
15+
16+
testCompile 'org.springframework.boot:spring-boot-starter-test'
17+
testCompile 'org.springframework.security:spring-security-test'
18+
testCompile 'net.sourceforge.htmlunit:htmlunit'
19+
}

Diff for: ‎samples/federated-identity-authorizationserver/src/main/java/sample/FederatedIdentityAuthorizationServerApplication.java

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
* Copyright 2020-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package sample;
17+
18+
import org.springframework.boot.SpringApplication;
19+
import org.springframework.boot.autoconfigure.SpringBootApplication;
20+
21+
/**
22+
* @author Steve Riesenberg
23+
* @since 0.2.3
24+
*/
25+
@SpringBootApplication
26+
public class FederatedIdentityAuthorizationServerApplication {
27+
28+
public static void main(String[] args) {
29+
SpringApplication.run(FederatedIdentityAuthorizationServerApplication.class, args);
30+
}
31+
32+
}

Diff for: ‎samples/federated-identity-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
/*
2+
* Copyright 2020-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package sample.config;
17+
18+
import java.util.UUID;
19+
20+
import com.nimbusds.jose.jwk.JWKSet;
21+
import com.nimbusds.jose.jwk.RSAKey;
22+
import com.nimbusds.jose.jwk.source.JWKSource;
23+
import com.nimbusds.jose.proc.SecurityContext;
24+
import sample.jose.Jwks;
25+
import sample.security.FederatedIdentityConfigurer;
26+
import sample.security.FederatedIdentityIdTokenCustomizer;
27+
28+
import org.springframework.context.annotation.Bean;
29+
import org.springframework.context.annotation.Configuration;
30+
import org.springframework.core.Ordered;
31+
import org.springframework.core.annotation.Order;
32+
import org.springframework.jdbc.core.JdbcTemplate;
33+
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabase;
34+
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder;
35+
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType;
36+
import org.springframework.security.config.Customizer;
37+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
38+
import org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
39+
import org.springframework.security.oauth2.core.AuthorizationGrantType;
40+
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
41+
import org.springframework.security.oauth2.core.oidc.OidcScopes;
42+
import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationConsentService;
43+
import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationService;
44+
import org.springframework.security.oauth2.server.authorization.JwtEncodingContext;
45+
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService;
46+
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
47+
import org.springframework.security.oauth2.server.authorization.OAuth2TokenCustomizer;
48+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
49+
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
50+
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
51+
import org.springframework.security.oauth2.server.authorization.config.ClientSettings;
52+
import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;
53+
import org.springframework.security.web.SecurityFilterChain;
54+
55+
/**
56+
* @author Steve Riesenberg
57+
* @since 0.2.3
58+
*/
59+
@Configuration(proxyBeanMethods = false)
60+
public class AuthorizationServerConfig {
61+
62+
@Bean
63+
@Order(Ordered.HIGHEST_PRECEDENCE)
64+
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
65+
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
66+
http.apply(new FederatedIdentityConfigurer());
67+
return http.formLogin(Customizer.withDefaults()).build();
68+
}
69+
70+
@Bean
71+
public OAuth2TokenCustomizer<JwtEncodingContext> idTokenCustomizer() {
72+
return new FederatedIdentityIdTokenCustomizer();
73+
}
74+
75+
// @formatter:off
76+
@Bean
77+
public RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) {
78+
RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
79+
.clientId("messaging-client")
80+
.clientSecret("{noop}secret")
81+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
82+
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
83+
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
84+
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
85+
.redirectUri("http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc")
86+
.redirectUri("http://127.0.0.1:8080/authorized")
87+
.scope(OidcScopes.OPENID)
88+
.scope("message.read")
89+
.scope("message.write")
90+
.clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
91+
.build();
92+
93+
// Save registered client in db as if in-memory
94+
JdbcRegisteredClientRepository registeredClientRepository = new JdbcRegisteredClientRepository(jdbcTemplate);
95+
registeredClientRepository.save(registeredClient);
96+
97+
return registeredClientRepository;
98+
}
99+
// @formatter:on
100+
101+
@Bean
102+
public OAuth2AuthorizationService authorizationService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) {
103+
return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository);
104+
}
105+
106+
@Bean
107+
public OAuth2AuthorizationConsentService authorizationConsentService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) {
108+
return new JdbcOAuth2AuthorizationConsentService(jdbcTemplate, registeredClientRepository);
109+
}
110+
111+
@Bean
112+
public JWKSource<SecurityContext> jwkSource() {
113+
RSAKey rsaKey = Jwks.generateRsa();
114+
JWKSet jwkSet = new JWKSet(rsaKey);
115+
return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
116+
}
117+
118+
@Bean
119+
public ProviderSettings providerSettings() {
120+
return ProviderSettings.builder().issuer("http://localhost:9000").build();
121+
}
122+
123+
@Bean
124+
public EmbeddedDatabase embeddedDatabase() {
125+
// @formatter:off
126+
return new EmbeddedDatabaseBuilder()
127+
.generateUniqueName(true)
128+
.setType(EmbeddedDatabaseType.H2)
129+
.setScriptEncoding("UTF-8")
130+
.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql")
131+
.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql")
132+
.addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql")
133+
.build();
134+
// @formatter:on
135+
}
136+
137+
}

0 commit comments

Comments
 (0)