Spring Authorization Server 1.0 Supplies Oauth 2.1 and OpenID Join 1.0 Implementations

Greater than two-and-a-half years after being launched to the Java neighborhood, VMWare has launched Spring Authorization Server 1.0. Constructed on high of Spring Safety, the Spring Authorization Server mission helps the creation of OpenID Join 1.0 Identification Suppliers and OAuth 2.1 Authorization Servers. The mission supersedes the Spring Safety OAuth mission which is not maintained.

Spring Authorization Server can also be based mostly on Spring Framework 6.0 and requires Java 17 as a minimal model. The mission helps Authorization Grants, Token Format, Consumer Authentication and Protocol Endpoints as described on the Function Record.

An instance software is used to clarify the essential configuration for a Spring Boot software created with Spring Initializr. The instance software is REST based mostly and requires the spring-boot-starter-web dependency within the pom.xml:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

As a way to show the login performance, take into account this instance wherein a REST endpoint is created:

@RestController
public class TimeController {

    @GetMapping("/time")
    public String retrieveTime() {
        DateTimeFormatter dateTimeFormatter =    
            DateTimeFormatter.ofPattern("HH:mm:ss");
        LocalTime localTime = LocalTime.now();
        return dateTimeFormatter.format(localTime);
    }
}

A primary Spring Boot software class is used to start out the applying with the beforehand created REST endpoint:

@SpringBootApplication
public class TimeApplication {

    public static void primary(String[] args) {
   	 SpringApplication.run(TimeApplication.class, args);
    }
}

After beginning the applying and opening the url http://localhost:8080/time, the time is proven:

21:00:34

Now the Spring Authorization Server dependency is added:

<dependency>
    <groupId>org.springframework.safety</groupId>
    <artifactId>spring-security-oauth2-authorization-server</artifactId>
    <model>1.0.0</model>
</dependency>

When beginning the applying once more, the password is logged, for instance:

Utilizing generated safety password: d73d5904-25a1-44ed-91e1-a32c4c5aedb8

Now when shopping to http://localhost:8080/time the request is redirected to http://localhost:8080/login and exhibits the next web page:

The default username consumer and the logged password could also be used to login after which the request is redirected to http://localhost:8080/time?proceed and the time is displayed once more.

The Creating Your First Software documentation particulars a number of @Bean elements, required for Spring Authorization Server, which must be outlined in a category annotated with @Configuration. The primary bean is used to outline the OAuth2 Protocol Endpoint:

@Bean
@Order(1)
public SecurityFilterChain protocolFilterChain(HttpSecurity http)
    throws Exception {
    OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
    http
        .exceptionHandling((exceptions) -> exceptions
        .authenticationEntryPoint(
            new LoginUrlAuthenticationEntryPoint("/login"))
        )
        .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
        .getConfigurer(OAuth2AuthorizationServerConfigurer.class)
        .oidc(Customizer.withDefaults());

        return http.construct();
}

The second bean is used to outline the Spring Safety Authentication:

@Bean
@Order(2)
public SecurityFilterChain authenticationFilterChain(HttpSecurity http) throws Exception {
    http
    .authorizeHttpRequests((authorize) -> authorize
        .anyRequest().authenticated()
    )
    .formLogin(Customizer.withDefaults());

    return http.construct();
}

A correct resolution to retailer customers must be used for actual merchandise, nonetheless this simplified instance shops the consumer james with the password gosling in reminiscence:

@Bean
public UserDetailsService userDetailsService() {
    UserDetails userDetails = Consumer.withDefaultPasswordEncoder()
        .username("james")
        .password("gosling")
        .roles("FOUNDER")
        .construct();

    return new InMemoryUserDetailsManager(userDetails);
}

New purchasers are registered in reminiscence with the RegisteredClientRepository:

@Bean
public RegisteredClientRepository registeredClientRepository() {
    RegisteredClient registeredClient =            
        RegisteredClient.withId(UUID.randomUUID().toString())
        .clientId("id")
        .clientSecret("secret")
        .clientAuthenticationMethod(
            ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
        .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
        .redirectUri(
          "http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc")
        .redirectUri("http://127.0.0.1:8080/licensed")
        .scope(OidcScopes.OPENID)
        .scope(OidcScopes.PROFILE)
        .scope("message.learn")
        .scope("message.write")
        .clientSettings(
            ClientSettings.builder()
            .requireAuthorizationConsent(true).construct())
        .construct();

	return new InMemoryRegisteredClientRepository(registeredClient);
}

Entry tokens are signed with the assistance of the next bean, by utilizing com.nimbusds.jose.jwk.RSAKey and never java.safety.interfaces.RSAKey:

@Bean
public JWKSource<SecurityContext> jwkSource() {
    KeyPair keyPair = generateRsaKey();
    RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
    RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
    RSAKey rsaKey = new RSAKey.Builder(publicKey)
        .privateKey(privateKey)
        .keyID(UUID.randomUUID().toString())
        .construct();
    JWKSet jwkSet = new JWKSet(rsaKey);
    return new ImmutableJWKSet<>(jwkSet);
}

non-public static KeyPair generateRsaKey() {
    KeyPair keyPair;
    attempt {
        KeyPairGenerator keyPairGenerator =                     
            KeyPairGenerator.getInstance("RSA");
    	  keyPairGenerator.initialize(2048);
    	  keyPair = keyPairGenerator.generateKeyPair();
    }
    catch (Exception ex) {
        throw new IllegalStateException(ex);
    }
    return keyPair;
}

The JwtDecoder is used to decode signed entry tokens, by utilizing com.nimbusds.jose.proc.SecurityContext and never org.springframework.safety.core.context.SecurityContext:

@Bean
public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
    return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
}

Lastly, the AuthorizationServerSettings is used to configure the OAuth2 authorization server:

@Bean
public AuthorizationServerSettings authorizationServerSettings() {
    return AuthorizationServerSettings.builder().construct();
}

Now when shopping to http://localhost:8080/time, the consumer james with the password gosling can be utilized to view the present time. After following these steps, the applying could also be prolonged to make use of numerous OAuth2 and OpenID Join 1.0 options comparable to tokens.

Spring Authorization Server is defined intimately by a number of movies, for instance by Joe Grandja, core committer on the Spring Safety staff, who offered Getting Began with Spring Authorization Server on the San Francisco JUG and Laurentiu Spilca, creator of Spring Safety in Motion who offered Implementing an OAuth 2 authorization server with Spring Safety at Spring I/O.

The mission is launched based mostly on the VMware Tanzu Open Supply Software program Assist coverage which suggests main releases are supported for as much as three years. Alternatively VMware provides industrial 24/7 help.

Extra info may be discovered within the Getting Began information, the Reference documentation and the examples on GitHub.