|
|
|
|
@ -1,237 +0,0 @@
@@ -1,237 +0,0 @@
|
|
|
|
|
/* |
|
|
|
|
* Copyright 2020-2023 the original author or authors. |
|
|
|
|
* |
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
|
|
|
|
* you may not use this file except in compliance with the License. |
|
|
|
|
* You may obtain a copy of the License at |
|
|
|
|
* |
|
|
|
|
* https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
* |
|
|
|
|
* Unless required by applicable law or agreed to in writing, software |
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS, |
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|
|
|
|
* See the License for the specific language governing permissions and |
|
|
|
|
* limitations under the License. |
|
|
|
|
*/ |
|
|
|
|
package sample.config; |
|
|
|
|
|
|
|
|
|
import java.security.KeyPair; |
|
|
|
|
import java.security.KeyPairGenerator; |
|
|
|
|
import java.security.interfaces.RSAPrivateKey; |
|
|
|
|
import java.security.interfaces.RSAPublicKey; |
|
|
|
|
import java.util.UUID; |
|
|
|
|
|
|
|
|
|
import com.nimbusds.jose.jwk.JWKSet; |
|
|
|
|
import com.nimbusds.jose.jwk.RSAKey; |
|
|
|
|
import com.nimbusds.jose.jwk.source.ImmutableJWKSet; |
|
|
|
|
import com.nimbusds.jose.jwk.source.JWKSource; |
|
|
|
|
import com.nimbusds.jose.proc.SecurityContext; |
|
|
|
|
import sample.authentication.DeviceClientAuthenticationProvider; |
|
|
|
|
import sample.web.authentication.DeviceClientAuthenticationConverter; |
|
|
|
|
|
|
|
|
|
import org.springframework.context.annotation.Bean; |
|
|
|
|
import org.springframework.context.annotation.Configuration; |
|
|
|
|
import org.springframework.core.annotation.Order; |
|
|
|
|
import org.springframework.jdbc.core.JdbcTemplate; |
|
|
|
|
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabase; |
|
|
|
|
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder; |
|
|
|
|
import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType; |
|
|
|
|
import org.springframework.security.config.Customizer; |
|
|
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity; |
|
|
|
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; |
|
|
|
|
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer; |
|
|
|
|
import org.springframework.security.core.userdetails.User; |
|
|
|
|
import org.springframework.security.core.userdetails.UserDetails; |
|
|
|
|
import org.springframework.security.core.userdetails.UserDetailsService; |
|
|
|
|
import org.springframework.security.oauth2.core.AuthorizationGrantType; |
|
|
|
|
import org.springframework.security.oauth2.core.ClientAuthenticationMethod; |
|
|
|
|
import org.springframework.security.oauth2.core.oidc.OidcScopes; |
|
|
|
|
import org.springframework.security.oauth2.jwt.JwtDecoder; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationService; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings; |
|
|
|
|
import org.springframework.security.oauth2.server.authorization.settings.ClientSettings; |
|
|
|
|
import org.springframework.security.provisioning.InMemoryUserDetailsManager; |
|
|
|
|
import org.springframework.security.web.SecurityFilterChain; |
|
|
|
|
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; |
|
|
|
|
|
|
|
|
|
/** |
|
|
|
|
* @author Steve Riesenberg |
|
|
|
|
* @since 1.1 |
|
|
|
|
*/ |
|
|
|
|
@Configuration(proxyBeanMethods = false) |
|
|
|
|
@EnableWebSecurity |
|
|
|
|
public class SecurityConfig { |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
@Order(1) |
|
|
|
|
public SecurityFilterChain authorizationServerSecurityFilterChain( |
|
|
|
|
HttpSecurity http, RegisteredClientRepository registeredClientRepository, |
|
|
|
|
AuthorizationServerSettings authorizationServerSettings) throws Exception { |
|
|
|
|
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http); |
|
|
|
|
|
|
|
|
|
/* |
|
|
|
|
* This sample demonstrates the use of a public client that does not |
|
|
|
|
* store credentials or authenticate with the authorization server. |
|
|
|
|
* |
|
|
|
|
* The following components show how to customize the authorization |
|
|
|
|
* server to allow for device clients to perform requests to the |
|
|
|
|
* OAuth 2.0 Device Authorization Endpoint and Token Endpoint without |
|
|
|
|
* a clientId/clientSecret. |
|
|
|
|
* |
|
|
|
|
* CAUTION: These endpoints will not require any authentication, and can |
|
|
|
|
* be accessed by any client that has a valid clientId. |
|
|
|
|
* |
|
|
|
|
* It is therefore RECOMMENDED to carefully monitor the use of these |
|
|
|
|
* endpoints and employ any additional protections as needed, which is |
|
|
|
|
* outside the scope of this sample. |
|
|
|
|
*/ |
|
|
|
|
DeviceClientAuthenticationConverter deviceClientAuthenticationConverter = |
|
|
|
|
new DeviceClientAuthenticationConverter( |
|
|
|
|
authorizationServerSettings.getDeviceAuthorizationEndpoint()); |
|
|
|
|
DeviceClientAuthenticationProvider deviceClientAuthenticationProvider = |
|
|
|
|
new DeviceClientAuthenticationProvider(registeredClientRepository); |
|
|
|
|
|
|
|
|
|
// @formatter:off
|
|
|
|
|
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class) |
|
|
|
|
.deviceAuthorizationEndpoint((deviceAuthorizationEndpoint) -> deviceAuthorizationEndpoint |
|
|
|
|
.verificationUri("/activate") |
|
|
|
|
) |
|
|
|
|
.clientAuthentication((clientAuthentication) -> clientAuthentication |
|
|
|
|
.authenticationConverter(deviceClientAuthenticationConverter) |
|
|
|
|
.authenticationProvider(deviceClientAuthenticationProvider) |
|
|
|
|
) |
|
|
|
|
.oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0
|
|
|
|
|
// @formatter:on
|
|
|
|
|
|
|
|
|
|
// @formatter:off
|
|
|
|
|
http |
|
|
|
|
.exceptionHandling((exceptions) -> exceptions |
|
|
|
|
.authenticationEntryPoint( |
|
|
|
|
new LoginUrlAuthenticationEntryPoint("/login")) |
|
|
|
|
) |
|
|
|
|
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt); |
|
|
|
|
// @formatter:on
|
|
|
|
|
|
|
|
|
|
return http.build(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
@Order(2) |
|
|
|
|
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { |
|
|
|
|
// @formatter:off
|
|
|
|
|
http |
|
|
|
|
.authorizeHttpRequests((authorize) -> authorize |
|
|
|
|
.anyRequest().authenticated() |
|
|
|
|
) |
|
|
|
|
.formLogin(Customizer.withDefaults()); |
|
|
|
|
// @formatter:on
|
|
|
|
|
|
|
|
|
|
return http.build(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
public UserDetailsService userDetailsService() { |
|
|
|
|
// @formatter:off
|
|
|
|
|
UserDetails userDetails = User.withDefaultPasswordEncoder() |
|
|
|
|
.username("user1") |
|
|
|
|
.password("password") |
|
|
|
|
.roles("USER") |
|
|
|
|
.build(); |
|
|
|
|
// @formatter:on
|
|
|
|
|
|
|
|
|
|
return new InMemoryUserDetailsManager(userDetails); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
public RegisteredClientRepository registeredClientRepository() { |
|
|
|
|
RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString()) |
|
|
|
|
.clientId("messaging-client") |
|
|
|
|
.clientSecret("{noop}secret") |
|
|
|
|
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC) |
|
|
|
|
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE) |
|
|
|
|
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) |
|
|
|
|
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) |
|
|
|
|
.redirectUri("http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc") |
|
|
|
|
.redirectUri("http://127.0.0.1:8080/authorized") |
|
|
|
|
.scope(OidcScopes.OPENID) |
|
|
|
|
.scope(OidcScopes.PROFILE) |
|
|
|
|
.scope("message.read") |
|
|
|
|
.scope("message.write") |
|
|
|
|
.clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build()) |
|
|
|
|
.build(); |
|
|
|
|
|
|
|
|
|
RegisteredClient deviceClient = RegisteredClient.withId(UUID.randomUUID().toString()) |
|
|
|
|
.clientId("device-messaging-client") |
|
|
|
|
.clientAuthenticationMethod(ClientAuthenticationMethod.NONE) |
|
|
|
|
.authorizationGrantType(AuthorizationGrantType.DEVICE_CODE) |
|
|
|
|
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) |
|
|
|
|
.scope("message.read") |
|
|
|
|
.scope("message.write") |
|
|
|
|
.build(); |
|
|
|
|
|
|
|
|
|
return new InMemoryRegisteredClientRepository(registeredClient, deviceClient); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
public OAuth2AuthorizationService authorizationService(JdbcTemplate jdbcTemplate, |
|
|
|
|
RegisteredClientRepository registeredClientRepository) { |
|
|
|
|
return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
public JWKSource<SecurityContext> jwkSource() { |
|
|
|
|
KeyPair keyPair = generateRsaKey(); |
|
|
|
|
RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic(); |
|
|
|
|
RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate(); |
|
|
|
|
RSAKey rsaKey = new RSAKey.Builder(publicKey) |
|
|
|
|
.privateKey(privateKey) |
|
|
|
|
.keyID(UUID.randomUUID().toString()) |
|
|
|
|
.build(); |
|
|
|
|
JWKSet jwkSet = new JWKSet(rsaKey); |
|
|
|
|
return new ImmutableJWKSet<>(jwkSet); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
private static KeyPair generateRsaKey() { |
|
|
|
|
KeyPair keyPair; |
|
|
|
|
try { |
|
|
|
|
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); |
|
|
|
|
keyPairGenerator.initialize(2048); |
|
|
|
|
keyPair = keyPairGenerator.generateKeyPair(); |
|
|
|
|
} |
|
|
|
|
catch (Exception ex) { |
|
|
|
|
throw new IllegalStateException(ex); |
|
|
|
|
} |
|
|
|
|
return keyPair; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) { |
|
|
|
|
return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
public AuthorizationServerSettings authorizationServerSettings() { |
|
|
|
|
return AuthorizationServerSettings.builder().build(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
public EmbeddedDatabase embeddedDatabase() { |
|
|
|
|
// @formatter:off
|
|
|
|
|
return new EmbeddedDatabaseBuilder() |
|
|
|
|
.generateUniqueName(true) |
|
|
|
|
.setType(EmbeddedDatabaseType.H2) |
|
|
|
|
.setScriptEncoding("UTF-8") |
|
|
|
|
.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql") |
|
|
|
|
.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql") |
|
|
|
|
.addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql") |
|
|
|
|
.build(); |
|
|
|
|
// @formatter:on
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
} |
Joe Grandja
3 years ago