From b43f55839676cdc48eaa9118a060a9be98ce9817 Mon Sep 17 00:00:00 2001 From: gebo <35388172+gebogebogebo@users.noreply.github.com> Date: Tue, 13 Jan 2026 15:24:36 +0900 Subject: [PATCH] update --- .../config/AuthorizationServerConfig.java | 109 ++---------------- .../java/sample/service/JdbcUserService.java | 11 -- .../sample/web/InitialDataController.java | 61 ++++++++++ 3 files changed, 71 insertions(+), 110 deletions(-) create mode 100644 samples/demo-authorizationserver/src/main/java/sample/web/InitialDataController.java diff --git a/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java b/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java index 6d2883a1..70fe89f3 100644 --- a/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java +++ b/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java @@ -70,23 +70,6 @@ public class AuthorizationServerConfig { HttpSecurity http, RegisteredClientRepository registeredClientRepository, AuthorizationServerSettings authorizationServerSettings) throws Exception { - /* - * This sample demonstrates the use of a public client that does not - * store credentials or authenticate with the authorization server. - * - * The following components show how to customize the authorization - * server to allow for device clients to perform requests to the - * OAuth 2.0 Device Authorization Endpoint and Token Endpoint without - * a clientId/clientSecret. - * - * CAUTION: These endpoints will not require any authentication, and can - * be accessed by any client that has a valid clientId. - * - * It is therefore RECOMMENDED to carefully monitor the use of these - * endpoints and employ any additional protections as needed, which is - * outside the scope of this sample. - */ - OAuth2AuthorizationServerConfigurer authorizationServerConfigurer = authorizationServer(); // @formatter:off @@ -116,88 +99,30 @@ public class AuthorizationServerConfig { // @formatter:off @Bean public JdbcRegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) { - RegisteredClient messagingClient = RegisteredClient.withId(UUID.randomUUID().toString()) - .clientId("messaging-client") - .clientSecret("{noop}secret") - .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC) - .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE) - .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) - .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) - .redirectUri("http://localhost:8080/login/oauth2/code/messaging-client-oidc") - .redirectUri("http://localhost:8080/authorized") - .postLogoutRedirectUri("http://localhost:8080/logged-out") - .scope(OidcScopes.OPENID) - .scope(OidcScopes.PROFILE) - .scope("message.read") - .scope("message.write") - .scope("user.read") - .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build()) - .build(); - - RegisteredClient deviceClient = RegisteredClient.withId(UUID.randomUUID().toString()) - .clientId("device-messaging-client") - .clientAuthenticationMethod(ClientAuthenticationMethod.NONE) - .authorizationGrantType(AuthorizationGrantType.DEVICE_CODE) - .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) - .scope("message.read") - .scope("message.write") - .build(); - - RegisteredClient tokenExchangeClient = RegisteredClient.withId(UUID.randomUUID().toString()) - .clientId("token-client") - .clientSecret("{noop}token") - .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC) - .authorizationGrantType(new AuthorizationGrantType("urn:ietf:params:oauth:grant-type:token-exchange")) - .scope("message.read") - .scope("message.write") - .build(); - - RegisteredClient mtlsDemoClient = RegisteredClient.withId(UUID.randomUUID().toString()) - .clientId("mtls-demo-client") - .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) - .clientAuthenticationMethod(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH) - .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) - .scope("message.read") - .scope("message.write") - .clientSettings( - ClientSettings.builder() - .x509CertificateSubjectDN("CN=demo-client-sample,OU=Spring Samples,O=Spring,C=US") - .jwkSetUrl("http://localhost:8080/jwks") - .build() - ) - .tokenSettings( - TokenSettings.builder() - .x509CertificateBoundAccessTokens(true) - .build() - ) - .build(); - - // Save registered client's in db as if in-memory - JdbcRegisteredClientRepository registeredClientRepository = new JdbcRegisteredClientRepository(jdbcTemplate); -// registeredClientRepository.save(messagingClient); -// registeredClientRepository.save(deviceClient); -// registeredClientRepository.save(tokenExchangeClient); -// registeredClientRepository.save(mtlsDemoClient); - - return registeredClientRepository; + return new JdbcRegisteredClientRepository(jdbcTemplate); } // @formatter:on @Bean - public JdbcOAuth2AuthorizationService authorizationService(JdbcTemplate jdbcTemplate, - RegisteredClientRepository registeredClientRepository) { + public JdbcOAuth2AuthorizationService authorizationService( + JdbcTemplate jdbcTemplate, + RegisteredClientRepository registeredClientRepository + ) { return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository); } @Bean - public JdbcOAuth2AuthorizationConsentService authorizationConsentService(JdbcTemplate jdbcTemplate, - RegisteredClientRepository registeredClientRepository) { + public JdbcOAuth2AuthorizationConsentService authorizationConsentService( + JdbcTemplate jdbcTemplate, + RegisteredClientRepository registeredClientRepository + ) { // Will be used by the ConsentController return new JdbcOAuth2AuthorizationConsentService(jdbcTemplate, registeredClientRepository); } @Bean public JWKSource jwkSource() { + // TODO これDBにおく RSAKey rsaKey = Jwks.generateRsa(); JWKSet jwkSet = new JWKSet(rsaKey); return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet); @@ -213,18 +138,4 @@ public class AuthorizationServerConfig { return AuthorizationServerSettings.builder().build(); } -// @Bean -// public EmbeddedDatabase embeddedDatabase() { -// // @formatter:off -// return new EmbeddedDatabaseBuilder() -// .generateUniqueName(true) -// .setType(EmbeddedDatabaseType.H2) -// .setScriptEncoding("UTF-8") -// .addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql") -// .addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql") -// .addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql") -// .build(); -// // @formatter:on -// } - } diff --git a/samples/demo-authorizationserver/src/main/java/sample/service/JdbcUserService.java b/samples/demo-authorizationserver/src/main/java/sample/service/JdbcUserService.java index 4bdcc322..dfdd5d50 100644 --- a/samples/demo-authorizationserver/src/main/java/sample/service/JdbcUserService.java +++ b/samples/demo-authorizationserver/src/main/java/sample/service/JdbcUserService.java @@ -2,8 +2,6 @@ package sample.service; import javax.sql.DataSource; -import org.springframework.security.core.userdetails.User; -import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.provisioning.JdbcUserDetailsManager; import org.springframework.stereotype.Service; @@ -12,15 +10,6 @@ public class JdbcUserService extends JdbcUserDetailsManager { public JdbcUserService(DataSource dataSource) { super(dataSource); - // NOTE: The 'users' and 'authorities' tables must exist in the database. -// if (!userExists("user1")) { -// UserDetails user = User.withDefaultPasswordEncoder() -// .username("user1") -// .password("password") -// .roles("USER") -// .build(); -// createUser(user); -// } } } diff --git a/samples/demo-authorizationserver/src/main/java/sample/web/InitialDataController.java b/samples/demo-authorizationserver/src/main/java/sample/web/InitialDataController.java new file mode 100644 index 00000000..e949353f --- /dev/null +++ b/samples/demo-authorizationserver/src/main/java/sample/web/InitialDataController.java @@ -0,0 +1,61 @@ +package sample.web; + +import org.springframework.http.HttpStatus; +import org.springframework.http.ResponseEntity; +import org.springframework.security.core.userdetails.User; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; +import org.springframework.security.oauth2.core.oidc.OidcScopes; +import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; +import org.springframework.security.oauth2.server.authorization.settings.ClientSettings; +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.PostMapping; +import sample.service.JdbcUserService; + +import java.util.UUID; + +@Controller +public class InitialDataController { + + @PostMapping("/initial-data") + public ResponseEntity initialData( + JdbcRegisteredClientRepository registeredClientRepository, + JdbcUserService jdbcUserService + ) + { + RegisteredClient messagingClient = RegisteredClient.withId(UUID.randomUUID().toString()) + .clientId("messaging-client") + .clientSecret("{noop}secret") + .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC) + .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE) + .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) + .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) + .redirectUri("http://localhost:8080/login/oauth2/code/messaging-client-oidc") + .redirectUri("http://localhost:8080/authorized") + .postLogoutRedirectUri("http://localhost:8080/logged-out") + .scope(OidcScopes.OPENID) + .scope(OidcScopes.PROFILE) + .scope("message.read") + .scope("message.write") + .scope("user.read") + .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build()) + .build(); + + // Save registered client's in db + registeredClientRepository.save(messagingClient); + + if (!jdbcUserService.userExists("user1")) { + UserDetails user = User.withDefaultPasswordEncoder() + .username("user1") + .password("password") + .roles("USER") + .build(); + jdbcUserService.createUser(user); + } + + return ResponseEntity.status(HttpStatus.OK).build(); + } + +}