You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
830 lines
26 KiB
830 lines
26 KiB
= OAuth 2.0 Resource Server Opaque Token |
|
|
|
[[webflux-oauth2resourceserver-opaque-minimaldependencies]] |
|
== Minimal Dependencies for Introspection |
|
As described in xref:servlet/oauth2/resource-server/jwt.adoc#oauth2resourceserver-jwt-minimaldependencies[Minimal Dependencies for JWT] most of Resource Server support is collected in `spring-security-oauth2-resource-server`. |
|
However unless a custom <<webflux-oauth2resourceserver-opaque-introspector-bean,`ReactiveOpaqueTokenIntrospector`>> is provided, the Resource Server will fallback to ReactiveOpaqueTokenIntrospector. |
|
Meaning that both `spring-security-oauth2-resource-server` and `oauth2-oidc-sdk` are necessary in order to have a working minimal Resource Server that supports opaque Bearer Tokens. |
|
Please refer to `spring-security-oauth2-resource-server` in order to determin the correct version for `oauth2-oidc-sdk`. |
|
|
|
[[webflux-oauth2resourceserver-opaque-minimalconfiguration]] |
|
== Minimal Configuration for Introspection |
|
|
|
Typically, an opaque token can be verified via an https://tools.ietf.org/html/rfc7662[OAuth 2.0 Introspection Endpoint], hosted by the authorization server. |
|
This can be handy when revocation is a requirement. |
|
|
|
When using https://spring.io/projects/spring-boot[Spring Boot], configuring an application as a resource server that uses introspection consists of two basic steps. |
|
First, include the needed dependencies and second, indicate the introspection endpoint details. |
|
|
|
[[webflux-oauth2resourceserver-opaque-introspectionuri]] |
|
=== Specifying the Authorization Server |
|
|
|
To specify where the introspection endpoint is, simply do: |
|
|
|
[source,yaml] |
|
---- |
|
spring: |
|
security: |
|
oauth2: |
|
resourceserver: |
|
opaque-token: |
|
introspection-uri: https://idp.example.com/introspect |
|
client-id: client |
|
client-secret: secret |
|
---- |
|
|
|
Where `https://idp.example.com/introspect` is the introspection endpoint hosted by your authorization server and `client-id` and `client-secret` are the credentials needed to hit that endpoint. |
|
|
|
Resource Server will use these properties to further self-configure and subsequently validate incoming JWTs. |
|
|
|
[NOTE] |
|
When using introspection, the authorization server's word is the law. |
|
If the authorization server responses that the token is valid, then it is. |
|
|
|
And that's it! |
|
|
|
=== Startup Expectations |
|
|
|
When this property and these dependencies are used, Resource Server will automatically configure itself to validate Opaque Bearer Tokens. |
|
|
|
This startup process is quite a bit simpler than for JWTs since no endpoints need to be discovered and no additional validation rules get added. |
|
|
|
=== Runtime Expectations |
|
|
|
Once the application is started up, Resource Server will attempt to process any request containing an `Authorization: Bearer` header: |
|
|
|
[source,http] |
|
---- |
|
GET / HTTP/1.1 |
|
Authorization: Bearer some-token-value # Resource Server will process this |
|
---- |
|
|
|
So long as this scheme is indicated, Resource Server will attempt to process the request according to the Bearer Token specification. |
|
|
|
Given an Opaque Token, Resource Server will |
|
|
|
1. Query the provided introspection endpoint using the provided credentials and the token |
|
2. Inspect the response for an `{ 'active' : true }` attribute |
|
3. Map each scope to an authority with the prefix `SCOPE_` |
|
|
|
The resulting `Authentication#getPrincipal`, by default, is a Spring Security `{security-api-url}org/springframework/security/oauth2/core/OAuth2AuthenticatedPrincipal.html[OAuth2AuthenticatedPrincipal]` object, and `Authentication#getName` maps to the token's `sub` property, if one is present. |
|
|
|
From here, you may want to jump to: |
|
|
|
* <<webflux-oauth2resourceserver-opaque-attributes,Looking Up Attributes Post-Authentication>> |
|
* <<webflux-oauth2resourceserver-opaque-authorization-extraction,Extracting Authorities Manually>> |
|
* <<webflux-oauth2resourceserver-opaque-jwt-introspector,Using Introspection with JWTs>> |
|
|
|
[[webflux-oauth2resourceserver-opaque-attributes]] |
|
== Looking Up Attributes Post-Authentication |
|
|
|
Once a token is authenticated, an instance of `BearerTokenAuthentication` is set in the `SecurityContext`. |
|
|
|
This means that it's available in `@Controller` methods when using `@EnableWebFlux` in your configuration: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@GetMapping("/foo") |
|
public Mono<String> foo(BearerTokenAuthentication authentication) { |
|
return Mono.just(authentication.getTokenAttributes().get("sub") + " is the subject"); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@GetMapping("/foo") |
|
fun foo(authentication: BearerTokenAuthentication): Mono<String> { |
|
return Mono.just(authentication.tokenAttributes["sub"].toString() + " is the subject") |
|
} |
|
---- |
|
====== |
|
|
|
Since `BearerTokenAuthentication` holds an `OAuth2AuthenticatedPrincipal`, that also means that it's available to controller methods, too: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@GetMapping("/foo") |
|
public Mono<String> foo(@AuthenticationPrincipal OAuth2AuthenticatedPrincipal principal) { |
|
return Mono.just(principal.getAttribute("sub") + " is the subject"); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@GetMapping("/foo") |
|
fun foo(@AuthenticationPrincipal principal: OAuth2AuthenticatedPrincipal): Mono<String> { |
|
return Mono.just(principal.getAttribute<Any>("sub").toString() + " is the subject") |
|
} |
|
---- |
|
====== |
|
|
|
=== Looking Up Attributes Via SpEL |
|
|
|
Of course, this also means that attributes can be accessed via SpEL. |
|
|
|
For example, if using `@EnableReactiveMethodSecurity` so that you can use `@PreAuthorize` annotations, you can do: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@PreAuthorize("principal?.attributes['sub'] = 'foo'") |
|
public Mono<String> forFoosEyesOnly() { |
|
return Mono.just("foo"); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@PreAuthorize("principal.attributes['sub'] = 'foo'") |
|
fun forFoosEyesOnly(): Mono<String> { |
|
return Mono.just("foo") |
|
} |
|
---- |
|
====== |
|
|
|
[[webflux-oauth2resourceserver-opaque-sansboot]] |
|
== Overriding or Replacing Boot Auto Configuration |
|
|
|
There are two ``@Bean``s that Spring Boot generates on Resource Server's behalf. |
|
|
|
The first is a `SecurityWebFilterChain` that configures the app as a resource server. |
|
When use Opaque Token, this `SecurityWebFilterChain` looks like: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@Bean |
|
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { |
|
http |
|
.authorizeExchange(exchanges -> exchanges |
|
.anyExchange().authenticated() |
|
) |
|
.oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::opaqueToken) |
|
return http.build(); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { |
|
return http { |
|
authorizeExchange { |
|
authorize(anyExchange, authenticated) |
|
} |
|
oauth2ResourceServer { |
|
opaqueToken { } |
|
} |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
If the application doesn't expose a `SecurityWebFilterChain` bean, then Spring Boot will expose the above default one. |
|
|
|
Replacing this is as simple as exposing the bean within the application: |
|
|
|
.Replacing SecurityWebFilterChain |
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@EnableWebFluxSecurity |
|
public class MyCustomSecurityConfiguration { |
|
@Bean |
|
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { |
|
http |
|
.authorizeExchange(exchanges -> exchanges |
|
.pathMatchers("/messages/**").hasAuthority("SCOPE_message:read") |
|
.anyExchange().authenticated() |
|
) |
|
.oauth2ResourceServer(oauth2 -> oauth2 |
|
.opaqueToken(opaqueToken -> opaqueToken |
|
.introspector(myIntrospector()) |
|
) |
|
); |
|
return http.build(); |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { |
|
return http { |
|
authorizeExchange { |
|
authorize("/messages/**", hasAuthority("SCOPE_message:read")) |
|
authorize(anyExchange, authenticated) |
|
} |
|
oauth2ResourceServer { |
|
opaqueToken { |
|
introspector = myIntrospector() |
|
} |
|
} |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
The above requires the scope of `message:read` for any URL that starts with `/messages/`. |
|
|
|
Methods on the `oauth2ResourceServer` DSL will also override or replace auto configuration. |
|
|
|
For example, the second `@Bean` Spring Boot creates is a `ReactiveOpaqueTokenIntrospector`, which decodes `String` tokens into validated instances of `OAuth2AuthenticatedPrincipal`: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@Bean |
|
public ReactiveOpaqueTokenIntrospector introspector() { |
|
return new NimbusReactiveOpaqueTokenIntrospector(introspectionUri, clientId, clientSecret); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun introspector(): ReactiveOpaqueTokenIntrospector { |
|
return NimbusReactiveOpaqueTokenIntrospector(introspectionUri, clientId, clientSecret) |
|
} |
|
---- |
|
====== |
|
|
|
If the application doesn't expose a `ReactiveOpaqueTokenIntrospector` bean, then Spring Boot will expose the above default one. |
|
|
|
And its configuration can be overridden using `introspectionUri()` and `introspectionClientCredentials()` or replaced using `introspector()`. |
|
|
|
[[webflux-oauth2resourceserver-opaque-introspectionuri-dsl]] |
|
=== Using `introspectionUri()` |
|
|
|
An authorization server's Introspection Uri can be configured <<webflux-oauth2resourceserver-opaque-introspectionuri,as a configuration property>> or it can be supplied in the DSL: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@EnableWebFluxSecurity |
|
public class DirectlyConfiguredIntrospectionUri { |
|
@Bean |
|
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { |
|
http |
|
.authorizeExchange(exchanges -> exchanges |
|
.anyExchange().authenticated() |
|
) |
|
.oauth2ResourceServer(oauth2 -> oauth2 |
|
.opaqueToken(opaqueToken -> opaqueToken |
|
.introspectionUri("https://idp.example.com/introspect") |
|
.introspectionClientCredentials("client", "secret") |
|
) |
|
); |
|
return http.build(); |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { |
|
return http { |
|
authorizeExchange { |
|
authorize(anyExchange, authenticated) |
|
} |
|
oauth2ResourceServer { |
|
opaqueToken { |
|
introspectionUri = "https://idp.example.com/introspect" |
|
introspectionClientCredentials("client", "secret") |
|
} |
|
} |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
Using `introspectionUri()` takes precedence over any configuration property. |
|
|
|
[[webflux-oauth2resourceserver-opaque-introspector-dsl]] |
|
=== Using `introspector()` |
|
|
|
More powerful than `introspectionUri()` is `introspector()`, which will completely replace any Boot auto configuration of `ReactiveOpaqueTokenIntrospector`: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@EnableWebFluxSecurity |
|
public class DirectlyConfiguredIntrospector { |
|
@Bean |
|
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { |
|
http |
|
.authorizeExchange(exchanges -> exchanges |
|
.anyExchange().authenticated() |
|
) |
|
.oauth2ResourceServer(oauth2 -> oauth2 |
|
.opaqueToken(opaqueToken -> opaqueToken |
|
.introspector(myCustomIntrospector()) |
|
) |
|
); |
|
return http.build(); |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { |
|
return http { |
|
authorizeExchange { |
|
authorize(anyExchange, authenticated) |
|
} |
|
oauth2ResourceServer { |
|
opaqueToken { |
|
introspector = myCustomIntrospector() |
|
} |
|
} |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
This is handy when deeper configuration, like <<webflux-oauth2resourceserver-opaque-authorization-extraction,authority mapping>>or <<webflux-oauth2resourceserver-opaque-jwt-introspector,JWT revocation>> is necessary. |
|
|
|
[[webflux-oauth2resourceserver-opaque-introspector-bean]] |
|
=== Exposing a `ReactiveOpaqueTokenIntrospector` `@Bean` |
|
|
|
Or, exposing a `ReactiveOpaqueTokenIntrospector` `@Bean` has the same effect as `introspector()`: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@Bean |
|
public ReactiveOpaqueTokenIntrospector introspector() { |
|
return new NimbusReactiveOpaqueTokenIntrospector(introspectionUri, clientId, clientSecret); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun introspector(): ReactiveOpaqueTokenIntrospector { |
|
return NimbusReactiveOpaqueTokenIntrospector(introspectionUri, clientId, clientSecret) |
|
} |
|
---- |
|
====== |
|
|
|
[[webflux-oauth2resourceserver-opaque-authorization]] |
|
== Configuring Authorization |
|
|
|
An OAuth 2.0 Introspection endpoint will typically return a `scope` attribute, indicating the scopes (or authorities) it's been granted, for example: |
|
|
|
`{ ..., "scope" : "messages contacts"}` |
|
|
|
When this is the case, Resource Server will attempt to coerce these scopes into a list of granted authorities, prefixing each scope with the string "SCOPE_". |
|
|
|
This means that to protect an endpoint or method with a scope derived from an Opaque Token, the corresponding expressions should include this prefix: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@EnableWebFluxSecurity |
|
public class MappedAuthorities { |
|
@Bean |
|
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { |
|
http |
|
.authorizeExchange(exchange -> exchange |
|
.pathMatchers("/contacts/**").hasAuthority("SCOPE_contacts") |
|
.pathMatchers("/messages/**").hasAuthority("SCOPE_messages") |
|
.anyExchange().authenticated() |
|
) |
|
.oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::opaqueToken); |
|
return http.build(); |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { |
|
return http { |
|
authorizeExchange { |
|
authorize("/contacts/**", hasAuthority("SCOPE_contacts")) |
|
authorize("/messages/**", hasAuthority("SCOPE_messages")) |
|
authorize(anyExchange, authenticated) |
|
} |
|
oauth2ResourceServer { |
|
opaqueToken { } |
|
} |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
Or similarly with method security: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@PreAuthorize("hasAuthority('SCOPE_messages')") |
|
public Flux<Message> getMessages(...) {} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@PreAuthorize("hasAuthority('SCOPE_messages')") |
|
fun getMessages(): Flux<Message> { } |
|
---- |
|
====== |
|
|
|
[[webflux-oauth2resourceserver-opaque-authorization-extraction]] |
|
=== Extracting Authorities Manually |
|
|
|
By default, Opaque Token support will extract the scope claim from an introspection response and parse it into individual `GrantedAuthority` instances. |
|
|
|
For example, if the introspection response were: |
|
|
|
[source,json] |
|
---- |
|
{ |
|
"active" : true, |
|
"scope" : "message:read message:write" |
|
} |
|
---- |
|
|
|
Then Resource Server would generate an `Authentication` with two authorities, one for `message:read` and the other for `message:write`. |
|
|
|
This can, of course, be customized using a custom `ReactiveOpaqueTokenIntrospector` that takes a look at the attribute set and converts in its own way: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
public class CustomAuthoritiesOpaqueTokenIntrospector implements ReactiveOpaqueTokenIntrospector { |
|
private ReactiveOpaqueTokenIntrospector delegate = |
|
new NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret"); |
|
|
|
public Mono<OAuth2AuthenticatedPrincipal> introspect(String token) { |
|
return this.delegate.introspect(token) |
|
.map(principal -> new DefaultOAuth2AuthenticatedPrincipal( |
|
principal.getName(), principal.getAttributes(), extractAuthorities(principal))); |
|
} |
|
|
|
private Collection<GrantedAuthority> extractAuthorities(OAuth2AuthenticatedPrincipal principal) { |
|
List<String> scopes = principal.getAttribute(OAuth2IntrospectionClaimNames.SCOPE); |
|
return scopes.stream() |
|
.map(SimpleGrantedAuthority::new) |
|
.collect(Collectors.toList()); |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
class CustomAuthoritiesOpaqueTokenIntrospector : ReactiveOpaqueTokenIntrospector { |
|
private val delegate: ReactiveOpaqueTokenIntrospector = NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret") |
|
override fun introspect(token: String): Mono<OAuth2AuthenticatedPrincipal> { |
|
return delegate.introspect(token) |
|
.map { principal: OAuth2AuthenticatedPrincipal -> |
|
DefaultOAuth2AuthenticatedPrincipal( |
|
principal.name, principal.attributes, extractAuthorities(principal)) |
|
} |
|
} |
|
|
|
private fun extractAuthorities(principal: OAuth2AuthenticatedPrincipal): Collection<GrantedAuthority> { |
|
val scopes = principal.getAttribute<List<String>>(OAuth2IntrospectionClaimNames.SCOPE) |
|
return scopes |
|
.map { SimpleGrantedAuthority(it) } |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
Thereafter, this custom introspector can be configured simply by exposing it as a `@Bean`: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@Bean |
|
public ReactiveOpaqueTokenIntrospector introspector() { |
|
return new CustomAuthoritiesOpaqueTokenIntrospector(); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun introspector(): ReactiveOpaqueTokenIntrospector { |
|
return CustomAuthoritiesOpaqueTokenIntrospector() |
|
} |
|
---- |
|
====== |
|
|
|
[[webflux-oauth2resourceserver-opaque-jwt-introspector]] |
|
== Using Introspection with JWTs |
|
|
|
A common question is whether or not introspection is compatible with JWTs. |
|
Spring Security's Opaque Token support has been designed to not care about the format of the token -- it will gladly pass any token to the introspection endpoint provided. |
|
|
|
So, let's say that you've got a requirement that requires you to check with the authorization server on each request, in case the JWT has been revoked. |
|
|
|
Even though you are using the JWT format for the token, your validation method is introspection, meaning you'd want to do: |
|
|
|
[source,yaml] |
|
---- |
|
spring: |
|
security: |
|
oauth2: |
|
resourceserver: |
|
opaque-token: |
|
introspection-uri: https://idp.example.org/introspection |
|
client-id: client |
|
client-secret: secret |
|
---- |
|
|
|
In this case, the resulting `Authentication` would be `BearerTokenAuthentication`. |
|
Any attributes in the corresponding `OAuth2AuthenticatedPrincipal` would be whatever was returned by the introspection endpoint. |
|
|
|
But, let's say that, oddly enough, the introspection endpoint only returns whether or not the token is active. |
|
Now what? |
|
|
|
In this case, you can create a custom `ReactiveOpaqueTokenIntrospector` that still hits the endpoint, but then updates the returned principal to have the JWTs claims as the attributes: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
public class JwtOpaqueTokenIntrospector implements ReactiveOpaqueTokenIntrospector { |
|
private ReactiveOpaqueTokenIntrospector delegate = |
|
new NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret"); |
|
private ReactiveJwtDecoder jwtDecoder = new NimbusReactiveJwtDecoder(new ParseOnlyJWTProcessor()); |
|
|
|
public Mono<OAuth2AuthenticatedPrincipal> introspect(String token) { |
|
return this.delegate.introspect(token) |
|
.flatMap(principal -> this.jwtDecoder.decode(token)) |
|
.map(jwt -> new DefaultOAuth2AuthenticatedPrincipal(jwt.getClaims(), NO_AUTHORITIES)); |
|
} |
|
|
|
private static class ParseOnlyJWTProcessor implements Converter<JWT, Mono<JWTClaimsSet>> { |
|
public Mono<JWTClaimsSet> convert(JWT jwt) { |
|
try { |
|
return Mono.just(jwt.getJWTClaimsSet()); |
|
} catch (Exception ex) { |
|
return Mono.error(ex); |
|
} |
|
} |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
class JwtOpaqueTokenIntrospector : ReactiveOpaqueTokenIntrospector { |
|
private val delegate: ReactiveOpaqueTokenIntrospector = NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret") |
|
private val jwtDecoder: ReactiveJwtDecoder = NimbusReactiveJwtDecoder(ParseOnlyJWTProcessor()) |
|
override fun introspect(token: String): Mono<OAuth2AuthenticatedPrincipal> { |
|
return delegate.introspect(token) |
|
.flatMap { jwtDecoder.decode(token) } |
|
.map { jwt: Jwt -> DefaultOAuth2AuthenticatedPrincipal(jwt.claims, NO_AUTHORITIES) } |
|
} |
|
|
|
private class ParseOnlyJWTProcessor : Converter<JWT, Mono<JWTClaimsSet>> { |
|
override fun convert(jwt: JWT): Mono<JWTClaimsSet> { |
|
return try { |
|
Mono.just(jwt.jwtClaimsSet) |
|
} catch (e: Exception) { |
|
Mono.error(e) |
|
} |
|
} |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
Thereafter, this custom introspector can be configured simply by exposing it as a `@Bean`: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@Bean |
|
public ReactiveOpaqueTokenIntrospector introspector() { |
|
return new JwtOpaqueTokenIntropsector(); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun introspector(): ReactiveOpaqueTokenIntrospector { |
|
return JwtOpaqueTokenIntrospector() |
|
} |
|
---- |
|
====== |
|
|
|
[[webflux-oauth2resourceserver-opaque-userinfo]] |
|
== Calling a `/userinfo` Endpoint |
|
|
|
Generally speaking, a Resource Server doesn't care about the underlying user, but instead about the authorities that have been granted. |
|
|
|
That said, at times it can be valuable to tie the authorization statement back to a user. |
|
|
|
If an application is also using `spring-security-oauth2-client`, having set up the appropriate `ClientRegistrationRepository`, then this is quite simple with a custom `OpaqueTokenIntrospector`. |
|
This implementation below does three things: |
|
|
|
* Delegates to the introspection endpoint, to affirm the token's validity |
|
* Looks up the appropriate client registration associated with the `/userinfo` endpoint |
|
* Invokes and returns the response from the `/userinfo` endpoint |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
public class UserInfoOpaqueTokenIntrospector implements ReactiveOpaqueTokenIntrospector { |
|
private final ReactiveOpaqueTokenIntrospector delegate = |
|
new NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret"); |
|
private final ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService = |
|
new DefaultReactiveOAuth2UserService(); |
|
|
|
private final ReactiveClientRegistrationRepository repository; |
|
|
|
// ... constructor |
|
|
|
@Override |
|
public Mono<OAuth2AuthenticatedPrincipal> introspect(String token) { |
|
return Mono.zip(this.delegate.introspect(token), this.repository.findByRegistrationId("registration-id")) |
|
.map(t -> { |
|
OAuth2AuthenticatedPrincipal authorized = t.getT1(); |
|
ClientRegistration clientRegistration = t.getT2(); |
|
Instant issuedAt = authorized.getAttribute(ISSUED_AT); |
|
Instant expiresAt = authorized.getAttribute(OAuth2IntrospectionClaimNames.EXPIRES_AT); |
|
OAuth2AccessToken accessToken = new OAuth2AccessToken(BEARER, token, issuedAt, expiresAt); |
|
return new OAuth2UserRequest(clientRegistration, accessToken); |
|
}) |
|
.flatMap(this.oauth2UserService::loadUser); |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
class UserInfoOpaqueTokenIntrospector : ReactiveOpaqueTokenIntrospector { |
|
private val delegate: ReactiveOpaqueTokenIntrospector = NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret") |
|
private val oauth2UserService: ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> = DefaultReactiveOAuth2UserService() |
|
private val repository: ReactiveClientRegistrationRepository? = null |
|
|
|
// ... constructor |
|
override fun introspect(token: String?): Mono<OAuth2AuthenticatedPrincipal> { |
|
return Mono.zip<OAuth2AuthenticatedPrincipal, ClientRegistration>(delegate.introspect(token), repository!!.findByRegistrationId("registration-id")) |
|
.map<OAuth2UserRequest> { t: Tuple2<OAuth2AuthenticatedPrincipal, ClientRegistration> -> |
|
val authorized = t.t1 |
|
val clientRegistration = t.t2 |
|
val issuedAt: Instant? = authorized.getAttribute(ISSUED_AT) |
|
val expiresAt: Instant? = authorized.getAttribute(OAuth2IntrospectionClaimNames.EXPIRES_AT) |
|
val accessToken = OAuth2AccessToken(BEARER, token, issuedAt, expiresAt) |
|
OAuth2UserRequest(clientRegistration, accessToken) |
|
} |
|
.flatMap { userRequest: OAuth2UserRequest -> oauth2UserService.loadUser(userRequest) } |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
If you aren't using `spring-security-oauth2-client`, it's still quite simple. |
|
You will simply need to invoke the `/userinfo` with your own instance of `WebClient`: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
public class UserInfoOpaqueTokenIntrospector implements ReactiveOpaqueTokenIntrospector { |
|
private final ReactiveOpaqueTokenIntrospector delegate = |
|
new NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret"); |
|
private final WebClient rest = WebClient.create(); |
|
|
|
@Override |
|
public Mono<OAuth2AuthenticatedPrincipal> introspect(String token) { |
|
return this.delegate.introspect(token) |
|
.map(this::makeUserInfoRequest); |
|
} |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
class UserInfoOpaqueTokenIntrospector : ReactiveOpaqueTokenIntrospector { |
|
private val delegate: ReactiveOpaqueTokenIntrospector = NimbusReactiveOpaqueTokenIntrospector("https://idp.example.org/introspect", "client", "secret") |
|
private val rest: WebClient = WebClient.create() |
|
|
|
override fun introspect(token: String): Mono<OAuth2AuthenticatedPrincipal> { |
|
return delegate.introspect(token) |
|
.map(this::makeUserInfoRequest) |
|
} |
|
} |
|
---- |
|
====== |
|
|
|
Either way, having created your `ReactiveOpaqueTokenIntrospector`, you should publish it as a `@Bean` to override the defaults: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
@Bean |
|
ReactiveOpaqueTokenIntrospector introspector() { |
|
return new UserInfoOpaqueTokenIntrospector(); |
|
} |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
@Bean |
|
fun introspector(): ReactiveOpaqueTokenIntrospector { |
|
return UserInfoOpaqueTokenIntrospector() |
|
} |
|
---- |
|
======
|
|
|