20 |
22 |
12 |
31 |
32 |
33 |
34 |
--------------------------------------------------------------------------------
/SpringAuthorizationServer/src/main/java/pk/training/basit/oauth2/authentication/OAuth2EndpointUtils.java:
--------------------------------------------------------------------------------
1 | package pk.training.basit.oauth2.authentication;
2 |
3 | import java.util.Map;
4 |
5 | import javax.servlet.http.HttpServletRequest;
6 |
7 | import org.springframework.security.oauth2.core.AuthorizationGrantType;
8 | import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
9 | import org.springframework.security.oauth2.core.OAuth2Error;
10 | import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
11 | import org.springframework.security.oauth2.core.endpoint.PkceParameterNames;
12 | import org.springframework.util.LinkedMultiValueMap;
13 | import org.springframework.util.MultiValueMap;
14 |
15 | public class OAuth2EndpointUtils {
16 |
17 | static final String ACCESS_TOKEN_REQUEST_ERROR_URI = "https://datatracker.ietf.org/doc/html/rfc6749#section-5.2";
18 |
19 | private OAuth2EndpointUtils() {
20 | }
21 |
22 | public static MultiValueMapLogin
13 |Wrong username or password
14 | 30 |
14 |
15 |
57 |
58 |
59 |
--------------------------------------------------------------------------------
/SpringAuthorizationServer/src/main/java/pk/training/basit/configuration/federated/identity/FederatedIdentityIdTokenCustomizer.java:
--------------------------------------------------------------------------------
1 | package pk.training.basit.configuration.federated.identity;
2 |
3 | import java.util.Arrays;
4 | import java.util.Collections;
5 | import java.util.HashMap;
6 | import java.util.HashSet;
7 | import java.util.Map;
8 | import java.util.Set;
9 |
10 | import org.springframework.security.core.Authentication;
11 | import org.springframework.security.oauth2.core.oidc.IdTokenClaimNames;
12 | import org.springframework.security.oauth2.core.oidc.OidcIdToken;
13 | import org.springframework.security.oauth2.core.oidc.endpoint.OidcParameterNames;
14 | import org.springframework.security.oauth2.core.oidc.user.OidcUser;
15 | import org.springframework.security.oauth2.core.user.OAuth2User;
16 | import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext;
17 | import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer;
18 |
19 | public final class FederatedIdentityIdTokenCustomizer implements OAuth2TokenCustomizer
16 |
17 |
55 |
56 |
18 | ![memorynotfound logo]()
19 |
20 |
21 |
22 |
26 |
27 |
23 | Incorrect email and/or password. Please try again.
24 |
25 |
28 |
29 |
53 |
54 |
12 |
20 |
21 |
22 |
53 |
54 |
55 |
56 |
--------------------------------------------------------------------------------
/SpringAuthorizationServer/src/main/java/pk/training/basit/configuration/SecurityConfiguration.java:
--------------------------------------------------------------------------------
1 | package pk.training.basit.configuration;
2 |
3 | import org.apache.logging.log4j.LogManager;
4 | import org.apache.logging.log4j.Logger;
5 | import org.springframework.beans.factory.annotation.Autowired;
6 | import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
7 | import org.springframework.boot.autoconfigure.security.servlet.PathRequest;
8 | import org.springframework.context.annotation.AdviceMode;
9 | import org.springframework.context.annotation.Bean;
10 | import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
11 | import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
12 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
13 | import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
14 | import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
15 | import org.springframework.security.web.SecurityFilterChain;
16 |
17 | import pk.training.basit.configuration.federated.identity.FederatedIdentityConfigurer;
18 | import pk.training.basit.configuration.federated.identity.UserRepositoryOAuth2UserHandler;
19 | import pk.training.basit.service.UserPrincipalService;
20 |
21 | @EnableGlobalMethodSecurity(
22 | prePostEnabled = true,
23 | order = 0,
24 | mode = AdviceMode.PROXY,
25 | proxyTargetClass = false
26 | )
27 | @EnableWebSecurity
28 | public class SecurityConfiguration {
29 |
30 | private static final Logger LOGGER = LogManager.getLogger(SecurityConfiguration.class);
31 |
32 | @Autowired
33 | private UserPrincipalService userPrincipalService;
34 |
35 | // If no passwordEncoder bean is defined then you have to prefix password like {noop}secret1, or {bcrypt}password
36 | // if not static spring boot 2.6.x gives bean currently in creation error at line .passwordEncoder(passwordEncoder()) in configureGlobal() method
37 | /**
38 | @Bean
39 | public static PasswordEncoder passwordEncoder() {
40 | LOGGER.debug("in passwordEncoder");
41 | return new BCryptPasswordEncoder();
42 | };
43 | */
44 |
45 | @Autowired
46 | protected void configureGlobal(AuthenticationManagerBuilder builder) throws Exception {
47 | LOGGER.debug("in configureGlobal");
48 | builder
49 | .userDetailsService(this.userPrincipalService)
50 | // .passwordEncoder(passwordEncoder())
51 | .and()
52 | .eraseCredentials(true);
53 | }
54 |
55 | @Bean
56 | public WebSecurityCustomizer webSecurityCustomizer() {
57 | return (web) -> web.ignoring().antMatchers("/webjars/**", "/image/**");
58 | }
59 |
60 | @Bean
61 | public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
62 | LOGGER.debug("in configure HttpSecurity");
63 |
64 | FederatedIdentityConfigurer federatedIdentityConfigurer = new FederatedIdentityConfigurer().oauth2UserHandler(new UserRepositoryOAuth2UserHandler());
65 |
66 | http.authorizeRequests(authorizeRequests -> authorizeRequests.requestMatchers(EndpointRequest.toAnyEndpoint(),PathRequest.toH2Console()).permitAll()
67 | .anyRequest().authenticated()
68 | )
69 | .formLogin(form -> form.loginPage("/login").failureUrl("/login-error").permitAll())
70 | .csrf().ignoringRequestMatchers(PathRequest.toH2Console())
71 | .and().headers().frameOptions().sameOrigin()
72 | .and()
73 | .apply(federatedIdentityConfigurer);
74 |
75 | return http.build();
76 | }
77 |
78 | }
79 |
--------------------------------------------------------------------------------
/SpringAuthorizationServer/src/main/java/pk/training/basit/oauth2/authentication/OAuth2ResourceOwnerPasswordAuthenticationConverter.java:
--------------------------------------------------------------------------------
1 | package pk.training.basit.oauth2.authentication;
2 |
3 | import java.util.Arrays;
4 | import java.util.HashSet;
5 | import java.util.Map;
6 | import java.util.Set;
7 | import java.util.stream.Collectors;
8 |
9 | import javax.servlet.http.HttpServletRequest;
10 |
11 | import org.springframework.security.core.Authentication;
12 | import org.springframework.security.core.context.SecurityContextHolder;
13 | import org.springframework.security.oauth2.core.AuthorizationGrantType;
14 | import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
15 | import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
16 | import org.springframework.security.web.authentication.AuthenticationConverter;
17 | import org.springframework.util.MultiValueMap;
18 | import org.springframework.util.StringUtils;
19 |
20 | public class OAuth2ResourceOwnerPasswordAuthenticationConverter implements AuthenticationConverter {
21 |
22 | @Override
23 | public Authentication convert(HttpServletRequest request) {
24 |
25 | // grant_type (REQUIRED)
26 | String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
27 | if (!AuthorizationGrantType.PASSWORD.getValue().equals(grantType)) {
28 | return null;
29 | }
30 |
31 | MultiValueMap
23 |
24 |
25 |
26 |
27 |
52 |
28 |
30 | Authorize the client using grant_type:
29 |-
31 |
- 32 | Authorization Code (Login to Spring Authorization Server using: user1/password) 33 | 34 |
- 35 | Client Credentials 36 | 37 |
- 38 | Password 39 | 40 |
24 |
92 |
93 |
--------------------------------------------------------------------------------
/SpringAuthorizationServer/src/main/java/pk/training/basit/configuration/federated/identity/FederatedIdentityConfigurer.java:
--------------------------------------------------------------------------------
1 | package pk.training.basit.configuration.federated.identity;
2 |
3 | import java.util.function.Consumer;
4 |
5 | import org.springframework.context.ApplicationContext;
6 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
7 | import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
8 | import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
9 | import org.springframework.security.oauth2.core.oidc.user.OidcUser;
10 | import org.springframework.security.oauth2.core.user.OAuth2User;
11 | import org.springframework.util.Assert;
12 |
13 | public final class FederatedIdentityConfigurer extends AbstractHttpConfigurer
25 |
27 | App permissions
26 |
28 |
37 |
29 |
36 | 30 | The application 31 | 32 | wants to access your account 33 | 34 |
35 |
38 |
40 |
41 | The following permissions are requested by the above app.
Please review
39 | these and consent if you approve.
42 |
81 |
43 |
79 |
80 |
82 |
91 |
83 |
90 |
84 |
85 | Your consent to provide access is required.
86 |
If you do not approve, click Cancel, in which case no information will be shared with the app.
87 |
88 |
27 |
28 |
124 |
125 |
--------------------------------------------------------------------------------
/SpringAuthorizationServerClient/src/main/java/pk/training/basit/config/WebClientConfig.java:
--------------------------------------------------------------------------------
1 | package pk.training.basit.config;
2 |
3 | import java.util.Collections;
4 | import java.util.HashMap;
5 | import java.util.Map;
6 | import java.util.function.Function;
7 |
8 | import javax.servlet.http.HttpServletRequest;
9 |
10 | import org.springframework.context.annotation.Bean;
11 | import org.springframework.context.annotation.Configuration;
12 | import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
13 | import org.springframework.security.core.Authentication;
14 | import org.springframework.security.core.userdetails.User;
15 | import org.springframework.security.oauth2.client.OAuth2AuthorizationContext;
16 | import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
17 | import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
18 | import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
19 | import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
20 | import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
21 | import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
22 | import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
23 | import org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction;
24 | import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
25 | import org.springframework.util.CollectionUtils;
26 | import org.springframework.util.StringUtils;
27 | import org.springframework.web.reactive.function.client.WebClient;
28 |
29 | @Configuration
30 | public class WebClientConfig {
31 |
32 | @Bean
33 | WebClient webClient(OAuth2AuthorizedClientManager authorizedClientManager) {
34 |
35 | ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2Client =
36 | new ServletOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
37 |
38 | return WebClient.builder().apply(oauth2Client.oauth2Configuration()).build();
39 | }
40 |
41 | @Bean
42 | OAuth2AuthorizedClientManager authorizedClientManager(ClientRegistrationRepository clientRegistrationRepository,
43 | OAuth2AuthorizedClientRepository authorizedClientRepository) {
44 |
45 | OAuth2AuthorizedClientProvider authorizedClientProvider =
46 | OAuth2AuthorizedClientProviderBuilder.builder()
47 | .authorizationCode()
48 | .refreshToken()
49 | .clientCredentials()
50 | .password()
51 | .build();
52 |
53 | DefaultOAuth2AuthorizedClientManager authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(
54 | clientRegistrationRepository, authorizedClientRepository);
55 |
56 | authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
57 |
58 | // Assuming the `username` and `password` are supplied as `HttpServletRequest` parameters,
59 | // map the `HttpServletRequest` parameters to `OAuth2AuthorizationContext.getAttributes()`
60 | authorizedClientManager.setContextAttributesMapper(contextAttributesMapper());
61 |
62 | return authorizedClientManager;
63 | }
64 |
65 | private Function
29 |
30 |
123 |
31 |
35 |
36 |
32 |
33 |
34 | 33 |
37 | ![memorynotfound logo]()
38 |
39 |
40 |
41 |
49 |
50 |
42 |
48 | 43 | The application 44 | 45 | wants to access your application account 46 |
47 |
51 |
58 |
59 |
52 |
57 | 53 | 54 | 55 |
56 |
60 |
68 |
69 |
61 |
67 | 62 | This will allow 63 | 64 | to: 65 |
66 |
70 |
85 |
86 |
71 |
84 | -
72 |
-
73 | 74 |81 |75 |77 |
76 |
78 | 79 |80 |
82 |
87 |
93 |
94 |
88 |
92 | 89 | Make sure you trust 90 |
91 |
95 |
122 |
96 |
120 |
121 |