oauth2UserService() {
27 | return new KickstartOAuth2UserService();
28 | }
29 | }
--------------------------------------------------------------------------------
/src/main/java/com/stewlutions/azuread_springsecurity5_oidc/kickstart/StubController.java:
--------------------------------------------------------------------------------
1 | package com.stewlutions.azuread_springsecurity5_oidc.kickstart;
2 |
3 | import java.text.MessageFormat;
4 |
5 | import org.springframework.web.bind.annotation.RequestMapping;
6 | import org.springframework.web.bind.annotation.RestController;
7 | import org.springframework.web.servlet.ModelAndView;
8 |
9 | import javax.servlet.http.HttpServletRequest;
10 |
11 | import com.microsoft.aad.adal4j.AuthenticationContext;
12 |
13 | import org.springframework.security.core.context.SecurityContextHolder;
14 | import org.springframework.ui.ModelMap;
15 | import org.springframework.web.bind.annotation.PathVariable;
16 |
17 | @RestController
18 | class StubController {
19 |
20 | @RequestMapping("/hello/{name}")
21 | String hello(@PathVariable String name) {
22 | return "Hello, " + name + "!";
23 | }
24 |
25 | @RequestMapping("/claims")
26 | String claims() {
27 | return "Data: " + SecurityContextHolder.getContext().getAuthentication().getPrincipal().toString();
28 | }
29 |
30 | @RequestMapping("/patient/{id}")
31 | ModelAndView patient(ModelMap model, HttpServletRequest request, @PathVariable String id) {
32 | model.addAttribute("attribute", "forwardWithForwardPrefix");
33 |
34 | String client_id = "";
35 | int state = (int )(Math.random() * 1000000 + 1);
36 | String resource = "client_id_guid_of_fhir";
37 | String base_uri = request.getRequestURL().toString();
38 | base_uri = base_uri.substring(0, base_uri.length() - request.getServletPath().length());
39 | String redirect_uri = base_uri + "/context/authorized";
40 |
41 | String redirect = String.format("https://login.microsoftonline.com/common/oauth2/authorize?client_id=%s&state=%s&resource=%s&redirect_uri=%s&response_type=code&response_mode=post", client_id, state, resource, redirect_uri);
42 | return new ModelAndView("redirect:" + redirect, model);
43 | }
44 | }
45 |
--------------------------------------------------------------------------------
/src/main/java/com/stewlutions/azuread_springsecurity5_oidc/kickstart/replacements/KickstartOAuth2UserService.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2002-2017 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package com.stewlutions.azuread_springsecurity5_oidc.kickstart.replacements;
17 |
18 | import org.springframework.core.ParameterizedTypeReference;
19 | import org.springframework.security.core.GrantedAuthority;
20 | import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
21 | import org.springframework.security.oauth2.core.OAuth2Error;
22 | import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
23 | import org.springframework.security.oauth2.core.user.OAuth2User;
24 | import org.springframework.security.oauth2.core.user.OAuth2UserAuthority;
25 | import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest;
26 | import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
27 | import org.springframework.util.Assert;
28 | import org.springframework.util.StringUtils;
29 |
30 | import java.util.HashSet;
31 | import java.util.Map;
32 | import java.util.Set;
33 |
34 | /**
35 | * An implementation of an {@link OAuth2UserService} that supports standard OAuth 2.0 Provider's.
36 | *
37 | * For standard OAuth 2.0 Provider's, the attribute name used to access the user's name
38 | * from the UserInfo response is required and therefore must be available via
39 | * {@link org.springframework.security.oauth2.client.registration.ClientRegistration.ProviderDetails.UserInfoEndpoint#getUserNameAttributeName() UserInfoEndpoint.getUserNameAttributeName()}.
40 | *
41 | * NOTE: Attribute names are not standardized between providers and therefore will vary.
42 | * Please consult the provider's API documentation for the set of supported user attribute names.
43 | *
44 | * @author Joe Grandja
45 | * @since 5.0
46 | * @see OAuth2UserService
47 | * @see OAuth2UserRequest
48 | * @see OAuth2User
49 | * @see DefaultOAuth2User
50 | */
51 | public class KickstartOAuth2UserService implements OAuth2UserService {
52 | private static final String MISSING_USER_INFO_URI_ERROR_CODE = "missing_user_info_uri";
53 | private static final String MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE = "missing_user_name_attribute";
54 | private KickstartUserInfoResponseClient userInfoResponseClient = new KickstartUserInfoResponseClient();
55 |
56 | @Override
57 | public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
58 | Assert.notNull(userRequest, "userRequest cannot be null");
59 |
60 | if (!StringUtils.hasText(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri())) {
61 | OAuth2Error oauth2Error = new OAuth2Error(
62 | MISSING_USER_INFO_URI_ERROR_CODE,
63 | "Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: " +
64 | userRequest.getClientRegistration().getRegistrationId(),
65 | null
66 | );
67 | throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
68 | }
69 | String userNameAttributeName = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName();
70 | if (!StringUtils.hasText(userNameAttributeName)) {
71 | OAuth2Error oauth2Error = new OAuth2Error(
72 | MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE,
73 | "Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: " +
74 | userRequest.getClientRegistration().getRegistrationId(),
75 | null
76 | );
77 | throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
78 | }
79 |
80 | ParameterizedTypeReference> typeReference =
81 | new ParameterizedTypeReference>() {};
82 | Map userAttributes = this.userInfoResponseClient.getUserInfoResponse(userRequest, typeReference);
83 | GrantedAuthority authority = new OAuth2UserAuthority(userAttributes);
84 | Set authorities = new HashSet<>();
85 | authorities.add(authority);
86 |
87 | return new DefaultOAuth2User(authorities, userAttributes, userNameAttributeName);
88 | }
89 | }
--------------------------------------------------------------------------------
/src/main/java/com/stewlutions/azuread_springsecurity5_oidc/kickstart/replacements/KickstartUserInfoResponseClient.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2002-2017 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package com.stewlutions.azuread_springsecurity5_oidc.kickstart.replacements;
17 |
18 | import com.nimbusds.oauth2.sdk.ErrorObject;
19 | import com.nimbusds.oauth2.sdk.ParseException;
20 | import com.nimbusds.oauth2.sdk.http.HTTPRequest;
21 | import com.nimbusds.oauth2.sdk.http.HTTPResponse;
22 | import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
23 | import com.nimbusds.openid.connect.sdk.UserInfoErrorResponse;
24 | import com.nimbusds.openid.connect.sdk.UserInfoRequest;
25 | import org.springframework.core.ParameterizedTypeReference;
26 | import org.springframework.http.HttpHeaders;
27 | import org.springframework.http.client.AbstractClientHttpResponse;
28 | import org.springframework.http.client.ClientHttpResponse;
29 | import org.springframework.http.converter.GenericHttpMessageConverter;
30 | import org.springframework.http.converter.HttpMessageNotReadableException;
31 | import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
32 | import org.springframework.security.authentication.AuthenticationServiceException;
33 | import org.springframework.security.oauth2.client.registration.ClientRegistration;
34 | import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest;
35 | import org.springframework.security.oauth2.core.OAuth2AccessToken;
36 | import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
37 | import org.springframework.security.oauth2.core.OAuth2Error;
38 | import org.springframework.util.Assert;
39 |
40 | import java.io.ByteArrayInputStream;
41 | import java.io.IOException;
42 | import java.io.InputStream;
43 | import java.net.URI;
44 | import java.nio.charset.Charset;
45 |
46 | /**
47 | * NOTE: This is a copy of org.springframework.security.oauth2.client.userinfo.NimbusUserInfoResponseClient
48 | *
49 | * @author Joe Grandja (modifications by Stewart Adam to fix Accept header)
50 | * @since 5.0
51 | */
52 | final class KickstartUserInfoResponseClient {
53 | private static final String INVALID_USER_INFO_RESPONSE_ERROR_CODE = "invalid_user_info_response";
54 | private final GenericHttpMessageConverter genericHttpMessageConverter = new MappingJackson2HttpMessageConverter();
55 |
56 | T getUserInfoResponse(OAuth2UserRequest userInfoRequest, Class returnType) throws OAuth2AuthenticationException {
57 | ClientHttpResponse userInfoResponse = this.getUserInfoResponse(
58 | userInfoRequest.getClientRegistration(), userInfoRequest.getAccessToken());
59 | try {
60 | return (T) this.genericHttpMessageConverter.read(returnType, userInfoResponse);
61 | } catch (IOException | HttpMessageNotReadableException ex) {
62 | OAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE,
63 | "An error occurred reading the UserInfo Success response: " + ex.getMessage(), null);
64 | throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);
65 | }
66 | }
67 |
68 | T getUserInfoResponse(OAuth2UserRequest userInfoRequest, ParameterizedTypeReference typeReference) throws OAuth2AuthenticationException {
69 | ClientHttpResponse userInfoResponse = this.getUserInfoResponse(
70 | userInfoRequest.getClientRegistration(), userInfoRequest.getAccessToken());
71 | try {
72 | return (T) this.genericHttpMessageConverter.read(typeReference.getType(), null, userInfoResponse);
73 | } catch (IOException | HttpMessageNotReadableException ex) {
74 | OAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE,
75 | "An error occurred reading the UserInfo Success response: " + ex.getMessage(), null);
76 | throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);
77 | }
78 | }
79 |
80 | private ClientHttpResponse getUserInfoResponse(ClientRegistration clientRegistration,
81 | OAuth2AccessToken oauth2AccessToken) throws OAuth2AuthenticationException {
82 | URI userInfoUri = URI.create(clientRegistration.getProviderDetails().getUserInfoEndpoint().getUri());
83 | BearerAccessToken accessToken = new BearerAccessToken(oauth2AccessToken.getTokenValue());
84 |
85 | UserInfoRequest userInfoRequest = new UserInfoRequest(userInfoUri, accessToken);
86 | HTTPRequest httpRequest = userInfoRequest.toHTTPRequest();
87 | httpRequest.setHeader("Accept", "application/json");
88 | httpRequest.setConnectTimeout(30000);
89 | httpRequest.setReadTimeout(30000);
90 | HTTPResponse httpResponse;
91 |
92 | try {
93 | httpResponse = httpRequest.send();
94 | } catch (IOException ex) {
95 | throw new AuthenticationServiceException("An error occurred while sending the UserInfo Request: " +
96 | ex.getMessage(), ex);
97 | }
98 |
99 | if (httpResponse.getStatusCode() == HTTPResponse.SC_OK) {
100 | return new NimbusClientHttpResponse(httpResponse);
101 | }
102 |
103 | UserInfoErrorResponse userInfoErrorResponse;
104 | try {
105 | userInfoErrorResponse = UserInfoErrorResponse.parse(httpResponse);
106 | } catch (ParseException ex) {
107 | OAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE,
108 | "An error occurred parsing the UserInfo Error response: " + ex.getMessage(), null);
109 | throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);
110 | }
111 | ErrorObject errorObject = userInfoErrorResponse.getErrorObject();
112 |
113 | StringBuilder errorDescription = new StringBuilder();
114 | errorDescription.append("An error occurred while attempting to access the UserInfo Endpoint -> ");
115 | errorDescription.append("Error details: [");
116 | errorDescription.append("UserInfo Uri: ").append(userInfoUri.toString());
117 | errorDescription.append(", Http Status: ").append(errorObject.getHTTPStatusCode());
118 | if (errorObject.getCode() != null) {
119 | errorDescription.append(", Error Code: ").append(errorObject.getCode());
120 | }
121 | if (errorObject.getDescription() != null) {
122 | errorDescription.append(", Error Description: ").append(errorObject.getDescription());
123 | }
124 | errorDescription.append("]");
125 |
126 | OAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE, errorDescription.toString(), null);
127 | throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
128 | }
129 |
130 | private static class NimbusClientHttpResponse extends AbstractClientHttpResponse {
131 | private final HTTPResponse httpResponse;
132 | private final HttpHeaders headers;
133 |
134 | private NimbusClientHttpResponse(HTTPResponse httpResponse) {
135 | Assert.notNull(httpResponse, "httpResponse cannot be null");
136 | this.httpResponse = httpResponse;
137 | this.headers = new HttpHeaders();
138 | this.headers.setAll(httpResponse.getHeaders());
139 | }
140 |
141 | @Override
142 | public int getRawStatusCode() throws IOException {
143 | return this.httpResponse.getStatusCode();
144 | }
145 |
146 | @Override
147 | public String getStatusText() throws IOException {
148 | return String.valueOf(this.getRawStatusCode());
149 | }
150 |
151 | @Override
152 | public void close() {
153 | }
154 |
155 | @Override
156 | public InputStream getBody() throws IOException {
157 | InputStream inputStream = new ByteArrayInputStream(
158 | this.httpResponse.getContent().getBytes(Charset.forName("UTF-8")));
159 | return inputStream;
160 | }
161 |
162 | @Override
163 | public HttpHeaders getHeaders() {
164 | return this.headers;
165 | }
166 | }
167 | }
--------------------------------------------------------------------------------
/src/main/resources/application.yaml:
--------------------------------------------------------------------------------
1 | spring:
2 | security:
3 | oauth2:
4 | client:
5 | registration:
6 | microsoft:
7 | client-id: aad-app-clientId-guid
8 | client-secret: aad-app-clientSecret-key
9 | authorization-grant-type: authorization_code
10 | redirect-uri-template: '{baseUrl}/login/oauth2/code/{registrationId}'
11 | scope: User.Read
12 | client-name: Microsoft
13 | client-alias: microsoft
14 | provider:
15 | microsoft:
16 | authorization-uri: https://login.microsoftonline.com/common/oauth2/authorize?resource=https://graph.microsoft.com/
17 | token-uri: https://login.microsoftonline.com/common/oauth2/token
18 | user-info-uri: https://graph.microsoft.com/v1.0/me
19 | user-name-attribute: id
20 | jwk-set-uri: https://login.microsoftonline.com/common/discovery/keys
--------------------------------------------------------------------------------
/src/test/java/com/stewlutions/azuread_springsecurity5_oidc/kickstart/KickstartApplicationTests.java:
--------------------------------------------------------------------------------
1 | package com.stewlutions.azuread_springsecurity5_oidc.kickstart;
2 |
3 | import org.junit.Test;
4 | import org.junit.runner.RunWith;
5 | import org.springframework.boot.test.context.SpringBootTest;
6 | import org.springframework.test.context.junit4.SpringRunner;
7 |
8 | @RunWith(SpringRunner.class)
9 | @SpringBootTest
10 | public class KickstartApplicationTests {
11 |
12 | @Test
13 | public void contextLoads() {
14 | }
15 |
16 | }
17 |
--------------------------------------------------------------------------------
/target/classes/application.yaml:
--------------------------------------------------------------------------------
1 | spring:
2 | security:
3 | oauth2:
4 | client:
5 | registration:
6 | microsoft:
7 | client-id: d2a196a1-2148-4500-9497-ca51107037da
8 | client-secret: 0tuLaOxwj0e5xGGdxp6418gSG9riHDL5FD5IqnzHs4w=
9 | authorization-grant-type: authorization_code
10 | redirect-uri-template: '{baseUrl}/login/oauth2/code/{registrationId}'
11 | scope: User.Read
12 | client-name: Microsoft
13 | client-alias: microsoft
14 | provider:
15 | microsoft:
16 | authorization-uri: https://login.microsoftonline.com/common/oauth2/authorize?resource=https://graph.microsoft.com/
17 | token-uri: https://login.microsoftonline.com/common/oauth2/token
18 | user-info-uri: https://graph.microsoft.com/v1.0/me
19 | user-name-attribute: id
20 | jwk-set-uri: https://login.microsoftonline.com/common/discovery/keys
--------------------------------------------------------------------------------