Spring Security Resource Server

Spring boot security - Learning project for Resource server Authentication and Authorization - using OAuth Resource Server starter project.

These are learnings from pluralsight https://github.com/jzheaux/resolutions from Jos Cumings,

• Spring Security has own classes for UserDetails , in order to overwrite/custom implement it by implmenting UserDetailsService interface.
• JDBCUserDetailsManager is available to provide own implementation for loading authorities and UserDetails values from Database.
• Using WebSecurityConfigurerAdapter and adding ANT/MVC matchers to excersie authorities control.
  

JWT Token - Authentication + Authorisation using Spring Security OAuth2 Resource Server

• Dependencies needed for

    <dependency>
    		<groupId>org.springframework.boot</groupId>
    		<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
    	</dependency>
    	<dependency>
    		<groupId>org.springframework.security</groupId>
    		<artifactId>spring-security-oauth2-jose</artifactId>
    	</dependency>
  

• No other annotations needed other than this to enable resource server ,except to enable global pre post authorize only

@EnableGlobalMethodSecurity(prePostEnabled = true)

• Keycloak starting , understanding and setting it up took considerable amount of time
• Realm creation
• roles can be placed at two levels - realm level and client level.
• Relam level is good one , as irrespective of client id , user will get roles information . If we create at client level its specific to that client id .
  Think scenario like we are using two different client ids for same application for two entry points like mobile and desktop. :- (
• Client Creation
• Enabling client secret by having access type to confidential and enabling of various OAuth flows.
• Roles created will come in complex object, we can map it to custom simple/array object by using client level mappers.
• Postman - latest postman OAuthorisation code grant enabled - settings
• Complex object - simple custom object mapping -
• Spring Security provides converters to provide custom implementation of roles and authority by overriding defaults provided by JwtAuthenticationConverter , JwtGrantedAuthoritiesConverter

@SpringBootApplication
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceserverApplication extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.authorizeRequests(a -> a.anyRequest().authenticated()).oauth2ResourceServer(
				o -> o.jwt(j -> j.jwtAuthenticationConverter(jwtAuthenticationConverter()))
		);
	}

	public static void main(String[] args) {
		SpringApplication.run(ResourceserverApplication.class, args);
	}

	private JwtAuthenticationConverter jwtAuthenticationConverter(){
		JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
		JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
		jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("user-roles");
		jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
		return jwtAuthenticationConverter;
	}

}