Spring Boot Security: OAuth 2.0 and OpenID Connect

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/application/OAuth2SecurityApplicationService.java

@@ -0,0 +1,24 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.application;
+
+import org.springframework.stereotype.Service;
+import tech.jhipster.lite.generator.project.domain.Project;
+import tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain.OAuth2Provider;
+import tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain.OAuth2SecurityService;
+
+@Service
+public class OAuth2SecurityApplicationService {
+
+  private final OAuth2SecurityService oauth2SecurityService;
+
+  public OAuth2SecurityApplicationService(OAuth2SecurityService oauth2SecurityService) {
+    this.oauth2SecurityService = oauth2SecurityService;
+  }
+
+  public void addDefault(Project project, OAuth2Provider provider, String issuerUri) {
+    oauth2SecurityService.addDefault(project, provider, issuerUri);
+  }
+
+  public void addClient(Project project, OAuth2Provider provider, String issuerUri) {
+    oauth2SecurityService.addClient(project, provider, issuerUri);
+  }
+}

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/domain/OAuth2Provider.java

@@ -0,0 +1,45 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain;
+
+/**
+ * Spring Security public built-in providers are automatically configured.
+ * - Google
+ * - Facebook
+ * - GitHub
+ * <p>
+ * Custom providers require an issuer URI but a default is provided.
+ */
+public enum OAuth2Provider {
+  GOOGLE(true, false),
+  FACEBOOK(true, false),
+  GITHUB(true, false),
+  OKTA(true, true, "https://your-okta-domain/oauth2/default"),
+  KEYCLOAK(false, true, "http://localhost:9080/auth/realms/jhipster"),
+  AUTH0(false, true, "https://your-auth0-domain/"),
+  OTHER(false, true, "https://your-issuer-uri");
+
+  private final boolean builtIn;
+  private final boolean custom;
+  private final String defaultIssuerUri;
+
+  OAuth2Provider(boolean builtIn, boolean custom) {
+    this(builtIn, custom, null);
+  }
+
+  OAuth2Provider(boolean builtIn, boolean custom, String defaultIssuerUri) {
+    this.builtIn = builtIn;
+    this.custom = custom;
+    this.defaultIssuerUri = defaultIssuerUri;
+  }
+
+  public boolean isBuiltIn() {
+    return builtIn;
+  }
+
+  public boolean isCustom() {
+    return custom;
+  }
+
+  public String getDefaultIssuerUri() {
+    return defaultIssuerUri;
+  }
+}

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/domain/OAuth2Security.java

@@ -0,0 +1,43 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain;
+
+import tech.jhipster.lite.generator.buildtool.generic.domain.Dependency;
+
+public class OAuth2Security {
+
+  public static final OAuth2Provider DEFAULT_PROVIDER = OAuth2Provider.KEYCLOAK;
+
+  private static final String DOCKER_KEYCLOAK_IMAGE = "jboss/keycloak";
+  private static final String DOCKER_KEYCLOAK_VERSION = "16.1.0";
+
+  private static final String SPRINGBOOT_PACKAGE = "org.springframework.boot";
+
+  private static final String STARTER_SECURITY = "spring-boot-starter-security";
+  private static final String STARTER_OAUTH2_CLIENT = "spring-boot-starter-oauth2-client";
+  private static final String STARTER_OAUTH2_RESOURCE_SERVER = "spring-boot-starter-oauth2-resource-server";
+
+  private OAuth2Security() {}
+
+  public static String getDockerKeycloakImage() {
+    return DOCKER_KEYCLOAK_IMAGE + ":" + DOCKER_KEYCLOAK_VERSION;
+  }
+
+  public static String getDockerKeycloakVersion() {
+    return DOCKER_KEYCLOAK_VERSION;
+  }
+
+  public static Dependency springBootStarterSecurityDependency() {
+    return Dependency.builder().groupId(SPRINGBOOT_PACKAGE).artifactId(STARTER_SECURITY).build();
+  }
+
+  public static Dependency springSecurityTestDependency() {
+    return Dependency.builder().groupId("org.springframework.security").artifactId("spring-security-test").scope("test").build();
+  }
+
+  public static Dependency springBootStarterOAuth2ClientDependency() {
+    return Dependency.builder().groupId(SPRINGBOOT_PACKAGE).artifactId(STARTER_OAUTH2_CLIENT).build();
+  }
+
+  public static Dependency springBootStarterOAuth2ResourceServerDependency() {
+    return Dependency.builder().groupId(SPRINGBOOT_PACKAGE).artifactId(STARTER_OAUTH2_RESOURCE_SERVER).build();
+  }
+}

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/domain/OAuth2SecurityDomainService.java

@@ -0,0 +1,147 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain;
+
+import static tech.jhipster.lite.common.domain.FileUtils.getPath;
+import static tech.jhipster.lite.generator.project.domain.Constants.TEST_JAVA;
+import static tech.jhipster.lite.generator.project.domain.DefaultConfig.PACKAGE_PATH;
+import static tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain.OAuth2Security.*;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Optional;
+import tech.jhipster.lite.generator.buildtool.generic.domain.BuildToolService;
+import tech.jhipster.lite.generator.project.domain.Project;
+import tech.jhipster.lite.generator.project.domain.ProjectRepository;
+import tech.jhipster.lite.generator.server.springboot.common.domain.SpringBootCommonService;
+
+public class OAuth2SecurityDomainService implements OAuth2SecurityService {
+
+  public static final String SOURCE = "server/springboot/mvc/security/oauth2";
+
+  private final ProjectRepository projectRepository;
+  private final BuildToolService buildToolService;
+  private final SpringBootCommonService springBootCommonService;
+
+  public OAuth2SecurityDomainService(
+    ProjectRepository projectRepository,
+    BuildToolService buildToolService,
+    SpringBootCommonService springBootCommonService
+  ) {
+    this.projectRepository = projectRepository;
+    this.buildToolService = buildToolService;
+    this.springBootCommonService = springBootCommonService;
+  }
+
+  @Override
+  public void addClient(Project project, OAuth2Provider provider, String issuerUri) {
+    addCommons(project, provider, issuerUri);
+  }
+
+  @Override
+  public void addDefault(Project project, OAuth2Provider provider, String issuerUri) {
+    addCommons(project, provider, issuerUri);
+    addResourceServerJwt(project);
+    // TODO default security configuration
+  }
+
+  @Override
+  public void addResourceServerJwt(Project project) {
+    addOAuth2ResourceServerDependency(project);
+    // TODO JWT
+  }
+
+  @Override
+  public void addKeycloakDocker(Project project) {
+    project.addConfig("dockerKeycloakImage", getDockerKeycloakImage());
+    project.addConfig("dockerKeycloakVersion", getDockerKeycloakVersion());
+    projectRepository.template(project, getPath(SOURCE, "src"), "keycloak.yml", "src/main/docker", "keycloak.yml");
+    projectRepository.template(
+      project,
+      getPath(SOURCE, "src"),
+      "jhipster-realm.json.mustache",
+      "src/main/docker/keycloak-realm-config",
+      "jhipster-realm.json"
+    );
+    projectRepository.template(
+      project,
+      getPath(SOURCE, "src"),
+      "jhipster-users-0.json.mustache",
+      "src/main/docker/keycloak-realm-config",
+      "jhipster-users-0.json"
+    );
+  }
+
+  private void addCommons(Project project, OAuth2Provider provider, String issuerUri) {
+    addOAuth2ClientDependencies(project);
+    OAuth2Provider providerFallback = fallbackToDefault(provider);
+    addOAuth2ClientProperties(project, providerFallback, issuerUri);
+    updateExceptionTranslator(project);
+    if (providerFallback == OAuth2Provider.KEYCLOAK) {
+      addKeycloakDocker(project);
+    }
+  }
+
+  private OAuth2Provider fallbackToDefault(OAuth2Provider provider) {
+    return Optional.ofNullable(provider).orElse(DEFAULT_PROVIDER);
+  }
+
+  private void addOAuth2ClientDependencies(Project project) {
+    buildToolService.addDependency(project, springBootStarterSecurityDependency());
+    buildToolService.addDependency(project, springBootStarterOAuth2ClientDependency());
+    // test
+    buildToolService.addDependency(project, springSecurityTestDependency());
+  }
+
+  private void addOAuth2ResourceServerDependency(Project project) {
+    buildToolService.addDependency(project, springBootStarterOAuth2ResourceServerDependency());
+  }
+
+  private void addOAuth2ClientProperties(Project project, OAuth2Provider provider, String issuerUri) {
+    oauth2ClientProperties(provider, issuerUri)
+      .forEach((k, v) -> {
+        springBootCommonService.addProperties(project, k, v);
+        springBootCommonService.addPropertiesTest(project, k, v);
+      });
+  }
+
+  private Map<String, Object> oauth2ClientProperties(OAuth2Provider provider, String issuerUri) {
+    Map<String, Object> result = new LinkedHashMap<>();
+
+    String providerId = provider.name().toLowerCase();
+
+    if (provider.isCustom()) {
+      String issuerUriFallback = Optional.ofNullable(issuerUri).orElse(provider.getDefaultIssuerUri());
+      result.put("spring.security.oauth2.client.provider." + providerId + ".issuer-uri", issuerUriFallback);
+    }
+    if (!provider.isBuiltIn()) {
+      result.put("spring.security.oauth2.client.registration." + providerId + ".client-name", providerId);
+    }
+    result.put("spring.security.oauth2.client.registration." + providerId + ".client-id", "web_app");
+    result.put("spring.security.oauth2.client.registration." + providerId + ".client-secret", "web_app");
+    result.put("spring.security.oauth2.client.registration." + providerId + ".scope", "openid,profile,email");
+
+    return result;
+  }
+
+  private void updateExceptionTranslator(Project project) {
+    String packageNamePath = project.getPackageNamePath().orElse(getPath(PACKAGE_PATH));
+    String exceptionPath = getPath(TEST_JAVA, packageNamePath, "technical/infrastructure/primary/exception");
+
+    // TODO test CSRF
+
+    // import @WithMockUser
+    String oldImport = "import org.springframework.test.util.ReflectionTestUtils;";
+    String newImport =
+      """
+
+      import org.springframework.security.test.context.support.WithMockUser;
+      import org.springframework.test.util.ReflectionTestUtils;""";
+    projectRepository.replaceText(project, exceptionPath, "ExceptionTranslatorIT.java", oldImport, newImport);
+
+    // add annotations
+    String oldAnnotation = "@AutoConfigureMockMvc";
+    String newAnnotation = """
+      @AutoConfigureMockMvc
+      @WithMockUser""";
+    projectRepository.replaceText(project, exceptionPath, "ExceptionTranslatorIT.java", oldAnnotation, newAnnotation);
+  }
+}

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/domain/OAuth2SecurityService.java

@@ -0,0 +1,10 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain;
+
+import tech.jhipster.lite.generator.project.domain.Project;
+
+public interface OAuth2SecurityService {
+  void addClient(Project project, OAuth2Provider provider, String issuerUri);
+  void addDefault(Project project, OAuth2Provider provider, String issuerUri);
+  void addResourceServerJwt(Project project);
+  void addKeycloakDocker(Project project);
+}

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/infrastructure/config/OAuth2SecurityBeanConfiguration.java

@@ -0,0 +1,32 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.infrastructure.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import tech.jhipster.lite.generator.buildtool.generic.domain.BuildToolService;
+import tech.jhipster.lite.generator.project.domain.ProjectRepository;
+import tech.jhipster.lite.generator.server.springboot.common.domain.SpringBootCommonService;
+import tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain.OAuth2SecurityDomainService;
+import tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain.OAuth2SecurityService;
+
+@Configuration
+public class OAuth2SecurityBeanConfiguration {
+
+  private final ProjectRepository projectRepository;
+  private final BuildToolService buildToolService;
+  private final SpringBootCommonService springBootCommonService;
+
+  public OAuth2SecurityBeanConfiguration(
+    ProjectRepository projectRepository,
+    BuildToolService buildToolService,
+    SpringBootCommonService springBootCommonService
+  ) {
+    this.projectRepository = projectRepository;
+    this.buildToolService = buildToolService;
+    this.springBootCommonService = springBootCommonService;
+  }
+
+  @Bean
+  public OAuth2SecurityService oauth2SecurityService() {
+    return new OAuth2SecurityDomainService(projectRepository, buildToolService, springBootCommonService);
+  }
+}

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/infrastructure/primary/dto/OAuth2ClientDTO.java

@@ -0,0 +1,36 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.infrastructure.primary.dto;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+import tech.jhipster.lite.generator.project.infrastructure.primary.dto.ProjectDTO;
+import tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.domain.OAuth2Provider;
+
+@Schema(description = "OAuth2 Client DTO")
+public class OAuth2ClientDTO extends ProjectDTO {
+
+  @JsonProperty(value = "provider", defaultValue = "KEYCLOAK")
+  @Schema(description = "OAuth2-OIDC provider", nullable = true, defaultValue = "KEYCLOAK")
+  private OAuth2Provider provider;
+
+  @JsonProperty("issuerUri")
+  @Schema(description = "your custom issuer URI for KEYCLOAK, OKTA, AUTH0 or OTHER", nullable = true)
+  private String issuerUri;
+
+  public OAuth2Provider getProvider() {
+    return provider;
+  }
+
+  public OAuth2ClientDTO provider(OAuth2Provider provider) {
+    this.provider = provider;
+    return this;
+  }
+
+  public String getIssuerUri() {
+    return issuerUri;
+  }
+
+  public OAuth2ClientDTO issuerUri(String issuerUri) {
+    this.issuerUri = issuerUri;
+    return this;
+  }
+}

src/main/java/tech/jhipster/lite/generator/server/springboot/mvc/security/oauth2/infrastructure/rest/OAuth2SecurityResource.java

@@ -0,0 +1,41 @@
+package tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.infrastructure.rest;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import tech.jhipster.lite.generator.project.domain.Project;
+import tech.jhipster.lite.generator.project.infrastructure.primary.dto.ProjectDTO;
+import tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.application.OAuth2SecurityApplicationService;
+import tech.jhipster.lite.generator.server.springboot.mvc.security.oauth2.infrastructure.primary.dto.OAuth2ClientDTO;
+
+@RestController
+@RequestMapping("/api/servers/spring-boot/mvc/security")
+@Tag(name = "Spring Boot - Security")
+class OAuth2SecurityResource {
+
+  private final OAuth2SecurityApplicationService oauth2SecurityApplicationService;
+
+  public OAuth2SecurityResource(OAuth2SecurityApplicationService oauth2SecurityApplicationService) {
+    this.oauth2SecurityApplicationService = oauth2SecurityApplicationService;
+  }
+
+  @Operation(summary = "Add a Spring Security OAuth2-OIDC Client")
+  @ApiResponse(responseCode = "500", description = "An error occurred while adding a Spring Security OAuth2-OIDC Client")
+  @PostMapping("/oauth2/add-client")
+  public void addClient(@RequestBody OAuth2ClientDTO oAuth2ClientDTO) {
+    Project project = ProjectDTO.toProject(oAuth2ClientDTO);
+    oauth2SecurityApplicationService.addClient(project, oAuth2ClientDTO.getProvider(), oAuth2ClientDTO.getIssuerUri());
+  }
+
+  @Operation(summary = "Add Spring Security default login with OAuth2")
+  @ApiResponse(responseCode = "500", description = "An error occurred while adding Spring Security default login with OAuth2")
+  @PostMapping("/oauth2/default")
+  public void addDefault(@RequestBody OAuth2ClientDTO oAuth2ClientDTO) {
+    Project project = ProjectDTO.toProject(oAuth2ClientDTO);
+    oauth2SecurityApplicationService.addDefault(project, oAuth2ClientDTO.getProvider(), oAuth2ClientDTO.getIssuerUri());
+  }
+}