From 041649fbd5c34423880594c2169f2ad4ffd47ad0 Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Thu, 27 Apr 2023 15:59:45 -0400 Subject: [PATCH] Merge federated-identity-authorizationserver into featured-authorizationserver Issue gh-1189 --- ...amples-featured-authorizationserver.gradle | 4 + .../config/AuthorizationServerConfig.java | 13 +- .../sample/config/DefaultSecurityConfig.java | 14 +- ...ratedIdentityAuthenticationEntryPoint.java | 4 +- ...dIdentityAuthenticationSuccessHandler.java | 4 +- .../security/FederatedIdentityConfigurer.java | 4 +- .../FederatedIdentityIdTokenCustomizer.java | 4 +- .../UserRepositoryOAuth2UserHandler.java | 4 +- .../main/java/sample/web/LoginController.java | 4 +- .../src/main/resources/application.yml | 23 +++ .../src/main/resources/templates/login.html | 0 .../gradle.properties | 1 - ...erated-identity-authorizationserver.gradle | 27 ---- ...dentityAuthorizationServerApplication.java | 32 ---- .../config/AuthorizationServerConfig.java | 150 ------------------ .../sample/config/DefaultSecurityConfig.java | 82 ---------- .../src/main/java/sample/jose/Jwks.java | 74 --------- .../java/sample/jose/KeyGeneratorUtils.java | 85 ---------- .../src/main/resources/application.yml | 33 ---- 19 files changed, 63 insertions(+), 499 deletions(-) rename samples/{federated-identity-authorizationserver => featured-authorizationserver}/src/main/java/sample/security/FederatedIdentityAuthenticationEntryPoint.java (97%) rename samples/{federated-identity-authorizationserver => featured-authorizationserver}/src/main/java/sample/security/FederatedIdentityAuthenticationSuccessHandler.java (97%) rename samples/{federated-identity-authorizationserver => featured-authorizationserver}/src/main/java/sample/security/FederatedIdentityConfigurer.java (98%) rename samples/{federated-identity-authorizationserver => featured-authorizationserver}/src/main/java/sample/security/FederatedIdentityIdTokenCustomizer.java (97%) rename samples/{federated-identity-authorizationserver => featured-authorizationserver}/src/main/java/sample/security/UserRepositoryOAuth2UserHandler.java (96%) rename samples/{federated-identity-authorizationserver => featured-authorizationserver}/src/main/java/sample/web/LoginController.java (92%) rename samples/{federated-identity-authorizationserver => featured-authorizationserver}/src/main/resources/templates/login.html (100%) delete mode 100644 samples/federated-identity-authorizationserver/gradle.properties delete mode 100644 samples/federated-identity-authorizationserver/samples-federated-identity-authorizationserver.gradle delete mode 100644 samples/federated-identity-authorizationserver/src/main/java/sample/FederatedIdentityAuthorizationServerApplication.java delete mode 100644 samples/federated-identity-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java delete mode 100644 samples/federated-identity-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java delete mode 100644 samples/federated-identity-authorizationserver/src/main/java/sample/jose/Jwks.java delete mode 100644 samples/federated-identity-authorizationserver/src/main/java/sample/jose/KeyGeneratorUtils.java delete mode 100644 samples/federated-identity-authorizationserver/src/main/resources/application.yml diff --git a/samples/featured-authorizationserver/samples-featured-authorizationserver.gradle b/samples/featured-authorizationserver/samples-featured-authorizationserver.gradle index 08f4a7208..f761b82e8 100644 --- a/samples/featured-authorizationserver/samples-featured-authorizationserver.gradle +++ b/samples/featured-authorizationserver/samples-featured-authorizationserver.gradle @@ -17,8 +17,12 @@ dependencies { implementation "org.springframework.boot:spring-boot-starter-web" implementation "org.springframework.boot:spring-boot-starter-thymeleaf" implementation "org.springframework.boot:spring-boot-starter-security" + implementation "org.springframework.boot:spring-boot-starter-oauth2-client" implementation "org.springframework.boot:spring-boot-starter-jdbc" implementation project(":spring-security-oauth2-authorization-server") + implementation "org.webjars:webjars-locator-core" + implementation "org.webjars:bootstrap:3.4.1" + implementation "org.webjars:jquery:3.4.1" runtimeOnly "com.h2database:h2" testImplementation "org.springframework.boot:spring-boot-starter-test" diff --git a/samples/featured-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java b/samples/featured-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java index f06656796..0e9918442 100644 --- a/samples/featured-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java +++ b/samples/featured-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java @@ -22,6 +22,8 @@ import com.nimbusds.jose.jwk.source.JWKSource; import com.nimbusds.jose.proc.SecurityContext; import sample.jose.Jwks; +import sample.security.FederatedIdentityConfigurer; +import sample.security.FederatedIdentityIdTokenCustomizer; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @@ -48,12 +50,15 @@ import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer; import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings; import org.springframework.security.oauth2.server.authorization.settings.ClientSettings; +import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext; +import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; /** * @author Joe Grandja * @author Daniel Garnier-Moiroux + * @author Steve Riesenberg * @since 1.1.0 */ @Configuration(proxyBeanMethods = false) @@ -75,7 +80,8 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h exceptions.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login")) ) .oauth2ResourceServer(oauth2ResourceServer -> - oauth2ResourceServer.jwt(Customizer.withDefaults())); + oauth2ResourceServer.jwt(Customizer.withDefaults())) + .apply(new FederatedIdentityConfigurer()); // @formatter:on return http.build(); } @@ -121,6 +127,11 @@ public OAuth2AuthorizationConsentService authorizationConsentService(JdbcTemplat return new JdbcOAuth2AuthorizationConsentService(jdbcTemplate, registeredClientRepository); } + @Bean + public OAuth2TokenCustomizer idTokenCustomizer() { + return new FederatedIdentityIdTokenCustomizer(); + } + @Bean public JWKSource jwkSource() { RSAKey rsaKey = Jwks.generateRsa(); diff --git a/samples/featured-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java b/samples/featured-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java index df0c80676..03f179d56 100644 --- a/samples/featured-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java +++ b/samples/featured-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java @@ -15,6 +15,9 @@ */ package sample.config; +import sample.security.FederatedIdentityConfigurer; +import sample.security.UserRepositoryOAuth2UserHandler; + import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; @@ -32,6 +35,7 @@ /** * @author Joe Grandja + * @author Steve Riesenberg * @since 1.1.0 */ @EnableWebSecurity @@ -41,11 +45,17 @@ public class DefaultSecurityConfig { // @formatter:off @Bean public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { + FederatedIdentityConfigurer federatedIdentityConfigurer = new FederatedIdentityConfigurer() + .oauth2UserHandler(new UserRepositoryOAuth2UserHandler()); + http .authorizeHttpRequests(authorize -> - authorize.anyRequest().authenticated() + authorize + .requestMatchers("/assets/**", "/webjars/**", "/login").permitAll() + .anyRequest().authenticated() ) - .formLogin(withDefaults()); + .formLogin(withDefaults()) + .apply(federatedIdentityConfigurer); return http.build(); } // @formatter:on diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationEntryPoint.java b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationEntryPoint.java similarity index 97% rename from samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationEntryPoint.java rename to samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationEntryPoint.java index b77e100b2..ee12a96e5 100644 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationEntryPoint.java +++ b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationEntryPoint.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 the original author or authors. + * Copyright 2020-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -38,7 +38,7 @@ * {@code registrationId} of the desired {@link ClientRegistration}. * * @author Steve Riesenberg - * @since 0.2.3 + * @since 1.1.0 */ public final class FederatedIdentityAuthenticationEntryPoint implements AuthenticationEntryPoint { diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationSuccessHandler.java b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationSuccessHandler.java similarity index 97% rename from samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationSuccessHandler.java rename to samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationSuccessHandler.java index 13e7979f3..a68b6bead 100644 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationSuccessHandler.java +++ b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityAuthenticationSuccessHandler.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 the original author or authors. + * Copyright 2020-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -34,7 +34,7 @@ * {@link OAuth2User} for Federated Account Linking or JIT Account Provisioning. * * @author Steve Riesenberg - * @since 0.2.3 + * @since 1.1.0 */ public final class FederatedIdentityAuthenticationSuccessHandler implements AuthenticationSuccessHandler { diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityConfigurer.java b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityConfigurer.java similarity index 98% rename from samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityConfigurer.java rename to samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityConfigurer.java index 6cf39a2e6..8232e9ff2 100644 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityConfigurer.java +++ b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityConfigurer.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 the original author or authors. + * Copyright 2020-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -29,7 +29,7 @@ * A configurer for setting up Federated Identity Management. * * @author Steve Riesenberg - * @since 0.2.3 + * @since 1.1.0 */ public final class FederatedIdentityConfigurer extends AbstractHttpConfigurer { diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityIdTokenCustomizer.java b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityIdTokenCustomizer.java similarity index 97% rename from samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityIdTokenCustomizer.java rename to samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityIdTokenCustomizer.java index 201f884fb..eddfce830 100644 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/security/FederatedIdentityIdTokenCustomizer.java +++ b/samples/featured-authorizationserver/src/main/java/sample/security/FederatedIdentityIdTokenCustomizer.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 the original author or authors. + * Copyright 2020-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -36,7 +36,7 @@ * the {@code id_token} produced by this authorization server. * * @author Steve Riesenberg - * @since 0.2.3 + * @since 1.1.0 */ public final class FederatedIdentityIdTokenCustomizer implements OAuth2TokenCustomizer { diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/security/UserRepositoryOAuth2UserHandler.java b/samples/featured-authorizationserver/src/main/java/sample/security/UserRepositoryOAuth2UserHandler.java similarity index 96% rename from samples/federated-identity-authorizationserver/src/main/java/sample/security/UserRepositoryOAuth2UserHandler.java rename to samples/featured-authorizationserver/src/main/java/sample/security/UserRepositoryOAuth2UserHandler.java index b7094681a..bf65977b8 100644 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/security/UserRepositoryOAuth2UserHandler.java +++ b/samples/featured-authorizationserver/src/main/java/sample/security/UserRepositoryOAuth2UserHandler.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 the original author or authors. + * Copyright 2020-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,7 +25,7 @@ * Example {@link Consumer} to perform JIT provisioning of an {@link OAuth2User}. * * @author Steve Riesenberg - * @since 0.2.3 + * @since 1.1.0 */ public final class UserRepositoryOAuth2UserHandler implements Consumer { diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/web/LoginController.java b/samples/featured-authorizationserver/src/main/java/sample/web/LoginController.java similarity index 92% rename from samples/federated-identity-authorizationserver/src/main/java/sample/web/LoginController.java rename to samples/featured-authorizationserver/src/main/java/sample/web/LoginController.java index 3de4f669c..fb0d4fbdd 100644 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/web/LoginController.java +++ b/samples/featured-authorizationserver/src/main/java/sample/web/LoginController.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 the original author or authors. + * Copyright 2020-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -20,7 +20,7 @@ /** * @author Steve Riesenberg - * @since 0.2.3 + * @since 1.1.0 */ @Controller public class LoginController { diff --git a/samples/featured-authorizationserver/src/main/resources/application.yml b/samples/featured-authorizationserver/src/main/resources/application.yml index ac3606472..78f30d9d8 100644 --- a/samples/featured-authorizationserver/src/main/resources/application.yml +++ b/samples/featured-authorizationserver/src/main/resources/application.yml @@ -1,6 +1,29 @@ server: port: 9000 +spring: + security: + oauth2: + client: + registration: + google-idp: + provider: google + client-id: ${GOOGLE_CLIENT_ID:google-client-id} + client-secret: ${GOOGLE_CLIENT_SECRET:google-client-secret} + scope: openid, https://www.googleapis.com/auth/userinfo.profile, https://www.googleapis.com/auth/userinfo.email + client-name: Sign in with Google + github-idp: + provider: github + client-id: ${GITHUB_CLIENT_ID:github-client-id} + client-secret: ${GITHUB_CLIENT_SECRET:github-client-secret} + scope: user:email, read:user + client-name: Sign in with GitHub + provider: + google: + user-name-attribute: email + github: + user-name-attribute: login + logging: level: root: INFO diff --git a/samples/federated-identity-authorizationserver/src/main/resources/templates/login.html b/samples/featured-authorizationserver/src/main/resources/templates/login.html similarity index 100% rename from samples/federated-identity-authorizationserver/src/main/resources/templates/login.html rename to samples/featured-authorizationserver/src/main/resources/templates/login.html diff --git a/samples/federated-identity-authorizationserver/gradle.properties b/samples/federated-identity-authorizationserver/gradle.properties deleted file mode 100644 index 3d071be66..000000000 --- a/samples/federated-identity-authorizationserver/gradle.properties +++ /dev/null @@ -1 +0,0 @@ -spring-security.version=6.1.0-RC1 diff --git a/samples/federated-identity-authorizationserver/samples-federated-identity-authorizationserver.gradle b/samples/federated-identity-authorizationserver/samples-federated-identity-authorizationserver.gradle deleted file mode 100644 index 7042fa45b..000000000 --- a/samples/federated-identity-authorizationserver/samples-federated-identity-authorizationserver.gradle +++ /dev/null @@ -1,27 +0,0 @@ -plugins { - id "org.springframework.boot" version "3.0.0" - id "io.spring.dependency-management" version "1.0.11.RELEASE" - id "java" -} - -group = project.rootProject.group -version = project.rootProject.version -sourceCompatibility = "17" - -repositories { - mavenCentral() - maven { url "https://repo.spring.io/milestone" } -} - -dependencies { - implementation "org.springframework.boot:spring-boot-starter-web" - implementation "org.springframework.boot:spring-boot-starter-security" - implementation "org.springframework.boot:spring-boot-starter-oauth2-client" - implementation "org.springframework.boot:spring-boot-starter-thymeleaf" - implementation "org.springframework.boot:spring-boot-starter-jdbc" - implementation "org.webjars:webjars-locator-core" - implementation "org.webjars:bootstrap:3.4.1" - implementation "org.webjars:jquery:3.4.1" - implementation project(":spring-security-oauth2-authorization-server") - runtimeOnly "com.h2database:h2" -} diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/FederatedIdentityAuthorizationServerApplication.java b/samples/federated-identity-authorizationserver/src/main/java/sample/FederatedIdentityAuthorizationServerApplication.java deleted file mode 100644 index 4a6b99e4b..000000000 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/FederatedIdentityAuthorizationServerApplication.java +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Copyright 2020-2022 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package sample; - -import org.springframework.boot.SpringApplication; -import org.springframework.boot.autoconfigure.SpringBootApplication; - -/** - * @author Steve Riesenberg - * @since 0.2.3 - */ -@SpringBootApplication -public class FederatedIdentityAuthorizationServerApplication { - - public static void main(String[] args) { - SpringApplication.run(FederatedIdentityAuthorizationServerApplication.class, args); - } - -} diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java b/samples/federated-identity-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java deleted file mode 100644 index cdc1bfa18..000000000 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java +++ /dev/null @@ -1,150 +0,0 @@ -/* - * Copyright 2020-2023 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package sample.config; - -import java.util.UUID; - -import com.nimbusds.jose.jwk.JWKSet; -import com.nimbusds.jose.jwk.RSAKey; -import com.nimbusds.jose.jwk.source.JWKSource; -import com.nimbusds.jose.proc.SecurityContext; -import sample.jose.Jwks; -import sample.security.FederatedIdentityConfigurer; -import sample.security.FederatedIdentityIdTokenCustomizer; - -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.core.Ordered; -import org.springframework.core.annotation.Order; -import org.springframework.jdbc.core.JdbcTemplate; -import org.springframework.jdbc.datasource.embedded.EmbeddedDatabase; -import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder; -import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType; -import org.springframework.security.config.Customizer; -import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer; -import org.springframework.security.oauth2.core.AuthorizationGrantType; -import org.springframework.security.oauth2.core.ClientAuthenticationMethod; -import org.springframework.security.oauth2.core.oidc.OidcScopes; -import org.springframework.security.oauth2.jwt.JwtDecoder; -import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationConsentService; -import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationService; -import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService; -import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService; -import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository; -import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; -import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository; -import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration; -import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer; -import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings; -import org.springframework.security.oauth2.server.authorization.settings.ClientSettings; -import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext; -import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer; -import org.springframework.security.web.SecurityFilterChain; - -/** - * @author Steve Riesenberg - * @since 0.2.3 - */ -@Configuration(proxyBeanMethods = false) -public class AuthorizationServerConfig { - - @Bean - @Order(Ordered.HIGHEST_PRECEDENCE) - public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception { - OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http); - http.getConfigurer(OAuth2AuthorizationServerConfigurer.class) - .oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0 - http.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt); - http.apply(new FederatedIdentityConfigurer()); - return http.build(); - } - - @Bean - public OAuth2TokenCustomizer idTokenCustomizer() { - return new FederatedIdentityIdTokenCustomizer(); - } - - // @formatter:off - @Bean - public RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) { - RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString()) - .clientId("messaging-client") - .clientSecret("{noop}secret") - .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC) - .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE) - .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN) - .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) - .redirectUri("http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc") - .redirectUri("http://127.0.0.1:8080/authorized") - .postLogoutRedirectUri("http://127.0.0.1:8080/logged-out") - .scope(OidcScopes.OPENID) - .scope(OidcScopes.PROFILE) - .scope("message.read") - .scope("message.write") - .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build()) - .build(); - - // Save registered client in db as if in-memory - JdbcRegisteredClientRepository registeredClientRepository = new JdbcRegisteredClientRepository(jdbcTemplate); - registeredClientRepository.save(registeredClient); - - return registeredClientRepository; - } - // @formatter:on - - @Bean - public OAuth2AuthorizationService authorizationService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) { - return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository); - } - - @Bean - public OAuth2AuthorizationConsentService authorizationConsentService(JdbcTemplate jdbcTemplate, RegisteredClientRepository registeredClientRepository) { - return new JdbcOAuth2AuthorizationConsentService(jdbcTemplate, registeredClientRepository); - } - - @Bean - public JWKSource jwkSource() { - RSAKey rsaKey = Jwks.generateRsa(); - JWKSet jwkSet = new JWKSet(rsaKey); - return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet); - } - - @Bean - public JwtDecoder jwtDecoder(JWKSource jwkSource) { - return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource); - } - - @Bean - public AuthorizationServerSettings authorizationServerSettings() { - return AuthorizationServerSettings.builder().build(); - } - - @Bean - public EmbeddedDatabase embeddedDatabase() { - // @formatter:off - return new EmbeddedDatabaseBuilder() - .generateUniqueName(true) - .setType(EmbeddedDatabaseType.H2) - .setScriptEncoding("UTF-8") - .addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql") - .addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql") - .addScript("org/springframework/security/oauth2/server/authorization/client/oauth2-registered-client-schema.sql") - .build(); - // @formatter:on - } - -} diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java b/samples/federated-identity-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java deleted file mode 100644 index f4ba86745..000000000 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java +++ /dev/null @@ -1,82 +0,0 @@ -/* - * Copyright 2020-2023 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package sample.config; - -import sample.security.FederatedIdentityConfigurer; -import sample.security.UserRepositoryOAuth2UserHandler; - -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.security.config.Customizer; -import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; -import org.springframework.security.core.session.SessionRegistry; -import org.springframework.security.core.session.SessionRegistryImpl; -import org.springframework.security.core.userdetails.User; -import org.springframework.security.core.userdetails.UserDetails; -import org.springframework.security.core.userdetails.UserDetailsService; -import org.springframework.security.provisioning.InMemoryUserDetailsManager; -import org.springframework.security.web.SecurityFilterChain; -import org.springframework.security.web.session.HttpSessionEventPublisher; - -/** - * @author Steve Riesenberg - * @since 0.2.3 - */ -@EnableWebSecurity -@Configuration(proxyBeanMethods = false) -public class DefaultSecurityConfig { - - // @formatter:off - @Bean - public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { - FederatedIdentityConfigurer federatedIdentityConfigurer = new FederatedIdentityConfigurer() - .oauth2UserHandler(new UserRepositoryOAuth2UserHandler()); - http - .authorizeHttpRequests(authorize -> - authorize - .requestMatchers("/assets/**", "/webjars/**", "/login").permitAll() - .anyRequest().authenticated() - ) - .formLogin(Customizer.withDefaults()) - .apply(federatedIdentityConfigurer); - return http.build(); - } - // @formatter:on - - // @formatter:off - @Bean - public UserDetailsService users() { - UserDetails user = User.withDefaultPasswordEncoder() - .username("user1") - .password("password") - .roles("USER") - .build(); - return new InMemoryUserDetailsManager(user); - } - // @formatter:on - - @Bean - public SessionRegistry sessionRegistry() { - return new SessionRegistryImpl(); - } - - @Bean - public HttpSessionEventPublisher httpSessionEventPublisher() { - return new HttpSessionEventPublisher(); - } - -} diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/jose/Jwks.java b/samples/federated-identity-authorizationserver/src/main/java/sample/jose/Jwks.java deleted file mode 100644 index 43285fa54..000000000 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/jose/Jwks.java +++ /dev/null @@ -1,74 +0,0 @@ -/* - * Copyright 2020-2022 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package sample.jose; - -import java.security.KeyPair; -import java.security.interfaces.ECPrivateKey; -import java.security.interfaces.ECPublicKey; -import java.security.interfaces.RSAPrivateKey; -import java.security.interfaces.RSAPublicKey; -import java.util.UUID; - -import javax.crypto.SecretKey; - -import com.nimbusds.jose.jwk.Curve; -import com.nimbusds.jose.jwk.ECKey; -import com.nimbusds.jose.jwk.OctetSequenceKey; -import com.nimbusds.jose.jwk.RSAKey; - -/** - * @author Joe Grandja - * @since 0.1.0 - */ -public final class Jwks { - - private Jwks() { - } - - public static RSAKey generateRsa() { - KeyPair keyPair = KeyGeneratorUtils.generateRsaKey(); - RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic(); - RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate(); - // @formatter:off - return new RSAKey.Builder(publicKey) - .privateKey(privateKey) - .keyID(UUID.randomUUID().toString()) - .build(); - // @formatter:on - } - - public static ECKey generateEc() { - KeyPair keyPair = KeyGeneratorUtils.generateEcKey(); - ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic(); - ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate(); - Curve curve = Curve.forECParameterSpec(publicKey.getParams()); - // @formatter:off - return new ECKey.Builder(curve, publicKey) - .privateKey(privateKey) - .keyID(UUID.randomUUID().toString()) - .build(); - // @formatter:on - } - - public static OctetSequenceKey generateSecret() { - SecretKey secretKey = KeyGeneratorUtils.generateSecretKey(); - // @formatter:off - return new OctetSequenceKey.Builder(secretKey) - .keyID(UUID.randomUUID().toString()) - .build(); - // @formatter:on - } -} diff --git a/samples/federated-identity-authorizationserver/src/main/java/sample/jose/KeyGeneratorUtils.java b/samples/federated-identity-authorizationserver/src/main/java/sample/jose/KeyGeneratorUtils.java deleted file mode 100644 index 290247267..000000000 --- a/samples/federated-identity-authorizationserver/src/main/java/sample/jose/KeyGeneratorUtils.java +++ /dev/null @@ -1,85 +0,0 @@ -/* - * Copyright 2020-2022 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package sample.jose; - -import java.math.BigInteger; -import java.security.KeyPair; -import java.security.KeyPairGenerator; -import java.security.spec.ECFieldFp; -import java.security.spec.ECParameterSpec; -import java.security.spec.ECPoint; -import java.security.spec.EllipticCurve; - -import javax.crypto.KeyGenerator; -import javax.crypto.SecretKey; - -/** - * @author Joe Grandja - * @since 0.1.0 - */ -final class KeyGeneratorUtils { - - private KeyGeneratorUtils() { - } - - static SecretKey generateSecretKey() { - SecretKey hmacKey; - try { - hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey(); - } catch (Exception ex) { - throw new IllegalStateException(ex); - } - return hmacKey; - } - - static KeyPair generateRsaKey() { - KeyPair keyPair; - try { - KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); - keyPairGenerator.initialize(2048); - keyPair = keyPairGenerator.generateKeyPair(); - } catch (Exception ex) { - throw new IllegalStateException(ex); - } - return keyPair; - } - - static KeyPair generateEcKey() { - EllipticCurve ellipticCurve = new EllipticCurve( - new ECFieldFp( - new BigInteger("115792089210356248762697446949407573530086143415290314195533631308867097853951")), - new BigInteger("115792089210356248762697446949407573530086143415290314195533631308867097853948"), - new BigInteger("41058363725152142129326129780047268409114441015993725554835256314039467401291")); - ECPoint ecPoint = new ECPoint( - new BigInteger("48439561293906451759052585252797914202762949526041747995844080717082404635286"), - new BigInteger("36134250956749795798585127919587881956611106672985015071877198253568414405109")); - ECParameterSpec ecParameterSpec = new ECParameterSpec( - ellipticCurve, - ecPoint, - new BigInteger("115792089210356248762697446949407573529996955224135760342422259061068512044369"), - 1); - - KeyPair keyPair; - try { - KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC"); - keyPairGenerator.initialize(ecParameterSpec); - keyPair = keyPairGenerator.generateKeyPair(); - } catch (Exception ex) { - throw new IllegalStateException(ex); - } - return keyPair; - } -} diff --git a/samples/federated-identity-authorizationserver/src/main/resources/application.yml b/samples/federated-identity-authorizationserver/src/main/resources/application.yml deleted file mode 100644 index 71bbbd965..000000000 --- a/samples/federated-identity-authorizationserver/src/main/resources/application.yml +++ /dev/null @@ -1,33 +0,0 @@ -server: - port: 9000 - -spring: - security: - oauth2: - client: - registration: - google-idp: - provider: google - client-id: ${GOOGLE_CLIENT_ID:google-client-id} - client-secret: ${GOOGLE_CLIENT_SECRET:google-client-secret} - scope: openid, https://www.googleapis.com/auth/userinfo.profile, https://www.googleapis.com/auth/userinfo.email - client-name: Sign in with Google - github-idp: - provider: github - client-id: ${GITHUB_CLIENT_ID:github-client-id} - client-secret: ${GITHUB_CLIENT_SECRET:github-client-secret} - scope: user:email, read:user - client-name: Sign in with GitHub - provider: - google: - user-name-attribute: email - github: - user-name-attribute: login - -logging: - level: - root: INFO - org.springframework.web: INFO - org.springframework.security: INFO - org.springframework.security.oauth2: INFO -# org.springframework.boot.autoconfigure: DEBUG