From 419d7264f98a3347160e80bd1b8e07e2f66aa8d6 Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Thu, 9 Apr 2020 10:33:03 -0600 Subject: [PATCH] Add Docs for Custom Bearer Token Header Issue gh-8337 --- .../reactive/oauth2/resource-server.adoc | 23 +++++++++++++++++++ .../servlet/oauth2/oauth2-resourceserver.adoc | 20 +++++++++------- 2 files changed, 35 insertions(+), 8 deletions(-) diff --git a/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc b/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc index 5e45a74427..35a8555f4c 100644 --- a/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc @@ -1077,6 +1077,29 @@ This approach allows us to add and remove elements from the repository (shown as NOTE: It would be unsafe to simply take any issuer and construct an `ReactiveAuthenticationManager` from it. The issuer should be one that the code can verify from a trusted source like a whitelist. +[[webflux-oauth2resourceserver-bearertoken-resolver]] +== Bearer Token Resolution + +By default, Resource Server looks for a bearer token in the `Authorization` header. +This, however, can be customized. + +For example, you may have a need to read the bearer token from a custom header. +To achieve this, you can wire an instance of `ServerBearerTokenAuthenticationConverter` into the DSL, as you can see in the following example: + +.Custom Bearer Token Header +==== +.Java +[source,java,role="primary"] +---- +ServerBearerTokenAuthenticationConverter converter = new ServerBearerTokenAuthenticationConverter(); +converter.setBearerTokenHeaderName(HttpHeaders.PROXY_AUTHORIZATION); +http + .oauth2ResourceServer(oauth2 -> oauth2 + .bearerTokenConverter(converter) + ); +---- +==== + == Bearer Token Propagation Now that you're in possession of a bearer token, it might be handy to pass that to downstream services. diff --git a/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc b/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc index d34335db73..e0e936f383 100644 --- a/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc @@ -1955,22 +1955,24 @@ However, if you resolve it by a claim in the bearer token, read on to learn abou === Bearer Token Resolution By default, Resource Server looks for a bearer token in the `Authorization` header. -This, however, can be customized in a couple of ways. +This, however, can be customized in a handful of ways. ==== Reading the Bearer Token from a Custom Header For example, you may have a need to read the bearer token from a custom header. -To achieve this, you can wire a `HeaderBearerTokenResolver` instance into the DSL, as you can see in the following example: +To achieve this, you can expose a `DefaultBearerTokenResolver` as a bean, or wire an instance into the DSL, as you can see in the following example: .Custom Bearer Token Header ==== .Java [source,java,role="primary"] ---- -http - .oauth2ResourceServer(oauth2 -> oauth2 - .bearerTokenResolver(new HeaderBearerTokenResolver("x-goog-iap-jwt-assertion")) - ); +@Bean +BearerTokenResolver bearerTokenResolver() { + DefaultBearerTokenResolver bearerTokenResolver = new DefaultBearerTokenResolver(); + bearerTokenResolver.setBearerTokenHeaderName(HttpHeaders.PROXY_AUTHORIZATION); + return bearerTokenResolver; +} ---- .Xml @@ -1981,12 +1983,14 @@ http - + class="org.springframework.security.oauth2.server.resource.web.DefaultBearerTokenResolver"> + ---- ==== +Or, in circumstances where a provider is using both a custom header and value, you can use `HeaderBearerTokenResolver` instead. + ==== Reading the Bearer Token from a Form Parameter Or, you may wish to read the token from a form parameter, which you can do by configuring the `DefaultBearerTokenResolver`, as you can see below: