120 lines
5.0 KiB
Plaintext
120 lines
5.0 KiB
Plaintext
= OAuth 2.0 Resource Server Sample
|
|
|
|
This sample demonstrates integrating Resource Server with a mock Authorization Server, though it can be modified to integrate
|
|
with your favorite Authorization Server. This resource server is configured to accept JWE-encrypted tokens.
|
|
|
|
With it, you can run the integration tests or run the application as a stand-alone service to explore how you can
|
|
secure your own service with OAuth 2.0 Bearer Tokens using Spring Security.
|
|
|
|
== 1. Running the tests
|
|
|
|
To run the tests, do:
|
|
|
|
```bash
|
|
./gradlew integrationTest
|
|
```
|
|
|
|
Or import the project into your IDE and run `OAuth2ResourceServerApplicationTests` from there.
|
|
|
|
=== What is it doing?
|
|
|
|
By default, the tests are pointing at a mock Authorization Server instance.
|
|
|
|
The tests are configured with a set of hard-coded tokens originally obtained from the mock Authorization Server,
|
|
and each makes a query to the Resource Server with their corresponding token.
|
|
|
|
The Resource Server decrypts the token and subsquently verifies it with the Authorization Server and authorizes the request, returning the phrase
|
|
|
|
```bash
|
|
Hello, subject!
|
|
```
|
|
|
|
where "subject" is the value of the `sub` field in the JWT returned by the Authorization Server.
|
|
|
|
== 2. Running the app
|
|
|
|
To run as a stand-alone application, do:
|
|
|
|
```bash
|
|
./gradlew bootRun
|
|
```
|
|
|
|
Or import the project into your IDE and run `OAuth2ResourceServerApplication` from there.
|
|
|
|
Once it is up, you can use the following token:
|
|
|
|
```bash
|
|
export TOKEN=eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.IyeWtsTonaiWJdoT13B0M7gpqVxAirVGlfqFI4TOmTRcVHICs_ESezS7fa0ODS9XYdwklTtG7hH39yeeMzr2Zo1Ghh-m36fdoqQrV1Do04rUvuTjqbgyNffeZEGB6rquJ-cyAVjp_Oljy10-Bbnw7CeVGwNBSVo9UCB5j49OlNWhLxFpYARFmOlYpXj-s4Q4JiqV6EvjDAYeohAR4QQmND3qoxR-s2I6SLcIho0sSSpUlhrRiqu2uvWefHDcZJdW2WYWnxLHxhzNu3CfnLiqhhaA_YA_iWXR9FYnPDCf_4q3FgSXcgttXzomFKAx5DwnE_dXvsCvpWxslZMU1UIiLA.MHOrrza2GQ9_5PIv.zU4tfhxT6apWBC3stBwQmGlCQBltWVQe4dFIykybWWBFqxo1bf2BZ37twzoEIFXG9jSYEMH4mvBXPWSvn66t-_jnqLnKTJst2plBjhagGCAoLNWXVKeYNp67o-lKOD_JJQFqsRw4oE05VSgRr14MZeaUBFcU3A_kKxMXOu899DKfXBGJvj75H7lDyd8RUXTb-OSWWfUiJc6Y5AUy1zCZCN9yfDsCXt9heTsZANy92Oou9sMFaXkYzyums5OtkBtLFzyuNMEoNioRehTV-FTuL8tDRB1mNhHObwsBfFbR6M1jJK37pHUXGtko-yZ6NGwxyLtwGh4uU2jzE614rQzuzR8aHaHxOkUs1pBTZ8AcRt41snByOe-KU0adthHxedobFiQQBoQ05DgSU7DO6hsK0uVBDF3eG2KjH4L2lZy-WugloLHhdguUoO9F0zUx15-XZO4EVzmhy8xfH2tSXz98eKzz9Dv0DdGnrBL9cK2MM88N1zoq5u4NdlnE12HvuesB7GKdMwZx1-gTw_pzP81TzcctJWl6ETK09Uc.jk0O8qc4Fvip856stDz05Q
|
|
```
|
|
|
|
And then make this request:
|
|
|
|
```bash
|
|
curl -H "Authorization: Bearer $TOKEN" localhost:8080
|
|
```
|
|
|
|
Which will respond with the phrase:
|
|
|
|
```bash
|
|
Hello, subject!
|
|
```
|
|
|
|
where `subject` is the value of the `sub` field in the JWT returned by the Authorization Server.
|
|
|
|
Or this:
|
|
|
|
```bash
|
|
export TOKEN=eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.CRBAEgvQhpB6pPQhpkTAKpsDai1FDcvkDSRig1R3OI-g18JdTe-qDhzWwP-hV3aCwFwHxQ_g8Z8OIZvhyKpQaPwBb72UeLqqhzSIkm0gEsmmjYg1vEGOrDH5_Fqlm0LnAnXTmsbOIWYIj11ZuenI2lEmMCkVwqth0RlzakdcHRXiuDTEln_trhZpE2j80X-9rS2gZy9Raa9VLir3-F3wC0GKPEL6e3x1OygC03ix9uyXS3vpTsU9zlgoYADZyaLeOF1mCG4mQhvXs7IPmPbwNsElJwKh0xSQCHvNOQShprlvd3cHiUFKYw9fXphY1O-AUYcRzHk4DjoBdkGNQMy_Kw.KtC_z674rYBtDgkN.e8QU50Iq1JHkn-1USSxpjEkbrukb4cobvlQRK40iXGAKVIuOod4bSq5fDpIAPHugqIf-_zGsvr-2OCOdzhtBikL46wU7UdZppxPWtk-X6kl33zH_XObRMaGfe-hLxt3RPxRVn7I1Hp6tGW1Rkxyf_ESq4XlcbbrkhDoIz_G_LKXJhvQ-xahW2e0AUc7RZSucns4XUeq9xX_dd7Ht-o1TmQI9WFoFc1l7oh9GtQ6GZMsghnZ1VrbIS2L7jSYiSsD2JqSv1LLtOGj_FBA0ufhqM3LloGiwflEwAryMD10oNb73WonKEycEj1rBsTIKW7SHkI-VkrQA4-8N-aLWgHwDnzyPZmyNyKpqUMvhjIE_0w6oqU4HpN7J5nfBEIAtpPZ_pDkwAdxCQ7JV3zfiUnF7ZQ3q1PnSId315si02ZN9-wRSrMHcHnboQN1Hs4xCAfGyClVyLpCzfa_fAehjt6v1DjgjbzwSjr_LdNmWTvXYBhNO8Jq9Vb7axksrdwksD3pYNMY8cRZxP-LO0V5Sv1_kT_Hf2yLo2iTwB8n8szzGrJ4QQLb5Znu7Sv-M2x52cnIDMiorP3LNpFk.G85FuMSm-8bGumFAStiFQA
|
|
|
|
curl -H "Authorization: Bearer $TOKEN" localhost:8080/message
|
|
```
|
|
|
|
Will respond with:
|
|
|
|
```bash
|
|
secret message
|
|
```
|
|
|
|
== 2. Testing against other Authorization Servers
|
|
|
|
_In order to use this sample, your Authorization Server must encrypt using the public key available in the sample.
|
|
Also it must support JWTs that either use the "scope" or "scp" attribute._
|
|
|
|
To change the sample to point at your Authorization Server, simply find this property in the `application.yml`:
|
|
|
|
```yaml
|
|
spring:
|
|
security:
|
|
oauth2:
|
|
resourceserver:
|
|
jwt:
|
|
jwk-set-uri: ${mockwebserver.url}/.well-known/jwks.json
|
|
```
|
|
|
|
And change the property to your Authorization Server's JWK set endpoint:
|
|
|
|
```yaml
|
|
spring:
|
|
security:
|
|
oauth2:
|
|
resourceserver:
|
|
jwt:
|
|
jwk-set-uri: https://localhost:9031/pf/JWKS
|
|
```
|
|
|
|
If your Authorization Server does not support RSA_OAEP_256 or AESGCM, then you can change these values in `OAuth2ResourceServerSecurityConfiguration`:
|
|
|
|
```java
|
|
|
|
```
|
|
|
|
And then you can run the app the same as before:
|
|
|
|
```bash
|
|
./gradlew bootRun
|
|
```
|
|
|
|
Make sure to obtain valid tokens from your Authorization Server in order to play with the sample Resource Server.
|
|
To use the `/` endpoint, any valid token from your Authorization Server will do.
|
|
To use the `/message` endpoint, the token should have the `message:read` scope.
|