-
Notifications
You must be signed in to change notification settings - Fork 41.4k
Add Spring Authorization Server support #34003
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
846986b
to
02dbdee
Compare
Hi! It seems that the two auto-configuration classes Is it possible to add a smoke test for the OAuth2 Authorization Server to catch such bugs and verify that it works correctly in a Boot application? |
665324a
to
1dbdd61
Compare
@mhalbritter I've added the imports and a few basic smoke tests. |
Thank you! |
Hi @mhalbritter! Just checking to see if there is any additional feedback on this PR? I'm especially interested in feedback related to the config properties. If there's any changes needed, I will sync up with @jgrandja and make any needed updates ready for review. |
Hey, i'll bring it up on the next team meeting. |
cc3d1c7
to
1ef34e1
Compare
1ef34e1
to
e4f6c66
Compare
e4f6c66
to
84a20ab
Compare
Fixes an issue where auto-configuration for Spring Authorization Server was overriding the default exception handling (AuthenticationEntryPoint) resulting in anonymous requests to the token endpoint being redirected to the Spring Security login page instead of returning 401 Unauthorized. Auto-configuration now registers a defaultAuthenticationEntryPointFor that is added to any other entry points already configured. See spring-projectsgh-34003
This PR introduces support for Spring Authorization Server. It includes:
spring-boot-starter-oauth2-authorization-server
org.springframework.security:spring-security-oauth2-authorization-server
spring-boot-autoconfigure
fororg.springframework.security:spring-security-oauth2-authorization-server
Overview
The auto-configuration is designed to closely match the Getting Started guide in the reference manual. When
spring-security-oauth2-authorization-server
is detected on the classpath, the following components are optionally registered:RegisteredClientRepository
AuthorizationServerSettings
SecurityFilterChain
for protocol endpointsSecurityFilterChain
for user authentication with Form Logincom.nimbusds.jose.jwk.source.JWKSource<SecurityContext>
with a generated RSA key-pairJwtDecoder
that uses the providedJWKSource
Because Spring Authorization Server is built on top of Spring Security, the order in which components are registered in collaboration with existing auto-configuration is important.
The main consideration is that
UserDetailsServiceAutoConfiguration
continue to be allowed to publish aUserDetailsService
if necessary. However, aJwtDecoder
must also be published afterwards. This is in-contrast withOAuth2ResourceServerAutoConfiguration
which prevents aUserDetailsService
from being published.Configuration
The
OAuth2AuthorizationServerProperties
allow configuringRegisteredClient
s andAuthorizationServerSettings
. Here is a typical client configuration with default settings:Here is a full configuration example: