Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix #1593: Reconfigure OIDC to resource-server #1594

Merged
merged 1 commit into from
Feb 29, 2024
Merged

Fix #1593: Reconfigure OIDC to resource-server #1594

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 5 additions & 10 deletions docs/Next-Step-Server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,15 +74,10 @@ The Next Step Server functionality is described in details in [Next Step Server

You may configure OpenID Connect (OIDC) authentication.

| Property | Default value | Description |
|--------------------------------------------------------------------------------------------|--------------------------|-------------------------------------------------------------------------------------------------------------------------------|
| `powerauth.nextstep.security.auth.type` | | `OIDC` for OpenID Connect. If OIDC enabled, the properties bellow must be configured. |
| `spring.security.oauth2.client.registration.nextstep-oidc-client.provider` | `nextstep-oidc-provider` | Should be `nextstep-oidc-provider`, defines the key for the `issuer-uri` property, see below. |
| `spring.security.oauth2.client.registration.nextstep-oidc-client.client-id` | | Client ID for authentication to the provider. |
| `spring.security.oauth2.client.registration.nextstep-oidc-client.client-secret` | | Client secret for authentication to the provider. |
| `spring.security.oauth2.client.registration.nextstep-oidc-client.authorization-grant-type` | `authorization_code` | Authorization grant type. Should be `authorization_code`. |
| `spring.security.oauth2.client.registration.nextstep-oidc-client.scope` | `openid` | Authorization scopes. Should be `openid`. |
| `spring.security.oauth2.client.registration.nextstep-oidc-client.redirectUri` | | Redirect URI from the provider back to the NextStep, e.g. `http://localhost:8080//powerauth-nextstep/login/oauth2/code/azure` |
| `spring.security.oauth2.client.provider.nextstep-oidc-provider.issuer-uri` | | URL of the provider, e.g. `https://sts.windows.net/example/` |
| Property | Default value | Description |
|---------------------------------------------------------|---------------|---------------------------------------------------------------------------------------|
| `powerauth.nextstep.security.auth.type` | | `OIDC` for OpenID Connect. If OIDC enabled, the properties bellow must be configured. |
| `spring.security.oauth2.resource-server.jwt.issuer-uri` | | URL of the provider, e.g. `https://sts.windows.net/example/` |
| `spring.security.oauth2.resource-server.jwt.audiences` | | A comma-separated list of allowed `aud` JWT claim values to be validated. |

See the [Spring Security documentation](https://docs.spring.io/spring-security/reference/servlet/oauth2/index.html#oauth2-client-log-users-in) and [OpenID Connect UserInfo endpoint](https://connect2id.com/products/server/docs/api/userinfo) for details.
2 changes: 1 addition & 1 deletion powerauth-nextstep/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-client</artifactId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
Expand Down
3 changes: 1 addition & 2 deletions ...extstep/src/main/java/io/getlime/security/powerauth/app/nextstep/NextStepApplication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.scheduling.annotation.EnableScheduling;

Expand All @@ -32,7 +31,7 @@
*
* @author Roman Strobl, [email protected]
*/
@SpringBootApplication(exclude = OAuth2ClientAutoConfiguration.class) // OAuth2Client dependency is included, but configuration is optional
@SpringBootApplication
@EnableScheduling
@ComponentScan(basePackages = {"io.getlime.security.powerauth.app.nextstep", "com.wultra.core.audit.base"})
public class NextStepApplication {
Expand Down
19 changes: 3 additions & 16 deletions ...rc/main/java/io/getlime/security/powerauth/app/nextstep/configuration/SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,8 @@

import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
Expand Down Expand Up @@ -57,13 +54,10 @@ public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception
logger.info("Initializing OIDC authentication.");
http.authorizeHttpRequests(authorize -> authorize
.requestMatchers(
new AntPathRequestMatcher("/login/oauth2/**"),
new AntPathRequestMatcher("/api/service/status"),
new AntPathRequestMatcher("/actuator/**"))
.permitAll()
.anyRequest()
.fullyAuthenticated())
.oauth2Login(withDefaults());
new AntPathRequestMatcher("/actuator/**")).permitAll()
.anyRequest().fullyAuthenticated())
.oauth2ResourceServer(oauth2 -> oauth2.jwt(withDefaults()));
} else {
logger.info("No authentication configured");
http.httpBasic(AbstractHttpConfigurer::disable);
Expand All @@ -74,13 +68,6 @@ public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception
.build();
}

@Configuration
@ConditionalOnProperty(name = "powerauth.nextstep.security.auth.type", havingValue = "OIDC")
@Import(OAuth2ClientAutoConfiguration.class)
public static class OAuth2ClientConfiguration {
// no code on purpose, only config class
}

enum AuthType {
NONE,

Expand Down
9 changes: 2 additions & 7 deletions powerauth-nextstep/src/main/resources/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,13 +72,8 @@ logging.config=${POWERAUTH_NEXTSTEP_LOGGING:}

# OpenID Connect (OIDC) Settings
#powerauth.nextstep.security.auth.type=OIDC
spring.security.oauth2.client.registration.nextstep-oidc-client.provider=nextstep-oidc-provider
spring.security.oauth2.client.registration.nextstep-oidc-client.client-id=
spring.security.oauth2.client.registration.nextstep-oidc-client.client-secret=
spring.security.oauth2.client.registration.nextstep-oidc-client.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.nextstep-oidc-client.scope=openid
spring.security.oauth2.client.registration.nextstep-oidc-client.redirectUri=
spring.security.oauth2.client.provider.nextstep-oidc-provider.issuer-uri=
spring.security.oauth2.resource-server.jwt.issuer-uri=
spring.security.oauth2.resource-server.jwt.audiences=

# Monitoring
management.tracing.sampling.probability=1.0
2 changes: 0 additions & 2 deletions powerauth-nextstep/src/test/resources/application-test.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,3 @@ powerauth.nextstep.db.master.encryption.key=Bq9h3/QiGTAChopid3Xd4ZDzaJ5rkrqBuzy2

# Liquibase
spring.liquibase.enabled=false

spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration
Loading