Examples with OAuth2ResourceServerConfigurer org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer used on opensource projects

Example 1 with OAuth2ResourceServerConfigurer

use of org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer in project okta-spring-boot by okta.

the class OktaOAuth2Configurer method init.

@SuppressWarnings("rawtypes")
@Override
public void init(HttpSecurity http) throws Exception {
    ApplicationContext context = http.getSharedObject(ApplicationContext.class);
    // make sure OktaOAuth2Properties are available
    if (!context.getBeansOfType(OktaOAuth2Properties.class).isEmpty()) {
        OktaOAuth2Properties oktaOAuth2Properties = context.getBean(OktaOAuth2Properties.class);
        // Auth Code Flow Config
        // if OAuth2ClientProperties bean is not available do NOT configure
        OAuth2ClientProperties.Provider propertiesProvider;
        OAuth2ClientProperties.Registration propertiesRegistration;
        if (!context.getBeansOfType(OAuth2ClientProperties.class).isEmpty() && (propertiesProvider = context.getBean(OAuth2ClientProperties.class).getProvider().get("okta")) != null && (propertiesRegistration = context.getBean(OAuth2ClientProperties.class).getRegistration().get("okta")) != null && !isEmpty(propertiesProvider.getIssuerUri()) && !isEmpty(propertiesRegistration.getClientId())) {
            // configure Okta user services
            configureLogin(http, oktaOAuth2Properties, context.getBean(Environment.class));
            // check for RP-Initiated logout
            if (!context.getBeansOfType(OidcClientInitiatedLogoutSuccessHandler.class).isEmpty()) {
                http.logout().logoutSuccessHandler(context.getBean(OidcClientInitiatedLogoutSuccessHandler.class));
            }
            // if issuer is root org, use opaque token validation
            if (TokenUtil.isRootOrgIssuer(propertiesProvider.getIssuerUri())) {
                log.debug("Opaque Token validation/introspection will be configured.");
                configureResourceServerForOpaqueTokenValidation(http, oktaOAuth2Properties);
                return;
            }
            OAuth2ResourceServerConfigurer oAuth2ResourceServerConfigurer = http.getConfigurer(OAuth2ResourceServerConfigurer.class);
            if (getJwtConfigurer(oAuth2ResourceServerConfigurer).isPresent()) {
                log.debug("JWT configurer is set in OAuth resource server configuration. " + "JWT validation will be configured.");
                configureResourceServerForJwtValidation(http, oktaOAuth2Properties);
            } else if (getOpaqueTokenConfigurer(oAuth2ResourceServerConfigurer).isPresent()) {
                log.debug("Opaque Token configurer is set in OAuth resource server configuration. " + "Opaque Token validation/introspection will be configured.");
                configureResourceServerForOpaqueTokenValidation(http, oktaOAuth2Properties);
            } else {
                log.debug("OAuth2ResourceServerConfigurer bean not configured, Resource Server support will not be enabled.");
            }
        } else {
            log.debug("OAuth/OIDC Login not configured due to missing issuer, client-id, or client-secret property");
        }
    }
}

Example 2 with OAuth2ResourceServerConfigurer

use of org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer in project custom-spring-authorization-server by andifalk.

the class AuthorizationServerConfig method authorizationServerSecurityFilterChain.

/*
     * Security config for all authz server endpoints.
     */
@Bean
@Order(Ordered.HIGHEST_PRECEDENCE)
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer = new OAuth2AuthorizationServerConfigurer<>();
    RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
    authorizationServerConfigurer.oidc(oidcConfigurer -> oidcConfigurer.userInfoEndpoint(oidcUserInfoEndpointConfigurer -> oidcUserInfoEndpointConfigurer.userInfoMapper(ac -> {
        Map<String, Object> claims = new HashMap<>();
        JwtAuthenticationToken jwtAuthenticationToken = (JwtAuthenticationToken) ac.getAuthentication().getPrincipal();
        claims.put("sub", jwtAuthenticationToken.getToken().getSubject());
        claims.put("name", jwtAuthenticationToken.getToken().getClaim("given_name") + " " + jwtAuthenticationToken.getToken().getClaim("family_name"));
        claims.put("family_name", jwtAuthenticationToken.getToken().getClaim("family_name"));
        claims.put("given_name", jwtAuthenticationToken.getToken().getClaim("given_name"));
        claims.put("email", jwtAuthenticationToken.getToken().getClaim("email"));
        claims.put("roles", jwtAuthenticationToken.getToken().getClaim("roles"));
        return new OidcUserInfo(claims);
    })));
    http.requestMatcher(endpointsMatcher).authorizeRequests(authorizeRequests -> authorizeRequests.anyRequest().authenticated()).csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher)).apply(authorizationServerConfigurer);
    http.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
    return http.formLogin(Customizer.withDefaults()).build();
}