Skip to content

Commit 0727d52

Browse files
germanosingermanosin
committed
Introduced Resource server configuration
1 parent 73c7217 commit 0727d52

File tree

6 files changed

+133
-0
lines changed

6 files changed

+133
-0
lines changed

‎api/build.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ dependencies {
1818
implementation libs.spring.starter.actuator
1919
implementation libs.spring.starter.logging
2020
implementation libs.spring.starter.oauth2.client
21+
implementation libs.spring.security.oauth2.resource.server
2122
implementation libs.spring.boot.actuator
2223
compileOnly libs.spring.boot.devtools
2324

‎api/src/main/java/io/kafbat/ui/config/auth/OAuthProperties.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,15 @@
66
import java.util.Map;
77
import java.util.Set;
88
import lombok.Data;
9+
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
910
import org.springframework.boot.context.properties.ConfigurationProperties;
1011
import org.springframework.util.Assert;
1112

1213
@ConfigurationProperties("auth.oauth2")
1314
@Data
1415
public class OAuthProperties {
1516
private Map<String, OAuth2Provider> client = new HashMap<>();
17+
private OAuth2ResourceServerProperties resourceServer = null;
1618

1719
@PostConstruct
1820
public void init() {

‎api/src/main/java/io/kafbat/ui/config/auth/OAuthSecurityConfig.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
1515
import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties;
1616
import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper;
17+
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
1718
import org.springframework.boot.context.properties.EnableConfigurationProperties;
1819
import org.springframework.context.annotation.Bean;
1920
import org.springframework.context.annotation.Configuration;
@@ -62,6 +63,20 @@ public SecurityWebFilterChain configure(ServerHttpSecurity http, OAuthLogoutSucc
6263
.logout(spec -> spec.logoutSuccessHandler(logoutHandler))
6364
.csrf(ServerHttpSecurity.CsrfSpec::disable);
6465

66+
if (properties.getResourceServer() != null) {
67+
OAuth2ResourceServerProperties resourceServer = properties.getResourceServer();
68+
if (resourceServer.getJwt() != null) {
69+
builder.oauth2ResourceServer((c) -> c.jwt((j) -> j.jwkSetUri(resourceServer.getJwt().getJwkSetUri())));
70+
} else if (resourceServer.getOpaquetoken() != null) {
71+
OAuth2ResourceServerProperties.Opaquetoken opaquetoken = resourceServer.getOpaquetoken();
72+
builder.oauth2ResourceServer(
73+
(c) -> c.opaqueToken(
74+
(o) -> o.introspectionUri(opaquetoken.getIntrospectionUri())
75+
.introspectionClientCredentials(opaquetoken.getClientId(), opaquetoken.getClientSecret())
76+
)
77+
);
78+
}
79+
}
6580

6681
builder.addFilterAt(new StaticFileWebFilter(), SecurityWebFiltersOrder.LOGIN_PAGE_GENERATING);
6782

‎documentation/compose/oauth/docker-compose.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
version: '3.8'
2+
3+
services:
4+
keycloak:
5+
image: quay.io/keycloak/keycloak:latest
6+
container_name: keycloak
7+
restart: always
8+
command: start-dev --import-realm
9+
environment:
10+
- KEYCLOAK_ADMIN=admin
11+
- KEYCLOAK_ADMIN_PASSWORD=admin
12+
- KC_DB=postgres
13+
- KC_DB_URL=jdbc:postgresql://db/keycloak
14+
- KC_DB_USERNAME=keycloak
15+
- KC_DB_PASSWORD=keycloak
16+
- KC_HOSTNAME=keycloak.oauth.orb.local
17+
- KC_HOSTNAME_STRICT=false
18+
ports:
19+
- "8080:8080"
20+
volumes:
21+
- ./realm-export.json:/opt/keycloak/data/import/realm-export.json
22+
depends_on:
23+
- db
24+
25+
db:
26+
image: postgres:15
27+
container_name: keycloak-db
28+
restart: always
29+
environment:
30+
- POSTGRES_DB=keycloak
31+
- POSTGRES_USER=keycloak
32+
- POSTGRES_PASSWORD=keycloak
33+
ports:
34+
- "5432:5432"
35+
volumes:
36+
- postgres_data:/var/lib/postgresql/data
37+
38+
kafka:
39+
image: confluentinc/cp-kafka:7.8.0
40+
hostname: kafka
41+
container_name: kafka
42+
ports:
43+
- "9092:9092"
44+
- "9997:9997"
45+
environment:
46+
KAFKA_BROKER_ID: 1
47+
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: 'CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT'
48+
KAFKA_ADVERTISED_LISTENERS: 'PLAINTEXT://kafka:29092,PLAINTEXT_HOST://localhost:9092'
49+
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
50+
KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
51+
KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
52+
KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
53+
KAFKA_JMX_PORT: 9997
54+
KAFKA_JMX_HOSTNAME: localhost
55+
KAFKA_PROCESS_ROLES: 'broker,controller'
56+
KAFKA_NODE_ID: 1
57+
KAFKA_CONTROLLER_QUORUM_VOTERS: '1@kafka:29093'
58+
KAFKA_LISTENERS: 'PLAINTEXT://kafka:29092,CONTROLLER://kafka:29093,PLAINTEXT_HOST://0.0.0.0:9092'
59+
KAFKA_INTER_BROKER_LISTENER_NAME: 'PLAINTEXT'
60+
KAFKA_CONTROLLER_LISTENER_NAMES: 'CONTROLLER'
61+
KAFKA_LOG_DIRS: '/tmp/kraft-combined-logs'
62+
CLUSTER_ID: 'MkU3OEVBNTcwNTJENDM2Qk'
63+
64+
kafbat-ui:
65+
container_name: kafbat-ui
66+
image: ghcr.io/kafbat/kafka-ui:0.0.1-SNAPSHOT
67+
ports:
68+
- 8090:8080
69+
depends_on:
70+
- kafka
71+
- keycloak
72+
environment:
73+
KAFKA_CLUSTERS_0_NAME: local
74+
KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:29092
75+
AUTH_TYPE: "OAUTH2"
76+
AUTH_OAUTH2_RESOURCE_SERVER_JWT_JWK_SET_URI: "http://keycloak.oauth.orb.local:8080/realms/myrealm/protocol/openid-connect/certs"
77+
AUTH_OAUTH2_CLIENT_KEYCLOACK_CLIENT_ID: "my-client"
78+
AUTH_OAUTH2_CLIENT_KEYCLOACK_CLIENT_SECRET: "my-secret"
79+
AUTH_OAUTH2_CLIENT_KEYCLOACK_SCOPE: openid
80+
AUTH_OAUTH2_CLIENT_KEYCLOACK_CLIENT_NAME: keycloack
81+
AUTH_OAUTH2_CLIENT_KEYCLOACK_PROVIDER: keycloack
82+
AUTH_OAUTH2_CLIENT_KEYCLOACK_CUSTOM_PARAMS_TYPE: oauth
83+
AUTH_OAUTH2_CLIENT_KEYCLOACK_ISSUER_URI: "http://keycloak.oauth.orb.local:8080/realms/myrealm"
84+
AUTH_OAUTH2_CLIENT_KEYCLOACK_USER_NAME_ATTRIBUTE: "preferred_username"
85+
volumes:
86+
postgres_data:

‎documentation/compose/oauth/realm-export.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"id": "myrealm",
3+
"realm": "myrealm",
4+
"enabled": true,
5+
"clients": [
6+
{
7+
"clientId": "my-client",
8+
"enabled": true,
9+
"publicClient": false,
10+
"secret": "my-secret",
11+
"directAccessGrantsEnabled": true,
12+
"redirectUris": ["http://localhost:8090/*"]
13+
}
14+
],
15+
"users": [
16+
{
17+
"username": "testuser",
18+
"enabled": true,
19+
"emailVerified": true,
20+
"credentials": [
21+
{
22+
"type": "password",
23+
"value": "testpassword"
24+
}
25+
]
26+
}
27+
]
28+
}

‎gradle/libs.versions.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ spring-boot-devtools = { module = 'org.springframework.boot:spring-boot-devtools
6666
spring-boot-configuration-processor = { module = 'org.springframework.boot:spring-boot-configuration-processor', version.ref = 'spring-boot' }
6767

6868
spring-security-ldap = { module = 'org.springframework.security:spring-security-ldap' }
69+
spring-security-oauth2-resource-server = { module = 'org.springframework.security:spring-security-oauth2-resource-server'}
6970

7071
swagger-integration-jakarta = { module = 'io.swagger.core.v3:swagger-integration-jakarta', version.ref = 'swagger-integration-jakarta' }
7172
lombok = { module = 'org.projectlombok:lombok', version.ref = 'lombok' }

0 commit comments

Comments
 (0)