Skip to content

Commit 2c79754

Browse files
jgrandjajgrandja
committed
Simplify configuring authorization server using HttpSecurity.with()
Closes spring-projectsgh-1707
1 parent 4d1e2d9 commit 2c79754

File tree

25 files changed

+751
-726
lines changed

25 files changed

+751
-726
lines changed

‎docs/modules/ROOT/pages/configuration-model.adoc‎

Lines changed: 66 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@
88

99
`OAuth2AuthorizationServerConfiguration` uses xref:configuration-model.adoc#customizing-the-configuration[`OAuth2AuthorizationServerConfigurer`] to apply the default configuration and registers a `SecurityFilterChain` `@Bean` composed of all the infrastructure components supporting an OAuth2 authorization server.
1010

11-
[TIP]
12-
`OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(HttpSecurity)` is a convenience (`static`) utility method that applies the default OAuth2 security configuration to `HttpSecurity`.
13-
1411
The OAuth2 authorization server `SecurityFilterChain` `@Bean` is configured with the following default protocol endpoints:
1512

1613
* xref:protocol-endpoints.adoc#oauth2-authorization-endpoint[OAuth2 Authorization endpoint]
@@ -58,11 +55,14 @@ https://openid.net/specs/openid-connect-core-1_0.html[OpenID Connect 1.0] is dis
5855
----
5956
@Bean
6057
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
61-
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
62-
63-
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
64-
.oidc(Customizer.withDefaults()); // Initialize `OidcConfigurer`
65-
58+
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
59+
OAuth2AuthorizationServerConfigurer.authorizationServer();
60+
http
61+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
62+
.with(authorizationServerConfigurer, (authorizationServer) ->
63+
authorizationServer
64+
.oidc(Customizer.withDefaults()) // Initialize `OidcConfigurer`
65+
);
6666
return http.build();
6767
}
6868
----
@@ -105,28 +105,31 @@ Furthermore, it lets you customize the request processing logic for the protocol
105105
@Bean
106106
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
107107
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
108-
new OAuth2AuthorizationServerConfigurer();
109-
http.apply(authorizationServerConfigurer);
110-
111-
authorizationServerConfigurer
112-
.registeredClientRepository(registeredClientRepository) <1>
113-
.authorizationService(authorizationService) <2>
114-
.authorizationConsentService(authorizationConsentService) <3>
115-
.authorizationServerSettings(authorizationServerSettings) <4>
116-
.tokenGenerator(tokenGenerator) <5>
117-
.clientAuthentication(clientAuthentication -> { }) <6>
118-
.authorizationEndpoint(authorizationEndpoint -> { }) <7>
119-
.deviceAuthorizationEndpoint(deviceAuthorizationEndpoint -> { }) <8>
120-
.deviceVerificationEndpoint(deviceVerificationEndpoint -> { }) <9>
121-
.tokenEndpoint(tokenEndpoint -> { }) <10>
122-
.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint -> { }) <11>
123-
.tokenRevocationEndpoint(tokenRevocationEndpoint -> { }) <12>
124-
.authorizationServerMetadataEndpoint(authorizationServerMetadataEndpoint -> { }) <13>
125-
.oidc(oidc -> oidc
126-
.providerConfigurationEndpoint(providerConfigurationEndpoint -> { }) <14>
127-
.logoutEndpoint(logoutEndpoint -> { }) <15>
128-
.userInfoEndpoint(userInfoEndpoint -> { }) <16>
129-
.clientRegistrationEndpoint(clientRegistrationEndpoint -> { }) <17>
108+
OAuth2AuthorizationServerConfigurer.authorizationServer();
109+
110+
http
111+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
112+
.with(authorizationServerConfigurer, (authorizationServer) ->
113+
authorizationServer
114+
.registeredClientRepository(registeredClientRepository) <1>
115+
.authorizationService(authorizationService) <2>
116+
.authorizationConsentService(authorizationConsentService) <3>
117+
.authorizationServerSettings(authorizationServerSettings) <4>
118+
.tokenGenerator(tokenGenerator) <5>
119+
.clientAuthentication(clientAuthentication -> { }) <6>
120+
.authorizationEndpoint(authorizationEndpoint -> { }) <7>
121+
.deviceAuthorizationEndpoint(deviceAuthorizationEndpoint -> { }) <8>
122+
.deviceVerificationEndpoint(deviceVerificationEndpoint -> { }) <9>
123+
.tokenEndpoint(tokenEndpoint -> { }) <10>
124+
.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint -> { }) <11>
125+
.tokenRevocationEndpoint(tokenRevocationEndpoint -> { }) <12>
126+
.authorizationServerMetadataEndpoint(authorizationServerMetadataEndpoint -> { }) <13>
127+
.oidc(oidc -> oidc
128+
.providerConfigurationEndpoint(providerConfigurationEndpoint -> { }) <14>
129+
.logoutEndpoint(logoutEndpoint -> { }) <15>
130+
.userInfoEndpoint(userInfoEndpoint -> { }) <16>
131+
.clientRegistrationEndpoint(clientRegistrationEndpoint -> { }) <17>
132+
)
130133
);
131134
132135
return http.build();
@@ -232,18 +235,21 @@ It defines extension points that let you customize the pre-processing, main proc
232235
@Bean
233236
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
234237
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
235-
new OAuth2AuthorizationServerConfigurer();
236-
http.apply(authorizationServerConfigurer);
237-
238-
authorizationServerConfigurer
239-
.clientAuthentication(clientAuthentication ->
240-
clientAuthentication
241-
.authenticationConverter(authenticationConverter) <1>
242-
.authenticationConverters(authenticationConvertersConsumer) <2>
243-
.authenticationProvider(authenticationProvider) <3>
244-
.authenticationProviders(authenticationProvidersConsumer) <4>
245-
.authenticationSuccessHandler(authenticationSuccessHandler) <5>
246-
.errorResponseHandler(errorResponseHandler) <6>
238+
OAuth2AuthorizationServerConfigurer.authorizationServer();
239+
240+
http
241+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
242+
.with(authorizationServerConfigurer, (authorizationServer) ->
243+
authorizationServer
244+
.clientAuthentication(clientAuthentication ->
245+
clientAuthentication
246+
.authenticationConverter(authenticationConverter) <1>
247+
.authenticationConverters(authenticationConvertersConsumer) <2>
248+
.authenticationProvider(authenticationProvider) <3>
249+
.authenticationProviders(authenticationProvidersConsumer) <4>
250+
.authenticationSuccessHandler(authenticationSuccessHandler) <5>
251+
.errorResponseHandler(errorResponseHandler) <6>
252+
)
247253
);
248254
249255
return http.build();
@@ -288,13 +294,16 @@ The following example shows how to configure `JwtClientAssertionAuthenticationPr
288294
@Bean
289295
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
290296
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
291-
new OAuth2AuthorizationServerConfigurer();
292-
http.apply(authorizationServerConfigurer);
297+
OAuth2AuthorizationServerConfigurer.authorizationServer();
293298
294-
authorizationServerConfigurer
295-
.clientAuthentication(clientAuthentication ->
296-
clientAuthentication
297-
.authenticationProviders(configureJwtClientAssertionValidator())
299+
http
300+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
301+
.with(authorizationServerConfigurer, (authorizationServer) ->
302+
authorizationServer
303+
.clientAuthentication(clientAuthentication ->
304+
clientAuthentication
305+
.authenticationProviders(configureJwtClientAssertionValidator())
306+
)
298307
);
299308
300309
return http.build();
@@ -339,14 +348,17 @@ If you need to verify another attribute of the client `X509Certificate`, for exa
339348
@Bean
340349
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
341350
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
342-
new OAuth2AuthorizationServerConfigurer();
343-
http.apply(authorizationServerConfigurer);
351+
OAuth2AuthorizationServerConfigurer.authorizationServer();
344352
345-
authorizationServerConfigurer
346-
.clientAuthentication(clientAuthentication ->
353+
http
354+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
355+
.with(authorizationServerConfigurer, (authorizationServer) ->
356+
authorizationServer
357+
.clientAuthentication(clientAuthentication ->
347358
clientAuthentication
348-
.authenticationProviders(configureX509ClientCertificateVerifier())
349-
);
359+
.authenticationProviders(configureX509ClientCertificateVerifier())
360+
)
361+
);
350362
351363
return http.build();
352364
}

‎docs/modules/ROOT/pages/core-model-components.adoc‎

Lines changed: 33 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -123,13 +123,15 @@ Alternatively, you can configure the `RegisteredClientRepository` through the xr
123123
@Bean
124124
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
125125
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
126-
new OAuth2AuthorizationServerConfigurer();
127-
http.apply(authorizationServerConfigurer);
126+
OAuth2AuthorizationServerConfigurer.authorizationServer();
128127
129-
authorizationServerConfigurer
130-
.registeredClientRepository(registeredClientRepository);
131-
132-
...
128+
http
129+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
130+
.with(authorizationServerConfigurer, (authorizationServer) ->
131+
authorizationServer
132+
.registeredClientRepository(registeredClientRepository)
133+
)
134+
...
133135
134136
return http.build();
135137
}
@@ -218,13 +220,15 @@ Alternatively, you can configure the `OAuth2AuthorizationService` through the xr
218220
@Bean
219221
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
220222
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
221-
new OAuth2AuthorizationServerConfigurer();
222-
http.apply(authorizationServerConfigurer);
223+
OAuth2AuthorizationServerConfigurer.authorizationServer();
223224
224-
authorizationServerConfigurer
225-
.authorizationService(authorizationService);
226-
227-
...
225+
http
226+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
227+
.with(authorizationServerConfigurer, (authorizationServer) ->
228+
authorizationServer
229+
.authorizationService(authorizationService)
230+
)
231+
...
228232
229233
return http.build();
230234
}
@@ -290,13 +294,15 @@ Alternatively, you can configure the `OAuth2AuthorizationConsentService` through
290294
@Bean
291295
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
292296
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
293-
new OAuth2AuthorizationServerConfigurer();
294-
http.apply(authorizationServerConfigurer);
297+
OAuth2AuthorizationServerConfigurer.authorizationServer();
295298
296-
authorizationServerConfigurer
297-
.authorizationConsentService(authorizationConsentService);
298-
299-
...
299+
http
300+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
301+
.with(authorizationServerConfigurer, (authorizationServer) ->
302+
authorizationServer
303+
.authorizationConsentService(authorizationConsentService)
304+
)
305+
...
300306
301307
return http.build();
302308
}
@@ -401,13 +407,15 @@ Alternatively, you can configure the `OAuth2TokenGenerator` through the xref:con
401407
@Bean
402408
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
403409
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
404-
new OAuth2AuthorizationServerConfigurer();
405-
http.apply(authorizationServerConfigurer);
406-
407-
authorizationServerConfigurer
408-
.tokenGenerator(tokenGenerator);
409-
410-
...
410+
OAuth2AuthorizationServerConfigurer.authorizationServer();
411+
412+
http
413+
.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
414+
.with(authorizationServerConfigurer, (authorizationServer) ->
415+
authorizationServer
416+
.tokenGenerator(tokenGenerator)
417+
)
418+
...
411419
412420
return http.build();
413421
}

‎docs/modules/ROOT/pages/guides/how-to-userinfo.adoc‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ TIP: Click on the "Expand folded text" icon in the code sample above to display
3131
This configuration provides the following:
3232

3333
<1> A Spring Security filter chain for the xref:{docs-dir}/protocol-endpoints.adoc[Protocol Endpoints].
34-
<2> Resource server support that allows User Info requests to be authenticated with access tokens.
34+
<2> Enabling OpenID Connect 1.0 will autoconfigure resource server support that allows User Info requests to be authenticated with access tokens.
3535
<3> An instance of `JwtDecoder` used to validate access tokens.
3636

3737
[[customize-user-info]]
@@ -87,9 +87,8 @@ This configuration maps claims from the access token (which is a JWT when using
8787

8888
<1> A Spring Security filter chain for the xref:{docs-dir}/protocol-endpoints.adoc[Protocol Endpoints].
8989
<2> A user info mapper that maps claims in a domain-specific way.
90-
<3> An example showing the configuration option for customizing the user info mapper.
91-
<4> Resource server support that allows User Info requests to be authenticated with access tokens.
92-
<5> An example showing how to apply the `OAuth2AuthorizationServerConfigurer` to the Spring Security configuration.
90+
<3> Enabling OpenID Connect 1.0 will autoconfigure resource server support that allows User Info requests to be authenticated with access tokens.
91+
<4> An example showing the configuration option for customizing the user info mapper.
9392

9493
The user info mapper is not limited to mapping claims from a JWT, but this is a simple example that demonstrates the customization option.
9594
Similar to the xref:guides/how-to-userinfo.adoc#customize-id-token[example shown earlier] where we customize claims of the ID token, you can customize claims of the access token itself ahead of time, as in the following example:

0 commit comments

Comments
 (0)