2. Create and Configure the SecurityFilterChain Bean<\/strong><\/h4>\n1. Create the security configuration file (name it SecurityConfig.java) in the config directory.<\/p>\n
2. Annotate this class with @Configuration and @EnableWebSecurity<\/p>\n
3. Create the SecurityFilterChain bin. It takes HttpSecurity as parameter, builds and returns the SecurityFilterChain.\u00a0 The code below shows what is returned:<\/p>\n
return<\/span> httpSecurity\r\n .<\/span>csrf<\/span>(<\/span>AbstractHttpConfigurer:<\/span>:<\/span>disable)<\/span>\r\n .<\/span>authorizeHttpRequests<\/span>(<\/span>auth -><\/span> auth\r\n .<\/span>anyRequest<\/span>().<\/span>authenticated<\/span>()<\/span>\r\n )<\/span>\r\n .<\/span>sessionManagement<\/span>(<\/span>session -><\/span> session.<\/span>sessionCreationPolicy<\/span>(<\/span>SessionCreationPolicy.<\/span>STATELESS<\/span>))<\/span>\r\n .<\/span>httpBasic<\/span>(<\/span>Customizer.<\/span>withDefaults<\/span>())<\/span>\r\n .<\/span>build<\/span>();<\/span>\r\n<\/pre>\n <\/p>\n
3. Create a Test User Bean<\/strong><\/h4>\nFor this tutorial, we would create a user in memory. In the following tutorial, we would implemented UserDetailsService.<\/p>\n
1. Create the InMemoryUserDetailsManager bean as shown below:<\/p>\n
@Bean<\/span>\r\npublic<\/span> InMemoryUserDetailsManager manager<\/span>(){<\/span>\r\n return<\/span> new<\/span> InMemoryUserDetailsManager<\/span>(<\/span>\r\n User.<\/span>withUsername<\/span>(<\/span>\"kindson\"<\/span>)<\/span>\r\n .<\/span>password<\/span>(<\/span>\"{noop}password\"<\/span>)<\/span>\r\n .<\/span>authorities<\/span>(<\/span>\"read\"<\/span>)<\/span>\r\n .<\/span>build<\/span>()<\/span>\r\n );<\/span>\r\n}<\/span>\r\n<\/pre>\n <\/p>\n
4. Configure the ResourceServer<\/strong><\/h4>\nAn OAuth2 resource server in Spring is a server that protects resources (e.g., APIs) and ensures that requests are authenticated using access tokens, typically issued by an OAuth2 authorization server.<\/p>\n
We would have to tell Spring that our service is an OAuth2 resource server.<\/p>\n
1. Add this line just before the sessionManagement line in the SecurityFilterChain bean<\/p>\n
.<\/span>oauth2ResourceServer<\/span>(<\/span>oauth2 -><\/span> oauth2.<\/span>jwt<\/span>(<\/span>Customizer.<\/span>withDefaults<\/span>()))<\/span> \r\n<\/pre>\n <\/p>\n
2. Run the application. Note that you will have the exception below:<\/p>\n
Parameter 0 of method setFilterChains in org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration required a bean of type 'org.springframework.security.oauth2.jwt.JwtDecoder' that could not be found.\r\n<\/pre>\nTo create a JwtDecoder, we would need to create a public\/private key pair.<\/p>\n
<\/p>\n
5. Create a Public\/Private Key Pair<\/strong><\/h4>\nWe would use the openssl tool in Mac to create the keys<\/p>\n
1. Create a folder called certs in the resources folder<\/p>\n
2. Navigate to this certs directory in the terminal and run the following command<\/p>\n
openssl genrsa -out keypair.pem 2048\r\n<\/pre>\n <\/p>\n
3. Run the following command to extract the public key.<\/p>\n
openssl rsa -in keypair.pem -pubout -out public.pem\r\n<\/pre>\n <\/p>\n
4. Run the following command to create a private key in the required format: pkcs8<\/p>\n
openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in keypair.pem -out private.pem\r\n<\/pre>\n <\/p>\n
5. Delete the keypair.pem<\/p>\n
<\/p>\n
6. Create Some Configuration to Externalize the Keys<\/strong><\/h4>\n1. Create a\u00a0 record and call it RsaKeyProperties. This would have two fields as shown below:<\/p>\n
@ConfigurationProperties<\/span>(<\/span>prefix =<\/span> \"rsa\"<\/span>)<\/span>\r\npublic<\/span> record RsaKeyProperties<\/span>(<\/span>RSAPublicKey publicKey,<\/span> RSAPrivateKey privateKey)<\/span> {<\/span>\r\n}<\/span>\r\n<\/pre>\n <\/p>\n
2. Set the values in the application.properties file<\/p>\n
rsa.<\/span>private<\/span>-<\/span>key=<\/span>classpath:<\/span>certs\/<\/span>private<\/span>.<\/span>pem<\/span>\r\nrsa.<\/span>public<\/span>-<\/span>key=<\/span>classpath:<\/span>certs\/<\/span>public<\/span>.<\/span>pem<\/span>\r\n<\/pre>\n <\/p>\n
3. Annotate the main class with @EnableConfigurationProperties like so
\n<\/p>\n
@EnableConfigurationProperties<\/span>(<\/span>RsaKeyProperties.<\/span>class<\/span>)<\/span>\r\n<\/pre>\n <\/p>\n
7. Create the JwtDecoder and JwtEncoder Bean<\/strong><\/h4>\nWe would need the keys to be able to create a JwtDecoder. This would be used to decipher the token<\/p>\n
1. Inject the RsaKeyProperties into the SecurityConfig as shown:<\/p>\n
private<\/span> final<\/span> RsaKeyProperties properties;<\/span>\r\n\r\npublic<\/span> SecurityConfig<\/span>(<\/span>RsaKeyProperties properties)<\/span> {<\/span>\r\n this<\/span>.<\/span>properties<\/span> =<\/span> properties;<\/span>\r\n}<\/span>\r\n<\/pre>\n <\/p>\n
2. Defined the decoder using the keys:<\/p>\n
@Bean<\/span>\r\nJwtDecoder jwtDecoder<\/span>()<\/span> {<\/span>\r\n return<\/span> NimbusJwtDecoder.<\/span>withPublicKey<\/span>(<\/span>properties.<\/span>publicKey<\/span>()).<\/span>build<\/span>();<\/span>\r\n}<\/span>\r\n<\/pre>\n <\/p>\n
3. Create the JwtEncoder Bean<\/p>\n
@Bean<\/span>\r\nJwtEncoder jwtEncoder<\/span>(){<\/span>\r\n JWK jwk =<\/span> new<\/span> RSAKey.<\/span>Builder<\/span>(<\/span>rsaKeyProperties.<\/span>publicKey<\/span>()).<\/span>privateKey<\/span>(<\/span>rsaKeyProperties.<\/span>privateKey<\/span>()).<\/span>build<\/span>();<\/span>\r\n JWKSource<<\/span>SecurityContext><\/span> jwkSource =<\/span> new<\/span> ImmutableJWKSet<>(<\/span>new<\/span> JWKSet(<\/span>jwk));<\/span>\r\n return<\/span> new<\/span> NimbusJwtEncoder<\/span>(<\/span>jwkSource);<\/span>\r\n}<\/span>\r\n<\/pre>\n <\/p>\n
8. Create the TokenService<\/strong><\/h4>\nWe would need a service that contains the generateToken method. The method would create a token and encode it using the JwtEncoder.<\/p>\n
1. Create the TokenService inside the service package<\/p>\n
2. Get a reference to the JwtEncoder bean<\/p>\n
3. Create the method as shown below:<\/p>\n
public<\/span> String generateToken<\/span>(<\/span>Authentication authentication){<\/span>\r\n Instant now =<\/span> Instant.<\/span>now<\/span>();<\/span>\r\n String scope =<\/span> authentication.<\/span>getAuthorities<\/span>().<\/span>stream<\/span>()<\/span>\r\n .<\/span>map<\/span>(<\/span>GrantedAuthority:<\/span>:<\/span>getAuthority)<\/span>\r\n .<\/span>collect<\/span>(<\/span>Collectors.<\/span>joining<\/span>(<\/span>