OAuth 2.0 client configuration For Rest APIs

To configure an OAuth 2.0 client in Spring Security for REST APIs, you need to set up a client registration that specifies the client details and behavior. Below is a guide on how to configure OAuth 2.0 client in Spring Security for REST APIs:

Step 1: Add Dependencies

Include the necessary dependencies for Spring Security and OAuth 2.0 in your project.

                
        <!-- Maven dependency -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-client</artifactId>
    </dependency>

Step 2: Configure OAuth 2.0 Client in application.properties or application.yml

Configure the OAuth 2.0 client details, such as client ID, client secret, and authorization endpoints.

                
    # application.properties

    spring.security.oauth2.client.registration.my-client.client-id=your-client-id
    spring.security.oauth2.client.registration.my-client.client-secret=your-client-secret
    spring.security.oauth2.client.registration.my-client.redirect-uri={baseUrl}/login/oauth2/code/{registrationId}
    spring.security.oauth2.client.registration.my-client.authorization-uri=https://authorization-server.com/oauth/authorize
    spring.security.oauth2.client.registration.my-client.token-uri=https://authorization-server.com/oauth/token
    spring.security.oauth2.client.registration.my-client.user-info-uri=https://authorization-server.com/userinfo
    spring.security.oauth2.client.registration.my-client.scope=openid,profile,email
    spring.security.oauth2.client.registration.my-client.client-name=my-client
    spring.security.oauth2.client.provider.my-client.authorization-uri=https://authorization-server.com/oauth/authorize
    spring.security.oauth2.client.provider.my-client.token-uri=https://authorization-server.com/oauth/token
    spring.security.oauth2.client.provider.my-client.jwk-set-uri=https://authorization-server.com/.well-known/jwks.json
    spring.security.oauth2.client.provider.my-client.user-info-uri=https://authorization-server.com/userinfo

Step 3: Configure OAuth 2.0 Client in SecurityConfig

Create a SecurityConfig class that extends WebSecurityConfigurerAdapter to configure security settings.

                
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;

    @Configuration
    @EnableWebSecurity
    public class SecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .antMatchers("/public/**").permitAll()
                    .antMatchers("/api/**").authenticated()
                    .and()
                .oauth2Login()
                    .loginPage("/login")
                    .and()
                .oauth2Client(); // Enable OAuth 2.0 client support
        }

        @Bean
        @Override
        public UserDetailsService userDetailsService() {
            UserDetails user = User.builder()
                .username("user")
                .password(passwordEncoder().encode("password"))
                .roles("USER")
                .build();

            return new InMemoryUserDetailsManager(user);
        }

        @Bean
        public PasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    }
In this example:
  • /public/** is accessible to everyone.
  • /api/** requires authentication.
  • OAuth 2.0 client support is enabled.

Step 4: Test OAuth 2.0 Login

Ensure that the OAuth 2.0 login flow works by accessing the /login endpoint.

Note:

  • Customize OAuth 2.0 client configurations based on your specific OAuth provider and application requirements.
  • Implement user authentication based on your user management system.

This example provides a basic setup for configuring an OAuth 2.0 client in Spring Security for REST APIs. Adjustments may be needed based on your specific use case and security requirements.

Next Post