Software Programming: OAuth2 Security

Wednesday 13 July 2022

Social Client Login with OAuth2 Spring Boot Application

July 13, 2022 java , Microservices , OAuth2 Security , Spring Boot 2 comments :

First of all you have to take auth2 access to the social web site, we see it in the video, then we will create a services and test it and see some services we learned in the previous post, we will give their link below which includes Eureka (client-1, client-2), ApiGetway, services.

Add client and secret Id in ApiGetway application.properties file:

spring.security.oauth2.client.registration.Oauth2_Security.client-id = Write your Client ID spring.security.oauth2.client.registration.Oauth2_Security.client-secret = Write your Secret ID

Add use Dependency in ApiGetway pom.xml file:

Add New Package in ApiGetway-> com.javatechie.spring.zulu.api.cofig and create SecurityConfiguration.java file.

package com.javatechie.spring.zulu.api.cofig;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
@EnableGlobalAuthentication
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
	
	
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		
		http.csrf().disable().antMatcher("/**").authorizeRequests()
         .antMatchers("/cli-api/**","/cli2-api/**").authenticated()
         .anyRequest().authenticated()
         .and()
         .oauth2Login().permitAll()
         .and()
         .logout()
         .invalidateHttpSession(true)
         .clearAuthentication(true)
         .logoutSuccessUrl("/");
		
	}
}

See the video step by step to run/learn past post video and current configuration post.

How to Develop Some Other Rest API How to Develop Eureka Server and Eureka Client Configuration How to Develop GateWayAPI How to get Google Token

Wednesday 6 July 2022

OAuth2 Security with Spring Boot

July 06, 2022 java , OAuth2 Security , Spring , Spring Boot 1 comment :

Introduction
OAuth2 is a token-based security authentication and authorization framework that breaks security down into four components. These four components are

A protected resource—This is the resource (in our case, a microservice) you want to protect and ensure that only authenticated users who have the proper authorization can access
A resource owner—A resource owner defines what applications can call their service, which users are allowed to access the service, and what they can do with the service. Each application registered by the resource owner will be given an application name that identifies the application along with an application secret key. The combination of the application name and the secret key are part of the credentials that are passed when authenticating an OAuth2 token.
An application—This is the application that’s going to call the service on a behalf of a user. After all, users rarely invoke a service directly. Instead, they rely on an application to do the work for them.
OAuth2 authentication server—The OAuth2 authentication server is the intermediary between the application and the services being consumed. The OAuth2 server allows the user to authenticate themselves without having to pass their user credentials down to every service the application is going to call on behalf of the user.

OAuth2 is a token-based security framework. A user authenticates against the OAuth2 server by providing their credentials along with the application that they’re using to access the resource. If the user’s credentials are valid, the OAuth2 server provides a token that can be presented every time a service being used by the user’s application tries to access a protected resource (the microservice). The OAuth2 specification has four types of grants:

Password
Client credential
Authorization code
Implicit

To set up an OAuth2 authentication server, you need the following Spring Cloud dependencies in the authentication-service/pom.xml file

For Example: You have to Create Project Node Name is: "a143mk-Oauth2-Security" on STS4 Tools.

Pom.xml file.

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.1.3.RELEASE</version>
		<relativePath/> 
	</parent>
	<groupId>a143mk.Controller.jpa</groupId>
	<artifactId>springsecurity</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>a143mk-Oauth2-Security</name>
	<description>Demo project for Spring Boot Oauth2 Security</description>
	<properties>
		<java.version>1.8</java.version>
		<spring-cloud.version>Greenwich.SR3</spring-cloud.version>
		
	</properties>
	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
		
		<dependency>
			<groupId>org.springframework.cloud</groupId>
			<artifactId>spring-cloud-starter-oauth2</artifactId>
		</dependency>

<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-test</artifactId>
			<scope>test</scope>
		</dependency>
	</dependencies>
	
	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-dependencies</artifactId>
				<version>${spring-cloud.version}</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
		</dependencies>
	</dependencyManagement>

<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
		</plugins>
	</build>

</project>

Create AuthServer.java class for use Authorization Server Configuration.

package a143mk.Security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;

@Configuration
@EnableAuthorizationServer
public class AuthServer extends AuthorizationServerConfigurerAdapter{

@Autowired
	AuthenticationManager authenticationManager;
	
	@Override
	public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
		clients.inMemory().withClient("abcds").secret("12345").scopes("read"). //abcd is client name/ID
		accessTokenValiditySeconds(1000)  // write the token expiry time.
		.authorizedGrantTypes("password","refresh_token");
		
		
		
	}

@SuppressWarnings("deprecation")
	@Override
	public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
		security.passwordEncoder(NoOpPasswordEncoder.getInstance());
		security.checkTokenAccess("isAuthenticated()").tokenKeyAccess("permitAll()");
		
	}

@Override
	public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
		 
		endpoints.authenticationManager(authenticationManager);
	}

}

The first thing to note in this listing is the @EnableAuthorizationServer annotation. This annotation tells Spring Cloud that this service will be used as an OAuth2 service and to add several REST-based endpoints that will be used in the OAuth2 authentication and authorization processes.

Like other pieces of the Spring Security framework, to set up users (and their roles), start by extending the WebSecurityConfigurerAdapter class and mark it with the @Configuration annotation.
As such, you need to provide the OAuth2 server a mechanism to authenticate users and return the user information about the authenticating user. This is done by defining two beans in your Spring WebSecurityConfigurerAdapter implementation: authenticationManagerBean() and userDetailsServiceBean(). These two beans are exposed by using the default authentication authenticationManagerBean() and userDetailsServiceBean() methods from the parent WebSecurityConfigurerAdapter class.
you have to Create ConfigWeb.java class.

package a143mk.Security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@SuppressWarnings("deprecation")
@Configuration
public class ConfigWeb extends WebSecurityConfigurerAdapter{

@Bean
	public UserDetailsService userdetailsservice()
	{
		InMemoryUserDetailsManager user=new InMemoryUserDetailsManager();
		user.createUser(User.withUsername("abcd")
				.password(passwordEncoder().encode("123")).roles("USER").authorities("read").build());
		return user;
	}
	
	@Bean
	public PasswordEncoder passwordEncoder()
	{
		return new BCryptPasswordEncoder();
	}

@Override
	@Bean
	public AuthenticationManager authenticationManagerBean() throws Exception {
		// TODO Auto-generated method stub
		return super.authenticationManagerBean();
	}

@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.formLogin();
		http.authorizeRequests().anyRequest().authenticated();
	}
		
}

Run As-> Spring Boot App for Output:

For step by step development working watch the video and learn yourself.

Subscribe to: Posts ( Atom )

Wednesday 13 July 2022

Social Client Login with OAuth2 Spring Boot Application

Wednesday 6 July 2022

OAuth2 Security with Spring Boot

OUR TECH-PROJECTS

DOWNLOAD ANY ONLINE VIDEOS

LABELS

Development Accessories

POPULAR POSTS