Adds dynamic client registration how-to guide
Closes gh-647
This commit is contained in:
Dmitriy Dubson
committed by
Joe Grandja
Joe Grandja
parent
05f1371668
commit
3386b1e8a2
111
docs/src/main/java/sample/dcr/DcrClient.java
Normal file
111
docs/src/main/java/sample/dcr/DcrClient.java
Normal file
@@ -0,0 +1,111 @@
|
||||
/*
|
||||
* Copyright 2020-2023 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package sample.dcr;
|
||||
|
||||
import com.fasterxml.jackson.annotation.JsonProperty;
|
||||
import org.springframework.http.HttpHeaders;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.security.oauth2.core.AuthorizationGrantType;
|
||||
import org.springframework.web.reactive.function.client.WebClient;
|
||||
import reactor.core.publisher.Mono;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.Objects;
|
||||
|
||||
public class DcrClient {
|
||||
// @fold:on
|
||||
private final WebClient webClient;
|
||||
|
||||
public DcrClient(final WebClient webClient) {
|
||||
this.webClient = webClient;
|
||||
}
|
||||
// @fold:off
|
||||
|
||||
public record DcrRequest( // <1>
|
||||
@JsonProperty("client_name") String clientName,
|
||||
@JsonProperty("grant_types") List<String> grantTypes,
|
||||
@JsonProperty("redirect_uris") List<String> redirectUris,
|
||||
String scope) {
|
||||
}
|
||||
|
||||
public record DcrResponse( // <2>
|
||||
@JsonProperty("registration_access_token") String registrationAccessToken,
|
||||
@JsonProperty("registration_client_uri") String registrationClientUri,
|
||||
@JsonProperty("client_name") String clientName,
|
||||
@JsonProperty("client_secret") String clientSecret,
|
||||
@JsonProperty("grant_types") List<String> grantTypes,
|
||||
@JsonProperty("redirect_uris") List<String> redirectUris,
|
||||
String scope) {
|
||||
}
|
||||
|
||||
public static final DcrRequest SAMPLE_CLIENT_REGISTRATION_REQUEST = new DcrRequest( // <3>
|
||||
"client-1",
|
||||
List.of(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()),
|
||||
List.of("https://client.example.org/callback", "https://client.example.org/callback2"),
|
||||
"openid email profile"
|
||||
);
|
||||
|
||||
public void exampleRegistration(String initialAccessToken) { // <4>
|
||||
DcrResponse clientRegistrationResponse =
|
||||
this.registerClient(initialAccessToken, SAMPLE_CLIENT_REGISTRATION_REQUEST); // <5>
|
||||
|
||||
assert (clientRegistrationResponse.clientName().contentEquals("client-1")); // <6>
|
||||
assert (!Objects.isNull(clientRegistrationResponse.clientSecret()));
|
||||
assert (clientRegistrationResponse.scope().contentEquals("openid profile email"));
|
||||
assert (clientRegistrationResponse.grantTypes().contains(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()));
|
||||
assert (clientRegistrationResponse.redirectUris().contains("https://client.example.org/callback"));
|
||||
assert (clientRegistrationResponse.redirectUris().contains("https://client.example.org/callback2"));
|
||||
assert (!clientRegistrationResponse.registrationAccessToken().isEmpty());
|
||||
assert (!clientRegistrationResponse.registrationClientUri().isEmpty());
|
||||
|
||||
String registrationAccessToken = clientRegistrationResponse.registrationAccessToken(); // <7>
|
||||
String registrationClientUri = clientRegistrationResponse.registrationClientUri();
|
||||
|
||||
DcrResponse retrievedClient = this.retrieveClient(registrationAccessToken, registrationClientUri); // <8>
|
||||
|
||||
assert (retrievedClient.clientName().contentEquals("client-1")); // <9>
|
||||
assert (!Objects.isNull(retrievedClient.clientSecret()));
|
||||
assert (retrievedClient.scope().contentEquals("openid profile email"));
|
||||
assert (retrievedClient.grantTypes().contains(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()));
|
||||
assert (retrievedClient.redirectUris().contains("https://client.example.org/callback"));
|
||||
assert (retrievedClient.redirectUris().contains("https://client.example.org/callback2"));
|
||||
assert (Objects.isNull(retrievedClient.registrationAccessToken()));
|
||||
assert (!retrievedClient.registrationClientUri().isEmpty());
|
||||
}
|
||||
|
||||
public DcrResponse registerClient(String initialAccessToken, DcrRequest request) { // <10>
|
||||
return this.webClient
|
||||
.post()
|
||||
.uri("/connect/register")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.accept(MediaType.APPLICATION_JSON)
|
||||
.header(HttpHeaders.AUTHORIZATION, "Bearer %s".formatted(initialAccessToken))
|
||||
.body(Mono.just(request), DcrRequest.class)
|
||||
.retrieve()
|
||||
.bodyToMono(DcrResponse.class)
|
||||
.block();
|
||||
}
|
||||
|
||||
public DcrResponse retrieveClient(String registrationAccessToken, String registrationClientUri) { // <11>
|
||||
return this.webClient
|
||||
.get()
|
||||
.uri(registrationClientUri)
|
||||
.header(HttpHeaders.AUTHORIZATION, "Bearer %s".formatted(registrationAccessToken))
|
||||
.retrieve()
|
||||
.bodyToMono(DcrResponse.class)
|
||||
.block();
|
||||
}
|
||||
}
|
||||
96
docs/src/main/java/sample/dcr/DcrConfiguration.java
Normal file
96
docs/src/main/java/sample/dcr/DcrConfiguration.java
Normal file
@@ -0,0 +1,96 @@
|
||||
/*
|
||||
* Copyright 2020-2023 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package sample.dcr;
|
||||
|
||||
import com.nimbusds.jose.jwk.JWKSet;
|
||||
import com.nimbusds.jose.jwk.RSAKey;
|
||||
import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
|
||||
import com.nimbusds.jose.jwk.source.JWKSource;
|
||||
import com.nimbusds.jose.proc.SecurityContext;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.core.userdetails.UserDetailsService;
|
||||
import org.springframework.security.oauth2.jwt.JwtDecoder;
|
||||
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
|
||||
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
|
||||
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
|
||||
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
|
||||
import java.security.KeyPair;
|
||||
import java.security.KeyPairGenerator;
|
||||
import java.security.interfaces.RSAPrivateKey;
|
||||
import java.security.interfaces.RSAPublicKey;
|
||||
import java.util.Collections;
|
||||
import java.util.UUID;
|
||||
|
||||
@Configuration
|
||||
@EnableWebSecurity
|
||||
public class DcrConfiguration {
|
||||
@Bean // <1>
|
||||
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
|
||||
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
|
||||
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
|
||||
.oidc(oidc -> oidc.clientRegistrationEndpoint(Customizer.withDefaults())); // <2>
|
||||
http.oauth2ResourceServer(oauth2ResourceServer ->
|
||||
oauth2ResourceServer.jwt(Customizer.withDefaults()));
|
||||
|
||||
return http.build();
|
||||
}
|
||||
// @fold:on
|
||||
|
||||
@Bean
|
||||
public UserDetailsService userDetailsService() {
|
||||
// This example uses client credentials grant type - no need for any users.
|
||||
return new InMemoryUserDetailsManager(Collections.emptyList());
|
||||
}
|
||||
|
||||
@Bean
|
||||
public JWKSource<SecurityContext> jwkSource() {
|
||||
// @formatter:off
|
||||
KeyPair keyPair;
|
||||
try {
|
||||
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
|
||||
keyPairGenerator.initialize(2048);
|
||||
keyPair = keyPairGenerator.generateKeyPair();
|
||||
} catch (Exception ex) {
|
||||
throw new IllegalStateException(ex);
|
||||
}
|
||||
RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
|
||||
RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
|
||||
RSAKey rsaKey = new RSAKey.Builder(publicKey)
|
||||
.privateKey(privateKey)
|
||||
.keyID(UUID.randomUUID().toString())
|
||||
.build();
|
||||
// @formatter:on
|
||||
JWKSet jwkSet = new JWKSet(rsaKey);
|
||||
return new ImmutableJWKSet<>(jwkSet);
|
||||
}
|
||||
|
||||
@Bean
|
||||
public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
|
||||
return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
|
||||
}
|
||||
|
||||
@Bean
|
||||
public AuthorizationServerSettings authorizationServerSettings() {
|
||||
return AuthorizationServerSettings.builder().build();
|
||||
}
|
||||
// @fold:off
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
/*
|
||||
* Copyright 2020-2023 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package sample.dcr;
|
||||
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.security.oauth2.core.AuthorizationGrantType;
|
||||
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
|
||||
import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
|
||||
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
|
||||
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
|
||||
|
||||
import java.util.UUID;
|
||||
|
||||
@Configuration
|
||||
public class RegisteredClientConfiguration {
|
||||
@Bean // <1>
|
||||
public RegisteredClientRepository registeredClientRepository() {
|
||||
RegisteredClient initialClient = RegisteredClient.withId(UUID.randomUUID().toString())
|
||||
.clientId("dcr-client") // <2>
|
||||
.clientSecret("{noop}secret")
|
||||
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
|
||||
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) // <3>
|
||||
.scope("client.create") // <4>
|
||||
.scope("client.read") // <5>
|
||||
.build();
|
||||
|
||||
return new InMemoryRegisteredClientRepository(initialClient); // <6>
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
/*
|
||||
* Copyright 2020-2023 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package sample.dcr;
|
||||
|
||||
import com.jayway.jsonpath.JsonPath;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
|
||||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
|
||||
import org.springframework.boot.test.context.SpringBootTest;
|
||||
import org.springframework.boot.test.web.server.LocalServerPort;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
import org.springframework.web.reactive.function.client.WebClient;
|
||||
|
||||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
|
||||
/**
|
||||
* Tests for Dynamic Client Registration how-to guide
|
||||
*
|
||||
* @author Dmitriy Dubson
|
||||
*/
|
||||
@SpringBootTest(
|
||||
webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
|
||||
classes = {DynamicClientRegistrationTests.AuthorizationServerConfig.class}
|
||||
)
|
||||
@AutoConfigureMockMvc
|
||||
public class DynamicClientRegistrationTests {
|
||||
|
||||
@Autowired
|
||||
private MockMvc mvc;
|
||||
|
||||
@LocalServerPort
|
||||
private String port;
|
||||
|
||||
@Test
|
||||
public void dynamicallyRegisterAClient() throws Exception {
|
||||
String tokenRequestBody = "scope=client.create&grant_type=client_credentials" ;
|
||||
MockHttpServletResponse tokenResponse = this.mvc.perform(post("/oauth2/token")
|
||||
.with(httpBasic("dcr-client", "secret"))
|
||||
.contentType(MediaType.APPLICATION_FORM_URLENCODED_VALUE)
|
||||
.content(tokenRequestBody))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(jsonPath("$.access_token").isNotEmpty())
|
||||
.andReturn()
|
||||
.getResponse();
|
||||
|
||||
String initialAccessToken = JsonPath.parse(tokenResponse.getContentAsString()).read("$.access_token");
|
||||
|
||||
WebClient webClient = WebClient.builder().baseUrl("http://127.0.0.1:%s".formatted(port)).build();
|
||||
DcrClient dcrClient = new DcrClient(webClient);
|
||||
|
||||
dcrClient.exampleRegistration(initialAccessToken);
|
||||
}
|
||||
|
||||
@EnableAutoConfiguration
|
||||
@EnableWebSecurity
|
||||
@Import({DcrConfiguration.class, RegisteredClientConfiguration.class})
|
||||
static class AuthorizationServerConfig {
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user