Move spring.oauth2.* to security.oauth2.*
Unfortunately, we have no other choice to flip the ignoreUnknownFields attribute of `SecurityProperties` has many different target are now set for that namespace outside the class. See gh-3445 for a potential way to improve that. Closes gh-3327
This commit is contained in:
Stephane Nicoll
@@ -271,13 +271,13 @@ content into your application; rather pick only the properties that you need.
|
||||
security.sessions=stateless # always / never / if_required / stateless
|
||||
security.ignored= # Comma-separated list of paths to exclude from the default secured paths
|
||||
|
||||
# OAuth2 client ({sc-spring-boot-autoconfigure}/security/oauth2/OAuth2ClientProperties.{sc-ext}[OAuth2ClientProperties]
|
||||
spring.oauth2.client.client-id= # OAuth2 client id
|
||||
spring.oauth2.client.client-secret= # OAuth2 client secret. A random secret is generated by default
|
||||
# SECURITY OAUTH2 CLIENT ({sc-spring-boot-autoconfigure}/security/oauth2/OAuth2ClientProperties.{sc-ext}[OAuth2ClientProperties]
|
||||
security.oauth2.client.client-id= # OAuth2 client id
|
||||
security.oauth2.client.client-secret= # OAuth2 client secret. A random secret is generated by default
|
||||
|
||||
# OAuth2 SSO ({sc-spring-boot-autoconfigure}/security/oauth2/client/OAuth2SsoProperties.{sc-ext}[OAuth2SsoProperties]
|
||||
spring.oauth2.sso.filter-order= # Filter order to apply if not providing an explicit WebSecurityConfigurerAdapter
|
||||
spring.oauth2.sso.login-path= # Path to the login page, i.e. the one that triggers the redirect to the OAuth2 Authorization Server
|
||||
# SECURITY OAUTH2 SSO ({sc-spring-boot-autoconfigure}/security/oauth2/client/OAuth2SsoProperties.{sc-ext}[OAuth2SsoProperties]
|
||||
security.oauth2.sso.filter-order= # Filter order to apply if not providing an explicit WebSecurityConfigurerAdapter
|
||||
security.oauth2.sso.login-path= # Path to the login page, i.e. the one that triggers the redirect to the OAuth2 Authorization Server
|
||||
|
||||
# DATASOURCE ({sc-spring-boot-autoconfigure}/jdbc/DataSourceAutoConfiguration.{sc-ext}[DataSourceAutoConfiguration] & {sc-spring-boot-autoconfigure}/jdbc/DataSourceProperties.{sc-ext}[DataSourceProperties])
|
||||
spring.datasource.name= # name of the data source
|
||||
|
||||
@@ -1640,8 +1640,8 @@ auto-configuration to make it easy to set up Authorization or Resource Server.
|
||||
[[boot-features-security-oauth2-authorization-server]]
|
||||
==== Authorization Server
|
||||
To create an Authorization Server and grant access tokens you need to use
|
||||
`@EnableAuthorizationServer` and provide `spring.oauth2.client.client-id` and
|
||||
`spring.oauth2.client.client-secret]` properties. The client will be registered for you
|
||||
`@EnableAuthorizationServer` and provide `security.oauth2.client.client-id` and
|
||||
`security.oauth2.client.client-secret]` properties. The client will be registered for you
|
||||
in an in-memory repository.
|
||||
|
||||
Having done that you will be able to use the client credentials to create an access token,
|
||||
@@ -1670,21 +1670,21 @@ access tokens. If your appplication is also an Authorization Server it already k
|
||||
to decode tokens, so there is nothing else to do. If your app is a standalone service then you
|
||||
need to give it some more configuration, one of the following options:
|
||||
|
||||
* `spring.oauth2.resource.user-info-uri` to use the `/me` resource (e.g.
|
||||
* `security.oauth2.resource.user-info-uri` to use the `/me` resource (e.g.
|
||||
`https://uaa.run.pivotal.io/userinfo` on PWS)
|
||||
|
||||
* `spring.oauth2.resource.token-info-uri` to use the token decoding endpoint (e.g.
|
||||
* `security.oauth2.resource.token-info-uri` to use the token decoding endpoint (e.g.
|
||||
`https://uaa.run.pivotal.io/check_token` on PWS).
|
||||
|
||||
If you specify both the `user-info-uri` and the `token-info-uri` then you can set a flag
|
||||
to say that one is preferred over the other (`prefer-token-info=true` is the default).
|
||||
|
||||
Alternatively (instead of `user-info-uri` or `token-info-uri`) if the tokens are JWTs you
|
||||
can configure a `spring.oauth2.resource.jwt.key-value` to decode them locally (where the
|
||||
can configure a `security.oauth2.resource.jwt.key-value` to decode them locally (where the
|
||||
key is a verification key). The verification key value is either a symmetric secret or
|
||||
PEM-encoded RSA public key. If you don't have the key and it's public you can provide a
|
||||
URI where it can be downloaded (as a JSON object with a "`value`" field) with
|
||||
`spring.oauth2.resource.jwt.key-uri`. E.g. on PWS:
|
||||
`security.oauth2.resource.jwt.key-uri`. E.g. on PWS:
|
||||
|
||||
[indent=0]
|
||||
----
|
||||
@@ -1692,7 +1692,7 @@ URI where it can be downloaded (as a JSON object with a "`value`" field) with
|
||||
{"alg":"SHA256withRSA","value":"-----BEGIN PUBLIC KEY-----\nMIIBI...\n-----END PUBLIC KEY-----\n"}
|
||||
----
|
||||
|
||||
WARNING: If you use the `spring.oauth2.resource.jwt.key-uri` the authorization server
|
||||
WARNING: If you use the `security.oauth2.resource.jwt.key-uri` the authorization server
|
||||
needs to be running when your application starts up. It will log a warning if it can't
|
||||
find the key, and tell you what to do to fix it.
|
||||
|
||||
@@ -1703,7 +1703,7 @@ find the key, and tell you what to do to fix it.
|
||||
Google, and certain other 3rd party identity providers, are more strict about the token
|
||||
type name that is sent in the headers to the user info endpoint. The default is "`Bearer`"
|
||||
which suits most providers and matches the spec, but if you need to change it you can set
|
||||
`spring.oauth2.resource.token-type`.
|
||||
`security.oauth2.resource.token-type`.
|
||||
|
||||
|
||||
|
||||
@@ -1727,13 +1727,14 @@ language feature). Example:
|
||||
|
||||
[source,yaml,indent=0]
|
||||
----
|
||||
oauth2:
|
||||
resource:
|
||||
jwt:
|
||||
keyValue: |
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC...
|
||||
-----END PUBLIC KEY-----
|
||||
security:
|
||||
oauth2:
|
||||
resource:
|
||||
jwt:
|
||||
keyValue: |
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC...
|
||||
-----END PUBLIC KEY-----
|
||||
----
|
||||
====
|
||||
|
||||
@@ -1743,21 +1744,21 @@ language feature). Example:
|
||||
==== Client
|
||||
To make your webapp into an OAuth2 client you can simply add `@EnableOAuth2Client` and
|
||||
Spring Boot will create an `OAuth2RestTemplate` for you to `@Autowire`. It uses the
|
||||
`spring.oauth2.client.*` as credentials (the same as you might be using in the
|
||||
`security.oauth2.client.*` as credentials (the same as you might be using in the
|
||||
Authorization Server), but in addition it will need to know the authorization and token
|
||||
URIs in the Authorization Server. For example:
|
||||
|
||||
.application.yml
|
||||
[source,yaml,indent=0]
|
||||
----
|
||||
spring:
|
||||
oauth2:
|
||||
client:
|
||||
clientId: bd1c0a783ccdd1c9b9e4
|
||||
clientSecret: 1a9030fbca47a5b2c28e92f19050bb77824b5ad1
|
||||
accessTokenUri: https://github.com/login/oauth/access_token
|
||||
userAuthorizationUri: https://github.com/login/oauth/authorize
|
||||
clientAuthenticationScheme: form
|
||||
security:
|
||||
oauth2:
|
||||
client:
|
||||
clientId: bd1c0a783ccdd1c9b9e4
|
||||
clientSecret: 1a9030fbca47a5b2c28e92f19050bb77824b5ad1
|
||||
accessTokenUri: https://github.com/login/oauth/access_token
|
||||
userAuthorizationUri: https://github.com/login/oauth/authorize
|
||||
clientAuthenticationScheme: form
|
||||
----
|
||||
|
||||
An application with this configuration will redirect to Github for authorization when you
|
||||
@@ -1767,21 +1768,21 @@ application is running on port 8080 (register your own client app in Github or o
|
||||
provider for more flexibility).
|
||||
|
||||
To limit the scope that the client asks for when it obtains an access token you can set
|
||||
`spring.oauth2.client.scope` (comma separated or an array in YAML). By default the scope
|
||||
`security.oauth2.client.scope` (comma separated or an array in YAML). By default the scope
|
||||
is empty and it is up to to Authorization Server to decide what the defaults should be,
|
||||
usually depending on the settings in the client registration that it holds.
|
||||
|
||||
NOTE: There is also a setting for `spring.oauth2.client.client-authentication-scheme`
|
||||
NOTE: There is also a setting for `security.oauth2.client.client-authentication-scheme`
|
||||
which defaults to "`header`" (but you might need to set it to "`form`" if, like Github for
|
||||
instance, your OAuth2 provider doesn't like header authentication). In fact, the
|
||||
`spring.oauth2.client.*` properties are bound to an instance of
|
||||
`security.oauth2.client.*` properties are bound to an instance of
|
||||
`AuthorizationCodeResourceDetails` so all its properties can be specified.
|
||||
|
||||
TIP: In a non-web application you can still `@Autowire` an `OAuth2RestOperations` and it
|
||||
is still wired into the `spring.oauth2.client.*` configuration. In this case it is a
|
||||
is still wired into the `security.oauth2.client.*` configuration. In this case it is a
|
||||
"`client credentials token grant`" you will be asking for if you use it (and there is no
|
||||
need to use `@EnableOAuth2Client` or `@EnableOAuth2Sso`). To switch it off, just remove
|
||||
the `spring.oauth2.client.client-id` from your configuration (or make it the empty
|
||||
the `security.oauth2.client.client-id` from your configuration (or make it the empty
|
||||
string).
|
||||
|
||||
|
||||
@@ -1795,12 +1796,12 @@ for a Single Sign On (SSO) protocol based on OAuth2, and Spring Boot makes it ea
|
||||
participate by providing an annotation `@EnableOAuth2Sso`. The Github client above can
|
||||
protect all its resources and authenticate using the Github `/user/` endpoint, by adding
|
||||
that annotation and declaring where to find the endpoint (in addition to the
|
||||
`spring.oauth2.client.*` configuration already listed above):
|
||||
`security.oauth2.client.*` configuration already listed above):
|
||||
|
||||
.application.yml
|
||||
[source,yaml,indent=0]]
|
||||
----
|
||||
spring:
|
||||
security:
|
||||
oauth2:
|
||||
...
|
||||
resource:
|
||||
@@ -1810,7 +1811,7 @@ that annotation and declaring where to find the endpoint (in addition to the
|
||||
|
||||
Since all paths are secure by default, there is no "`home`" page that you can show to
|
||||
unauthenticated users and invite them to login (by visiting the `/login` path, or the
|
||||
path specified by `spring.oauth2.sso.login-path`).
|
||||
path specified by `security.oauth2.sso.login-path`).
|
||||
|
||||
To customize the access rules or paths to protect, so you can add a "`home`" page for
|
||||
instance, `@EnableOAuth2Sso` can be added to a `WebSecurityConfigurerAdapter` and the
|
||||
|
||||
Reference in New Issue
Block a user