From 460fdaf52f9eb0012bb3fb14091b075d6b4b3a29 Mon Sep 17 00:00:00 2001 From: artsiom Date: Sat, 10 Nov 2018 12:40:55 +0300 Subject: [PATCH 1/2] Add configurable property for JWK encryption algorithm See gh-15145 --- .../OAuth2ResourceServerProperties.java | 13 +++++++++++ .../OAuth2ResourceServerJwkConfiguration.java | 3 ++- ...2ResourceServerAutoConfigurationTests.java | 23 +++++++++++++++++-- .../appendix-application-properties.adoc | 1 + 4 files changed, 37 insertions(+), 3 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/OAuth2ResourceServerProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/OAuth2ResourceServerProperties.java index 6df4452a4b..f262e4c703 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/OAuth2ResourceServerProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/OAuth2ResourceServerProperties.java @@ -40,6 +40,11 @@ public class OAuth2ResourceServerProperties { */ private String jwkSetUri; + /** + * JSON Web Algorithm used for verifying the digital signatures. + */ + private String jwsAlgorithm = "RS256"; + /** * URI that an OpenID Connect Provider asserts as its Issuer Identifier. */ @@ -53,6 +58,14 @@ public class OAuth2ResourceServerProperties { this.jwkSetUri = jwkSetUri; } + public String getJwsAlgorithm() { + return this.jwsAlgorithm; + } + + public void setJwsAlgorithm(String jwsAlgorithm) { + this.jwsAlgorithm = jwsAlgorithm; + } + public String getIssuerUri() { return this.issuerUri; } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java index d760162198..14c04a5e36 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java @@ -46,7 +46,8 @@ class OAuth2ResourceServerJwkConfiguration { @ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri") @ConditionalOnMissingBean public JwtDecoder jwtDecoderByJwkKeySetUri() { - return new NimbusJwtDecoderJwkSupport(this.properties.getJwt().getJwkSetUri()); + return new NimbusJwtDecoderJwkSupport(this.properties.getJwt().getJwkSetUri(), + this.properties.getJwt().getJwsAlgorithm()); } @Bean diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java index 56cda029bb..27a173edf5 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java @@ -22,6 +22,7 @@ import java.util.Map; import javax.servlet.Filter; +import com.nimbusds.jose.JWSAlgorithm; import okhttp3.mockwebserver.MockResponse; import okhttp3.mockwebserver.MockWebServer; import org.junit.After; @@ -78,8 +79,26 @@ public class OAuth2ResourceServerAutoConfigurationTests { this.contextRunner.withPropertyValues( "spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com") .run((context) -> { - assertThat(context.getBean(JwtDecoder.class)) - .isInstanceOf(NimbusJwtDecoderJwkSupport.class); + JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class); + assertThat(jwtDecoder).isInstanceOf(NimbusJwtDecoderJwkSupport.class); + NimbusJwtDecoderJwkSupport decoder = (NimbusJwtDecoderJwkSupport) jwtDecoder; + assertThat(decoder).hasFieldOrPropertyWithValue("jwsAlgorithm", + JWSAlgorithm.RS256); + assertThat(getBearerTokenFilter(context)).isNotNull(); + }); + } + + @Test + public void autoConfigurationShouldConfigureResourceServerWithJwsAlgotihms() { + this.contextRunner.withPropertyValues( + "spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com", + "spring.security.oauth2.resourceserver.jwt.jws-algorithm=HS512") + .run((context) -> { + JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class); + assertThat(jwtDecoder).isInstanceOf(NimbusJwtDecoderJwkSupport.class); + NimbusJwtDecoderJwkSupport decoder = (NimbusJwtDecoderJwkSupport) jwtDecoder; + assertThat(decoder).hasFieldOrPropertyWithValue("jwsAlgorithm", + JWSAlgorithm.HS512); assertThat(getBearerTokenFilter(context)).isNotNull(); }); } diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc index 57c33719e6..34db91ce66 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc @@ -547,6 +547,7 @@ content into your application. Rather, pick only the properties that you need. # SECURITY OAUTH2 RESOURCE SERVER ({sc-spring-boot-autoconfigure}/security/oauth2/resource/OAuth2ResourceServerProperties.{sc-ext}[OAuth2ResourceServerProperties]) spring.security.oauth2.resourceserver.jwt.jwk-set-uri= # JSON Web Key URI to use to verify the JWT token. + spring.security.oauth2.resourceserver.jwt.jws-algorithm= # JSON Web Algorithm used for verifying the digital signatures. spring.security.oauth2.resourceserver.jwt.issuer-uri= # URI that an OpenID Connect Provider asserts as its Issuer Identifier. # ---------------------------------------- From 0df13baa0f01459172c24fe4c3abf88090dbd733 Mon Sep 17 00:00:00 2001 From: Stephane Nicoll Date: Mon, 3 Dec 2018 11:49:18 +0100 Subject: [PATCH 2/2] Polish "Add configurable property for JWK encryption algorithm" Closes gh-15145 --- .../OAuth2ResourceServerJwkConfiguration.java | 11 ++++----- ...2ResourceServerAutoConfigurationTests.java | 24 ++++++++++++------- .../appendix-application-properties.adoc | 2 +- 3 files changed, 21 insertions(+), 16 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java index 14c04a5e36..086c9653b9 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwkConfiguration.java @@ -36,26 +36,25 @@ import org.springframework.security.oauth2.jwt.NimbusJwtDecoderJwkSupport; @Configuration class OAuth2ResourceServerJwkConfiguration { - private final OAuth2ResourceServerProperties properties; + private final OAuth2ResourceServerProperties.Jwt properties; OAuth2ResourceServerJwkConfiguration(OAuth2ResourceServerProperties properties) { - this.properties = properties; + this.properties = properties.getJwt(); } @Bean @ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri") @ConditionalOnMissingBean public JwtDecoder jwtDecoderByJwkKeySetUri() { - return new NimbusJwtDecoderJwkSupport(this.properties.getJwt().getJwkSetUri(), - this.properties.getJwt().getJwsAlgorithm()); + return new NimbusJwtDecoderJwkSupport(this.properties.getJwkSetUri(), + this.properties.getJwsAlgorithm()); } @Bean @Conditional(IssuerUriCondition.class) @ConditionalOnMissingBean public JwtDecoder jwtDecoderByIssuerUri() { - return JwtDecoders - .fromOidcIssuerLocation(this.properties.getJwt().getIssuerUri()); + return JwtDecoders.fromOidcIssuerLocation(this.properties.getIssuerUri()); } } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java index 27a173edf5..7f4cc934d4 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerAutoConfigurationTests.java @@ -79,25 +79,31 @@ public class OAuth2ResourceServerAutoConfigurationTests { this.contextRunner.withPropertyValues( "spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com") .run((context) -> { - JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class); - assertThat(jwtDecoder).isInstanceOf(NimbusJwtDecoderJwkSupport.class); - NimbusJwtDecoderJwkSupport decoder = (NimbusJwtDecoderJwkSupport) jwtDecoder; - assertThat(decoder).hasFieldOrPropertyWithValue("jwsAlgorithm", - JWSAlgorithm.RS256); + assertThat(context.getBean(JwtDecoder.class)) + .isInstanceOf(NimbusJwtDecoderJwkSupport.class); assertThat(getBearerTokenFilter(context)).isNotNull(); }); } @Test - public void autoConfigurationShouldConfigureResourceServerWithJwsAlgotihms() { + public void autoConfigurationShouldMatchDefaultJwsAlgorithm() { + this.contextRunner.withPropertyValues( + "spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com") + .run((context) -> { + JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class); + assertThat(jwtDecoder).hasFieldOrPropertyWithValue("jwsAlgorithm", + JWSAlgorithm.RS256); + }); + } + + @Test + public void autoConfigurationShouldConfigureResourceServerWithJwsAlgorithm() { this.contextRunner.withPropertyValues( "spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com", "spring.security.oauth2.resourceserver.jwt.jws-algorithm=HS512") .run((context) -> { JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class); - assertThat(jwtDecoder).isInstanceOf(NimbusJwtDecoderJwkSupport.class); - NimbusJwtDecoderJwkSupport decoder = (NimbusJwtDecoderJwkSupport) jwtDecoder; - assertThat(decoder).hasFieldOrPropertyWithValue("jwsAlgorithm", + assertThat(jwtDecoder).hasFieldOrPropertyWithValue("jwsAlgorithm", JWSAlgorithm.HS512); assertThat(getBearerTokenFilter(context)).isNotNull(); }); diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc index 34db91ce66..7776bdcf8d 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc @@ -547,7 +547,7 @@ content into your application. Rather, pick only the properties that you need. # SECURITY OAUTH2 RESOURCE SERVER ({sc-spring-boot-autoconfigure}/security/oauth2/resource/OAuth2ResourceServerProperties.{sc-ext}[OAuth2ResourceServerProperties]) spring.security.oauth2.resourceserver.jwt.jwk-set-uri= # JSON Web Key URI to use to verify the JWT token. - spring.security.oauth2.resourceserver.jwt.jws-algorithm= # JSON Web Algorithm used for verifying the digital signatures. + spring.security.oauth2.resourceserver.jwt.jws-algorithm=RS256 # JSON Web Algorithm used for verifying the digital signatures. spring.security.oauth2.resourceserver.jwt.issuer-uri= # URI that an OpenID Connect Provider asserts as its Issuer Identifier. # ----------------------------------------