diff --git a/samples/grpc-oauth2/README.md b/samples/grpc-oauth2/README.md new file mode 100644 index 0000000..821f535 --- /dev/null +++ b/samples/grpc-oauth2/README.md @@ -0,0 +1,35 @@ +# Spring Boot gRPC Sample + +This project is a copy one of the samples from the [gRPC Spring Boot Starter](https://github.com/yidongnan/grpc-spring-boot-starter/blob/master/examples/local-grpc-server/build.gradle). Build and run any way you like to run Spring Boot. E.g: + +``` +$ ./mvnw spring-boot:test-run +... + . ____ _ __ _ _ + /\\ / ___'_ __ _ _(_)_ __ __ _ \ \ \ \ +( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \ + \\/ ___)| |_)| | | | | || (_| | ) ) ) ) + ' |____| .__|_| |_|_| |_\__, | / / / / + =========|_|==============|___/=/_/_/_/ + :: Spring Boot :: (v3.4.1) + +... +2022-12-08T05:32:25.427-08:00 INFO 551632 --- [ main] g.s.a.GrpcServerFactoryAutoConfiguration : Detected grpc-netty: Creating NettyGrpcServerFactory +2025-01-28T07:10:35.363Z INFO 1218185 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port 44207 (http) with context path '/' +2025-01-28T07:10:35.394Z INFO 1218185 --- [ main] o.s.e.b.s.e.m.SpringBootApplicationMain : Started SpringBootApplicationMain in 2.802 seconds (process running for 3.291) +2025-01-28T07:10:35.749Z INFO 1218050 --- [grpc-server] [ main] o.s.grpc.server.NettyGrpcServerFactory : Registered gRPC service: Simple +2025-01-28T07:10:35.749Z INFO 1218050 --- [grpc-server] [ main] o.s.grpc.server.NettyGrpcServerFactory : Registered gRPC service: grpc.reflection.v1.ServerReflection +2025-01-28T07:10:35.749Z INFO 1218050 --- [grpc-server] [ main] o.s.grpc.server.NettyGrpcServerFactory : Registered gRPC service: grpc.health.v1.Health +2025-01-28T07:10:35.835Z INFO 1218050 --- [grpc-server] [ main] o.s.g.s.lifecycle.GrpcServerLifecycle : gRPC Server started, listening on address: [/[0:0:0:0:0:0:0:0]:9090] +2025-01-28T07:10:35.844Z INFO 1218050 --- [grpc-server] [ main] o.s.grpc.sample.GrpcServerApplication : Started GrpcServerApplication in 5.072 seconds (process running for 5.419) +``` + +The server starts by default on port 9090 and the auth server port is shown on start up (its random for now, until the testjars project has another release). Test with [gRPCurl](https://github.com/fullstorydev/grpcurl). There is a B/S insecure channel that lets you authenticate by asserting in a header that you are a user: + +``` +$ TOKEN=`curl -v spring:secret@localhost:43737/oauth2/token -d grant_type=client_credentials | jq -r .access_token` +$ grpcurl -H "Authorization: Bearer $TOKEN" -d '{"name":"Hi"}' -plaintext localhost:9090 Simple.SayHello +{ + "message": "Hello ==\u003e Hi" +} +``` diff --git a/samples/grpc-oauth2/build.gradle b/samples/grpc-oauth2/build.gradle new file mode 100644 index 0000000..ae43684 --- /dev/null +++ b/samples/grpc-oauth2/build.gradle @@ -0,0 +1,60 @@ +plugins { + id 'java' + id 'org.springframework.boot' version '3.4.1' + id 'io.spring.dependency-management' version '1.1.6' + id 'org.graalvm.buildtools.native' version '0.10.3' + id 'com.google.protobuf' version '0.9.4' +} + +group = 'com.example' +version = '0.4.0-SNAPSHOT' + +java { + toolchain { + languageVersion = JavaLanguageVersion.of(17) + } +} + +repositories { + mavenLocal() + mavenCentral() + maven { url 'https://repo.spring.io/milestone' } + maven { url 'https://repo.spring.io/snapshot' } +} + +dependencyManagement { + imports { + mavenBom 'org.springframework.grpc:spring-grpc-dependencies:0.4.0-SNAPSHOT' + } +} + +dependencies { + implementation 'org.springframework.grpc:spring-grpc-spring-boot-starter' + implementation 'org.springframework.boot:spring-boot-starter-security' + implementation 'io.grpc:grpc-services' + testImplementation 'org.springframework.boot:spring-boot-starter-test' + testImplementation 'org.springframework.grpc:spring-grpc-test' + testRuntimeOnly 'org.junit.platform:junit-platform-launcher' +} + +tasks.named('test') { + useJUnitPlatform() +} + +protobuf { + protoc { + artifact = "com.google.protobuf:protoc:${dependencyManagement.importedProperties['protobuf-java.version']}" + } + plugins { + grpc { + artifact = "io.grpc:protoc-gen-grpc-java:${dependencyManagement.importedProperties['grpc.version']}" + } + } + generateProtoTasks { + all()*.plugins { + grpc { + option 'jakarta_omit' + } + } + } +} diff --git a/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.jar b/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.jar new file mode 100644 index 0000000..a4b76b9 Binary files /dev/null and b/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.jar differ diff --git a/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.properties b/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.properties new file mode 100644 index 0000000..df97d72 --- /dev/null +++ b/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.properties @@ -0,0 +1,7 @@ +distributionBase=GRADLE_USER_HOME +distributionPath=wrapper/dists +distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip +networkTimeout=10000 +validateDistributionUrl=true +zipStoreBase=GRADLE_USER_HOME +zipStorePath=wrapper/dists diff --git a/samples/grpc-oauth2/gradlew b/samples/grpc-oauth2/gradlew new file mode 100755 index 0000000..f5feea6 --- /dev/null +++ b/samples/grpc-oauth2/gradlew @@ -0,0 +1,252 @@ +#!/bin/sh + +# +# Copyright © 2015-2021 the original authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + +############################################################################## +# +# Gradle start up script for POSIX generated by Gradle. +# +# Important for running: +# +# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is +# noncompliant, but you have some other compliant shell such as ksh or +# bash, then to run this script, type that shell name before the whole +# command line, like: +# +# ksh Gradle +# +# Busybox and similar reduced shells will NOT work, because this script +# requires all of these POSIX shell features: +# * functions; +# * expansions «$var», «${var}», «${var:-default}», «${var+SET}», +# «${var#prefix}», «${var%suffix}», and «$( cmd )»; +# * compound commands having a testable exit status, especially «case»; +# * various built-in commands including «command», «set», and «ulimit». +# +# Important for patching: +# +# (2) This script targets any POSIX shell, so it avoids extensions provided +# by Bash, Ksh, etc; in particular arrays are avoided. +# +# The "traditional" practice of packing multiple parameters into a +# space-separated string is a well documented source of bugs and security +# problems, so this is (mostly) avoided, by progressively accumulating +# options in "$@", and eventually passing that to Java. +# +# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS, +# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly; +# see the in-line comments for details. +# +# There are tweaks for specific operating systems such as AIX, CygWin, +# Darwin, MinGW, and NonStop. +# +# (3) This script is generated from the Groovy template +# https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt +# within the Gradle project. +# +# You can find Gradle at https://github.com/gradle/gradle/. +# +############################################################################## + +# Attempt to set APP_HOME + +# Resolve links: $0 may be a link +app_path=$0 + +# Need this for daisy-chained symlinks. +while + APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path + [ -h "$app_path" ] +do + ls=$( ls -ld "$app_path" ) + link=${ls#*' -> '} + case $link in #( + /*) app_path=$link ;; #( + *) app_path=$APP_HOME$link ;; + esac +done + +# This is normally unused +# shellcheck disable=SC2034 +APP_BASE_NAME=${0##*/} +# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036) +APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s +' "$PWD" ) || exit + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD=maximum + +warn () { + echo "$*" +} >&2 + +die () { + echo + echo "$*" + echo + exit 1 +} >&2 + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "$( uname )" in #( + CYGWIN* ) cygwin=true ;; #( + Darwin* ) darwin=true ;; #( + MSYS* | MINGW* ) msys=true ;; #( + NONSTOP* ) nonstop=true ;; +esac + +CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD=$JAVA_HOME/jre/sh/java + else + JAVACMD=$JAVA_HOME/bin/java + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD=java + if ! command -v java >/dev/null 2>&1 + then + die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +fi + +# Increase the maximum file descriptors if we can. +if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then + case $MAX_FD in #( + max*) + # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked. + # shellcheck disable=SC2039,SC3045 + MAX_FD=$( ulimit -H -n ) || + warn "Could not query maximum file descriptor limit" + esac + case $MAX_FD in #( + '' | soft) :;; #( + *) + # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked. + # shellcheck disable=SC2039,SC3045 + ulimit -n "$MAX_FD" || + warn "Could not set maximum file descriptor limit to $MAX_FD" + esac +fi + +# Collect all arguments for the java command, stacking in reverse order: +# * args from the command line +# * the main class name +# * -classpath +# * -D...appname settings +# * --module-path (only if needed) +# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. + +# For Cygwin or MSYS, switch paths to Windows format before running java +if "$cygwin" || "$msys" ; then + APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) + CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) + + JAVACMD=$( cygpath --unix "$JAVACMD" ) + + # Now convert the arguments - kludge to limit ourselves to /bin/sh + for arg do + if + case $arg in #( + -*) false ;; # don't mess with options #( + /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath + [ -e "$t" ] ;; #( + *) false ;; + esac + then + arg=$( cygpath --path --ignore --mixed "$arg" ) + fi + # Roll the args list around exactly as many times as the number of + # args, so each arg winds up back in the position where it started, but + # possibly modified. + # + # NB: a `for` loop captures its iteration list before it begins, so + # changing the positional parameters here affects neither the number of + # iterations, nor the values presented in `arg`. + shift # remove old arg + set -- "$@" "$arg" # push replacement arg + done +fi + + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' + +# Collect all arguments for the java command: +# * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments, +# and any embedded shellness will be escaped. +# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be +# treated as '${Hostname}' itself on the command line. + +set -- \ + "-Dorg.gradle.appname=$APP_BASE_NAME" \ + -classpath "$CLASSPATH" \ + org.gradle.wrapper.GradleWrapperMain \ + "$@" + +# Stop when "xargs" is not available. +if ! command -v xargs >/dev/null 2>&1 +then + die "xargs is not available" +fi + +# Use "xargs" to parse quoted args. +# +# With -n1 it outputs one arg per line, with the quotes and backslashes removed. +# +# In Bash we could simply go: +# +# readarray ARGS < <( xargs -n1 <<<"$var" ) && +# set -- "${ARGS[@]}" "$@" +# +# but POSIX shell has neither arrays nor command substitution, so instead we +# post-process each arg (as a line of input to sed) to backslash-escape any +# character that might be a shell metacharacter, then use eval to reverse +# that process (while maintaining the separation between arguments), and wrap +# the whole thing up as a single "set" statement. +# +# This will of course break if any of these variables contains a newline or +# an unmatched quote. +# + +eval "set -- $( + printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | + xargs -n1 | + sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | + tr '\n' ' ' + )" '"$@"' + +exec "$JAVACMD" "$@" diff --git a/samples/grpc-oauth2/gradlew.bat b/samples/grpc-oauth2/gradlew.bat new file mode 100644 index 0000000..9b42019 --- /dev/null +++ b/samples/grpc-oauth2/gradlew.bat @@ -0,0 +1,94 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem +@rem SPDX-License-Identifier: Apache-2.0 +@rem + +@if "%DEBUG%"=="" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%"=="" set DIRNAME=. +@rem This is normally unused +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if %ERRORLEVEL% equ 0 goto execute + +echo. 1>&2 +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2 +echo. 1>&2 +echo Please set the JAVA_HOME variable in your environment to match the 1>&2 +echo location of your Java installation. 1>&2 + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto execute + +echo. 1>&2 +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2 +echo. 1>&2 +echo Please set the JAVA_HOME variable in your environment to match the 1>&2 +echo location of your Java installation. 1>&2 + +goto fail + +:execute +@rem Setup the command line + +set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* + +:end +@rem End local scope for the variables with windows NT shell +if %ERRORLEVEL% equ 0 goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +set EXIT_CODE=%ERRORLEVEL% +if %EXIT_CODE% equ 0 set EXIT_CODE=1 +if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE% +exit /b %EXIT_CODE% + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega diff --git a/samples/grpc-oauth2/pom.xml b/samples/grpc-oauth2/pom.xml new file mode 100644 index 0000000..0d4e952 --- /dev/null +++ b/samples/grpc-oauth2/pom.xml @@ -0,0 +1,245 @@ + + + 4.0.0 + + org.springframework.boot + spring-boot-starter-parent + 3.4.1 + + + org.springframework.grpc + grpc-oauth2-sample + 0.4.0-SNAPSHOT + Spring gRPC Server Sample + Demo project for Spring gRPC + + + + + + + + + + + + + + + 17 + 0.0.39 + 3.25.5 + 1.63.2 + 3.9.4 + 1.9.18 + + + + + org.springframework.grpc + spring-grpc-dependencies + 0.4.0-SNAPSHOT + pom + import + + + + + + org.springframework.grpc + spring-grpc-spring-boot-starter + + + org.springframework.boot + spring-boot-starter-oauth2-resource-server + + + io.grpc + grpc-services + + + + org.springframework.boot + spring-boot-starter-oauth2-client + test + + + org.springframework.grpc + spring-grpc-test + test + + + org.springframework.experimental.boot + spring-boot-testjars + 0.0.2 + test + + + org.apache.maven + maven-resolver-provider + ${maven.version} + test + + + org.apache.maven.resolver + maven-resolver-api + ${maven.resolver.version} + test + + + org.apache.maven.resolver + maven-resolver-spi + ${maven.resolver.version} + test + + + org.apache.maven.resolver + maven-resolver-util + ${maven.resolver.version} + test + + + org.apache.maven.resolver + maven-resolver-impl + ${maven.resolver.version} + test + + + org.apache.maven.resolver + maven-resolver-connector-basic + ${maven.resolver.version} + test + + + org.apache.maven.resolver + maven-resolver-transport-file + ${maven.resolver.version} + test + + + org.apache.maven.resolver + maven-resolver-transport-http + ${maven.resolver.version} + test + + + org.apache.maven.resolver + maven-resolver-supplier + ${maven.resolver.version} + test + + + + + + + kr.motd.maven + os-maven-plugin + 1.7.1 + + + + + org.graalvm.buildtools + native-maven-plugin + + + --verbose + + + + + org.springframework.boot + spring-boot-maven-plugin + + + org.apache.maven.plugins + maven-deploy-plugin + + true + + + + io.spring.javaformat + spring-javaformat-maven-plugin + ${spring-javaformat-maven-plugin.version} + + + + validate + true + + validate + + + + + + org.xolstice.maven.plugins + protobuf-maven-plugin + 0.6.1 + + + com.google.protobuf:protoc:${protobuf-java.version}:exe:${os.detected.classifier} + grpc-java + + io.grpc:protoc-gen-grpc-java:${grpc.version}:exe:${os.detected.classifier} + + + + + + jakarta_omit,@generated=omit + + + + compile + compile-custom + + + + + + + + + + spring-milestones + Spring Milestones + https://repo.spring.io/milestone + + false + + + + spring-snapshots + Spring Snapshots + https://repo.spring.io/snapshot + + false + + + + + + spring-milestones + Spring Milestones + https://repo.spring.io/milestone + + false + + + + spring-snapshots + Spring Snapshots + https://repo.spring.io/snapshot + + false + + + + + + \ No newline at end of file diff --git a/samples/grpc-oauth2/settings.gradle b/samples/grpc-oauth2/settings.gradle new file mode 100644 index 0000000..d294bd1 --- /dev/null +++ b/samples/grpc-oauth2/settings.gradle @@ -0,0 +1,8 @@ +pluginManagement { + repositories { + maven { url 'https://repo.spring.io/milestone' } + maven { url 'https://repo.spring.io/snapshot' } + gradlePluginPortal() + } +} +rootProject.name = 'demo' diff --git a/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java b/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java new file mode 100644 index 0000000..9763131 --- /dev/null +++ b/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java @@ -0,0 +1,44 @@ +package org.springframework.grpc.sample; + +import static org.springframework.security.config.Customizer.withDefaults; + +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Import; +import org.springframework.grpc.server.GlobalServerInterceptor; +import org.springframework.grpc.server.security.AuthenticationProcessInterceptor; +import org.springframework.grpc.server.security.GrpcSecurity; +import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; + +import io.grpc.Metadata; + +@SpringBootApplication +@EnableMethodSecurity +@Import(AuthenticationConfiguration.class) +public class GrpcServerApplication { + + public static final Metadata.Key USER_KEY = Metadata.Key.of("X-USER", Metadata.ASCII_STRING_MARSHALLER); + + public static void main(String[] args) { + SpringApplication.run(GrpcServerApplication.class, args); + } + + @Bean + @GlobalServerInterceptor + AuthenticationProcessInterceptor jwtSecurityFilterChain(GrpcSecurity grpc) throws Exception { + return grpc + .authorizeRequests(requests -> requests.methods("Simple/StreamHello") + .hasAuthority("SCOPE_profile") + .methods("Simple/SayHello") + .authenticated() + .methods("grpc.*/*") + .permitAll() + .allRequests() + .denyAll()) + .oauth2ResourceServer((resourceServer) -> resourceServer.jwt(withDefaults())) + .build(); + } + +} \ No newline at end of file diff --git a/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerService.java b/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerService.java new file mode 100644 index 0000000..3f8eb8f --- /dev/null +++ b/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerService.java @@ -0,0 +1,50 @@ +package org.springframework.grpc.sample; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.springframework.grpc.sample.proto.HelloReply; +import org.springframework.grpc.sample.proto.HelloRequest; +import org.springframework.grpc.sample.proto.SimpleGrpc; +import org.springframework.stereotype.Service; + +import io.grpc.stub.StreamObserver; + +@Service +public class GrpcServerService extends SimpleGrpc.SimpleImplBase { + + private static Log log = LogFactory.getLog(GrpcServerService.class); + + @Override + // @PreAuthorize("hasAuthority('ROLE_USER')") + public void sayHello(HelloRequest req, StreamObserver responseObserver) { + log.info("Hello " + req.getName()); + if (req.getName().startsWith("error")) { + throw new IllegalArgumentException("Bad name: " + req.getName()); + } + HelloReply reply = HelloReply.newBuilder().setMessage("Hello ==> " + req.getName()).build(); + responseObserver.onNext(reply); + responseObserver.onCompleted(); + } + + @Override + // @PreAuthorize("hasAuthority('ROLE_ADMIN')") + public void streamHello(HelloRequest req, StreamObserver responseObserver) { + log.info("Hello " + req.getName()); + int count = 0; + while (count < 10) { + HelloReply reply = HelloReply.newBuilder().setMessage("Hello(" + count + ") ==> " + req.getName()).build(); + responseObserver.onNext(reply); + count++; + try { + Thread.sleep(1000L); + } + catch (InterruptedException e) { + Thread.currentThread().interrupt(); + responseObserver.onError(e); + return; + } + } + responseObserver.onCompleted(); + } + +} \ No newline at end of file diff --git a/samples/grpc-oauth2/src/main/proto/hello.proto b/samples/grpc-oauth2/src/main/proto/hello.proto new file mode 100644 index 0000000..731679c --- /dev/null +++ b/samples/grpc-oauth2/src/main/proto/hello.proto @@ -0,0 +1,23 @@ +syntax = "proto3"; + +option java_multiple_files = true; +option java_package = "org.springframework.grpc.sample.proto"; +option java_outer_classname = "HelloWorldProto"; + +// The greeting service definition. +service Simple { + // Sends a greeting + rpc SayHello (HelloRequest) returns (HelloReply) { + } + rpc StreamHello(HelloRequest) returns (stream HelloReply) {} +} + +// The request message containing the user's name. +message HelloRequest { + string name = 1; +} + +// The response message containing the greetings +message HelloReply { + string message = 1; +} \ No newline at end of file diff --git a/samples/grpc-oauth2/src/main/resources/META-INF/native-image/org.springframework.samples/grpc-server-sample/native-image.properties b/samples/grpc-oauth2/src/main/resources/META-INF/native-image/org.springframework.samples/grpc-server-sample/native-image.properties new file mode 100644 index 0000000..5c43451 --- /dev/null +++ b/samples/grpc-oauth2/src/main/resources/META-INF/native-image/org.springframework.samples/grpc-server-sample/native-image.properties @@ -0,0 +1,2 @@ +# Ignored unless building in Nix (https://github.com/oracle/graal/issues/8639) +Args = -ENIX_LDFLAGS -ENIX_CC_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu diff --git a/samples/grpc-oauth2/src/main/resources/application.properties b/samples/grpc-oauth2/src/main/resources/application.properties new file mode 100644 index 0000000..e6c76fa --- /dev/null +++ b/samples/grpc-oauth2/src/main/resources/application.properties @@ -0,0 +1,8 @@ +spring.application.name=grpc-server +logging.level.org.springframework.security=debug +spring.security.oauth2.resourceserver.jwt.jwk-set-uri=${spring.security.oauth2.client.provider.spring.issuer-uri:http://localhost:9000}/oauth2/jwks +spring.security.oauth2.client.registration.spring.client-id=spring +spring.security.oauth2.client.registration.spring.client-secret=secret +spring.security.oauth2.client.registration.spring.authorization-grant-type=client_credentials +spring.security.oauth2.client.registration.spring.provider=local +spring.security.oauth2.client.provider.local.token-uri=${spring.security.oauth2.client.provider.spring.issuer-uri:http://localhost:9000}/oauth2/token diff --git a/samples/grpc-oauth2/src/test/java/org/springframework/grpc/sample/GrpcServerApplicationTests.java b/samples/grpc-oauth2/src/test/java/org/springframework/grpc/sample/GrpcServerApplicationTests.java new file mode 100644 index 0000000..8fa1a1a --- /dev/null +++ b/samples/grpc-oauth2/src/test/java/org/springframework/grpc/sample/GrpcServerApplicationTests.java @@ -0,0 +1,159 @@ +package org.springframework.grpc.sample; + +import static org.junit.Assert.assertThrows; +import static org.junit.jupiter.api.Assertions.assertEquals; + +import java.util.List; +import java.util.concurrent.atomic.AtomicBoolean; +import java.util.concurrent.atomic.AtomicReference; + +import org.awaitility.Awaitility; +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.boot.SpringApplication; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.boot.test.context.TestConfiguration; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Lazy; +import org.springframework.experimental.boot.server.exec.CommonsExecWebServerFactoryBean; +import org.springframework.experimental.boot.server.exec.MavenClasspathEntry; +import org.springframework.experimental.boot.test.context.EnableDynamicProperty; +import org.springframework.experimental.boot.test.context.OAuth2ClientProviderIssuerUri; +import org.springframework.grpc.client.ChannelBuilderOptions; +import org.springframework.grpc.client.GrpcChannelFactory; +import org.springframework.grpc.client.security.BearerTokenAuthenticationInterceptor; +import org.springframework.grpc.sample.proto.HelloReply; +import org.springframework.grpc.sample.proto.HelloRequest; +import org.springframework.grpc.sample.proto.SimpleGrpc; +import org.springframework.grpc.test.LocalGrpcPort; +import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest; +import org.springframework.security.oauth2.client.endpoint.RestClientClientCredentialsTokenResponseClient; +import org.springframework.security.oauth2.client.registration.ClientRegistration; +import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository; +import org.springframework.test.annotation.DirtiesContext; + +import io.grpc.Status.Code; +import io.grpc.StatusRuntimeException; +import io.grpc.reflection.v1.ServerReflectionGrpc; +import io.grpc.reflection.v1.ServerReflectionRequest; +import io.grpc.reflection.v1.ServerReflectionResponse; +import io.grpc.stub.StreamObserver; + +@SpringBootTest(properties = { "spring.grpc.server.port=0", + "spring.grpc.client.channels.stub.address=static://0.0.0.0:${local.grpc.port}" }) +public class GrpcServerApplicationTests { + + public static void main(String[] args) { + SpringApplication.from(GrpcServerApplication::main).with(ExtraConfiguration.class).run(args); + } + + @Autowired + @Qualifier("stub") + private SimpleGrpc.SimpleBlockingStub stub; + + @Autowired + @Qualifier("reflect") + private ServerReflectionGrpc.ServerReflectionStub reflect; + + @Autowired + @Qualifier("basic") + private SimpleGrpc.SimpleBlockingStub basic; + + @Test + @DirtiesContext + void contextLoads() { + } + + @Test + @DirtiesContext + void unauthenticated() { + StatusRuntimeException exception = assertThrows(StatusRuntimeException.class, + () -> stub.sayHello(HelloRequest.newBuilder().setName("Alien").build())); + assertEquals(Code.UNAUTHENTICATED, exception.getStatus().getCode()); + } + + @Test + @DirtiesContext + void anonymous() throws Exception { + AtomicReference response = new AtomicReference<>(); + AtomicBoolean error = new AtomicBoolean(); + StreamObserver responses = new StreamObserver() { + @Override + public void onNext(ServerReflectionResponse value) { + response.set(value); + } + + @Override + public void onError(Throwable t) { + error.set(true); + } + + @Override + public void onCompleted() { + } + }; + StreamObserver request = reflect.serverReflectionInfo(responses); + request.onNext(ServerReflectionRequest.newBuilder().setListServices("").build()); + request.onCompleted(); + Awaitility.await().until(() -> response.get() != null || error.get()); + } + + @Test + @DirtiesContext + void unauthauthorized() { + // The token has no scopes and scope=profile is required + StatusRuntimeException exception = assertThrows(StatusRuntimeException.class, + () -> basic.streamHello(HelloRequest.newBuilder().setName("Alien").build()).next()); + assertEquals(Code.PERMISSION_DENIED, exception.getStatus().getCode()); + } + + @Test + @DirtiesContext + void authenticated() { + // The token has no scopes but none are required + HelloReply response = basic.sayHello(HelloRequest.newBuilder().setName("Alien").build()); + assertEquals("Hello ==> Alien", response.getMessage()); + } + + @TestConfiguration(proxyBeanMethods = false) + @EnableDynamicProperty + static class ExtraConfiguration { + + @Bean + @OAuth2ClientProviderIssuerUri + static CommonsExecWebServerFactoryBean authServer() { + return CommonsExecWebServerFactoryBean.builder() + .defaultSpringBootApplicationMain() + .classpath(classpath -> classpath + .entries(MavenClasspathEntry.springBootStarter("oauth2-authorization-server"))); + } + + @Bean + @Lazy + SimpleGrpc.SimpleBlockingStub basic(GrpcChannelFactory channels, @LocalGrpcPort int port, + ClientRegistrationRepository registry) { + RestClientClientCredentialsTokenResponseClient creds = new RestClientClientCredentialsTokenResponseClient(); + ClientRegistration reg = registry.findByRegistrationId("spring"); + String token = creds.getTokenResponse(new OAuth2ClientCredentialsGrantRequest(reg)) + .getAccessToken() + .getTokenValue(); + return SimpleGrpc.newBlockingStub(channels.createChannel("stub", ChannelBuilderOptions.defaults() + .withInterceptors(List.of(new BearerTokenAuthenticationInterceptor(token))))); + } + + @Bean + @Lazy + SimpleGrpc.SimpleBlockingStub stub(GrpcChannelFactory channels, @LocalGrpcPort int port) { + return SimpleGrpc.newBlockingStub(channels.createChannel("stub")); + } + + @Bean + @Lazy + ServerReflectionGrpc.ServerReflectionStub reflect(GrpcChannelFactory channels, @LocalGrpcPort int port) { + return ServerReflectionGrpc.newStub(channels.createChannel("stub")); + } + + } + +} diff --git a/samples/grpc-oauth2/src/test/resources/testjars/authServer/application.yml b/samples/grpc-oauth2/src/test/resources/testjars/authServer/application.yml new file mode 100644 index 0000000..63add2f --- /dev/null +++ b/samples/grpc-oauth2/src/test/resources/testjars/authServer/application.yml @@ -0,0 +1,18 @@ +logging.level.org.springframework.security: TRACE +spring: + security: + oauth2: + authorizationserver: + client: + oidc-client: + registration: + client-id: "spring" + client-secret: "{noop}secret" + client-authentication-methods: + - "client_secret_basic" + authorization-grant-types: + - "client_credentials" + - "refresh_token" + scopes: + - "openid" + - "profile" \ No newline at end of file diff --git a/samples/grpc-secure/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java b/samples/grpc-secure/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java index 4a88659..237d486 100644 --- a/samples/grpc-secure/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java +++ b/samples/grpc-secure/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java @@ -38,11 +38,14 @@ public class GrpcServerApplication { @GlobalServerInterceptor public ServerInterceptor securityInterceptor(GrpcSecurity security) throws Exception { return security - .authorizeRequests(requests -> requests - .methods("Simple/StreamHello").hasAuthority("ROLE_ADMIN") - .methods("Simple/SayHello").hasAuthority("ROLE_USER") - .methods("grpc.*/*").permitAll() - .allRequests().denyAll()) + .authorizeRequests(requests -> requests.methods("Simple/StreamHello") + .hasAuthority("ROLE_ADMIN") + .methods("Simple/SayHello") + .hasAuthority("ROLE_USER") + .methods("grpc.*/*") + .permitAll() + .allRequests() + .denyAll()) .httpBasic(withDefaults()) .preauth(withDefaults()) .build(); diff --git a/samples/grpc-tomcat-secure/src/main/java/org/springframework/grpc/sample/GrpcServerService.java b/samples/grpc-tomcat-secure/src/main/java/org/springframework/grpc/sample/GrpcServerService.java index 06d0526..ab5aa23 100644 --- a/samples/grpc-tomcat-secure/src/main/java/org/springframework/grpc/sample/GrpcServerService.java +++ b/samples/grpc-tomcat-secure/src/main/java/org/springframework/grpc/sample/GrpcServerService.java @@ -5,7 +5,6 @@ import org.apache.commons.logging.LogFactory; import org.springframework.grpc.sample.proto.HelloReply; import org.springframework.grpc.sample.proto.HelloRequest; import org.springframework.grpc.sample.proto.SimpleGrpc; -import org.springframework.security.core.context.SecurityContext; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Service; diff --git a/samples/pom.xml b/samples/pom.xml index d30666a..fb17a9f 100644 --- a/samples/pom.xml +++ b/samples/pom.xml @@ -18,6 +18,7 @@ grpc-server grpc-secure + grpc-oauth2 grpc-reactive grpc-server-netty-shaded grpc-tomcat diff --git a/spring-grpc-core/pom.xml b/spring-grpc-core/pom.xml index b4d7acc..b83ebcf 100644 --- a/spring-grpc-core/pom.xml +++ b/spring-grpc-core/pom.xml @@ -32,6 +32,16 @@ spring-security-web true + + org.springframework.security + spring-security-oauth2-resource-server + true + + + org.springframework.security + spring-security-oauth2-jose + true + org.springframework.security spring-security-config diff --git a/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/BearerTokenAuthenticationExtractor.java b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/BearerTokenAuthenticationExtractor.java new file mode 100644 index 0000000..e7193a4 --- /dev/null +++ b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/BearerTokenAuthenticationExtractor.java @@ -0,0 +1,51 @@ +/* + * Copyright 2024-2024 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.grpc.server.security; + +import java.util.Locale; + +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken; + +import io.grpc.Attributes; +import io.grpc.Metadata; + +/** + * Extracts the HTTP Basic authentication credentials from the gRPC request headers. If + * the 'Authorization' header is present and starts with 'Basic ', the username and + * password are extracted from the Base64-encoded header value and returned as a + * {@link UsernamePasswordAuthenticationToken}. If the header is not present or does not + * start with 'Basic ', this method returns null. + * + * @author Dave Syer + */ +public class BearerTokenAuthenticationExtractor implements GrpcAuthenticationExtractor { + + @Override + public Authentication extract(Metadata headers, Attributes attributes) { + String auth = headers.get(GrpcSecurity.AUTHORIZATION_KEY); + if (auth == null) { + return null; + } + if (!auth.toLowerCase(Locale.ROOT).startsWith("bearer ")) { + return null; + } + auth = auth.substring("bearer ".length()); + return new BearerTokenAuthenticationToken(auth); + } + +} diff --git a/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/GrpcSecurity.java b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/GrpcSecurity.java index 989d991..d0ee2be 100644 --- a/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/GrpcSecurity.java +++ b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/GrpcSecurity.java @@ -146,6 +146,12 @@ public final class GrpcSecurity return this; } + public GrpcSecurity oauth2ResourceServer(Customizer customizer) throws Exception { + customizer.customize(getOrApply(new OAuth2ResourceServerConfigurer(getContext()))); + authenticationExtractor(new BearerTokenAuthenticationExtractor()); + return this; + } + @SuppressWarnings({ "unchecked", "removal" }) private > C getOrApply( C configurer) throws Exception { diff --git a/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/OAuth2ResourceServerConfigurer.java b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/OAuth2ResourceServerConfigurer.java new file mode 100644 index 0000000..6a815c6 --- /dev/null +++ b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/OAuth2ResourceServerConfigurer.java @@ -0,0 +1,257 @@ +/* + * Copyright 2024-2024 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.grpc.server.security; + +import java.util.function.Supplier; + +import org.springframework.context.ApplicationContext; +import org.springframework.core.convert.converter.Converter; +import org.springframework.security.authentication.AbstractAuthenticationToken; +import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.authentication.AuthenticationProvider; +import org.springframework.security.config.Customizer; +import org.springframework.security.config.annotation.SecurityConfigurerAdapter; +import org.springframework.security.oauth2.jwt.Jwt; +import org.springframework.security.oauth2.jwt.JwtDecoder; +import org.springframework.security.oauth2.jwt.NimbusJwtDecoder; +import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter; +import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider; +import org.springframework.security.oauth2.server.resource.authentication.OpaqueTokenAuthenticationProvider; +import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenAuthenticationConverter; +import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector; +import org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector; +import org.springframework.util.Assert; + +public class OAuth2ResourceServerConfigurer + extends SecurityConfigurerAdapter { + + private final ApplicationContext context; + + private JwtConfigurer jwtConfigurer; + + private OpaqueTokenConfigurer opaqueTokenConfigurer; + + public OAuth2ResourceServerConfigurer(ApplicationContext context) { + this.context = context; + } + + public OAuth2ResourceServerConfigurer jwt(Customizer jwtCustomizer) { + if (this.jwtConfigurer == null) { + this.jwtConfigurer = new JwtConfigurer(this.context); + } + jwtCustomizer.customize(this.jwtConfigurer); + return this; + } + + public OAuth2ResourceServerConfigurer opaqueToken(Customizer opaqueTokenCustomizer) { + if (this.opaqueTokenConfigurer == null) { + this.opaqueTokenConfigurer = new OpaqueTokenConfigurer(this.context); + } + opaqueTokenCustomizer.customize(this.opaqueTokenConfigurer); + return this; + } + + @Override + public void init(GrpcSecurity grpc) { + AuthenticationProvider authenticationProvider = getAuthenticationProvider(); + if (authenticationProvider != null) { + grpc.authenticationProvider(authenticationProvider); + } + } + + AuthenticationProvider getAuthenticationProvider() { + if (this.jwtConfigurer != null) { + return this.jwtConfigurer.getAuthenticationProvider(); + } + if (this.opaqueTokenConfigurer != null) { + return this.opaqueTokenConfigurer.getAuthenticationProvider(); + } + return null; + } + + public class JwtConfigurer { + + private final ApplicationContext context; + + private AuthenticationManager authenticationManager; + + private JwtDecoder decoder; + + private Converter jwtAuthenticationConverter; + + JwtConfigurer(ApplicationContext context) { + this.context = context; + } + + public JwtConfigurer authenticationManager(AuthenticationManager authenticationManager) { + Assert.notNull(authenticationManager, "authenticationManager cannot be null"); + this.authenticationManager = authenticationManager; + return this; + } + + public JwtConfigurer decoder(JwtDecoder decoder) { + this.decoder = decoder; + return this; + } + + public JwtConfigurer jwkSetUri(String uri) { + this.decoder = NimbusJwtDecoder.withJwkSetUri(uri).build(); + return this; + } + + public JwtConfigurer jwtAuthenticationConverter( + Converter jwtAuthenticationConverter) { + this.jwtAuthenticationConverter = jwtAuthenticationConverter; + return this; + } + + Converter getJwtAuthenticationConverter() { + if (this.jwtAuthenticationConverter == null) { + if (this.context.getBeanNamesForType(JwtAuthenticationConverter.class).length > 0) { + this.jwtAuthenticationConverter = this.context.getBean(JwtAuthenticationConverter.class); + } + else { + this.jwtAuthenticationConverter = new JwtAuthenticationConverter(); + } + } + return this.jwtAuthenticationConverter; + } + + JwtDecoder getJwtDecoder() { + if (this.decoder == null) { + return this.context.getBean(JwtDecoder.class); + } + return this.decoder; + } + + AuthenticationProvider getAuthenticationProvider() { + if (this.authenticationManager != null) { + return null; + } + JwtDecoder decoder = getJwtDecoder(); + Converter jwtAuthenticationConverter = getJwtAuthenticationConverter(); + JwtAuthenticationProvider provider = new JwtAuthenticationProvider(decoder); + provider.setJwtAuthenticationConverter(jwtAuthenticationConverter); + return postProcess(provider); + } + + AuthenticationManager getAuthenticationManager(GrpcSecurity grpc) { + if (this.authenticationManager != null) { + return this.authenticationManager; + } + return grpc.getSharedObject(AuthenticationManager.class); + } + + } + + public class OpaqueTokenConfigurer { + + private final ApplicationContext context; + + private AuthenticationManager authenticationManager; + + private String introspectionUri; + + private String clientId; + + private String clientSecret; + + private Supplier introspector; + + private OpaqueTokenAuthenticationConverter authenticationConverter; + + OpaqueTokenConfigurer(ApplicationContext context) { + this.context = context; + } + + public OpaqueTokenConfigurer authenticationManager(AuthenticationManager authenticationManager) { + Assert.notNull(authenticationManager, "authenticationManager cannot be null"); + this.authenticationManager = authenticationManager; + return this; + } + + public OpaqueTokenConfigurer introspectionUri(String introspectionUri) { + Assert.notNull(introspectionUri, "introspectionUri cannot be null"); + this.introspectionUri = introspectionUri; + this.introspector = () -> new SpringOpaqueTokenIntrospector(this.introspectionUri, this.clientId, + this.clientSecret); + return this; + } + + public OpaqueTokenConfigurer introspectionClientCredentials(String clientId, String clientSecret) { + Assert.notNull(clientId, "clientId cannot be null"); + Assert.notNull(clientSecret, "clientSecret cannot be null"); + this.clientId = clientId; + this.clientSecret = clientSecret; + this.introspector = () -> new SpringOpaqueTokenIntrospector(this.introspectionUri, this.clientId, + this.clientSecret); + return this; + } + + public OpaqueTokenConfigurer introspector(OpaqueTokenIntrospector introspector) { + Assert.notNull(introspector, "introspector cannot be null"); + this.introspector = () -> introspector; + return this; + } + + public OpaqueTokenConfigurer authenticationConverter( + OpaqueTokenAuthenticationConverter authenticationConverter) { + Assert.notNull(authenticationConverter, "authenticationConverter cannot be null"); + this.authenticationConverter = authenticationConverter; + return this; + } + + OpaqueTokenIntrospector getIntrospector() { + if (this.introspector != null) { + return this.introspector.get(); + } + return this.context.getBean(OpaqueTokenIntrospector.class); + } + + OpaqueTokenAuthenticationConverter getAuthenticationConverter() { + if (this.authenticationConverter != null) { + return this.authenticationConverter; + } + if (this.context.getBeanNamesForType(OpaqueTokenAuthenticationConverter.class).length > 0) { + return this.context.getBean(OpaqueTokenAuthenticationConverter.class); + } + return null; + } + + AuthenticationProvider getAuthenticationProvider() { + if (this.authenticationManager != null) { + return null; + } + OpaqueTokenIntrospector introspector = getIntrospector(); + OpaqueTokenAuthenticationProvider opaqueTokenAuthenticationProvider = new OpaqueTokenAuthenticationProvider( + introspector); + OpaqueTokenAuthenticationConverter authenticationConverter = getAuthenticationConverter(); + if (authenticationConverter != null) { + opaqueTokenAuthenticationProvider.setAuthenticationConverter(authenticationConverter); + } + return opaqueTokenAuthenticationProvider; + } + + AuthenticationManager getAuthenticationManager(GrpcSecurity http) { + if (this.authenticationManager != null) { + return this.authenticationManager; + } + return http.getSharedObject(AuthenticationManager.class); + } + + } + +} diff --git a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/client.adoc b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/client.adoc index 7dfdbfa..0ba981d 100644 --- a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/client.adoc +++ b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/client.adoc @@ -253,3 +253,28 @@ Channel basic(GrpcChannelFactory channels) { Usage of the bearer token interceptor is similar. You can look at the implementation of those interceptors to see how to create your own for custom headers. + +=== OAuth2 Clients + +Spring gRPC provides an autoconfigured OAuth2 client that can be used to provide authentication to your gRPC clients. +It works the same as in any Spring Boot application, in that if you configure properties in `spring.security.oauth2.authorizationserver.client.*` you will be able to inject an `ClientRegistrationRepository` and use it to create an `OAuth2AuthorizedClient` for a given client registration. +Here's an example showing how to plug the client registration into a `BearerTokenAuthenticationInterceptor` in the gRPC client: + +[source,java] +---- +@Bean +@Lazy +SimpleGrpc.SimpleBlockingStub basic(GrpcChannelFactory channels, ClientRegistrationRepository registry) { + ClientRegistration reg = registry.findByRegistrationId("spring"); + return SimpleGrpc.newBlockingStub(channels.createChannel("0.0.0.0:9090", ChannelBuilderOptions.defaults() + .withInterceptors(List.of(new BearerTokenAuthenticationInterceptor(() -> token(reg)))))); +} + +private String token(ClientRegistration reg) { + RestClientClientCredentialsTokenResponseClient creds = new RestClientClientCredentialsTokenResponseClient(); + String token = creds.getTokenResponse(new OAuth2ClientCredentialsGrantRequest(reg)) + .getAccessToken() + .getTokenValue(); + return token; +} +---- \ No newline at end of file diff --git a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc index 0615276..866f22a 100644 --- a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc +++ b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc @@ -185,6 +185,60 @@ Here we configure a bundle named "ssltest" that uses a JKS keystore, similar to It is then applied to the gRPC server using the `spring.grpc.server.ssl.bundle` property. To use self-signed certificates, for testing purposes only, you also need to set `spring.grpc.server.ssl.secure=false`. +=== Declarative Security with Spring Security + +If you want to enhance the security of your gRPC server, you can use Spring Security by employing similar mechanisms to those used for regular HTTP security. +If Spring Security is on the classpath, some autoconfiguration will be automatically added to your project. +By default, just https://docs.spring.io/spring-boot/reference/web/spring-security.html[like in a servlet application], you will get a `UserDetailsService` from Spring Boot and an `AuthenticationManager` that will authenticate requests using HTTP Basic authentication. +Basic authentication is enabled by default, as well as "preauthentication" via mTLS. +Preauthentication works by extracting a user details object from the client's TLS certificate, matching the principal name with the user in the `UserDetailsService` (just like in a normal web application). +You can then use `@Preauthorize` on your `BindableService` beans to enforce authorization rules with roles (more precisely authorities in Spring Security terminology). + +You can change the defaults and add your own rules by configuring beans of type `UserDetailsService` and/or `AuthenticationServerInterceptor`. +In this way you can move the authorization rules to a central place, and you can also add your own authentication mechanisms. +The `AuthenticationServerInterceptor` can be created from a Spring Security configurer of type `GrpcSecurity`. +Its usage will be familiar to anyone who has used Spring Security before. +Here's an example: + +[source,java] +---- +@Bean +@GlobalServerInterceptor +AuthenticationProcessInterceptor jwtSecurityFilterChain(GrpcSecurity grpc) throws Exception { + return grpc + .authorizeRequests(requests -> requests + .methods("Simple/StreamHello").hasAuthority("ROLE_ADMIN") + .methods("Simple/SayHello").hasAuthority("ROLE_USER") + .methods("grpc.*/*").permitAll() + .allRequests().denyAll()) + .httpBasic(withDefaults()) + .preauth(withDefaults()) + .build(); +} +---- + +Here we configure a filter that allows access to one method only to admin users, and another to users with the "USER" role; +access to all gRPC services (e.g. reflection and health indicators) is allowed to all; and all other requests are denied. +We also enable HTTP Basic authentication and preauthentication (mTLS) (`withDefaults()` is a static import from the `Customizer` in Spring Security). + +=== OAuth2 Resource Server + +Similar to the way Spring Boot works https://docs.spring.io/spring-boot/reference/web/spring-security.html#web.security.oauth2.server[with normal web applications], if you have the `spring-security-oauth2-resource-server` dependency on the classpath, Spring gRPC will be able to automatically configure an OAuth2 resource server. +There are 2 choices for the token types, just the same as in Spring Boot, and they are configured with the same application properties and optional custom beans. + +For JWT you need to set up either the JWK Set or OIDC Issuer URI. +The JWK Set URI is set via `spring.security.oauth2.resourceserver.jwt.jwk-set-uri` (it's an endpoint in the authorization server). +You also need to have the `spring-security-oauth2-jose` dependency on the classpath to handle the JWT decoding. + +For opaque tokens, it works exactly the same as with a regular web application, with the same application properties. E.g. + +[source,properties] +---- +spring.security.oauth2.resourceserver.opaquetoken.introspection-uri=https://example.com/check-token +spring.security.oauth2.resourceserver.opaquetoken.client-id=my-client-id +spring.security.oauth2.resourceserver.opaquetoken.client-secret=my-client-secret +---- + === Servlet The servlet-based server supports any security configuration that the servlet container supports, including Spring Security. diff --git a/spring-grpc-spring-boot-autoconfigure/pom.xml b/spring-grpc-spring-boot-autoconfigure/pom.xml index fb33fff..96c2fca 100644 --- a/spring-grpc-spring-boot-autoconfigure/pom.xml +++ b/spring-grpc-spring-boot-autoconfigure/pom.xml @@ -110,6 +110,21 @@ spring-security-config true + + org.springframework.security + spring-security-oauth2-client + true + + + org.springframework.security + spring-security-oauth2-resource-server + true + + + org.springframework.security + spring-security-oauth2-jose + true + org.springframework.security spring-security-web diff --git a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/GrpcServerFactoryAutoConfiguration.java b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/GrpcServerFactoryAutoConfiguration.java index 337bb01..78e5d05 100644 --- a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/GrpcServerFactoryAutoConfiguration.java +++ b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/GrpcServerFactoryAutoConfiguration.java @@ -33,14 +33,12 @@ import org.springframework.boot.web.servlet.ServletRegistrationBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Conditional; import org.springframework.context.annotation.Configuration; -import org.springframework.context.annotation.ConfigurationCondition.ConfigurationPhase; import org.springframework.context.annotation.Import; import org.springframework.core.Ordered; import org.springframework.grpc.server.service.GrpcServiceDiscoverer; import org.springframework.util.unit.DataSize; import io.grpc.BindableService; -import io.grpc.ServerServiceDefinition; import io.grpc.servlet.jakarta.GrpcServlet; import io.grpc.servlet.jakarta.ServletServerBuilder; diff --git a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ClientAutoConfiguration.java b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ClientAutoConfiguration.java new file mode 100644 index 0000000..0e7c374 --- /dev/null +++ b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ClientAutoConfiguration.java @@ -0,0 +1,51 @@ +/* + * Copyright 2024-2024 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.grpc.autoconfigure.server.security; + +import java.util.ArrayList; +import java.util.List; + +import org.springframework.boot.autoconfigure.AutoConfiguration; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.boot.autoconfigure.security.oauth2.client.ClientsConfiguredCondition; +import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties; +import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Conditional; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.oauth2.client.registration.ClientRegistration; +import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository; +import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository; + +// Copied from Spring Boot (https://github.com/spring-projects/spring-boot/issues/40997, ] +// https://github.com/spring-projects/spring-boot/issues/15877) +@AutoConfiguration( + after = org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration.class) +@Configuration(proxyBeanMethods = false) +@Conditional(ClientsConfiguredCondition.class) +@EnableConfigurationProperties(OAuth2ClientProperties.class) +public class OAuth2ClientAutoConfiguration { + + @Bean + @ConditionalOnMissingBean(ClientRegistrationRepository.class) + InMemoryClientRegistrationRepository clientRegistrationRepository(OAuth2ClientProperties properties) { + List registrations = new ArrayList<>( + new OAuth2ClientPropertiesMapper(properties).asClientRegistrations().values()); + return new InMemoryClientRegistrationRepository(registrations); + } + +} diff --git a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ResourceServerAutoConfiguration.java b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ResourceServerAutoConfiguration.java new file mode 100644 index 0000000..0848c57 --- /dev/null +++ b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ResourceServerAutoConfiguration.java @@ -0,0 +1,303 @@ +/* + * Copyright 2024-2024 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.grpc.autoconfigure.server.security; + +import static org.springframework.security.config.Customizer.withDefaults; + +import java.security.KeyFactory; +import java.security.interfaces.RSAPublicKey; +import java.security.spec.X509EncodedKeySpec; +import java.util.ArrayList; +import java.util.Base64; +import java.util.Collections; +import java.util.List; +import java.util.Set; + +import org.springframework.beans.factory.ObjectProvider; +import org.springframework.boot.autoconfigure.AutoConfiguration; +import org.springframework.boot.autoconfigure.condition.AnyNestedCondition; +import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; +import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; +import org.springframework.boot.autoconfigure.security.oauth2.resource.IssuerUriCondition; +import org.springframework.boot.autoconfigure.security.oauth2.resource.KeyValueCondition; +import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties; +import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.JwkSetUriJwtDecoderBuilderCustomizer; +import org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.boot.context.properties.PropertyMapper; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Conditional; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Import; +import org.springframework.grpc.server.GlobalServerInterceptor; +import org.springframework.grpc.server.security.AuthenticationProcessInterceptor; +import org.springframework.grpc.server.security.GrpcSecurity; +import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator; +import org.springframework.security.oauth2.core.OAuth2TokenValidator; +import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm; +import org.springframework.security.oauth2.jwt.Jwt; +import org.springframework.security.oauth2.jwt.JwtClaimNames; +import org.springframework.security.oauth2.jwt.JwtClaimValidator; +import org.springframework.security.oauth2.jwt.JwtDecoder; +import org.springframework.security.oauth2.jwt.JwtValidators; +import org.springframework.security.oauth2.jwt.NimbusJwtDecoder; +import org.springframework.security.oauth2.jwt.NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder; +import org.springframework.security.oauth2.jwt.SupplierJwtDecoder; +import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken; +import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter; +import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter; +import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector; +import org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector; +import org.springframework.util.CollectionUtils; + +// All copied from Spring Boot (https://github.com/spring-projects/spring-boot/issues/43978), except the +// 2 @Beans of type AuthenticationProcessInterceptor +@AutoConfiguration(before = { GrpcSecurityAutoConfiguration.class, UserDetailsServiceAutoConfiguration.class }, + after = org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration.class) +@EnableConfigurationProperties(OAuth2ResourceServerProperties.class) +@ConditionalOnClass(BearerTokenAuthenticationToken.class) +@Import({ Oauth2ResourceServerConfiguration.JwtConfiguration.class, + Oauth2ResourceServerConfiguration.OpaqueTokenConfiguration.class }) +class OAuth2ResourceServerAutoConfiguration { + +} + +@Configuration(proxyBeanMethods = false) +class Oauth2ResourceServerConfiguration { + + @Configuration(proxyBeanMethods = false) + @ConditionalOnClass(JwtDecoder.class) + @Import({ OAuth2ResourceServerJwtConfiguration.JwtConverterConfiguration.class, + OAuth2ResourceServerJwtConfiguration.JwtDecoderConfiguration.class, + OAuth2ResourceServerJwtConfiguration.OAuth2SecurityFilterChainConfiguration.class }) + static class JwtConfiguration { + + } + + @Configuration(proxyBeanMethods = false) + @Import({ OAuth2ResourceServerOpaqueTokenConfiguration.OpaqueTokenIntrospectionClientConfiguration.class, + OAuth2ResourceServerOpaqueTokenConfiguration.OAuth2SecurityFilterChainConfiguration.class }) + static class OpaqueTokenConfiguration { + + } + +} + +@Configuration(proxyBeanMethods = false) +class OAuth2ResourceServerOpaqueTokenConfiguration { + + @Configuration(proxyBeanMethods = false) + @ConditionalOnMissingBean(OpaqueTokenIntrospector.class) + static class OpaqueTokenIntrospectionClientConfiguration { + + @Bean + @ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.opaquetoken.introspection-uri") + SpringOpaqueTokenIntrospector opaqueTokenIntrospector(OAuth2ResourceServerProperties properties) { + OAuth2ResourceServerProperties.Opaquetoken opaqueToken = properties.getOpaquetoken(); + return new SpringOpaqueTokenIntrospector(opaqueToken.getIntrospectionUri(), opaqueToken.getClientId(), + opaqueToken.getClientSecret()); + } + + } + + @Configuration(proxyBeanMethods = false) + @ConditionalOnMissingBean(AuthenticationProcessInterceptor.class) + static class OAuth2SecurityFilterChainConfiguration { + + @Bean + @ConditionalOnBean(OpaqueTokenIntrospector.class) + @GlobalServerInterceptor + AuthenticationProcessInterceptor opaqueTokenSecurityFilterChain(GrpcSecurity http) throws Exception { + http.authorizeRequests((requests) -> requests.allRequests().authenticated()); + http.oauth2ResourceServer((resourceServer) -> resourceServer.opaqueToken(withDefaults())); + return http.build(); + } + + } + +} + +@Configuration(proxyBeanMethods = false) +class OAuth2ResourceServerJwtConfiguration { + + @Configuration(proxyBeanMethods = false) + @ConditionalOnMissingBean(JwtDecoder.class) + static class JwtDecoderConfiguration { + + private final OAuth2ResourceServerProperties.Jwt properties; + + private final List> additionalValidators; + + JwtDecoderConfiguration(OAuth2ResourceServerProperties properties, + ObjectProvider> additionalValidators) { + this.properties = properties.getJwt(); + this.additionalValidators = additionalValidators.orderedStream().toList(); + } + + @Bean + @ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri") + JwtDecoder jwtDecoderByJwkKeySetUri(ObjectProvider customizers) { + JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withJwkSetUri(this.properties.getJwkSetUri()) + .jwsAlgorithms(this::jwsAlgorithms); + customizers.orderedStream().forEach((customizer) -> customizer.customize(builder)); + NimbusJwtDecoder nimbusJwtDecoder = builder.build(); + String issuerUri = this.properties.getIssuerUri(); + OAuth2TokenValidator defaultValidator = (issuerUri != null) + ? JwtValidators.createDefaultWithIssuer(issuerUri) : JwtValidators.createDefault(); + nimbusJwtDecoder.setJwtValidator(getValidators(defaultValidator)); + return nimbusJwtDecoder; + } + + private void jwsAlgorithms(Set signatureAlgorithms) { + for (String algorithm : this.properties.getJwsAlgorithms()) { + signatureAlgorithms.add(SignatureAlgorithm.from(algorithm)); + } + } + + private OAuth2TokenValidator getValidators(OAuth2TokenValidator defaultValidator) { + List audiences = this.properties.getAudiences(); + if (CollectionUtils.isEmpty(audiences) && this.additionalValidators.isEmpty()) { + return defaultValidator; + } + List> validators = new ArrayList<>(); + validators.add(defaultValidator); + if (!CollectionUtils.isEmpty(audiences)) { + validators.add(audValidator(audiences)); + } + validators.addAll(this.additionalValidators); + return new DelegatingOAuth2TokenValidator<>(validators); + } + + private JwtClaimValidator> audValidator(List audiences) { + return new JwtClaimValidator<>(JwtClaimNames.AUD, (aud) -> nullSafeDisjoint(aud, audiences)); + } + + private boolean nullSafeDisjoint(List c1, List c2) { + return c1 != null && !Collections.disjoint(c1, c2); + } + + @Bean + @Conditional(KeyValueCondition.class) + JwtDecoder jwtDecoderByPublicKeyValue() throws Exception { + RSAPublicKey publicKey = (RSAPublicKey) KeyFactory.getInstance("RSA") + .generatePublic(new X509EncodedKeySpec(getKeySpec(this.properties.readPublicKey()))); + NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withPublicKey(publicKey) + .signatureAlgorithm(SignatureAlgorithm.from(exactlyOneAlgorithm())) + .build(); + jwtDecoder.setJwtValidator(getValidators(JwtValidators.createDefault())); + return jwtDecoder; + } + + private byte[] getKeySpec(String keyValue) { + keyValue = keyValue.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", ""); + return Base64.getMimeDecoder().decode(keyValue); + } + + private String exactlyOneAlgorithm() { + List algorithms = this.properties.getJwsAlgorithms(); + int count = (algorithms != null) ? algorithms.size() : 0; + if (count != 1) { + throw new IllegalStateException( + "Creating a JWT decoder using a public key requires exactly one JWS algorithm but " + count + + " were configured"); + } + return algorithms.get(0); + } + + @Bean + @Conditional(IssuerUriCondition.class) + SupplierJwtDecoder jwtDecoderByIssuerUri(ObjectProvider customizers) { + return new SupplierJwtDecoder(() -> { + String issuerUri = this.properties.getIssuerUri(); + JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withIssuerLocation(issuerUri); + customizers.orderedStream().forEach((customizer) -> customizer.customize(builder)); + NimbusJwtDecoder jwtDecoder = builder.build(); + jwtDecoder.setJwtValidator(getValidators(JwtValidators.createDefaultWithIssuer(issuerUri))); + return jwtDecoder; + }); + } + + } + + @Configuration(proxyBeanMethods = false) + @ConditionalOnMissingBean(AuthenticationProcessInterceptor.class) + static class OAuth2SecurityFilterChainConfiguration { + + @Bean + @ConditionalOnBean(JwtDecoder.class) + @GlobalServerInterceptor + AuthenticationProcessInterceptor jwtSecurityFilterChain(GrpcSecurity http) throws Exception { + http.authorizeRequests((requests) -> requests.allRequests().authenticated()); + http.oauth2ResourceServer((resourceServer) -> resourceServer.jwt(withDefaults())); + return http.build(); + } + + } + + @Configuration(proxyBeanMethods = false) + @ConditionalOnMissingBean(JwtAuthenticationConverter.class) + @Conditional(JwtConverterPropertiesCondition.class) + static class JwtConverterConfiguration { + + private final OAuth2ResourceServerProperties.Jwt properties; + + JwtConverterConfiguration(OAuth2ResourceServerProperties properties) { + this.properties = properties.getJwt(); + } + + @Bean + JwtAuthenticationConverter getJwtAuthenticationConverter() { + JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter(); + PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull(); + map.from(this.properties.getAuthorityPrefix()).to(grantedAuthoritiesConverter::setAuthorityPrefix); + map.from(this.properties.getAuthoritiesClaimDelimiter()) + .to(grantedAuthoritiesConverter::setAuthoritiesClaimDelimiter); + map.from(this.properties.getAuthoritiesClaimName()) + .to(grantedAuthoritiesConverter::setAuthoritiesClaimName); + JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter(); + map.from(this.properties.getPrincipalClaimName()).to(jwtAuthenticationConverter::setPrincipalClaimName); + jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter); + return jwtAuthenticationConverter; + } + + } + + private static class JwtConverterPropertiesCondition extends AnyNestedCondition { + + JwtConverterPropertiesCondition() { + super(ConfigurationPhase.REGISTER_BEAN); + } + + @ConditionalOnProperty(prefix = "spring.security.oauth2.resourceserver.jwt", name = "authority-prefix") + static class OnAuthorityPrefix { + + } + + @ConditionalOnProperty(prefix = "spring.security.oauth2.resourceserver.jwt", name = "principal-claim-name") + static class OnPrincipalClaimName { + + } + + @ConditionalOnProperty(prefix = "spring.security.oauth2.resourceserver.jwt", name = "authorities-claim-name") + static class OnAuthoritiesClaimName { + + } + + } + +} \ No newline at end of file diff --git a/spring-grpc-spring-boot-autoconfigure/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/spring-grpc-spring-boot-autoconfigure/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports index 27ce109..5862f10 100644 --- a/spring-grpc-spring-boot-autoconfigure/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports +++ b/spring-grpc-spring-boot-autoconfigure/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -7,3 +7,5 @@ org.springframework.grpc.autoconfigure.server.GrpcServerObservationAutoConfigura org.springframework.grpc.autoconfigure.server.GrpcServerReflectionAutoConfiguration org.springframework.grpc.autoconfigure.server.exception.GrpcExceptionHandlerAutoConfiguration org.springframework.grpc.autoconfigure.server.security.GrpcSecurityAutoConfiguration +org.springframework.grpc.autoconfigure.server.security.OAuth2ClientAutoConfiguration +org.springframework.grpc.autoconfigure.server.security.OAuth2ResourceServerAutoConfiguration \ No newline at end of file